6 Commits

Include renames

Author	SHA1	Message	Date
bot-implementer	1d649648da	feat: bootstrap pnpm workspace (E00-S01) ... pnpm 11.23.0 workspace with a committed frozen lockfile, Node engine restricted to the 24.x line, TypeScript 6.0.3 pinned exactly, strict base tsconfig, apps/packages/extensions kept as separate workspaces, root build/test/typecheck commands, and the FIT-001 architecture test rejecting core-to-extension imports. Minimal CI runs only the root scripts (S05 stages stay out of scope). Closes #58.	2026-08-27 23:00:54 +00:00
kpcto	39f51a322f	Remove README.md	2026-08-26 22:35:26 +00:00
implementer	86aa3afbbf	refactor: newsletter signup posts no credential (SEC-14-R1 option a) ... Rework PR #15 per security review SEC-14-R1: the client no longer carries an API token. js/newsletter-config.js ships only the non-secret endpoint, enforced https-only at config load time via validateEndpoint() (mirroring the protocol allowlist in js/reading-list.js); js/newsletter.js POSTs email-only with no Authorization header. Failure paths keep the single user-safe message that never leaks token, endpoint, status, or raw body; success still shows the confirmation. CI gains a gitleaks step that fails on any secret hit; README documents the server-side token, the residual signup-abuse risk, and the authoritative server-side validation follow-up.	2026-08-26 11:27:11 +00:00
bot-implementer	cb9cf703a8	docs: document the newsletter page and its config in the README	2026-08-25 19:15:56 +00:00
bot-implementer	e4a192baab	docs: document the reading list page and data file in the README	2026-08-25 12:30:10 +00:00
bot-implementer	4a73b14471	chore: scaffold static personal blog site	2026-08-25 10:43:53 +00:00