Skip to content
WELD 0.1.2
Menu

Changelog#

Notable changes to WELD, newest first.

Unreleased#

  • Changed: the docs pages wear the front page's look: the same header and main menu (Docs marked current), each page a cream sheet on the green field, commands on the quick start's terminal with its gold Copy button, the weld bead under every title, branded callouts and a derived dark mode. Motion only for readers who allow it. Sources: docs/_header.html, docs/theme/weld.css, the theme key in docs/docs.json.

  • Fixed: code on the front page's Sourdough card is cream, so it meets AA contrast on the deep green.

  • Changed: the front page header has a main nav that includes Docs.

  • Changed: the test APP_KEY is an obvious dummy (32 zero bytes), labeled test-only, and App\Support\DummyAppKey makes the app refuse it when APP_ENV=production; tests cover both.

  • Changed: the regen gate treats Squire kit files that WELD keeps under deploy/ as relocated (not drift), and oracle:check finds the check file at the app root or under deploy/.

  • Changed: WELD adopts Pest 4 for new tests: the PHPUnit class tests run unchanged, composer test runs Pest over the whole suite, tests/Pest.php is configured, the example feature test is converted, and pestphp/pest is required at ^4 because Pest 5 needs PHP 8.4.

  • Changed: CI pins the Preflight components to the 0.1.4 release SHA, so PROCTOR's preflight-pinned check passes.

  • Changed: the GitHub Actions in WELD's CI (actions/checkout, shivammathur/setup-php) are pinned to commit SHAs with the tag in a comment, so PROCTOR's ci-pipelines-unpinned-uses warning is gone; setup-php moves from the unpublished @v3 to 2.40.0.

  • Added: a docs site (site/docs/) built by the shared docs builder from docs/, checked in composer ci.

  • Changed: the regeneration baseline shrinks from 66 to 62 known-drift paths now that Sourdough no longer ships resources/js/app.js, welcome.blade.php or a phantom vite.config.js, and the .editorconfig matches.

  • Fixed: npm run lint passes on the shipped code: the dead badgeDir constant leaves scripts/readme-art/build.mjs, and Squire's kit bytes (site/assets/agent-ready.js, site/assets/stack-env.js, with the unused catch (e) bindings and dead variables fixed in Squire's kit) are synced in, so the ESLint config no longer excludes them.

  • Changed: npm run lint is now a pure check (eslint .); a new npm run fix script runs eslint . --fix.

  • Fixed: TrustedProxiesTest no longer depends on a local .env file. The trustProxies() closure in bootstrap/app.php runs when the HTTP kernel resolves on the first request, after the test's app refresh has re-read .env into the process environment, so the .env that composer create-project writes clobbered the value the test set and one of the four tests failed. The helper now re-asserts TRUSTED_PROXIES after the refresh, so the suite is green with a .env present and without one.

  • Changed: the README and front page say Sourdough bakes four shapes today (raw PHP, Laravel with Blade, Laravel with Blade plus Vue islands, and Laravel with Inertia and Vue) and only raw PHP with a Vue SPA is not available yet; the front page gains a card for the islands shape. WELD is the Inertia and Vue shape, already assembled with every part wired.

  • Changed: the front-page deploy layer pins HELMET ^0.3, PROCTOR ^0.4 and CREED ^0.1 (lock: HELMET 0.3.0, PROCTOR 0.4.0, CREED 0.1.6).

  • Changed: CI pins Preflight 0.1.4 (GitLab component includes and the GitHub reusable workflow at its tag commit); the deploy layer sets minimum-stability to stable.

  • Changed: HELMET moves to ^0.3 and PROCTOR to ^0.4 (lock: HELMET 0.3.0, PROCTOR 0.4.x, CREED 0.1.6, ADVISOR 0.1.5), so the newest PROCTOR checks run on WELD itself; an empty HELMET_PROXIES= now trusts nobody. Tests, style, analysis and PROCTOR pass unchanged.

0.1.2 (2026-11-03)#

  • Changed: SESAME moves from 0.2 to 0.4 (^0.4). It now logs sign-in events (sesame.login, sesame.logout, with a per sign-in session_ref; turn off with SESAME_LOG=false), re-reads the signed-in user when the resolver asks for it, and the gateway driver refuses an at+jwt access token. WELD itself needed no code change.
  • Fixed: the user menu gains a Sign out item on SESAME's logout route, the app bar branding drops the Laravel Starter Kit name and links (WELD logo text, waynestate/weld repository, weld.apps.wayne.edu documentation), .editorconfig covers compose.yaml and its variants, ExampleTest stops booting the framework, and UiBrandingTest pins the branding.
  • Changed: docs and package metadata name nougat as the canonical repository, with git.wayne.edu and GitHub as read-only mirrors, until git.wayne.edu has CI runners.
  • Changed: Laravel's trusted proxy list now comes from the TRUSTED_PROXIES environment variable (unset keeps Citadel's 172.18.0.1, set but empty trusts none, * trusts all), instead of a literal address. Citadel behaviour is unchanged.
  • Changed: the README and front page now say Sourdough is the starter tool for every shape of Wayne State app (raw PHP and Laravel with Blade today, the Vue shapes planned) and WELD is the Inertia and Vue shape, already assembled and ready to clone.
  • Changed: CI pulls its Docker Hub images through the GitLab Dependency Proxy (the group's CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX), so pipelines no longer hit Docker Hub's anonymous pull limit.
  • Added: waynestate/advisor joins require-dev at ^0.1, and "Clone it and rename" gains one step: php vendor/bin/advisor install --client=claude --write writes .mcp.json, which is now git-ignored because a committed MCP config would run a program on whoever opens the project. Set ADVISOR_ENABLED=1 in .env to switch the advisor on.
  • Changed: bin/weld.ps1 up and bin/weld.sh up write .mcp.json from ADVISOR inside the app container as part of the first-run setup (no PHP on the host PATH in the Docker path), with a --no-advisor opt-out on both scripts (-NoAdvisor on the PowerShell one).
  • Changed: the deploy layer's Squire kit is refreshed to 0.3.3 (release options can now live in ./.env.squire).
  • Changed: the deploy layer's Squire kit is refreshed to 0.3.4 (the local .env.squire file is now git-ignored).
  • Changed: the deploy layer's Squire kit is refreshed to 0.4.0: deploy/oracle-check.php arrives, so php artisan oracle:check runs the real check, and release.sh runs it without failing the release.
  • Changed: the Oracle overlay docs name Squire's parity image, squire/oracle-parity:8.3.
  • Added: StackIntegrationTest pins HELMET's security headers on a signed-in dashboard, a 404 error page and /up; ProctorCheckTest runs PROCTOR against CREED's policy.json inside the test suite, which composer ci alone did not cover.
  • Added: README section "Clone it and rename": copy WELD, rename the composer name, APP_NAME, site title and git remote, regenerate the key and re-run the checks, for PowerShell and sh.
  • Changed: BEST_PRACTICES.md re-checked against the code on 2026-11-02: the Squire kit's Dockerfile, entrypoint and release script move W10, W12, W16 and W24 from Not yet to Documented, W8/W13/W22 sentences name the new deploy files, and the shifted line numbers in composer.json, .env.example and bootstrap/app.php are corrected.
  • Added: the regen gate, which makes "WELD is the prebuilt Inertia shape" checkable: bin/regen-check.php compares a freshly generated Sourdough Inertia app (its .sourdough/manifest.json, path to SHA-256) with WELD file by file, skipping .sourdough/product-files.json entries and any vendor or node_modules path, and fails only on drift not already recorded in .sourdough/regen-baseline.json (a ratchet; --write-baseline records the current drift). The logic lives in App\Support\RegenCheck with unit tests, composer regen-check passes arguments through (not part of ci), and warning-only regen-gate jobs in both pipelines generate a fresh app from Sourdough's main and run the gate.

0.1.1 (2026-10-29)#

  • Added: agent-ready site (prompt blocks, Markdown twins, llms.txt), from Squire's kit.
  • Fixed: stale capability claims in the site and docs.
  • Changed: project names written as words except acronyms.
  • npm run typecheck (vue-tsc, no emit) joins the scripts, and it passes: the ten errors from the first run are fixed in the bullets below.
  • site/assets/wayne-ui/marks/warrior-strong-reverse.svg comes back from the WayneUI static bundle; the CSS has pointed at it since the front page assets landed.
  • The tsconfig types array keeps vite/client and regains ./resources/js/types: the shared interfaces move from index.ts to index.d.ts, which is the shape that entry resolves to. vue/tsx stays out, because it never resolved.
  • VITE_APP_NAME is declared in a new resources/js/env.d.ts against vite/client's ImportMetaEnv, replacing the inline declare module block in the app entry.
  • The app entry imports the Ziggy config from a new ziggy-value.js beside the generated ziggy.js, with a matching ziggy-value.d.ts: the generated declaration names the routes but not the value, and the value's string location predates the package's typed shape, so the declaration stops at the config minus that field.
  • SharedData extends Inertia's PageProps, so it satisfies the constraint usePage puts on its type argument.
  • AppHeader types its page with usePage<SharedData>(), so the user menu meets a User instead of unknown.
  • TextLink's optional method prop takes Inertia's Method union instead of string.
  • Welcome reads the signed-in state from usePage<SharedData>() instead of $page, which vue-tsc does not recognize on the component instance.

0.1.0 (2026-10-29)#

  • waynestate/helmet moves from ^0.1 to ^0.2 (locked at 0.2.3). The published config/helmet.php re-syncs with the package: HELMET_PRESET fills the proxy list (an unknown name throws at boot), and the security headers middleware joins the global chain, so every response carries the baseline. The trusted-header set narrows to X-Forwarded-For and X-Forwarded-Proto; X-Forwarded-Port is no longer trusted, because Citadel's HA-Proxy never sends it.
  • php artisan weld:doctor: local setup only: the app key, writable storage, the database and pending migrations. The standards checks (PHP version, debug in production, secure session cookies) belong to PROCTOR, and the report points at composer proctor.
  • Ziggy's route list leaves the inline <script> from @routes and moves into the Vite bundle: composer ziggy generates resources/js/ziggy.js (plus ziggy.d.ts), the app entry imports it and passes it to ZiggyVue, so route() works in Vue exactly as before while HELMET's strict CSP stays closed. A CI job regenerates the file and fails on any diff, and a feature test pins the contract that every script tag on the app page carries a nonce.
  • PROCTOR is welded in from Packagist (waynestate/proctor dev dependency, CREED's policy.json carried by waynestate/creed): composer proctor measures WELD against the version policy, and a CI job runs it on every pipeline. Warnings pass, failures block. The package's own bin looks for its autoloader where only a project-root install puts one, so composer proctor runs directly without a temporary launcher.
  • SESAME is welded in from Packagist (waynestate/sesame): sign-in moves from the starter kit's password forms to /login and /logout, owned by the package. The fake driver signs in locally; pointing at CAS is an env change. A username column joins users, and App\Sesame\UserResolver imports the identity on first sign-in.
  • HELMET is welded in from Packagist (waynestate/helmet): security headers and CSP on every web response, a published config/helmet.php, trusted proxies in bootstrap/app.php, and the Vite build asks for the per-request nonce. /up stays Laravel's built-in health route. Every web response now wears the baseline.
  • docs/running-off-citadel.md: the off-Citadel contract: OpenShift, Coolify and plain Docker, with Citadel for comparison. Traffic and trusted proxies per platform, php://stderr logs, writable paths, non-root user, /up, and weld:doctor after every deploy. Same bead, four different tables.
  • README: one line under "Run it locally" linking the guide.
  • php artisan weld:doctor: checks the app is set up safely, one PASS, WARN or FAIL line per check (PHP version, app key, debug in production, secure session cookies, writable storage, database, pending migrations); exits 1 when anything FAILs, --json for machines. A good bead is a quiet one: all PASS and nothing to say.
  • bin/weld.ps1 and bin/weld.sh: a doctor subcommand runs it in the app container.
  • README: "Check your setup".
  • compose.yaml: the local stack: the app (PHP and Composer in one image) and Vite, on pinned images, SQLite per .env.example, ports bound to 127.0.0.1 only.
  • bin/weld.ps1 (Windows, PowerShell 5.1 and 7) and bin/weld.sh (Linux and macOS, POSIX sh): up, down, test and logs, the same subcommands on every OS.
  • README: "Run it locally" is now one command per OS.