- POST /approvals and PATCH /approvals/{id} require a console admin session
(EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- separate qB sync timer from the planning timer
- threshold cleanup, reserved-plan and pending-import sweeps, 6h reconcile enqueue
engine tasks with time-slot idempotency keys instead of running inline
- pending-import sweep selects by completed_at (sync refreshes updated_at every round)
- POST /download-cache/cleanup and /library/reconcile return {taskId, runId} (202);
web jumps to the engine run page
- test: a 50MB verifyAndImport in progress does not delay qB sync
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- rss: port of MP RssHelper._parse_impl/get_rss_link semantics with safe
XML (entities off, DTD/ENTITY rejected, size/item caps), ETag/Last-Modified,
backoff + Retry-After, circuit breaker with manual reset, passkey redaction,
overlap-window GUID+digest dedupe
- sites/spider: TS port of MP SiteSpider (indexer schema, search URL builder,
field DSL, filters, Jinja templates via nunjucks, login-page detection);
audiences definition hand-written as JSON; raw category id preserved;
shared per-site token bucket
- sites/mteam: port of MP MTorrentSpider (params, result mapping, promo
factors, genDlToken flow) without embedding the API key in enclosures;
business code/message checks
- testkit: mock RSS server, mock NexusPHP site, mock M-Team API
- docs: W1-3b migration mapping appended to porting ledger
Co-Authored-By: Claude Fable 5.1 <[email protected]>
