release: v1.3.0 - #270
Merged
Merged
release: v1.3.0#270
Conversation
fig-ai-agent
Bot
force-pushed
the
fig/release-v1.3.0
branch
from
September 14, 2026 13:10
5aba1c5 to
19ed264
Compare
zyntromedia
added a commit
that referenced
this pull request
Sep 15, 2026
* Add: Agent Task Skills + Merge Protection Agents: Task Master, Result Orchestrator, Milestone Tracker, Blocker Resolver, Handoff Coordinator, Summary Reporter -- runnable modules under knowledge/agents/ with tests (40 passing). Protect: .gitattributes merge strategy, CODEOWNERS, merge_rules.json. Policy: additive only -- no file replacement, history preserved. Note: protect-merge.yml is delivered separately -- the GitHub App for this repo lacks the workflows permission, and a push touching .github/workflows/ is rejected in full at the tree level. * Add front matter to agent skill docs knowledge/sync_knowledge_index.py walks knowledge/**/*.md and requires title, description, tags, doc_kind, status, owner, last_reviewed. The six new SKILL.md files had none, so the repo's own index gate failed on them. With front matter added the gate passes: 12 notes, 200 records. Tests unchanged: 40 passed. * Remove stray draft file from the branch * Update CONTRIBUTING.md Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> * Create CHECKLIST_BILLING.md Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> * feat(ci): add full CI/CD pipeline deliverable (orchestrator + reusable workflows) - pipeline.yml: single entry point with Quality/Security/Build stages and a ci-gate aggregate job intended as the sole required status check - reusable-python-ci.yml: lint -> typecheck -> test+coverage (fail-fast) - reusable-security-scan.yml: gitleaks, pip-audit, CodeQL - validate_pipeline.py: offline validator (YAML parse, SHA pinning, job graph) - README.md + HANDOFF.md: rationale, reconciliation table, promotion steps All action refs pinned to full commit SHAs (0 unpinned). No existing file is modified or replaced; promotion into .github/workflows/ is documented and gated on the workflows scope. * fix(ci): make validator executable and black-clean - EXE001: chmod +x validate_pipeline.py (shebang present, file was not executable) - reformat to satisfy black --check * docs(ci): record pre-existing ruff baseline (5183 errors) before gate promotion The Lint job would go red on promotion because main already carries 5,183 ruff errors. Documents the three remediation options (changed-files scoping, exclude list, baseline burn-down) so the gate can land green. * Create cron-automation/code * chore(lint): drop unused `import sys` from knowledge/scripts/diff_policy.py (#262) `sys` is imported but never referenced in the file — the only occurrence is the import line itself. Removing it clears the unused-import warning. Applies the intent of #253 to current main, where the branch's snapshot of this file had gone stale and no longer applied. Verified: file compiles, and an AST pass over the imports after the change reports none unused. Co-authored-by: fig-ai-agent <fig-ai-agent@users.noreply.github.com> * docs(changelog): record PR #262 (unused import cleanup in diff_policy.py) (#263) Adds the [2026-09-14] Fixed entry for #262 and notes it supersedes #253. Co-authored-by: fig-ai-agent <fig-ai-agent@users.noreply.github.com> * Create SKILL.md 🧩 FIX.jsx — Current State & Full Implementation 🔗 Context: ZyntroAI / FastAPI Boilerplate • Self-Contained Container • v1.3.0 📄 Purpose: Global Error Boundary • Auto-Recovery • UI Fallback • Logging • Schema Safe 📄 FIX.jsx — Full Current Code jsx import React, { Component, ReactNode } from 'react'; import { useZyntro } from './core/ZyntroContext'; import { logError, safeRender } from '../scripts/verify'; interface FIXState { hasError: boolean; error: Error | null; errorInfo: string; recovered: boolean; retryCount: number; } interface FIXProps { children: ReactNode; fallback?: ReactNode; maxRetries?: number; onReset?: () => void; } // 🛡️ Main Error Boundary export default class FIX extends Component<FIXProps, FIXState> { static defaultProps = { maxRetries: 3, fallback: null, }; constructor(props: FIXProps) { super(props); this.state = { hasError: false, error: null, errorInfo: '', recovered: false, retryCount: 0, }; } static getDerivedStateFromError(error: Error): Partial<FIXState> { return { hasError: true, error, recovered: false }; } componentDidCatch(error: Error, info: { componentStack: string }) { this.setState({ errorInfo: info.componentStack }); logError({ source: 'FIX.jsx', message: error.message, stack: info.componentStack, timestamp: new Date().toISOString(), }); } // 🔄 Auto-Reset Logic handleRetry = () => { const { retryCount } = this.state; const { maxRetries, onReset } = this.props; if (retryCount < maxRetries) { this.setState({ hasError: false, error: null, errorInfo: '', recovered: true, retryCount: retryCount + 1, }); onReset?.(); } }; render() { const { hasError, error, errorInfo, recovered, retryCount } = this.state; const { children, fallback, maxRetries } = this.props; if (hasError) { return ( <div className="zyntro-fix-boundary" data-theme="dark"> {fallback || ( <div className="fix-fallback"> <h2>⚠️ ระบบพบข้อผิดพลาด</h2> <p className="error-message">{error?.message || 'Unknown error'}</p> <button className="fix-retry-btn" onClick={this.handleRetry} disabled={retryCount >= maxRetries} > {retryCount >= maxRetries ? '❌ หมดจำนวนครั้งลอง' : `🔄 ลองใหม่ (${retryCount}/${maxRetries})`} </button> <details className="fix-details"> <summary>📋 ข้อมูลเทคนิค</summary> <pre>{errorInfo}</pre> </details> </div> )} </div> ); } return <>{children}</>; } } // 🧩 Hook Wrapper (for functional components) export function useFIX() { const { config } = useZyntro(); const safeUpdate = <T,>(fn: () => T): T | null => { try { return safeRender(fn); } catch (e) { logError({ source: 'useFIX', error: String(e) }); return null; } }; return { safeUpdate, logError }; } 📂 Structure & Dependencies Path: src/core/FIX.jsx - Imports: React • ZyntroContext • verify.js (schema/log) - Related: schemas/container.schema.json • gui/Dashboard.jsx ✅ Key Features (Current) 1. 🛡️ Error Boundary: Catches render/child errors • Prevents app crash 2. 🔄 Auto-Recovery: Max 3 retries • Manual retry button 3. 📝 Logging: Sends to verify.js • Full stack trace • Timestamp 4. 🎨 UI Ready: Mobile-first • Theme-aware • Details fold-out 5. 🧩 Dual API: Class Boundary + Hook ( useFIX ) 6. ✅ Safe: No external dependencies • Validated against schema 📊 Usage Example jsx import FIX from './core/FIX'; <FIX fallback={<div>กำลังโหลด...</div>}> <Dashboard /> </FIX> 🔗 Linked to Workflow - Works with auto-compress-manage.yml • No conflict - Verified in PR #242 • Schema compliant ✅ Would you like me to add inline comments, export default + named, or integrate SHA-check into this file? 🛠️🔒Skills พิเศษ กรณี เจอconfig ซ้ำ จากผลการค้นหา ดูเหมือนว่าคุณอาจกำลังถามเกี่ยวกับ **การจัดการ Skills (ทักษะ) เมื่อมีการตั้งค่า config ซ้ำกัน** ซึ่งมักพบในบริบทของระบบ AI Agent หรือเกม ## กรณี OpenCode / AI Agent Skills หากคุณกำลังทำงานกับระบบเช่น **OpenCode** ที่มีระบบ Skills ผ่านไฟล์ `SKILL.md`: ### เมื่อเจอ config ซ้ำ - **Skill names ต้องไม่ซ้ำกัน**Across all locations (ทั้ง project config และ global config) หากชื่อซ้ำ จะเกิดปัญหา skill ไม่แสดงหรือโหลดผิด content[1][2] - **ลำดับความสำคัญของ sources** (จากต่ำไปสูง): 1. Built-in skills 2. Global config (`~/.config/opencode/skills`) 3. Project config (`.opencode/skills`) 4. Explicit `skills` config entries - **การแก้ไข**: - ตรวจสอบว่า `SKILL.md` สะกดด้วยตัวพิมพ์ใหญ่ทั้งหมด - ตรวจสอบ frontmatter มี `name` และ `description` - **ตั้งชื่อ skill ให้ unique** ทุก location - ตรวจสอบ permissions — skills ที่มี `deny` จะถูกซ่อนจาก agents[2][3] ## กรณีเกม (เช่น DOAXVV, Azur Lane) หากคุณหมายถึง **เกม** ที่มีระบบ skill ซ้ำ: ### DOAXVV - **Skill ที่ซ้ำกันจะ発動เพียง 1 อัน** (เฉพาะอันเดียว) - **ข้อยกเว้น**: おうえんบอร์ด (Support Board) **ไม่ได้รับผลกระทบ** — skill ซ้ำกันก็発動ทั้งหมด[4] - **ข้อควรระวัง**: - ชุดว่ายน้ำ, อุปกรณ์เสริม, และ潜在能力 (potential ability) อาจมี skill ซ้ำ → ต้องระวัง - หากชื่อ skill มีตัวเลขหรือตัวอักษรต่อท้ายต่างกัน → ถือเป็น skill คนละอัน ### Azur Lane - Skill ที่ระบุว่า **"同じ種類のスキルの効果は重複しない"** (ผลของ skill ประเภทเดียวกันไม่ซ้อนทับ): - หากมี skill ระบบเดียวกันหลายอัน → **ใช้เฉพาะอันที่มี effect สูงสุด** - เช่น「砲術指揮・駆逐艦」LV3 กับ LV1 → ใช้ LV3 เท่านั้น[5] - Skill ที่มีชื่อต่างกันแต่เป็นประเภท "指揮" (command) → ก็ใช้ rule เดียวกัน *** หากคุณหมายถึงระบบอื่น (เช่น game engine, framework อื่น) กรุณาระบุเพิ่มเติมครับ เพื่อให้ผมตอบได้ตรงมากขึ้น! การอ้างอิง: [1] Frontmatter https://opencode.ai/v2/docs/skills/ [2] Agent Skills | OpenCode https://opencode.ai/docs/skills/ [3] ทักษะของเอเจนต์ https://opencode.ai/docs/th/skills/ [4] 【DOAXVVゲーム解説】装備したスキルの重複について https://vv-fun.blog.jp/archives/20226171.html [5] 【アズールレーン】スキルの重複について https://smartgamecap.net/?p=1364 [6] Kahananui Fullskills https://www.ea.com/zh-hans/games/the-sims/the-sims-4/gallery/item/eKagdxk8S72kg2gy0PBAQQ== [7] Skill Config Reborn https://www.nexusmods.com/skyrimspecialedition/mods/55627 [8] What happens when you get the same skill twice? :: Thea 2 https://steamcommunity.com/app/606230/discussions/0/1743390429221794951/ [9] Class SkillConfig - jotunnlib.github.io https://jotunnlib.github.io/jotunnlib/api/JotunnLib.Entities.SkillConfig.html [10] วิธีแก้ไขทักษะแบบพกพา https://tinydesignshop.com/th/guides/how-to-edit-portable-skills Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> * Create SKILL.md ถ้าจะทำให้ [FIG.jsx.txt](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!sbc1a113c1fad4847908180415924cce4&EntityRepresentationId=aa6be836-608d-40e8-833d-f5c505ce7268) และ [FIG_MasterAdvancedSkillmd_260914_194220.PDF](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!s892c5a90b2484e268b21e3a4f3ded885&EntityRepresentationId=5471d0a7-7e67-4c68-99a3-92a457ceee32) เป็นเวอร์ชัน **Best / Production Grade** จริง ๆ ผมแนะนำ Architecture ดังนี้: [1](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!sbc1a113c1fad4847908180415924cce4)[2](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!s892c5a90b2484e268b21e3a4f3ded885) ```text FIG v4.0 Enterprise │ ├── API Gateway ├── API Registry ├── API SDK ├── CRUD Engine │ ├── MasterFiles Engine │ ├── Read │ ├── Write │ ├── Update │ └── Delete │ ├── RBAC ├── Permission Middleware ├── Route Protection │ ├── Retry Engine ├── Cache Engine ├── Offline Queue ├── Audit Logger ├── Metrics ├── Event Bus │ ├── JWT Manager ├── Refresh Token ├── Session Manager │ ├── Health Check ├── System Monitor ├── Error Recovery │ └── Plugin System ``` ### MasterFiles ระดับ Enterprise ```jsx const MASTERFILES = { mode: "strict", immutable: true, requireAudit: true, requireApproval: true, protectedPaths: [ "/api/v1/masterfiles", "/api/v1/config", "/api/v1/system", "/api/v1/settings", ], permissions: { viewer: ["READ"], maintainer: [ "READ", "WRITE", "UPDATE", ], admin: [ "READ", "WRITE", "UPDATE", "DELETE", ], }, }; ``` ### Built-in API Registry ```jsx FIG.API = { AUTH: {}, USERS: {}, MASTERFILES: {}, SETTINGS: {}, SYSTEM: {}, HEALTH: {}, METRICS: {}, }; ``` ### Global API SDK ```jsx FIG.get(); FIG.post(); FIG.put(); FIG.patch(); FIG.delete(); ``` ### Cache Layer ```jsx FIG.cache.set(key, value); FIG.cache.get(key); FIG.cache.remove(key); FIG.cache.clear(); ``` ### Event System ```jsx FIG.on("success", callback); FIG.on("error", callback); FIG.on("forbidden", callback); ``` ### Metrics ```jsx FIG.metrics.report() { requests: 152, success: 149, errors: 3, uptime: "99.8%" } ``` ### Audit Log ```jsx { user: "admin", endpoint: "/masterfiles/1", action: "UPDATE", timestamp: "..." } ``` ### React Hook ```jsx const { data, loading, error, create, update, remove, refresh, } = useMasterfiles(); ``` ### ตัวอย่างใช้งาน ```jsx <FIG endpoint={FIG.API.MASTERFILES.LIST} method="GET" > {({ data, isLoading, isForbidden, }) => { if (isLoading) return <>Loading...</>; if (isForbidden) return <>Access Denied</>; return ( <pre> {JSON.stringify( data, null, 2 )} </pre> ); }} </FIG> ``` ### จุดที่ควรมีในเวอร์ชัน Best - ✅ CRUD Complete - ✅ MasterFiles Control - ✅ RBAC - ✅ JWT Authentication - ✅ Refresh Token - ✅ Permission Middleware - ✅ Audit Trail - ✅ Retry Logic - ✅ Event Bus - ✅ Cache Manager - ✅ Offline Support - ✅ Metrics Dashboard - ✅ Plugin System - ✅ FastAPI Ready - ✅ NestJS Ready - ✅ Express Ready - ✅ Django REST Ready - ✅ Enterprise Security Layer สรุปสั้น ๆ: ถ้าพัฒนาไปถึงระดับนี้ `FIG.jsx` จะไม่ใช่แค่ Component แต่จะกลายเป็น **Frontend API Framework + Gateway + MasterFiles Security Platform** แบบครบวงจรครับ [1](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!sbc1a113c1fad4847908180415924cce4)[2](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!s892c5a90b2484e268b21e3a4f3ded885)จาก [FIG_V4_260914_194917.PDF](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!scdbccabf952540aeb1ac787fdfb88f05&EntityRepresentationId=2394e9a3-d27e-4c1a-ae5a-b531c9a13c8c) ผมเห็นว่า FIG v4.0 ถูกวางไว้เป็นสถาปัตยกรรมระดับ Enterprise แล้ว โดยมีองค์ประกอบหลักดังนี้: API Gateway, API Registry, API SDK, CRUD Engine, MasterFiles Engine, RBAC, Permission Middleware, Retry Engine, Cache Engine, Audit Logger, Metrics, JWT Manager และ Plugin System [1](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!scdbccabf952540aeb1ac787fdfb88f05) เมื่อรวมกับข้อมูลที่คุณเป็น Owner ของ Organization **ZyntroAI** แนวทางที่ดีที่สุดคือยกระดับจาก **FIG v4.0 Enterprise** ไปเป็น **FIG v4.1 Organization Edition** ดังนี้ ```text ZyntroAI Organization │ ├── FIG-Core │ ├── FIG-API │ ├── FIG-MasterFiles │ ├── FIG-Plugins │ ├── FIG-Security │ ├── FIG-Docs │ └── .github ``` ## Organization Governance ```jsx FIG.ORG = { name: "ZyntroAI", mode: "organization", ownership: { ownerOnly: true, require2FA: true, requireAudit: true, } }; ``` ## MasterFiles Owner Policy ```jsx const MASTERFILES = { mode: "strict", ownerOnly: true, immutable: true, requireApproval: true, requireAudit: true, protectedPaths: [ "/api/v1/masterfiles", "/api/v1/system", "/api/v1/config", "/api/v1/settings" ] }; ``` ## GitHub Organization Integration ```yaml masterfiles: require_code_owner: true require_pull_request: true require_status_checks: true require_signed_commits: true require_review_count: 2 ``` ## FIG Enterprise Role Model ```jsx roles: ORGANIZATION_OWNER ADMIN MAINTAINER VIEWER ``` สิทธิ์: ```text ORGANIZATION_OWNER ✅ READ ✅ WRITE ✅ UPDATE ✅ DELETE ✅ SYSTEM ADMIN ✅ READ ✅ WRITE ✅ UPDATE MAINTAINER ✅ READ ✅ WRITE VIEWER ✅ READ ``` ## Built-in Security Layer ```jsx FIG.Security = { enforceRBAC: true, enforceAudit: true, enforceOwnerApproval: true, enforceProtectedRoutes: true, enforceJWT: true, }; ``` ## Enterprise Audit ```json { "organization": "ZyntroAI", "repository": "fig-framework", "actor": "owner", "action": "MASTERFILE_UPDATE", "resource": "/api/v1/masterfiles", "timestamp": "2026-09-14T19:49:17Z" } ``` ## เป้าหมายสูงสุด จากเอกสาร [FIG_V4_260914_194917.PDF](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!scdbccabf952540aeb1ac787fdfb88f05&EntityRepresentationId=2394e9a3-d27e-4c1a-ae5a-b531c9a13c8c) ปัจจุบัน FIG เป็น "Frontend API Framework + Gateway + MasterFiles Security Platform" อยู่แล้ว [1](https://onedrive.live.com?cid=F3BE42E16A88456A&id=F3BE42E16A88456A!scdbccabf952540aeb1ac787fdfb88f05) หากผูกเข้ากับ Organization **ZyntroAI** อย่างเป็นทางการ FIG จะกลายเป็น: ```text FIG v4.1 Organization Edition Frontend Framework + API Gateway + API SDK + MasterFiles Engine + Enterprise Security Layer + Organization Governance + GitHub Owner Control + Audit Platform + Plugin Ecosystem ``` ซึ่งเป็นโครงสร้างที่เหมาะสำหรับควบคุมหลาย Repository ภายใต้ Organization Owner เดียวได้อย่างเป็นระบบและขยายต่อเป็น Enterprise Platform ได้ในอนาคต. Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> * Harden JWT secret validation and back users with a database - security: validate JWT_SECRET on use (min 32 chars, reject known placeholders) so a misconfigured deployment fails loudly instead of signing tokens with a guessable key. Dev fallback still generates a full-strength key into data/jwt_secret.txt. - user_store: add a SQLAlchemy-backed users table (SQLite by default, DATABASE_URL to point at Postgres) replacing the JSON-file user records. Legacy JSON users are imported on first init, so no accounts are lost. - users/skills routers: read and write through the user store; API surface and per-user skill gating unchanged. Register validates username length and an 8-char minimum password, and accepts allowed_skills. - tests: cover secret validation and the user store (43 passing). * feat(deliverables): official documentation registry + docs bar & image gallery Adds deliverables/official-docs/: a verified registry of official documentation links (FastAPI, Python, FIG, Dola, ZyntroAI) shared by the React front end and the FastAPI back end, plus the components that render it. Six URLs in the supplied link set do not resolve; each was checked live and is recorded in CORRECTED_LINKS with its reason and replacement: - fastapi.tiangolo.com/advanced/architecture/ -> 404, replaced - docs.hellofig.ai -> host does not resolve - share.hellofig.app/help -> 404, replaced - hellofig.app/changelog -> 404, removed - hellofig.ai -> replaced with hellofig.app - .github/CHECKLIST_BILLING.md (Origin) -> 404, removed JS registry is the source of truth; official-docs.json is generated and a parity test fails if the Python twin drifts. Every href is scheme-checked before it reaches the DOM. Tests: 13 JS (node --test), 23 Python (pytest), 11 live links verified, 11 render assertions. * docs(changelog): record PR #267 (JWT secret hardening + DB user store) (#268) Co-authored-by: Fig Agent <nattapong@zyntro.ai> * Update README.md Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> * feat(deliverables): fig-best-practices gate — policy, engine, fixtures, tests Adds deliverables/fig-best-practices/: the FIG best-practices standard as an executable gate rather than a document. Six layers, eight criteria, one policy file that the prose standard (BEST-PRACTICES.md) and the CI gate both derive from, so they cannot drift. - policy/fig-best-practices.yaml single source of truth - figbp/ policy, tokens (WCAG contrast math), secrets (redacting), integrations, gate - quality_gate.py CLI: --root/--json/--list/--fail-on-advisory - design/design-tokens.json tokens with declared contrast pairs - integrations/ contract schema + worked example - agents/ one scoped instruction file per role - examples/clean-project passes 8/8 - examples/broken-project fails 7/8 deliberately (TESTING passes) - tests/ 69 tests Exit codes: 0 pass, 1 blocking failure, 2 malformed policy. Fixes found while building: - the credential pattern anchored on \b never matched *_TOKEN = "..." because underscore is a word character, so a whole class of assignments went undetected - the agent scope regex did not accept markdown-bold "**Scope:**", which failed the clean fixture - the CLI bound sys.stdout as a default argument, so captured output vanished - the integrations module was imported but never called from the gate; contract validation now runs under SECURITY, where an inlined secret belongs - the source guide s hard-coded model="gpt-4o" example was replaced with a config-supplied model id, and two dead doc URLs were corrected Also records, under policy corrections:, two commands the user states are real which this deliverable cannot verify from its own evidence. * docs: rewrite README to match the repository as it stands (#269) Replaces the pasted CI/CD-and-branch-strategy draft with a README that is verifiable against main. Every count, path, workflow name and protection detail was checked against the live tree. - CI/CD section now states what is true: 13 of 73 uses: refs are SHA-pinned (60 still tagged) and 5 of the 11 workflow files do not parse, so they never run. Names the six that do. - Branch model corrected: main is the default and the PR target; Origin is a separate branch that is NOT in sync with main and triggers nothing. The earlier draft called Origin the primary integration branch. - Added the deployment-environment table from the live Environments API (main has a 15-minute wait timer; Production/Preview/copilot have none). - Deliverables 21 -> 24, docs 30 -> 31, workflows 13 -> 11 to match the tree. - Branch-naming note corrected: this repo has no docs/ or fix/ ref; the refs to avoid are the single-segment Origin, M, github, main, main-1. - Added a Target state section marking governance items (masterfiles-guard, CodeQL, container scan, signed commits, SLSA, FIG RBAC) as not implemented, so no reader mistakes a document for a control. - LICENSE still carries the [zyntromedia] placeholder — noted, not silently changed. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * docs(changelog): record PR #269 (README rewrite) (#271) Co-authored-by: Fig Agent <nattapong@zyntro.ai> * release: v1.3.0 (#270) Co-authored-by: fig-ai-agent <bot@zyntroai.local> * docs: correct the deliverables count and list in README (#272) A concurrent merge added deliverables/fig-best-practices, and the list was also missing ci and full-cicd-pipeline. Tree now holds 25 suites, not 24. Both the summary table and the Deliverables section updated. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * docs: correct the docs file count in README (#273) A concurrent merge added docs/releases/v1.3.0.md, so the reference library holds 32 files, not 31. Updated the summary table and named release notes among the covered topics. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * chore: fill in the LICENSE copyright holder (#274) LICENSE line 3 read 'Copyright (c) 2026 [zyntromedia]' — the placeholder brackets were never removed. Now reads 'Copyright (c) 2026 Zyntro Media', matching the ZyntroAI organisation display name. README no longer reports the placeholder as outstanding (the check now asserts the holder is filled instead of asserting the placeholder is present), and the order-of-attack list is updated to the one remaining licence task: a license field in package.json. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * docs(changelog): record PR #274 (LICENSE copyright holder) (#275) Co-authored-by: Fig Agent <nattapong@zyntro.ai> * chore: declare the MIT license in package.json (#276) The root package.json had no license field at all, so npm tooling and GitHub's license detection had nothing to read even though LICENSE has been MIT since the start. Added "license": "MIT" after version, matching the LICENSE file (now updated in #274 to name Zyntro Media). Also drops the completed item from the README order-of-attack list and renumbers it — the remaining four are unchanged. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * docs(changelog): record PR #276 (MIT license in package.json) (#277) Co-authored-by: Fig Agent <nattapong@zyntro.ai> * docs(problems): fix stale count, duplicate P-009 id, duplicate date section (#278) Three defects in PROBLEMS.md, all verified against the current tree. P-002 said 66 unpinned action refs; the re-verified table said 23. Measured today: 60 unpinned of 73 total, across 30 distinct uses: values. Neither earlier number reproduces, so the entry now records the per-file breakdown, the date of measurement, and states that the prior figures are stale rather than silently replacing one guess with another. P-009 was used by two unrelated problems — the root tests/ suite that never collects, and release_drafter.yaml sitting in workflows/. The second is now P-011 with a breadcrumb; the tests/ entry keeps P-009. docs/releases/v1.2.0.md cited the ambiguous id, so it no longer points at two things. Two [2026-09-11] sections existed, one above [2026-09-10] and one below it, breaking reverse-chronological order. Consolidated into a single section at the top; no entry was moved between dates. Verified: 12 entry headings before and after, code-fence count unchanged at 11, all eleven ids P-001..P-011 present, status key and How-to section intact. Co-authored-by: Fig Agent <nattapong@zyntro.ai> * Update README.md --------- Signed-off-by: Zyntro-Agents <zyntro.ai.studio@gmail.com> Co-authored-by: fig-ai-agent <fig-ai-agent@users.noreply.github.com> Co-authored-by: fig-ai-agent[bot] <310751119+fig-ai-agent[bot]@users.noreply.github.com> Co-authored-by: fig-ai-agent[bot] <fig-ai-agent[bot]@users.noreply.github.com> Co-authored-by: Fig Agent <nattapong@zyntro.ai> Co-authored-by: fig-ai-agent <bot@zyntroai.local>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version
What's included
Changelog
Migration / breaking changes
Verification
Version
v1.3.0
What's included
Minor release cut from
main. Sincev1.2.0(a461cf3, 2026-09-12) — 94 commits,of which 37 landed as merged PRs.
Added — deliverables
deliverables/official-docs/: an official documentation registry.One JSON registry (
src/official-docs.json) read from both sides of the stack(
src/official_docs.py,src/official-docs.js,src/utils.ts), every linkchecked against the live URL by
scripts/verify_links.pyrather than assumed,and a React docs bar + image gallery (
src/Company.jsx) rendered from the sameregistry so the UI cannot drift from the data.
deliverables/fig-best-practices/: a quality gate for projectsbuilt on the Fig platform.
BEST-PRACTICES.mdis the policy, six agent briefs(developer / reviewer / security / designer / performance / deployment) state
who enforces what,
ci/quality-gate.ymlis the Actions entry point, and twofixture projects — a known-bad and a known-good tree — exercise the gate.
69 tests.
deliverables/ci/: the full CI/CD pipeline (orchestrator plusreusable workflows).
pr-triage-automove, the automated form oforganize-misplaced-files. A root file is moved only when it is not canonical,no tracked
.pyimports it (AST-parsed), and its name appears in no othertracked file. Wrapped in an import probe so a poisoned import cannot kill the
run; dry-run by default,
--applyrequired. 37 tests.deliverables/agent-core/: Dockerfile and Helm chart.ci-workflow-authoringpluslint.pyto check workflowsbefore they run. 16 tests.
handling cases.
Changed
A signing key shorter than 32 characters, or one of a set of known placeholder
values, is now rejected so a misconfigured deployment fails loudly instead of
signing tokens with a guessable key. Added
app/user_store.py, aSQLAlchemy-backed user table that imports legacy JSON users on first init and
keeps the existing shape, so the API surface and per-user skill gating are
unchanged.
DATABASE_URLselects Postgres, otherwise SQLite. 43 tests.cron automation, and the corresponding knowledge notes.
README.mdto describe the repository as it stands ratherthan as it was intended: the real entrypoints, which one
app/Dockerfileandvercel.jsonserve, required vs optional configuration, the real test command,and a
Known statesection recording what is genuinely broken.templates/(which Actions does not read) into.github/workflows/.Fixed
YAML.
knowledge/scripts/diff_policy.pyatknowledge/insteadof the missing
vault/.auto-compress-manage.yml, which had failed atSet up jobon all 781 runs: five action refs pointed at SHAs that do not existupstream. Four skip conditions added alongside the fix.
Auto-Index-Sync.yml.import sysin knowledge/scripts/diff_policy.py #262 — dropped the unusedimport sysfromknowledge/scripts/diff_policy.py.ci.ymlupdated.Direct to
main— besides the PRs above, 57 commits landed straight onmain:new skill docs (
SKILL.mdfiles), knowledge notes, guideline documents, acron-automation/directory, and severalAdd files via upload. These were notreviewed through PRs and are listed here rather than itemised.
Dependencies
requirements.txtupdated.requirements-dev.txtfor test/lint tooling.deliverables/product-crud/web.Changelog
Full sections:
CHANGELOG.md→[2026-09-14],[2026-09-13],[2026-09-12]. Two merged PRs had no changelog record at the time of thisrelease — #265 and #266 — and are added in this release PR alongside the
notes.
Migration / breaking changes
None. No migration required. The JWT change (#267) is stricter than before by
design: a deployment signing tokens with a short or placeholder key will now fail
at startup instead of silently continuing. Set a key of at least 32 characters —
or unset it and let the local fallback generate one.
Verification
main— see note belowfig-best-practices), 43 (app/, clean venv),37 (
pr-triage-automove), 16 (ci-workflow-authoring)CI note: every workflow on
mainstill fails at Set up job, for thepre-existing org policy reason — all actions must be pinned to a full-length
commit SHA. Repairs have been attempted repeatedly (#243, #250), and each
attempt was subsequently overwritten or left unreconciled, so the repo remains in
a state where the policy text (
README.md,SECURITY.md) does not match theworkflows that are actually on
main. This is tracked inPROBLEMS.md; it isnot introduced by this release and does not affect the artifacts above, which run
their own tests. It does mean no PR on this repository can show green checks.