Skip to content

Add Apostille Me and Hacker House Medellín production/test pairs to the canonical fleet #95

Description

@ORESoftware

Audit finding — 2026-08-05

The user-requested product organizations apostille-me and hacker-house-medellin have complete production repository fleets, but their paired test organizations do not exist:

  • apostille-me-test — organization lookup returns 404
  • hacker-house-medellin-test — organization lookup returns 404

Neither pair is currently modeled in the live 18-pair / 341-repository test-fleet manifest. They must therefore be treated as an explicit control-plane expansion, not as missing repositories inside an existing paired organization.

Required design

Apostille Me

Add synthetic, privacy-safe certification surfaces for at least:

  • API and schema contracts
  • MASH, Leptos, and Dioxus browser E2E
  • document upload and type/size limits
  • OCR/extraction redaction
  • jurisdiction/workflow rules
  • payment and order idempotency
  • webhook reconciliation
  • status notifications
  • CLI/client/SDK ingestion
  • auth and tenant isolation
  • accessibility and responsive UI
  • deletion/retention and audit events

Never store passports, government IDs, certificates, signatures, addresses, payment details, or real customer documents in Git.

Hacker House Medellín

Add synthetic certification surfaces for at least:

  • API and schema contracts
  • MASH, Leptos, and Dioxus browser E2E
  • room/desk inventory and booking races
  • payments, deposits, refunds, and idempotency
  • access-control and guest lifecycle
  • coworking/coliving tenant isolation
  • maintenance and incident workflows
  • notifications and WebSockets
  • CLI/client/SDK ingestion
  • accessibility, mobile/responsive, and offline recovery
  • retention, audit, and privacy controls

Never store resident identity documents, door/access credentials, payment data, private messages, or real occupancy records in Git.

Acceptance criteria

  • Add both production/test pairs to the canonical manifest with explicit retained and specialized repository sets.
  • Keep r2g and r2g-test excluded.
  • Update all manifest counts, docs, deterministic index assertions, and dry-run expectations atomically.
  • Add contract tests for per-pair uniqueness, exact totals, and sensitive-fixture prohibitions.
  • Provision the two GitHub organizations through the approved organization-creation path.
  • Create every managed repository through reviewable bootstrap branches and PRs.
  • Install the GitHub App on both test organizations and verify authenticated inventory.
  • Do not embed PATs or document/identity credentials in the manifest, workflows, fixtures, or logs.

Related

Activity

  1. linear-code commented on Aug 5, 2026

    @linear-code
  2. ORESoftware commented on Aug 6, 2026

    @ORESoftware
    ContributorAuthor

    2026-08-06 paired-fleet expansion update

    Authenticated checks still return 404 for both apostille-me-test/.github and hacker-house-medellin-test/.github; neither organization appears in the installed GitHub App inventory. The paired-fleet expansion remains blocked on organization creation and App installation, not on missing repositories inside an existing organization.

    Product-side canonical E2E seeds are now under review:

    • hacker-house-medellin/.github#11 → hacker-house-medellin/hhm-e2e
    • apostille-me/.github#12 → apostille-me/apme-e2e

    Each seed includes offline fixture contracts, Playwright/Puppeteer/Selenium suites, canonical Zed dependency intent, a secret-shape gate, and a fail-closed publisher that refuses duplicate repository creation and generates the npm lock through the actual resolver. These product repositories complement but do not replace the requested paired test organizations.

    No manifest totals should be changed to claim these pairs are live until the organizations exist, the GitHub App is installed, authenticated inventory succeeds, and reviewed test-repository bootstrap PRs are published.

  3. ORESoftware commented on Aug 8, 2026

    @ORESoftware
    ContributorAuthor

    2026-08-08 Hacker House Medellín test-fleet state correction

    Authenticated connector inventory now verifies that hacker-house-medellin-test exists and the GitHub App is installed. The installation currently exposes zero repositories.

    This narrows the remaining HHM work from organization/App provisioning to:

    1. add the hacker-house-medellin / hacker-house-medellin-test pair to the canonical manifest and deterministic index;
    2. publish reviewable test-repository bootstraps into the empty test organization;
    3. pin production sources or explicit source gates;
    4. run the synthetic coliving/coworking contract and browser matrices; and
    5. record exact repository heads and workflow evidence before declaring the pair live.

    The product-side hhm-e2e seed remains under review in hacker-house-medellin/.github#11. Its initially pinned Playwright and Puppeteer versions were unpublished; the branch has been corrected to currently published versions and CI has been re-triggered. No credential material or resident data was added.

    Linear: DEN-2032.

  4. ORESoftware commented on Aug 8, 2026

    @ORESoftware
    ContributorAuthor

    2026-08-08 Apostille Me test-fleet state correction

    Authenticated connector inventory now verifies that apostille-me-test exists and the GitHub App is installed. The installation currently exposes zero repositories.

    This narrows the remaining Apostille Me work from organization/App provisioning to:

    1. add the apostille-me / apostille-me-test pair to the canonical manifest and deterministic index;
    2. publish reviewable test-repository bootstraps into the empty test organization;
    3. pin production sources or explicit source gates;
    4. run privacy-safe document, OCR/redaction, workflow, payment-idempotency, webhook, auth/tenant, accessibility, deletion, and audit contracts using synthetic fixtures only; and
    5. record exact repository heads and workflow evidence before declaring the pair live.

    The validated 48-repository recovery bundle is not an appropriate provisioning source by itself because the production fleet has advanced and the paired test fleet uses specialized certification repository identities. No credential material or customer document data was added.

    Linear: DEN-2031.

  5. ORESoftware commented on Aug 8, 2026

    @ORESoftware
    ContributorAuthor

    HHM fleet expansion is under review

    Canonical control-plane PR: zed-pkg-test/zed-pkg-e2e#141

    Reviewed head: 6e4ee595afd312a3ab2f3e98c3dc8b29964f756a

    The final branch adds the hacker-house-medellin / hacker-house-medellin-test pair with 18 private specialized repositories covering the three Rust web stacks, API/WebSocket contracts, flags-2-env CLI behavior, opto-sync reconciliation, infra/database, booking races, tenant isolation, payment/access controls, notifications, performance, MCP, and Rust/TypeScript consumers.

    Generation run 31269385319 succeeded with:

    • 19 production/test pairs;
    • 319 specialized repositories;
    • 19 governance repositories;
    • 338 managed repositories;
    • 360 expected repositories;
    • 258 dependency lanes;
    • 11 fleet contract tests passing.

    The PR contains only the deterministic manifest/index/tests and the existing secret-backed workflow allowlists. Temporary generators and schema inspectors were removed. Pull-request CI is credential-free and does not mutate hacker-house-medellin-test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions