moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

OCV-197: CMS cross-application session revocation and runtime verification #74

Open
moeardent wants to merge 205 commits from moeardent/OCV-197-cms-shared-session into dev AGit
pull from: moeardent/OCV-197-cms-shared-session
merge into: moebiusol:dev
Conversation 0 Commits 205 Files changed 256 +49989 -312
moeardent commented 2026-11-08 19:40:08 +00:00
Owner
Copy link

Work package: OCV-197, OCV-206, OCV-246. Exact source head ca7dada18a. Change: strict same-client introspection and isolated Backend access decision before callback writes and each bound site/admin request, safe session retirement versus unavailable retry, localized messages, exact mandatory runtime test packaging. Verification: independent technical source review CLEAR; R95 runner fixtures20/20 and report checks15/15 PASS, shell syntax PASS,628 unchanged source guards and owned scratch released/absent. These fixture checks do NOT execute PHP: qualified current Joomla/PHP image, real IdP/session checks and normal CI remain required. Existing supplier/security work in this branch retains its recorded prerequisites. Request independent official approval of the exact final head before any protected merge; do not treat technical review or historical PR71 as that approval. DEV/TEST/QA only; no production.

Work package: [OCV-197](https://moebiusol.youtrack.cloud/issue/OCV-197), [OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206), [OCV-246](https://moebiusol.youtrack.cloud/issue/OCV-246). Exact source head ca7dada18afacd62c9d789952b23c537ee40edc0. Change: strict same-client introspection and isolated Backend access decision before callback writes and each bound site/admin request, safe session retirement versus unavailable retry, localized messages, exact mandatory runtime test packaging. Verification: independent technical source review CLEAR; R95 runner fixtures20/20 and report checks15/15 PASS, shell syntax PASS,628 unchanged source guards and owned scratch released/absent. These fixture checks do NOT execute PHP: qualified current Joomla/PHP image, real IdP/session checks and normal CI remain required. Existing supplier/security work in this branch retains its recorded prerequisites. Request independent official approval of the exact final head before any protected merge; do not treat technical review or historical PR71 as that approval. DEV/TEST/QA only; no production.
[FIX] OCV-246 restore CMS authenticated semantic runtime contract
Some checks are pending
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch is running
Details
7b4845195f 
- Recover the accepted fixed-tenant six-field endpoint and complete semantic capability inventory.
- Bake explicit original product coordinates and activate the image-owned route safely inside the PVC.
- Preserve current CI and require PHP, actual-rule and UID33 mount regression tests; remote evidence remains pending.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Verification-Ref: source re-review complete; shell syntax, 3 Apache static checks and image boundary passed; exact-head remote PHP/mount/Apache evidence pending
Risk-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Release-Ref: DEV/TEST candidate only; no deployment or production authorization
Exception-Ref: None
[SEC] OCV-229 validate contact return URL origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
527d082c2a 
Require exact HTTP(S) scheme, host and effective port for absolute returns; retain safe root-relative paths and form anchor. Reject ambiguous and cross-origin values to the routed fallback. Add production-method and POST regression checks to validation CI.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 admit work refs for source validation only
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
96137e0587 
Repair native source-contract rejection of configured feature/fix/quality validation branches. Keep Build, Security and Promote restricted to protected routes and retain exact producer source/stage parity. Add fail-closed coverage for malformed refs, nondefault identity and producer-chain isolation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 derive DEV destinations for verified source validation
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
bf23196be3 
Keep work-ref provenance intact while mapping only verified Validate route contexts to DEV compatibility destinations. Leave protected artifact/deployment routing unchanged. Exercise real native verification, checkout identity, launcher and dispatcher together with fail-closed integration tests.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: worker
Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]
Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 clear Qodana findings in redirect harness
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
34807ad3bf 
Make Joomla test doubles consume their parameters, use local imports and explicit exception reporting, and apply readonly/constant style without changing production redirect behavior. Record build 21814 findings and required exact-head revalidation.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 mark immutable contact test double readonly
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate failed with exit 255
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 255
Details
675bd46d4c 
Resolve the sole Qodana finding on exact-head CMS Validate build 21820 without changing production redirect behavior or test cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-229 avoid redundant readonly modifier
Some checks failed
teamcity/medcms/validate TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/sbom-source TeamCity OculusVitaCMS_Validate passed
Details
teamcity/medcms/grype-source TeamCity OculusVitaCMS_Validate failed with exit 2
Details
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
03d4280e74 
Qodana found one redundant property modifier after the test double became a readonly class. Remove only that modifier; all 30 redirect cases and 95 CI unit tests remain green.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229]

Verification-Ref: specs/ocv-229-contact-return-origin/verification.md
[FIX] OCV-206 scope CMS source SBOM to product checkout
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
ea99fbb099 
Exclude generated scanner and report trees from Syft source inventory, reject contaminated or unattributed package records, and leave image scanning plus the fail-on-low Grype gate unchanged. TeamCity 21827 proved the prior source SBOM contained only Syft/Qodana tool binaries.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 narrow CMS SBOM exclusions to generated CI files
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
f0c35a11e7 
Retain any product package material elsewhere under artifacts, and mark exact-head integration evidence pending until TeamCity verifies the Syft and Grype results. Independent review found this scope risk before merge.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to source validation
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
c17741a381 
Allow feature, fix and quality refs only through Validate source actions while preserving native ref and SHA provenance. Keep image, security and promotion routing protected; cover dispatcher and native boundary regression cases.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-206 admit CMS work refs to TeamCity Validate filter
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
86041aa95f 
Widen only non-release source Validate VCS filtering to standard review refs. Preserve protected image, security and promotion filters. Record failed exact-head attempts as non-scanner evidence.

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: local-executor

Trace-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]

Verification-Ref: specs/ocv-206-cms-source-sbom-scope/verification.md
[FIX] OCV-246 replace CMS route entries safely
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
2829b2c23b 
Use no-follow moves for handler activation and PVC rollback so a symlink-to-directory cannot redirect staged entries.

Add an injected activation-failure regression that checks the prior symlink and PVC route configuration are restored.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: shell syntax, Apache static checks (3/3), image boundary and diff checks passed; PHP-backed route sync test unavailable locally (PHP CLI missing); exact-head TeamCity revalidation pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: DEV/TEST candidate only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 validate CMS runtime contract on review branches
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d558e1910 
Keep delivery provenance closed to dev/test/main while running the exact PHP runtime suite in the existing non-release Qodana branch lane.

The branch lane remains verification-only and does not build, publish, or promote images.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP runtime suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 isolate branch runtime checks from TeamCity secrets
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02544ab56f 
Run PHP route tests in a minimal environment so source-under-review does not inherit unrelated project credentials.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; remote runtime test pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 require PHP CLI for CMS runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
49cfe047b5 
Do not treat Docker presence as satisfying a PHP CLI dependency; install or fail clearly before executing the required runtime suite.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provision PHPUnit for runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
04f9d28872 
Install or require PHPUnit alongside PHP CLI before running the fail-closed runtime contract suite on branch and stable validation lanes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provide PHP 8.4 in CMS validation lane
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
56685f430f 
Install the required PHP 8.4 CLI when the TeamCity agent has no qualifying interpreter; Docker presence is not a PHP CLI substitute.

The PHP 8.4 Ubuntu setup follows PHP installation guidance; only CLI SAPI is used by validation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 fail closed without approved PHP test image
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
4c922d5ae0 
Remove the unapproved third-party PHP package source and package installation from shared TeamCity validation. Require PHP 8.4+ CLI and PHPUnit from an approved, digest-pinned test image; retain the branch-only runtime suite and do not widen native delivery routes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [moebiusol/oculus-vita-cms#59]
Verification-Ref: branch-lane/static checks and shell syntax, Apache route tests, image boundary checks, and diff checks pass; PHP runtime suite not run due missing approved PHP 8.4/PHPUnit image
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 consume complete CMS route guard input
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
d6333a5b1b 
Accept valid runtime routing even when trailing Apache configuration causes an early grep exit to send SIGPIPE to sed under pipefail. Consume the full normalized file while preserving the exact required stable-handler rule and wrong-target rejection.

Three actual-script fixtures cover repository rules, a 520 KB configuration tail and fail-closed wrong-handler rejection. PHP metadata validation is stubbed only in these shell fixtures; approved PHP, Apache, mount and exact-image CI qualification remain required.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: #59
Verification-Ref: 3 shell guard fixtures, 3 Apache static tests, image-boundary, bash syntax and diff checks passed
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no merge or deployment
Checkpoint source-only harness work before CMS security convergence. Existing branch/stable lanes and complete runtime suite retained. Official PHPUnit producer signatures and signed artifact metadata replace release-hash pins; no CI secrets or self-granted mount privileges enter the container. Verification: 17 offline lifecycle/provenance cases, branch contract, three route guards, three Apache static checks, shell syntax and independent technical source review pass. Actual image build, PHAR signature execution, SBOM/scan, qualified image binding and authorized mount executor remain unverified; no official approval, deployment or runtime completion claim. YouTrack: OCV-206, OCV-246
Integrate exact OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] source candidate 03d4280e74 from #61 while preserving the OCV-246 runtime endpoint and local harness checkpoint. Feature integration only; no approval, push or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Integrate exact OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] candidate 86041aa95f from #62. Resolve shared test conflicts by retaining both work-ref scenarios and unioning every input/refusal oracle. Preserve Grype policy and OCV-229 redirect repair; feature integration is not approval or deployment.

YouTrack: OCV-229, OCV-206, OCV-246
Preserve OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] exact-origin repair and all30 redirect checks, OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206] product source-SBOM scope, and all15 OCV-246 runtime PHPUnit methods. Replace only the newly merged redirect host-PHP/mutable-image fallback with the existing immutable isolated harness; explicit12-file closure and regression/static checks preserve mandatory execution and credential isolation.

Source verification:128 Python CI tests PASS; focused41 included, harness17 included; Apache route static3 PASS; branch-lane, CI governance, quality-gate, image boundary, Bash syntax and diff checks PASS. Actual PHP/image/mount/security server qualification and independent exact-head review pending. No push, protected merge, deployment or approval.

YouTrack: OCV-229, OCV-206, OCV-246
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] bind runtime metadata validation to bounded opened handle
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 1
Details
c9ff4073ae 
Repair the independently confirmed local pathname-check/open race: require matching regular-file device/inode on one opened handle, validate its size, bound the actual read and close in finally. Preserve fixed production path, bearer authorization, no-store and six-field semantic contract. Add deterministic actual endpoint regressions backed by real file replacement/growth plus byte boundaries; all15 prior PHPUnit methods retained.

OCV-229 [https://moebiusol.youtrack.cloud/issue/OCV-229] security convergence under OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]. Source checks: Apache static3 PASS, image boundary PASS, diff check PASS. PHP absent locally:17 source methods pending actual server execution and independent exact-head review. Local path ownership/exploitability unverified; no unauthenticated remote exploit or atomic concurrent same-inode rewrite guarantee claimed. No push/deployment/approval.

YouTrack: OCV-246, OCV-229, OCV-206
Retain the original 36 checks and add the actual renamed mixed-case object path. Independently reviewed driver passed 37 server browser checks on the updated diagnostic image; no deployed-edge, image-security or release approval is implied.

YouTrack: OCV-206, OCV-268
docs(OCV-268): preserve debugger and account boundaries
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce3552fc17
fix(OCV-268): repair Imagick artifact memory ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
045a28f9bf
fix(OCV-268): qualify native PHP resource accounting
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
f8116cdbed
fix(OCV-268): measure shared socket storage in daemon view
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
170586f46e
fix(OCV-268): admit native memory using Linux available capacity
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ce982c51b6
fix(OCV-268): bound cold storage retries and preserve Docker ceiling
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c3f0701ebf
fix(OCV-268): size Docker scan within original freshness window
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
2286de4d0a
fix(OCV-268): restore bounded vanished-file counter recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
77098a4581
fix(OCV-269): align Serbian sign-in action with supplied workbook
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1f41f9a865
fix(OCV-206): align CMS Serbian action labels
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
314ed6af7c
fix(OCV-206): validate CMS export token timestamps
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a9c912183a
OCV-206 Apply Joomla text policies to workbench saves
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1365fba138
OCV-206 Reject ambiguous resource link authorities
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
be9a10cd65
OCV-206 Preserve literal CMS login return paths
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13021bdb32
OCV-206 Enforce CMS account resource ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
25ceec04c4
OCV-246 Reject invalid SSO token dates
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3fc9e979da
OCV-246 Enforce vetting for explicit HCP groups
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
98e5f89450
OCV-246 Require boolean SSO privilege claims
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
784347c58e
OCV-246 Save published article revisions atomically
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
86ffb915d2
OCV-246 make editorial transitions atomic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
67646bf6de
fix(OCV-246): validate explicit SSO authorized party
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a558193aa5
fix(OCV-246): restrict ID token audience to configured client
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
598f6e86b0
fix(OCV-269): apply supplied Serbian configurable footer text
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
13857a31e3
fix(OCV-246): confine CMS status publishing to Forgejo
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
5ab736b266
fix(OCV-269): restore account navigation Serbian diacritic
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
d147361a62
fix(OCV-246): render unlinked resource information safely
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
dc04651f58
fix(OCV-246): revalidate substituted article authority
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6a7136c8ae
fix(OCV-246): keep article discovery within publication bounds
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9761a0e90b
fix(OCV-246): derive article media from selected localized item
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
21075478a7
fix(OCV-246): retain intro hero when full article image is empty
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e3ee56d77d
fix(OCV-246): bind export JWT key fetches to configured origin
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80a492cc41
fix(OCV-246): preserve UTC SQL instants in content export
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c6b3d88e2f
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Fix CMS immutable account binding
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
80395ee95c
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Synchronize category publication through CMS export journal
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
a8e73a4fba 
Require published categories and ancestors, journal descendant article changes, and restore eligible unchanged content through incremental exports. Resolve stale publication and context events without broad deactivation.

Verified local PHP 8.5 fixture: 1734 checks; independent source review PASS. PHP 8.4 and integrated runtime qualification remain separate.

Affected: OCV-206
Validate actual upload size and raster type, and enforce self-contained sanitized SVG references with the locked real supplier. Retain safe fragments, CSS, and verified inline raster images, including a narrow supplier WebP extension.

Local PHP 8.5 actual multipart verification: 95 cases and 329 assertions passed; independent replay passed. Normal PHP 8.4/Apache CI qualification remains pending.

Affected: OCV-246

Affected: OCV-206
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] complete runtime test source consumption
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
e7f54a8ae1 
Preserve the normal isolated runtime runner and require all current media and export suites with actual assertions.

YouTrack: OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268], OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Export complete CMS collections from one PostgreSQL snapshot
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
7da1d14837
OCV-246 Bound CMS export memory within the existing product runtime
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0727135f78
OCV-268 Preserve bounded native failure diagnostics without raw environment reproducers
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ed42b3a225
fix(OCV-268): separate retained SDK and runtime phase provenance
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
2029aa2d97
fix(OCV-268): verify retained SDK inputs for phase recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
90ccffd369
fix(OCV-268): prepare retained SDK environment recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d8768868d
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Use authenticated recovery build dependencies
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02c21275dc 
Preserve both hash-bound PHP and Imagick source declarations, refresh signed indexes through the existing qualified build APT context, and avoid the inherited global PHP deny pin. Focused source contracts: 32 PASS; actual read-only policy control confirms the causal pin. Constructor, native runtime and product acceptance remain pending.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Restore declared recovery SDK dependency closure
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
42de54b10e 
Reuse the existing authenticated compiler backport declaration before the unchanged offline SDK install. Preserve signed-index refresh, full PHP and Imagick dependency declarations, all 19 original SDK payloads and the source lock. All 35 affected source checks pass; complete read-only APT simulation resolves the SDK plus all eight declared backports. Constructor and native runtime qualification remain pending.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] Retain bounded supplier timeout diagnostics
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0dfbb15855 
Preserve partial captured stdout and stderr in the same existing log when a supplier command reaches its unchanged deadline, then re-raise the same timeout. Never serialize command arguments or the environment. Normal output and failure contracts are unchanged. All 40 affected source checks pass. The PHP/Imagick dependency timeout cause and SDK/native qualification remain unresolved.

YouTrack: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268]
Measure same-agent mounts over one existing exec; preserve original timestamps, per-member timeout retry and strict failure admission. Bound private DU streams and retain category/digest receipts. 39 focused observer/recovery tests passed; actual observer qualification and SDK image construction remain pending.

YouTrack: https://moebiusol.youtrack.cloud/issue/OCV-246

Refs: https://moebiusol.youtrack.cloud/issue/OCV-206 https://moebiusol.youtrack.cloud/issue/OCV-268
OCV-268: record bounded recovery observer qualification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
4956be7dd5 
Record 39 focused passes and eight actual observation/publication cycles at source0380f578. Preserve unknown historical transport cause and pending image/native qualification; no runtime or clinical approval.

YouTrack: https://moebiusol.youtrack.cloud/issue/OCV-268

Refs: https://moebiusol.youtrack.cloud/issue/OCV-206 https://moebiusol.youtrack.cloud/issue/OCV-246
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] retain fresh supplier observations through bounded metadata recovery
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9cd96c437d 
Use exact private Docker configuration and proven terminal read-only helpers. Permit only one headroom-qualified whole observation retry, revalidate original and replacement rows before atomic handoff, preserve all identity/freshness/capacity bounds. Independent path review clear; 56 offline tests pass; no native or live qualification claim.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound Docker-root observation retries to one remote helper
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
62dd8b3743 
Keep two maximum 8s scans inside the existing 20s aggregate ceiling, require proven child-group quiescence and complete strict measurements, and make uncertain transport fatal without a fresh exec. Preserve original timestamps, 30s freshness and all storage/identity controls. Independent source review clear; 66 offline focused and actual-consumer tests passed in 46.498s. Live qualification pending; no image or native qualification claim.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound recovery APT acquisition retry inside existing deadline
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
da1ce68ca5 
Use one standard APT failed-file retry only in recovery dependency invocations after the authenticated libltdl-dev HTTPS broken-pipe failure. Keep each original 900s subprocess budget, signed indexes, expiry, full PHP/Imagick declarations, eight locked backports and fail-closed SDK boundary. No global APT or normal bootstrap change. Independent technical source review clear; 17 focused recovery tests passed. Image and native qualification remain pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] bound complete recovery dependencies by natural source phases
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6e4bfb46e1 
Install the complete authenticated Imagick then PHP build-dependency declarations, preserving signed context, no-remove, eight declared backports and each 900s operation. Verify both installed declarations and all dependency/conflict variants with dpkg-checkbuilddeps before unchanged SDK installation. The external whole-build 3600s budget remains unchanged; no unsafe I/O, source-lock, SDK-byte or capability change. Independent technical source review clear and 22 focused checks passed, including the real Debian checker against isolated installed state. Image/native qualification remains pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] join independent supplier closing reads concurrently
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0ce3784026 
After all physical and optional memory measurements, concurrently fetch the independent kubelet summary, Pod-after and daemon-after metadata. Join every bounded outcome before composition or propagation, preserve exact source timestamps/identities and all storage/freshness controls, and never hide a fatal sibling behind a retryable timeout. No persistent transport, shared platform or deadline change. Independent technical review clear; 52 observer unit tests passed, including causal barrier/failed/cancelled sibling tests and unchanged actual process-lifetime bounds. Live transport and image/native qualification remain pending.

YouTrack: OCV-206, OCV-246, OCV-268
OCV-268 record reviewed recovery composition verification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
9cd262cb84
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] verify email before domain-derived publisher grant
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
195c7fea71 
Restrict only the email-domain authorization shortcut; preserve bound-user login and explicit trusted role/group grants. Add seven signed callback regressions. Independent technical source review clear; execution and official source approval remain pending.

YouTrack: OCV-246, OCV-206
OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246] record causal publisher regression verification
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
0af723c27f 
Retain 4 baseline failures and 3 passing controls, then 113 passing signed callback tests on the explicit Joomla 6.1.0 isolated carrier. Preserve raw-output and dependency-hash limitations; no candidate, official CI, approval or deployed acceptance claim.

YouTrack: OCV-246, OCV-206
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Fix private recovery admission evidence ownership
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
bbc794255c
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Project retained SDK inputs read-only for compiler
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
6491bc417e
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Preserve bounded Docker observation exception diagnostics
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
1b30ba9a29
OCV-268 [https://moebiusol.youtrack.cloud/issue/OCV-268] Retain private vanished-region diagnostics and valid interrupted receipts
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
c81c42aa2e
OCV-268 repair readline prerequisites and owned supplier cancellation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
55fc611f8f
feat(OCV-197): revalidate CMS SSO sessions across applications
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
ca7dada18a 
YouTrack: OCV-197 [https://moebiusol.youtrack.cloud/issue/OCV-197], OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206], OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Required
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/74/head:moeardent/OCV-197-cms-shared-session
git switch moeardent/OCV-197-cms-shared-session
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#74
No description provided.
Delete branch "moeardent/OCV-197-cms-shared-session"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?