moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

OCV-246 CMS current runtime and account-security repairs #73

Open
moeardent wants to merge 177 commits from moeardent/OCV-246-current-product-repairs into dev AGit
pull from: moeardent/OCV-246-current-product-repairs
merge into: moebiusol:dev
Conversation 0 Commits 177 Files changed 240 +42940 -308
moeardent commented 2026-11-02 21:23:45 +00:00
Owner
Copy link

Integrates the current CMS product repairs under OCV-246 and OCV-206, continuing the source history of migrated PR 71. Final head: 80395ee95c. The latest repair requires the SSO issuer and subject pair, the full configured tenant issuer and a unique exact remote UID before account actions; mutable email and username matching is removed. Final bounded PHP verification: 528 cases and 3276 assertions passed, with independent security source review. The actual test methods used an explicit assertion adapter on TEST PHP 8.4.21; full PHPUnit, current normal CI, official approval and deployed DEV/TEST acceptance remain required. Previous runtime, export security, article publication and UTC fixes are retained. Existing dirty work is excluded. No production deployment.

Integrates the current CMS product repairs under [OCV-246](https://moebiusol.youtrack.cloud/issue/OCV-246) and [OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206), continuing the source history of migrated PR 71. Final head: 80395ee95c564c46e505e26e93444b7ca2da436b. The latest repair requires the SSO issuer and subject pair, the full configured tenant issuer and a unique exact remote UID before account actions; mutable email and username matching is removed. Final bounded PHP verification: 528 cases and 3276 assertions passed, with independent security source review. The actual test methods used an explicit assertion adapter on TEST PHP 8.4.21; full PHPUnit, current normal CI, official approval and deployed DEV/TEST acceptance remain required. Previous runtime, export security, article publication and UTC fixes are retained. Existing dirty work is excluded. No production deployment.
[FIX] OCV-246 restore CMS authenticated semantic runtime contract
Some checks are pending
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch is running
Details
7b4845195f 
- Recover the accepted fixed-tenant six-field endpoint and complete semantic capability inventory.
- Bake explicit original product coordinates and activate the image-owned route safely inside the PVC.
- Preserve current CI and require PHP, actual-rule and UID33 mount regression tests; remote evidence remains pending.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Verification-Ref: source re-review complete; shell syntax, 3 Apache static checks and image boundary passed; exact-head remote PHP/mount/Apache evidence pending
Risk-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Release-Ref: DEV/TEST candidate only; no deployment or production authorization
Exception-Ref: None
[SEC] OCV-229 validate contact return URL origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
527d082c2a 
Require exact HTTP(S) scheme, host and effective port for absolute returns; retain safe root-relative paths and form anchor. Reject ambiguous and cross-origin values to the routed fallback. Add production-method and POST regression checks to validation CI.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 admit work refs for source validation only
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
96137e0587 
Repair native source-contract rejection of configured feature/fix/quality validation branches. Keep Build, Security and Promote restricted to protected routes and retain exact producer source/stage parity. Add fail-closed coverage for malformed refs, nondefault identity and producer-chain isolation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 derive DEV destinations for verified source validation
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
bf23196be3 
Keep work-ref provenance intact while mapping only verified Validate route contexts to DEV compatibility destinations. Leave protected artifact/deployment routing unchanged. Exercise real native verification, checkout identity, launcher and dispatcher together with fail-closed integration tests.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 clear Qodana findings in redirect harness
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
34807ad3bf 
Make Joomla test doubles consume their parameters, use local imports and explicit exception reporting, and apply readonly/constant style without changing production redirect behavior. Record build 21814 findings and required exact-head revalidation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 mark immutable contact test double readonly
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
675bd46d4c 
Resolve the sole Qodana finding on exact-head CMS Validate build 21820 without changing production redirect behavior or test cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 avoid redundant readonly modifier
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/sbom-source TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/grype-source TeamCity OculusVitaCMS_Validate failed with exit 2
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
03d4280e74 
Qodana found one redundant property modifier after the test double became a readonly class. Remove only that modifier; all 30 redirect cases and 95 CI unit tests remain green.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-206 scope CMS source SBOM to product checkout
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
ea99fbb099 
Exclude generated scanner and report trees from Syft source inventory, reject contaminated or unattributed package records, and leave image scanning plus the fail-on-low Grype gate unchanged. TeamCity 21827 proved the prior source SBOM contained only Syft/Qodana tool binaries.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 narrow CMS SBOM exclusions to generated CI files
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
f0c35a11e7 
Retain any product package material elsewhere under artifacts, and mark exact-head integration evidence pending until TeamCity verifies the Syft and Grype results. Independent review found this scope risk before merge.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to source validation
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
c17741a381 
Allow feature, fix and quality refs only through Validate source actions while preserving native ref and SHA provenance. Keep image, security and promotion routing protected; cover dispatcher and native boundary regression cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to TeamCity Validate filter
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
86041aa95f 
Widen only non-release source Validate VCS filtering to standard review refs. Preserve protected image, security and promotion filters. Record failed exact-head attempts as non-scanner evidence.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-246 replace CMS route entries safely
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
2829b2c23b 
Use no-follow moves for handler activation and PVC rollback so a symlink-to-directory cannot redirect staged entries.

Add an injected activation-failure regression that checks the prior symlink and PVC route configuration are restored.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: shell syntax, Apache static checks (3/3), image boundary and diff checks passed; PHP-backed route sync test unavailable locally (PHP CLI missing); exact-head TeamCity revalidation pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: DEV/TEST candidate only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 validate CMS runtime contract on review branches
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d558e1910 
Keep delivery provenance closed to dev/test/main while running the exact PHP runtime suite in the existing non-release Qodana branch lane.

The branch lane remains verification-only and does not build, publish, or promote images.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP runtime suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 isolate branch runtime checks from TeamCity secrets
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02544ab56f 
Run PHP route tests in a minimal environment so source-under-review does not inherit unrelated project credentials.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; remote runtime test pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 require PHP CLI for CMS runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
49cfe047b5 
Do not treat Docker presence as satisfying a PHP CLI dependency; install or fail clearly before executing the required runtime suite.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provision PHPUnit for runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
04f9d28872 
Install or require PHPUnit alongside PHP CLI before running the fail-closed runtime contract suite on branch and stable validation lanes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provide PHP 8.4 in CMS validation lane
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
56685f430f 
Install the required PHP 8.4 CLI when the TeamCity agent has no qualifying interpreter; Docker presence is not a PHP CLI substitute.

The PHP 8.4 Ubuntu setup follows PHP installation guidance; only CLI SAPI is used by validation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 fail closed without approved PHP test image
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
4c922d5ae0 
Remove the unapproved third-party PHP package source and package installation from shared TeamCity validation. Require PHP 8.4+ CLI and PHPUnit from an approved, digest-pinned test image; retain the branch-only runtime suite and do not widen native delivery routes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [moebiusol/oculus-vita-cms#59]
Verification-Ref: branch-lane/static checks and shell syntax, Apache route tests, image boundary checks, and diff checks pass; PHP runtime suite not run due missing approved PHP 8.4/PHPUnit image
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 consume complete CMS route guard input
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
d6333a5b1b 
Accept valid runtime routing even when trailing Apache configuration causes an early grep exit to send SIGPIPE to sed under pipefail. Consume the full normalized file while preserving the exact required stable-handler rule and wrong-target rejection.

Three actual-script fixtures cover repository rules, a 520 KB configuration tail and fail-closed wrong-handler rejection. PHP metadata validation is stubbed only in these shell fixtures; approved PHP, Apache, mount and exact-image CI qualification remain required.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: #59
Verification-Ref: 3 shell guard fixtures, 3 Apache static tests, image-boundary, bash syntax and diff checks passed
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no merge or deployment
Checkpoint source-only harness work before CMS security convergence. Existing branch/stable lanes and complete runtime suite retained. Official PHPUnit producer signatures and signed artifact metadata replace release-hash pins; no CI secrets or self-granted mount privileges enter the container. Verification: 17 offline lifecycle/provenance cases, branch contract, three route guards, three Apache static checks, shell syntax and independent technical source review pass. Actual image build, PHAR signature execution, SBOM/scan, qualified image binding and authorized mount executor remain unverified; no official approval, deployment or runtime completion claim. YouTrack: OCV-206, OCV-246
Integrate exact OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] source candidate 03d4280e74 from #61 while preserving the OCV-246 runtime endpoint and local harness checkpoint. Feature integration only; no approval, push or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Integrate exact OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] candidate 86041aa95f from #62. Resolve shared test conflicts by retaining both work-ref scenarios and unioning every input/refusal oracle. Preserve Grype policy and OCV-229 redirect repair; feature integration is not approval or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Preserve OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] exact-origin repair and all30 redirect checks, OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] product source-SBOM scope, and all15 OCV-246 runtime PHPUnit methods. Replace only the newly merged redirect host-PHP/mutable-image fallback with the existing immutable isolated harness; explicit12-file closure and regression/static checks preserve mandatory execution and credential isolation.

Source verification:128 Python CI tests PASS; focused41 included, harness17 included; Apache route static3 PASS; branch-lane, CI governance, quality-gate, image boundary, Bash syntax and diff checks PASS. Actual PHP/image/mount/security server qualification and independent exact-head review pending. No push, protected merge, deployment or approval.

YouTrack: OCV-229, OCV-206, OCV-246
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] bind runtime metadata validation to bounded opened handle
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
c9ff4073ae 
Repair the independently confirmed local pathname-check/open race: require matching regular-file device/inode on one opened handle, validate its size, bound the actual read and close in finally. Preserve fixed production path, bearer authorization, no-store and six-field semantic contract. Add deterministic actual endpoint regressions backed by real file replacement/growth plus byte boundaries; all15 prior PHPUnit methods retained.

OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] security convergence under OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]. Source checks: Apache static3 PASS, image boundary PASS, diff check PASS. PHP absent locally:17 source methods pending actual server execution and independent exact-head review. Local path ownership/exploitability unverified; no unauthenticated remote exploit or atomic concurrent same-inode rewrite guarantee claimed. No push/deployment/approval.

YouTrack: OCV-246, OCV-229, OCV-206
Retain the original 36 checks and add the actual renamed mixed-case object path. Independently reviewed driver passed 37 server browser checks on the updated diagnostic image; no deployed-edge, image-security or release approval is implied.

YouTrack: OCV-206, OCV-268
docs(OCV-268): preserve debugger and account boundaries
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce3552fc17
fix(OCV-268): repair Imagick artifact memory ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
045a28f9bf
fix(OCV-268): qualify native PHP resource accounting
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
f8116cdbed
fix(OCV-268): measure shared socket storage in daemon view
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
170586f46e
fix(OCV-268): admit native memory using Linux available capacity
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce982c51b6
fix(OCV-268): bound cold storage retries and preserve Docker ceiling
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c3f0701ebf
fix(OCV-268): size Docker scan within original freshness window
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
2286de4d0a
fix(OCV-268): restore bounded vanished-file counter recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
77098a4581
fix(OCV-269): align Serbian sign-in action with supplied workbook
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1f41f9a865
fix(OCV-206): align CMS Serbian action labels
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
314ed6af7c
fix(OCV-206): validate CMS export token timestamps
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a9c912183a
OCV-206 Apply Joomla text policies to workbench saves
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1365fba138
OCV-206 Reject ambiguous resource link authorities
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
be9a10cd65
OCV-206 Preserve literal CMS login return paths
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13021bdb32
OCV-206 Enforce CMS account resource ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
25ceec04c4
OCV-246 Reject invalid SSO token dates
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3fc9e979da
OCV-246 Enforce vetting for explicit HCP groups
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
98e5f89450
OCV-246 Require boolean SSO privilege claims
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
784347c58e
OCV-246 Save published article revisions atomically
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
86ffb915d2
OCV-246 make editorial transitions atomic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
67646bf6de
fix(OCV-246): validate explicit SSO authorized party
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a558193aa5
fix(OCV-246): restrict ID token audience to configured client
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
598f6e86b0
fix(OCV-269): apply supplied Serbian configurable footer text
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13857a31e3
fix(OCV-246): confine CMS status publishing to Forgejo
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
5ab736b266
fix(OCV-269): restore account navigation Serbian diacritic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
d147361a62
fix(OCV-246): render unlinked resource information safely
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
dc04651f58
fix(OCV-246): revalidate substituted article authority
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6a7136c8ae
fix(OCV-246): keep article discovery within publication bounds
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9761a0e90b
fix(OCV-246): derive article media from selected localized item
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
21075478a7
fix(OCV-246): retain intro hero when full article image is empty
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e3ee56d77d
fix(OCV-246): bind export JWT key fetches to configured origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80a492cc41
fix(OCV-246): preserve UTC SQL instants in content export
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c6b3d88e2f
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Fix CMS immutable account binding
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80395ee95c
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Synchronize category publication through CMS export journal
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a8e73a4fba 
Require published categories and ancestors, journal descendant article changes, and restore eligible unchanged content through incremental exports. Resolve stale publication and context events without broad deactivation.

Verified local PHP 8.5 fixture: 1734 checks; independent source review PASS. PHP 8.4 and integrated runtime qualification remain separate.

Affected: OCV-206
Validate actual upload size and raster type, and enforce self-contained sanitized SVG references with the locked real supplier. Retain safe fragments, CSS, and verified inline raster images, including a narrow supplier WebP extension.

Local PHP 8.5 actual multipart verification: 95 cases and 329 assertions passed; independent replay passed. Normal PHP 8.4/Apache CI qualification remains pending.

Affected: OCV-246

Affected: OCV-206
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] complete runtime test source consumption
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e7f54a8ae1 
Preserve the normal isolated runtime runner and require all current media and export suites with actual assertions.

YouTrack: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268], OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Required
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/73/head:moeardent/OCV-246-current-product-repairs
git switch moeardent/OCV-246-current-product-repairs
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#73
No description provided.
Delete branch "moeardent/OCV-246-current-product-repairs"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?