Integrate contributor PRs #3533, #3534, and #3535 on current main. Preserve the read-only module audit, canonical glossary and ADR ownership, and opt-in install closure. Refresh only the manual trigger manifest registry binding and coverage after adding the skill.
Sources: #3689#3691#3692#3693. Preserve Claude marketplace migration guidance, tool-result boundaries, scoped workflow authority, and bounded batch preparation. Regenerate the Pi projection and recompute the shared registry digest on one main head.
The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
Perl::Critic has no InputOutput::RequireThreeArgOpen or
Modules::RequireTaintChecking policy. perlcritic warns that they are
not installed and ignores them. Two-arg open is already covered by
InputOutput::ProhibitTwoArgOpen in the same profile. Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d70726d79c)
sanitize_html is not a built-in Laravel rule and the skill never
registers it, so the validator throws BadMethodCallException. The same
FormRequest already strips tags in validated(). Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit 453c0651f7)
The users router uses Depends() for OAuth2PasswordRequestForm but the
import line omits it, so the module raises NameError on import.
Regenerated pi/core with scripts/build-pi-core.js.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d383fb57e9)
Preserve complete source ancestry for PRs #3512, #3513, #3515, #3516, #3517 and #3518. Repair bounded recovery, alias compatibility and evaluator packaging gaps while keeping registry reuse inside the canonical loader. Verified actual hook, setup, dashboard, evaluator, sandbox and profile workflows plus full npm, Python, lint and supply-chain checks. ECC-043 preparation only; integration remains with the delivery owner.
Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Drop the duplicate ECC_PREPUSH_RUN_CHECKS key now that main sets it,
refresh the skill-triggers registry digest, classify skill-host-compat
for pi/core, and bump the Turkish AGENTS.md counts the catalog sync
does not cover.
Treat non-2xx activity responses as feed errors, preserve non-Markdown Copilot agent assets, and apply the reviewed reference escape parity correction with regenerated bindings. Allow the test runner to drain piped output on its existing success or failure exit status. Validate installed workflows and bounded real Node20/24 pipe regressions.
Phase 1 pipes the build into `tail -20`. Without pipefail the pipeline's
exit status is tail's, so a failed build exits 0. Phase 2 already sets
pipefail, but only after Phase 1 has run, and each phase is its own code
block. Set it at the top of the Phase 1, 3 and 4 blocks, which pipe a gate
into head or tail. Mirrored in pi/core.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.
Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.
haelyra