Feature 04 (Platform Services: Secrets, Settings, Time and Jobs) - all 5 tasks verified in the feature branch.
WHAT: Shared backend services every later feature depends on: encryption of secrets at rest, the household settings singleton, timezone-correct Monday-week math, default seeding, and an async job runner (D-010, D-013, D-015).
Task 3 (3d2d9d03): household settings seeding and API - PR #27 (rebased onto dev/Feature 03).
Task 4 (d07100de): default seeding for AI settings and notification prefs - PR #28.
Task 5 (f7b9a2c8): async job runner and GET /api/v1/jobs/{id} - PR #29.
Feature acceptance: secrets round-trip and tampering is detected, boot fails on a missing/short key; household settings validate IANA zones and HH:MM times; week math is correct across DST and the 2026 ISO week-53 boundary under non-UTC zones; a job completes with a readable progressive result and a job left running is failed at next boot with 'interrupted by restart'. Integration at the feature head: make test and make build exit 0; gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make sqlc-check no drift. Migration 0003 aligns jobs.status to queued/running/succeeded/failed. Approved dependencies only (modernc.org/sqlite, oklog/ulid/v2; sqlc dev-only).
This PR merges the feature branch into dev (merge commit, matching Features 01-03).
Feature 04 (Platform Services: Secrets, Settings, Time and Jobs) - all 5 tasks verified in the feature branch.
WHAT: Shared backend services every later feature depends on: encryption of secrets at rest, the household settings singleton, timezone-correct Monday-week math, default seeding, and an async job runner (D-010, D-013, D-015).
Tasks:
- Task 1 (59e4569d): secretbox AES-256-GCM - PR #17.
- Task 2 (c1edef2a): household week/local-time utilities - PR #18.
- Task 3 (3d2d9d03): household settings seeding and API - PR #27 (rebased onto dev/Feature 03).
- Task 4 (d07100de): default seeding for AI settings and notification prefs - PR #28.
- Task 5 (f7b9a2c8): async job runner and GET /api/v1/jobs/{id} - PR #29.
Feature acceptance: secrets round-trip and tampering is detected, boot fails on a missing/short key; household settings validate IANA zones and HH:MM times; week math is correct across DST and the 2026 ISO week-53 boundary under non-UTC zones; a job completes with a readable progressive result and a job left running is failed at next boot with 'interrupted by restart'. Integration at the feature head: make test and make build exit 0; gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make sqlc-check no drift. Migration 0003 aligns jobs.status to queued/running/succeeded/failed. Approved dependencies only (modernc.org/sqlite, oklog/ulid/v2; sqlc dev-only).
This PR merges the feature branch into dev (merge commit, matching Features 01-03).
Feature 03 made the OIDC variables required, so the Feature 04 boot tests'
loadConfig helper now sets them alongside the secret key file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
{"verdict":"CHANGES_REQUIRED","reviewed_sha":"e050736178aef191871448ca6536e62cb5e9595c","summary":"The feature does not meet its API job done-condition. Formatting, vet, and diff checks passed. The race tests could not start because Go could not create a temporary build directory on the read-only filesystem.","findings":[{"id":"F1","severity":"medium","location":"internal/server/server.go:71","failure_case":"A client cannot enqueue a job through the API, so it cannot exercise the required enqueue-to-progress-to-result flow.","evidence":"The router registers only GET /jobs/{id}. The HTTP progress tests call Kind.Enqueue directly and register their progressive handler only in test code.","suggested_correction":"Add an authenticated API operation that enqueues a registered progressive job kind, then test enqueue, intermediate result, and completion through HTTP."}]}
Posted unaltered by review_agent. This is transport, not a second review.
## Independent review — Codex `gpt-6-sol`, reasoning high
Verdict: **CHANGES_REQUIRED**
Reviewed SHA: `e050736178aef191871448ca6536e62cb5e9595c`
```json
{
"verdict": "CHANGES_REQUIRED",
"reviewed_sha": "e050736178aef191871448ca6536e62cb5e9595c",
"summary": "The feature does not meet its API job done-condition. Formatting, vet, and diff checks passed. The race tests could not start because Go could not create a temporary build directory on the read-only filesystem.",
"findings": [
{
"id": "F1",
"severity": "medium",
"location": "internal/server/server.go:71",
"failure_case": "A client cannot enqueue a job through the API, so it cannot exercise the required enqueue-to-progress-to-result flow.",
"evidence": "The router registers only GET /jobs/{id}. The HTTP progress tests call Kind.Enqueue directly and register their progressive handler only in test code.",
"suggested_correction": "Add an authenticated API operation that enqueues a registered progressive job kind, then test enqueue, intermediate result, and completion through HTTP."
}
]
}
```
---
Posted unaltered by `review_agent`. This is transport, not a second review.
{"verdict":"APPROVED","reviewed_sha":"bba9033ac5c9f12fd9bcd40f38f47235e9f85f1c","summary":"Round 1’s missing POST endpoint is fixed. The authenticated router test covers enqueue, a readable progressive result, and success. The reviewed feature meets the stated done-conditions; no blocking defect was found. gofmt, go vet, and TZ=UTC go test -race -count=1 ./... passed.","findings":[]}
Posted unaltered by review_agent. This is transport, not a second review.
## Independent review — Codex `gpt-6-sol`, reasoning high
Verdict: **APPROVED**
Reviewed SHA: `bba9033ac5c9f12fd9bcd40f38f47235e9f85f1c`
```json
{
"verdict": "APPROVED",
"reviewed_sha": "bba9033ac5c9f12fd9bcd40f38f47235e9f85f1c",
"summary": "Round 1’s missing POST endpoint is fixed. The authenticated router test covers enqueue, a readable progressive result, and success. The reviewed feature meets the stated done-conditions; no blocking defect was found. gofmt, go vet, and TZ=UTC go test -race -count=1 ./... passed.",
"findings": []
}
```
---
Posted unaltered by `review_agent`. This is transport, not a second review.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Feature 04 (Platform Services: Secrets, Settings, Time and Jobs) - all 5 tasks verified in the feature branch.
WHAT: Shared backend services every later feature depends on: encryption of secrets at rest, the household settings singleton, timezone-correct Monday-week math, default seeding, and an async job runner (D-010, D-013, D-015).
Tasks:
Feature acceptance: secrets round-trip and tampering is detected, boot fails on a missing/short key; household settings validate IANA zones and HH:MM times; week math is correct across DST and the 2026 ISO week-53 boundary under non-UTC zones; a job completes with a readable progressive result and a job left running is failed at next boot with 'interrupted by restart'. Integration at the feature head: make test and make build exit 0; gofmt empty; go vet clean; TZ=UTC go test -race all packages pass; CGO_ENABLED=0 build ok; make sqlc-check no drift. Migration 0003 aligns jobs.status to queued/running/succeeded/failed. Approved dependencies only (modernc.org/sqlite, oklog/ulid/v2; sqlc dev-only).
This PR merges the feature branch into dev (merge commit, matching Features 01-03).
Independent review — Codex
gpt-6-sol, reasoning highVerdict: CHANGES_REQUIRED
Reviewed SHA:
e050736178aef191871448ca6536e62cb5e9595cPosted unaltered by
review_agent. This is transport, not a second review.Independent review — Codex
gpt-6-sol, reasoning highVerdict: APPROVED
Reviewed SHA:
bba9033ac5c9f12fd9bcd40f38f47235e9f85f1cPosted unaltered by
review_agent. This is transport, not a second review.