zizmor audits the workflows themselves for what makes a workflow unsafe, and uploads what it finds to code scanning. Its first run here found one thing, 6 times: a checkout that leaves the job's token in the checked-out repository, where any later step can read it. No workflow pushes or needs the token after the checkout, so every checkout now sets persist-credentials to false, and zizmor reports nothing. OpenSSF Scorecard grades how the repository is kept: branch protection, pinned dependencies, token permissions and the like. It runs on the default branch and weekly, publishes its score and uploads its findings to code scanning. Every new action is pinned to a commit, each job names the permissions it needs, and no new workflow has a default permission.
The account API kept everything in the memory of its process, so every restart and every deployment of the API deleted all accounts and signed everyone out. PostgresAccountStore implements IAccountStore on PostgreSQL through Npgsql. The three uniqueness rules are unique constraints, so two requests that race for one name, address or Google identity are decided by the database. A refused account is an ordinary answer, not an exception, and the rules are reported in the order the in-memory store reports them. A session refers to its account, and a session of an account that is not stored is refused; the in-memory store now refuses it as well. The schema is a list of numbered steps. The service takes the missing ones when it starts, in one transaction under an advisory lock, and does not start when the database cannot be reached or is newer than the release. /health answers 503 while the database does not answer. ConnectionStrings:Accounts selects PostgreSQL. A production service that is given no database does not start; keeping accounts in memory there has to be asked for with Accounts:Store=Memory. Development and the tests keep the in-memory store by default. The store gains RemoveExpiredSessionsAsync, and a background service calls it at the start and once an hour: a session whose token is never presented again no longer keeps its row for ever. PostgreSQL keeps a timestamp to the microsecond. The store cuts a moment to that precision and returns what it stored, and the service uses the returned account, so the creation time in the registration response equals the one every later read returns. Tests. AccountStoreContractTests states the rules once and runs them on both stores. Further tests cover the schema steps applied concurrently and a database that is too new, the choice of the store from the configuration, the removal of expired sessions, and an account with its session surviving a restart of the service over HTTP. The PostgreSQL tests read their database from PROGMAWEB_TEST_POSTGRES and work in a schema of their own each. Without the variable they are skipped; CI starts PostgreSQL 16 for them, and a test fails the run when the variable is missing there. Operations. ops/README.md describes the database: the Unix socket with peer authentication, so that no password exists, the one-time preparation, and rollback across a schema step. The service unit starts after PostgreSQL. docs/LIMITATIONS.md no longer lists the in-memory store and now lists the missing backup and the missing deletion of accounts.
The DocFX gate only failed on a broken link or an unresolved reference. DocFX does not report a declaration without a comment, and the API had none, so the gate passed over a reference with no descriptions at all. The gate now has three parts: - DocFX still builds the reference with warnings as errors. - The API project compiles its XML documentation. With warnings as errors already on, an undocumented public declaration or a wrong cref now fails the build. - docs/api/CheckDocumentation.cs reads the metadata DocFX generated and fails when a namespace, type or member has no summary. This covers internal and private members, which the compiler does not check. It runs as a file-based .NET program, so the gate needs no tool beyond the SDK. It refuses to pass when the metadata is missing or defines nothing. To satisfy the gate, every declaration of apps/api has documentation comments, 131 reference items in all, and the two namespaces are described by overwrite files in docs/api/namespaces. Only comment lines were added to the C# sources; no statement changed. docs/api/filterConfig.yml leaves generator-written code out of the reference: the generated regular-expression namespace, and the one partial method whose generated half replaces the comment of its declaration. Verified locally: the solution builds with no warnings, the 23 API tests pass, DocFX builds with no warnings and the coverage check passes. Removing one summary and one namespace file made the check fail and name both.
The backend workflow now builds the API reference with DocFX and treats every warning as an error, so an unresolved reference or a broken link fails the check. - docs/api holds the DocFX project: it reads apps/api/Progmaweb.Api.csproj and includes internal members, because the service is an application and most of its types are internal. - .config/dotnet-tools.json pins docfx 2.81.0, so CI and a local run use the same version through `dotnet tool restore`. - The workflow also runs when the DocFX project or the tool manifest change. - `just api-docs` runs the same two commands locally. - The generated site and metadata are ignored. The gate does not require documentation comments: the API has none yet, and DocFX does not report an undocumented member. Requiring them is a separate change to the C# sources. Verified locally with docfx 2.81.0 on the .NET 10 SDK: the build passes with no warnings, and a broken link in the overview page makes it fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adopt Patent Grant 1.1, make the apex host canonical while excluding account surfaces from indexing, move the Progmasoft mail boundary into its owning repository, migrate the .NET 10 tests to native MTP, and add persistent light/dark and en-US/de-DE preferences across corporate and account experiences.