Merge dev into main

CHANGELOG.md

@@ -1,3 +1,86 @@
+1.0.53 || 19.07.2026
+outreach batch 1 fully enriched: 20 API-verified prospects via YouTube
+Data API v3 (outreach_sourcer.py). all burn events verified by video
+title + timestamp, subscriber counts from channel statistics endpoint.
+5 prospects have biz emails. M0 fit corrected to signal-based scoring:
+10 YES fits (recipes, crafts, tutorials, fashion, finance, podcasts,
+nutrition, fitness), 4 PARTIAL, 3 POOR (animation, cinematic, vlogs).
+6 false positives filtered (gaming shadowbans, advice videos,
+third-party references). ~2,100 quota units used (21% of free daily
+tier). script reusable for batches 2-5.
+
+1.0.52 || 18.07.2026
+B2.5: ui makeover — rectangles-npm and react-bulma-components ripped out
+of ui/; replaced with Tailwind CSS v4 + CSS variable design tokens
+(ui/src/styles/tokens.css: color palette, type scale, spacing, radius,
+dark mode). All ui/ screens restyled: login/signup/forgot, contracts,
+requests, settings, setup wizard, config page. Shared components
+(SideBar, TopBar, Icon, Branding) rewritten on Tailwind. Card pattern
+replaces Bulma cards everywhere. Form inputs use consistent rounded
+inputs with icon prefixes. 43/43 vitest tests green.
+
+1.0.51 || 18.07.2026
+CLAUDE.md: new working convention — "hand off the next task": after a merge,
+agents end their final message with the next unticked lane item and a
+paste-ready kickoff prompt (task verbatim, gates, owned dirs, acceptance
+bar) for a fresh workspace.
+
+1.0.50 || 18.07.2026
+D4: web10-social data layer — full conventions-schema stack for the M0
+killer app slice. new src/data/ with typed modules: posts (CRUD + media
+upload via API presigned URLs), feed (chronological inbox + sort dropdown:
+newest/oldest/most_reacted via aggregate), profile (read/upsert), contacts
+(conventions schema CRUD + search), dms (records-based, deterministic
+conversation service names), comments (threaded), reactions (toggle,
+aggregate counts). wapi.ts: thin typed fetch wrapper over legacy wapi.js.
+Web10SocialAdapter wired with all 30+ new data-layer methods alongside
+legacy adapter (backward compat). SMR terms extended for profile, contacts,
+inbox, comments, reactions, media services. 55 new vitest tests (227 total,
+all green). screens deferred to D2.5 post-B2.5 tokens.
+
+1.0.49 || 18.07.2026
+wave-0 security fixes: CORS tightened — allow_origins=["*"] replaced
+with origins derived from CORS_SERVICE_MANAGERS + PROVIDER settings;
+bare except clauses removed (twilio.py catches TwilioRestException,
+stripe.py catches StripeError, auth.py certify() catches only
+PyJWTError/ValueError/TypeError); provider URL validation added to
+certify_with_remote_provider (scheme allowlist, private-IP/localhost
+SSRF guard, length cap, 10s fetch timeout). 280 api tests green.
+
+1.0.48 || 18.07.2026
+plan: ui stability specced end to end. the thin playwright line in
+CROSS-CUTTING quality/testing expanded into a real item: playwright-
+in-docker against the compose stack, ~6-10 smoke journeys across all
+three uis (ui signup/login/consent, social post->feed + grant/revoke
+terms, marketing-ui route smoke), selenium rejected (flake + grid
+drift), visual regression explicitly deferred until B2.5/D2.5
+makeovers settle. two ci gaps recorded as items: marketing-ui has
+ZERO component tests (--passWithNoTests masks it — backfill item)
+and the shared js workflow runs typecheck + build with continue-on-
+error (a non-compiling ui shows a green check — fix item under
+ci/cd, also noted in wave-0 status). new report-a-bug loop item as
+the explicit counterweight to a thin e2e layer: feedback endpoint in
+marketing-api + <=2-click report affordance + error boundaries in
+all three uis so white-screens convert to reports, not bounces.
+ux telemetry item added with the privacy split: marketing-ui gets
+full funnel analytics + self-hosted replay (posthog/openreplay --
+never third-party saas); platform uis (ui, social) get content-free
+aggregate events + a js error beacon ONLY -- session-recording js
+there is ruled out by the manifesto ("nobody is mining you") and
+phase-11 e2e encryption; replay-grade insight on the platform is
+opt-in dogfood/design-partner sessions, consent as the feature.
+board: lane C gains C5 (e2e/ harness), lane D gains D10 (report-a-
+bug loop) and D11 (ux telemetry).
+
+1.0.47 || 18.07.2026
+board refresh: CURRENT CONDUCTOR BOARD in parallel execution.txt
+re-cut for the D20/D21 pivot + timeline.md week 0 — ws1 B2.5 stack
+pick/tokens, ws2 REPOINTED from C2 sdk (off the M0 critical path)
+to D4 data layer, ws3 wave-0 security fixes then A6, ws4 outreach
+batch 1 or E1. merge-order notes added (lane A single-branch,
+D2.5 waits on B2.5 tokens, B4.5 M0 slice follows B2.5). stale
+17.07 board was pointing agents at pre-pivot work.
+
 1.0.46 || 18.07.2026
 D21: user billing stripped — users are never charged; credits/space
 metering repurposed as OPERATOR-SET quotas (rate/abuse throttle +

CLAUDE.md

@@ -97,6 +97,14 @@ touches auth, the DB layer, or tokens, run those tests and keep them green.
   auth flow, update `CLAUDE.md`/`GLOSSARY.md` in the same branch. A big
   architectural decision gets an entry in `decisions.md`. Stale orientation
   docs are worse than none.
+- **Hand off the next task.** After your work merges (or the PR is up), end
+  your final message with the next unticked item in your lane from
+  `parallel execution.txt` AND a paste-ready kickoff prompt for a fresh
+  workspace: the task text verbatim, its gates (what must merge first —
+  check the lane file), the directories that lane owns, and the acceptance
+  bar. If the next item is gated on unmerged work, say so in the kickoff so
+  the next agent checks the gate before building. This keeps the parallel
+  conveyor moving without the operator re-deriving state.
 
 ## Running it
 `docker-compose.yml` brings the stack up locally (`*.localhost` vhosts).

api/app/main.py

@@ -19,10 +19,21 @@
     terms_of_service="http://example.com/terms/",
 )
 
+def _cors_origins():
+    """Build allow-listed CORS origins from settings."""
+    origins = set()
+    for host in settings.CORS_SERVICE_MANAGERS:
+        origins.add(f"http://{host}")
+        origins.add(f"https://{host}")
+    # The API itself may serve the UI or OpenAPI docs
+    origins.add(f"http://{settings.PROVIDER}")
+    origins.add(f"https://{settings.PROVIDER}")
+    return list(origins)
+
 app.add_middleware(
     CORSMiddleware,
     allow_credentials=True,
-    allow_origins=["*"],
+    allow_origins=_cors_origins(),
     allow_methods=["*"],
     allow_headers=["*"],
 )

api/app/services/auth.py

@@ -1,4 +1,6 @@
 from datetime import datetime, timedelta
+import ipaddress
+from urllib.parse import urlparse
 
 import jwt
 import requests
@@ -55,10 +57,44 @@ def can_mint(submission_token: TokenData, mint_token: TokenData) -> bool:
     return True
 
 
+def _is_private_ip(host: str) -> bool:
+    """Return True if host resolves to a private, loopback, or link-local address."""
+    try:
+        addr = ipaddress.ip_address(host)
+        return (
+            addr.is_private or addr.is_loopback or addr.is_link_local
+            or addr.is_reserved or addr.is_multicast
+        )
+    except ValueError:
+        pass
+    # DNS name — reject obvious internal hosts
+    lower = host.lower()
+    return lower in ("localhost", "localhost.localdomain") or lower.endswith(".local")
+
+
+def _validate_provider_url(url: str) -> str:
+    """Validate a provider URL before any outbound fetch.
+
+    Raises Exception("TOKEN") on any violation.
+    """
+    if not url or len(url) > 2048:
+        raise Exception("TOKEN")
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        raise Exception("TOKEN")
+    host = parsed.hostname
+    if not host:
+        raise Exception("TOKEN")
+    if _is_private_ip(host):
+        raise Exception("TOKEN")
+    return f"{parsed.scheme}://{parsed.netloc}{parsed.path}".rstrip("/")
+
+
 def certify_with_remote_provider(token: Token) -> bool:
     decoded = decode_token(token.token)
-    url = f"{decoded.provider}/certify"
-    response = requests.post(url, json=token.model_dump())
+    base = _validate_provider_url(decoded.provider)
+    url = f"{base}/certify"
+    response = requests.post(url, json=token.model_dump(), timeout=10)
     return response.status_code == 200
 
 
@@ -78,7 +114,7 @@ def certify(token: Token) -> bool:
             raise Exception("TOKEN")
         if token_data.username != "anon" and datetime.utcnow() > datetime.fromisoformat(token_data.expires):
             raise Exception("TOKEN")
-    except Exception:
+    except (jwt.exceptions.PyJWTError, ValueError, TypeError):
         raise Exception("TOKEN")
     return True
 

api/app/services/stripe.py

@@ -178,7 +178,7 @@ def create_dev_pay_session(customer_id,bus_id,pay_data):
                 }
             }
         )
-    except:
+    except stripe.error.StripeError:
         raise exceptions.BUSINESS_NOT_READY
     return checkout_session["url"]
 

api/app/services/twilio.py

@@ -1,4 +1,5 @@
 # Download the helper library from https://www.twilio.com/docs/python/install
+from twilio.base.exceptions import TwilioRestException
 from twilio.rest import Client
 from twilio.twiml.messaging_response import MessagingResponse
 
@@ -24,7 +25,7 @@ def send_verification(phone_number,username):
                             }, to="+"+str(phone_number), channel='sms')
 
         return verification.sid
-    except:
+    except Exception:
         raise exceptions.BAD_NUM
 
 # check the verification code

decisions.md

@@ -9,6 +9,23 @@ Status legend: [decided] intent set · [in-progress] · [open] still debating.
 
 ---
 
+### D22 — UI stack: Tailwind CSS + shadcn/ui, replacing rectangles-npm [decided]
+rectangles-npm is a homemade layout framework only one person understands;
+uis built on it read as engineering prototypes, not products. The replacement
+must be boring and mainstream so any frontend dev can contribute, and it must
+be themeable from day one because creator nodes wear their brand (phase 4
+white-label). Tailwind CSS + shadcn/ui is the pick: native to our Vite +
+React 19 + TypeScript toolchain, huge ecosystem, accessible Radix primitives,
+CSS variable–based theming (creator branding = swapping CSS vars), and the
+design-token layer maps directly to Tailwind's `tailwind.config.css`. The
+shared tokens (type scale, spacing, color, radius, dark mode) live in
+`ui/src/styles/tokens.css` as CSS custom properties consumed by both the
+node's `ui/` and `marketing/web10-social/` (D2.5). Rejects: CSS-in-JS
+(emotion/styled-components — runtime cost, SSR headaches, another abstraction),
+Bulma (the old vendor we're already ripping out), and any framework that
+requires a build-step for theming (creator themes must be hot-swappable CSS
+vars, not rebuilds).
+
 ### D21 — User billing is stripped; metering survives as operator-set quotas (anti-abuse), and the money screen is in M0 [decided]
 Users are never charged (D5: accounts free, paid by the operator's revenue),
 so the legacy per-user billing surface (plans, user subscriptions, per-account

marketing/web10-social/src/__tests__/data/comments.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as wapi from '../../data/wapi';
+import * as comments from '../../data/comments';
+
+function mockWapi() {
+  const mock = {
+    isSignedIn: vi.fn(() => true),
+    signOut: vi.fn(),
+    setToken: vi.fn(),
+    readToken: vi.fn(() => ({ provider: 'api.web10.app', username: 'alice' })),
+    openAuthPortal: vi.fn(),
+    authListen: vi.fn(),
+    read: vi.fn(),
+    create: vi.fn(),
+    update: vi.fn(),
+    delete: vi.fn(),
+    aggregate: vi.fn(),
+    getUploadUrl: vi.fn(),
+    initP2P: vi.fn(),
+    sendP2P: vi.fn(),
+  };
+  vi.spyOn(wapi, 'getWapi').mockReturnValue(mock as any);
+  return mock;
+}
+
+describe('comments data layer', () => {
+  let mock: ReturnType<typeof mockWapi>;
+
+  beforeEach(() => {
+    mock = mockWapi();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('readComments', () => {
+    it('reads all comments for a post', async () => {
+      const list = [
+        { _id: 'cm1', post_id: 'p1', text: 'nice!', created_at: '2026-07-18T00:00:00Z' },
+      ];
+      mock.read.mockResolvedValue(list);
+      const result = await comments.readComments('p1');
+      expect(mock.read).toHaveBeenCalledWith('comments', { post_id: 'p1' });
+      expect(result).toEqual(list);
+    });
+  });
+
+  describe('readTopLevelComments', () => {
+    it('reads top-level comments only', async () => {
+      mock.read.mockResolvedValue([]);
+      await comments.readTopLevelComments('p1');
+      expect(mock.read).toHaveBeenCalledWith('comments', {
+        post_id: 'p1',
+        parent_id: { $exists: false },
+      });
+    });
+  });
+
+  describe('readReplies', () => {
+    it('reads replies to a comment', async () => {
+      mock.read.mockResolvedValue([]);
+      await comments.readReplies('cm1');
+      expect(mock.read).toHaveBeenCalledWith('comments', { parent_id: 'cm1' });
+    });
+  });
+
+  describe('createComment', () => {
+    it('creates a new comment', async () => {
+      const comment = { post_id: 'p1', text: 'Great post!', created_at: '2026-07-18T00:00:00Z' };
+      const created = { _id: 'cm1', ...comment };
+      mock.create.mockResolvedValue(created);
+      const result = await comments.createComment(comment);
+      expect(mock.create).toHaveBeenCalledWith('comments', comment);
+      expect(result).toEqual(created);
+    });
+  });
+
+  describe('updateComment', () => {
+    it('updates a comment by ID', async () => {
+      const updated = { _id: 'cm1', text: 'Updated comment' };
+      mock.update.mockResolvedValue(updated);
+      await comments.updateComment('cm1', { text: 'Updated comment' });
+      expect(mock.update).toHaveBeenCalledWith('comments', { _id: 'cm1' }, { $set: { text: 'Updated comment' } });
+    });
+  });
+
+  describe('deleteComment', () => {
+    it('deletes a comment by ID', async () => {
+      mock.delete.mockResolvedValue(undefined);
+      await comments.deleteComment('cm1');
+      expect(mock.delete).toHaveBeenCalledWith('comments', { _id: 'cm1' });
+    });
+  });
+
+  describe('countComments', () => {
+    it('returns the number of comments on a post', async () => {
+      mock.read.mockResolvedValue([
+        { _id: 'cm1', post_id: 'p1', text: 'a', created_at: '2026-07-18T00:00:00Z' },
+        { _id: 'cm2', post_id: 'p1', text: 'b', created_at: '2026-07-18T00:00:00Z' },
+      ]);
+      const count = await comments.countComments('p1');
+      expect(count).toBe(2);
+    });
+  });
+});