genesis-stack 1.4.8 → 1.4.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.4.8",
+  "version": "1.4.10",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/jskit.md

@@ -362,6 +362,46 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Leave `npm run lint` (which reports narrowing in code) and `npx jskit check`
   without findings.
 
+## Security pass
+
+- Read JSKIT's security pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/security-pass`
+  completely: each route's `auth` and `permission`, a table resource's
+  `ownership` and row policy scoping every handle call, `expectScoped()` for
+  another workspace's rows, `rateLimit` and `config.auth.rateLimits`, the
+  first account's setup code, and what `NODE_ENV=production` requires, such as
+  `AUTH_LOCAL_SESSION_SECRET`.
+- Try each refusal through `app.inject` on the test server, then run
+  `npm run verify`.
+
+## User experience pass
+
+- Read JSKIT's user experience pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/ux-pass`
+  completely: main tasks as `shell.primary-nav` placements and each inner
+  page's `jskit.parent`, `ShellPrimaryAction` for a list's New and a record's
+  one filled next step, a new form's `initialValue` or `createModel`,
+  `saveSuccess` for where Save lands, `CrudDeleteAction`'s confirmation, Undo
+  in the snackbar, and the app's words through `useJskitText()`.
+- Walk each main task in the host's managed Preview or a Playwright spec, then
+  run `npm run verify`.
+
+## Speed pass
+
+- Read JSKIT's speed pass page at
+  `https://mobily-enterprises.github.io/jskit-ai/guide/framework/speed-pass`
+  completely: `jskit test` runs test files in parallel within the machine's
+  test budget (`V64_TEST_CONCURRENCY`, else half the CPUs) and ends with its
+  slowest files, `jskit test --databases` restores a stored snapshot for each
+  file, a fixture every file only reads is made once in a
+  `--test-global-setup` module, a client provider exported by its own subpath
+  keeps screens out of every page's first load, and a list reads its related
+  records with `include` and its selected values by `filter[id]` in one
+  request.
+- Compare the whole `npm test` wall time, its slowest files and the build's
+  chunk sizes before and after, then leave `npx jskit check` and
+  `npm run verify` passing.
+
 ## Verification
 
 - Verify `application`: `npm` `run` `verify`

package/stacks/pieces/rails-sqlite.md

@@ -50,7 +50,8 @@ Rails SQLite connection, Active Record migration, and database filename conventi
   its schema and migrates an existing one.
 - The `sqlite3` gem normally installs a precompiled native gem; a source build
   needs the SQLite headers. Use the inherited Rails migration and seed
-  guidance and test concurrent writes on SQLite itself.
+  guidance, and run a path's two-writer test, where it needs one, on SQLite
+  itself.
 - Sanity checks with Rails and SQLite: the rails and sqlite pieces' checks
   apply.
 

package/stacks/pieces/sqlite.md

@@ -30,9 +30,9 @@ SQLite file-backed persistence, migrations, and backup conventions.
 - Keep durable database files outside disposable build and release directories.
   A host may supply a persistent filename; do not replace that value with a
   repository-relative default or recreate an existing database during setup.
-- Use transactions, foreign-key enforcement, and bounded busy handling. Prove
-  concurrent writes using SQLite itself; a different engine does not establish
-  SQLite's locking behavior.
+- Use transactions, foreign-key enforcement, and bounded busy handling. Run a
+  path's two-writer test, where it needs one, on SQLite itself; a different
+  engine does not establish SQLite's locking behavior.
 - Use SQLite's online backup API or `VACUUM INTO` for a consistent backup of a
   running database, including committed WAL data. Do not copy only the main file
   while writers are active. Validate backups and prove restoration before