3 Commits

Include renames

Author	SHA1	Message	Date
Latte	d79ff2d476	docs: forbid AI attribution and document the stdio transport in CLAUDE.md ... Record that no 'Generated with Claude Code' / Co-Authored-By / 'made by Claude' attribution may appear in commits, PRs, releases, comments or docs. Add stdio transport notes (stdout reserved for JSON-RPC, build_server vs _serve).	2026-06-27 15:19:42 +02:00
LatteandClaude Opus 4.8	385b442b6f	docs: local vs server quickstart, authz model, packaging ... Reframe the README around two transports and add a local stdio quickstart with uvx/pip and Claude Desktop / Claude Code wiring. New docs: local-quickstart.md and packaging.md (uv build/publish). Document resource-type-aware authorization and classified gitea_request in security.md; stdio env vars + audit-log fallback in configuration.md; local install in deployment.md; core+adapters in architecture.md. Add the missing root AGENTS.md contract, update CLAUDE.md with the core/adapter layout, fail-closed invariants, and the branching flow (HEAD -> feature -> dev -> main). Update roadmap/todo and .env.example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-27 11:17:01 +02:00
LatteandClaude Sonnet 4.6	b8217dce8a	feat: harden OAuth state secret validation, DCR file permissions, and policy defaults ... - Enforce 32-char minimum on OAUTH_STATE_SECRET at startup (config.py) - Write DCR client registry with owner-only (0o600) permissions before atomic replace - Flip policy.yaml default write action from allow → deny - Add CLAUDE.md with architecture, commands, and AGENTS.md contract summary - Add .pre-commit-config.yaml mirroring `make lint` checks - Update .gitignore: add .venv, .claude, .mypy_cache, .ruff_cache, .coverage.* - Extend docs: audit log rotation guidance, OAUTH_STATE_SECRET and DCR_STORAGE_PATH notes - Tests: short-secret rejection, 32-char acceptance, POSIX permission check for DCR store Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-14 14:13:22 +02:00