Skip to content

graft batch 1: 14 lands from backlog-1 - #292

Merged
thedancingdeveloper merged 19 commits into
mainfrom
graft/batch-1
Oct 27, 2026
Merged

graft batch 1: 14 lands from backlog-1#292
thedancingdeveloper merged 19 commits into
mainfrom
graft/batch-1

Conversation

@thedancingdeveloper

@thedancingdeveloper thedancingdeveloper commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Batch 1 of graft line backlog-1, one commit per land, oldest first, by graft-mirror (decision D26). Merge it with rebase-merge to keep the commits (D28). graft never merges or queues this PR.

  • Base: main at b5dc542 (graft c2acf498d32103e41e1508d71cd8c4d6e1b832fad8192be9ad4acb6a8fd8610c8)
  • Lands: 19 (c2acf498d32103e41e1508d71cd8c4d6e1b832fad8192be9ad4acb6a8fd8610c8..ca218d415da16d2271f72cedad066ccc4b7c19358df711583d0035b1206e98c1c)
Changeset Author Session Work item Attestations Subject
ca218d415da16 (appended) thedancingdeveloper ses_01M5WN2901RZCXJDKMZN0YGQJM WI-2589 none test: format step-up throttle test
c9fdba135613d (appended) thedancingdeveloper ses_01M5WN2901RZCXJDKMZN0YGQJM WI-2589 none test: prove step-up throttle on a paused clock
cf81a9954e21f (appended) thedancingdeveloper ses_01M5VWDZMP04Q41075E2RQ7WW9 WI-2280 none feat: add managed configuration mode
c0b455efb6d5c (appended) thedancingdeveloper ses_01M5VTZ03NEG44FKXPGJ6F1S36 WI-2572 none fix: step-up follows the registry and throttles confirmations
ca18d2a8b7a2b (appended) thedancingdeveloper - WI-2504 none feat: SABnzbd mode=set_config for *arr category and misc settings
cab699f5a29c4 thedancingdeveloper ses_01M5VR4J90479B3QQSP86NQ51R WI-2503 none feat: non-Docker first-run setup
c6d859f59ac2b thedancingdeveloper ses_01M5VQBD7MC4QASHR0DY4GAH8W WI-168 none fix: pin mock-nntp-server's nzb-nntp dependency for standalone publish (WI-168)
ca2d179d9de98 thedancingdeveloper ses_01M5VQBD7MC4QASHR0DY4GAH8W WI-168 none fix: give mock-nntp-server its own edition and rust-version (WI-168)
cdef56d697f56 thedancingdeveloper ses_01M5VQBD7MC4QASHR0DY4GAH8W WI-168 none fix: drop dev-only path deps when exporting a standalone crate (WI-168)
cb564fb55f463 thedancingdeveloper ses_01M5VQBD7MC4QASHR0DY4GAH8W WI-168 none fix: version the mock-nntp-server dev-dependency so crate export resolves (WI-168)
cc6b07a926bdb thedancingdeveloper ses_01M5VP6FM04XT8VDTEHGGHW7N5 WI-2502 none feat: patch config settings with If-Match and lock checks
c8ae119530b97 thedancingdeveloper ses_01M5VQBD7MC4QASHR0DY4GAH8W WI-168 none chore: publish mock-nntp-server first in the standalone sync (WI-168)
c281227bf6acd thedancingdeveloper ses_01M5VMZBYHR1KPM6G23AJVMV8Q WI-2501 none feat: expose effective config with source and lock state
ceae206431116 thedancingdeveloper ses_01M5VKWJCY8JJ2FXV5VYZ6P29W WI-2500 none feat: publish a GUI settings registry at GET /api/config/schema
c563118c16ab1 thedancingdeveloper ses_01M5VJ7H14WVBNCZF68N038TFJ WI-2499 none feat: refuse an exposed listen address without login or confirmation
cdd75e455f4ee graft ses_01M5VA63D4BVWW9D9R319H5S8A WI-2497 none feat: require step-up re-auth for sensitive settings
c96d7203d0211 thedancingdeveloper ses_01M5V8M1PQ8R544WGR40MJZZ17 WI-2498 none feat: confine configurable paths to allowed roots
c395aa4234dab graft ses_01M5V89FP0N58R41HR07YQK1GZ WI-2277 none chore: configure internal release registries
c08612ccf53a0 graft ses_01M5V7K7ST8517DB2G8DRQ66HD WI-2287 none test: make transport timeout slice map deterministic

Graft-Batch: 1
Graft-Line: backlog-1
Graft-Changeset: ca218d415da16d2271f72cedad066ccc4b7c19358df711583d0035b1206e98c1c

@thedancingdeveloper graft
test: make transport timeout slice map deterministic
f5a737a 
Graft-Changeset: c08612ccf53a08cee996fb8ea8a6b1a013a9f9aa574afef2a5b399284272eb9df
Graft-Session: ses_01M5V7K7ST8517DB2G8DRQ66HD
Graft-Work-Item: WI-2287
Graft-Batch: 1
@thedancingdeveloper graft
chore: configure internal release registries
ef718f7 
Graft-Changeset: c395aa4234dab3d254fd79e6eaf49d5d63cbbe187110b3b4db8fc09ab7b29cd43
Graft-Session: ses_01M5V89FP0N58R41HR07YQK1GZ
Graft-Work-Item: WI-2277
Graft-Batch: 1
@thedancingdeveloper graft
feat: confine configurable paths to allowed roots
25c7dbd 
Graft-Changeset: c96d7203d0211ee005bb270e91b5475d934bd7db9e1a007c8f71f2c55c18d5ef4
Graft-Session: ses_01M5V8M1PQ8R544WGR40MJZZ17
Graft-Work-Item: WI-2498
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: require step-up re-auth for sensitive settings
d7bab92 
Graft-Changeset: cdd75e455f4eedac91603c370cd1cdc2cd072d1cf06f4c2a36608536fd3c5577d
Graft-Session: ses_01M5VA63D4BVWW9D9R319H5S8A
Graft-Work-Item: WI-2497
Graft-Batch: 1
@thedancingdeveloper graft
feat: refuse an exposed listen address without login or confirmation
e042b33 
A non-loopback bind from the GUI is rejected while web login is off and otherwise needs an explicit confirmation. The saved change still waits for restart.

Graft-Changeset: c563118c16ab1ba5aedc658c779e61708d3dc694593a3403b0e346172671ef5c3
Graft-Session: ses_01M5VJ7H14WVBNCZF68N038TFJ
Graft-Work-Item: WI-2499
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: publish a GUI settings registry at GET /api/config/schema
219630d 
The registry names every AppConfig leaf the form can render, including type,
default, constraints, env and CLI source, restart-required, and auth class.
Keys the granular endpoints already write stay listed and are marked so.

Graft-Changeset: ceae206431116b4c2b73e653bf01a6d8870f53796267804bbeae9a38672871947
Graft-Session: ses_01M5VKWJCY8JJ2FXV5VYZ6P29W
Graft-Work-Item: WI-2500
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: expose effective config with source and lock state
cb54ddb 
GET /api/config/effective lists each registry setting's live value,
where it came from, and whether env or CLI locked it. Secrets stay
masked and the body hash is the ETag.

Graft-Changeset: c281227bf6acdc8b8aecc0697c14d30e4e259d1595169f7e79c30b4c8f06626ab
Graft-Session: ses_01M5VMZBYHR1KPM6G23AJVMV8Q
Graft-Work-Item: WI-2501
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
chore: publish mock-nntp-server first in the standalone sync (WI-168)
270c9b3 
Graft-Changeset: c8ae119530b9792eddfa402a666e1d4489ef5cfda9bddcf871e967cc7756a9653
Graft-Session: ses_01M5VQBD7MC4QASHR0DY4GAH8W
Graft-Work-Item: WI-168
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: patch config settings with If-Match and lock checks
d80fbea 
PATCH /api/config validates a partial registry map, requires If-Match,
rejects locked keys with their source, and persists through the existing
atomic config write.

Graft-Changeset: cc6b07a926bdb231bf5c3e4de8c1cef8499b93c8bcf51ab1278ecd191a050cd92
Graft-Session: ses_01M5VP6FM04XT8VDTEHGGHW7N5
Graft-Work-Item: WI-2502
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
fix: version the mock-nntp-server dev-dependency so crate export reso…
04719ab 
…lves (WI-168)

Graft-Changeset: cb564fb55f46305349b4b9af2fb2f1a3e7a2fa0226ed778316191253a1542d683
Graft-Session: ses_01M5VQBD7MC4QASHR0DY4GAH8W
Graft-Work-Item: WI-168
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
fix: drop dev-only path deps when exporting a standalone crate (WI-168)
043bc3a 
Graft-Changeset: cdef56d697f5616d71733ead7f31afc82bfda032ee2538414279911d156e1f6a1
Graft-Session: ses_01M5VQBD7MC4QASHR0DY4GAH8W
Graft-Work-Item: WI-168
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
fix: give mock-nntp-server its own edition and rust-version (WI-168)
c1bfccd 
Graft-Changeset: ca2d179d9de98bfa9057a5960638383e27d9086e6277f87f6c5b71ac8ef9476b0
Graft-Session: ses_01M5VQBD7MC4QASHR0DY4GAH8W
Graft-Work-Item: WI-168
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
fix: pin mock-nntp-server's nzb-nntp dependency for standalone publis…
be8b789 
…h (WI-168)

Graft-Changeset: c6d859f59ac2bffc1be4e21e84169f63eac6a5357d280e13d72d214572e01a22e
Graft-Session: ses_01M5VQBD7MC4QASHR0DY4GAH8W
Graft-Work-Item: WI-168
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: non-Docker first-run setup
565b0ce 
Graft-Changeset: cab699f5a29c4d810250c51980e22f29ec43200d61b0bec04af5360bcb43ee9c0
Graft-Session: ses_01M5VR4J90479B3QQSP86NQ51R
Graft-Work-Item: WI-2503
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: SABnzbd mode=set_config for *arr category and misc settings
20da44a 
Map section/keyword/value through the documented allowlist onto the
config registry. Refuse locked, sensitive and out-of-roots writes with
SAB-shaped errors, and round-trip Radarr/Sonarr category create/update.

Graft-Changeset: ca18d2a8b7a2bf5736a294d96ddc19d3f69e9a9241bd42707b4d4765e29483adf
Graft-Work-Item: WI-2504
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
fix: step-up follows the registry and throttles confirmations
0d84767 
Graft-Changeset: c0b455efb6d5c7814579816138478ae1a7ec2bfec4960d7e275f22dadf4e097d4
Graft-Session: ses_01M5VTZ03NEG44FKXPGJ6F1S36
Graft-Work-Item: WI-2572
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
feat: add managed configuration mode
e34bd17 
Graft-Changeset: cf81a9954e21fbf52de2b7b8f6387c4b72212b5ab4a4e68a8a99d83e30b627bd0
Graft-Session: ses_01M5VWDZMP04Q41075E2RQ7WW9
Graft-Work-Item: WI-2280
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
test: prove step-up throttle on a paused clock
de6d7f8 
The repeated-wrong-password test asserted wall time under 40ms and failed
on a loaded CI runner. Drive the same tokio sleep with a paused clock so
the delay and the cleared delay are virtual time, not the host clock.

Graft-Changeset: c9fdba135613d120fc29298caefa989e9f0f18428dbd1b3f561accf73fe1e7719
Graft-Session: ses_01M5WN2901RZCXJDKMZN0YGQJM
Graft-Work-Item: WI-2589
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper graft
test: format step-up throttle test
06e612d 
Graft-Changeset: ca218d415da16d2271f72cedad066ccc4b7c19358df711583d0035b1206e98c1c
Graft-Session: ses_01M5WN2901RZCXJDKMZN0YGQJM
Graft-Work-Item: WI-2589
Claimed-Author: thedancingdeveloper <306930456+thedancingdeveloper@users.noreply.github.com>
Graft-Batch: 1
@thedancingdeveloper
thedancingdeveloper added this pull request to the merge queue Oct 27, 2026
Merged via the queue into main with commit d4bc8d9 Oct 27, 2026
9 of 10 checks passed
@thedancingdeveloper
thedancingdeveloper deleted the graft/batch-1 branch October 27, 2026 02:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thedancingdeveloper