staging → main: the dpp-web audit remediation - #18
Open
LKSNDRTMLKV wants to merge 24 commits into
Open
Conversation
ESPR Article 10 is Requirements for the digital product passport and defines no tiers; access is Art. 11(b), free of charge, with the actor-to-data mapping delegated per product group under Art. 9(2)(f) and no such act adopted yet, so the public Public/Restricted/Private tier page was wrong at its premise and is replaced by the Battery Art. 77(2) lattice plus the constraints common to every regime.
…ate per-passport-per-day count with no scanner-identifying field
… be committed to a public repo
…ng a removed product-category schema and an internal decision-record reference from published content
…d act that does not exist, and correct the ESPR sector table's electronics basis and unsold-goods article
…ne, and give the docs site the headers and robots file the landing site already had
…pe the workflow token to read-only
# Conflicts: # site/dpp-docs/src/content/docs/regulatory/electronics.mdx
…istry status and access vocabulary against primary text and engine source
…retract the unverified standards-conformance claim, and correct the remaining landing and roadmap claims
…edential-standard version
…ocial config and the deprecated zod re-export
…ft check is deterministic and cross-repo changes are not deadlocked
…ected credential-standard version" This reverts commit ec48fe3.
# Conflicts: # site/dpp-docs/src/content/docs/regulatory/electronics.mdx
# Conflicts: # .github/workflows/ci.yml
Deploying odal-node-docs with
|
| Latest commit: |
9a4c526
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://62ea8bdf.odal-node-docs.pages.dev |
| Branch Preview URL: | https://staging.odal-node-docs.pages.dev |
Deploying odal-node-landing with
|
| Latest commit: |
9a4c526
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c3c1b4dd.odal-node-landing.pages.dev |
| Branch Preview URL: | https://staging.odal-node-landing.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integration branch for the 2026-08 audit remediation. This is the promotion gate —
mainis what Cloudflare Pages publishes, so nothing reaches production without passing through here first.Contains every branch from PRs #10, #13, #14, #15, #16 and #17, plus two CI fixes that could not be made on the individual branches. Each of those PRs remains open as the per-topic review record; this one is the thing that ships.
What changes for a reader of the site
What changes for CI
Four gates, each tested against a known-bad input before being trusted: a link crawler over the built output, a leakage scan covering
public/, an API-spec drift check, and a dependency audit. The workflow token is scoped to read-only.The two CI fixes made here
The spec check was tied to another repo's moving
main. That deadlocks any coordinated change — the web side cannot go green until the engine side merges, so neither can be reviewed on a green build — and lets an unrelated engine merge redden pull requests here. The vendored spec is now pinned to an explicit engine commit recorded inopenapi-source.json, so the check is deterministic and self-contained, and bumping the pin is a reviewable line in a diff. A separate non-blocking step reports how far the pin is behind, because "the published spec is old" was the original finding and must stay visible.A resync of an unmerged upstream change was reverted. The credential-standard correction belongs entirely to
dpp-engine#140. It comes back here when that merges, via a pin bump.Verification on this branch
pnpm -r buildgreen ·pnpm -r check0 errors / 0 warnings / 5 hints · 824 internal links across 44 pages resolve · leakage clean · spec matches the pin ·pnpm audit --audit-level criticalpasses.Searched the built output for every retracted claim —
18 March 2026,1 April 2026,foldable,Annex X minimum,no system clock,cannot delete rows,maintained conformance matrix,remains unpublished— zero files each.Still open, deliberately
proxyUrlwas verified statically, not at runtime. It stops the API reference relaying requests through a third party, and the claim is a privacy one — worth confirming in a browser before launch.