docs: changelog + skills for waves 10-11#1877
Conversation
Document every user-facing PR merged to trunk-dev after #1818 under the existing ## [Unreleased] section (11 Added, 3 Changed, 5 Fixed) and mirror the substantive features into the plugin skills (generate, new, doctor, routes, autumn-web). No version bump. Bullets verified against source.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the changelog and documentation files to reflect recent features and fixes on the trunk-dev branch, including in-process TLS termination, automatic ACME certificate provisioning, one-time submit tokens, route auth-coverage audits, accessible UI primitives, and various scaffolding improvements. The single review comment was found to be incorrect, as it mistakenly identified two distinct changelog entries as duplicates; therefore, I have no feedback to provide on the changes.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 60d8987933
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | `Uuid` | `UUID NOT NULL` | `Uuid` | | ||
| | `Bytea` | `BYTEA NOT NULL` | `Vec<u8>` | | ||
| | `Attachment` | `JSONB NULL` (blob metadata) | `Option<Blob>` (always nullable) — **requires `storage` feature in Cargo.toml**; generator does not add it automatically | | ||
| | `Attachment` | `JSONB NULL` (blob metadata) | `Option<Blob>` (always nullable) — **requires `storage` feature in Cargo.toml**; generator does not add it automatically. **(trunk-dev)** the scaffold's create/update handlers take a `Multipart` extractor and stream to the blob store via `save_to_blob_store` (issue #1236) | |
There was a problem hiding this comment.
For trunk-dev attachment scaffolds, this line now describes the multipart handlers but still says the generator does not add the required storage feature. The scaffold planner currently auto-enables both storage and multipart when attachment fields are present (autumn-cli/src/generate/scaffold.rs calls ensure_autumn_web_feature for both), so agents following this skill will tell users to make unnecessary Cargo.toml edits and may misdiagnose generated attachment scaffolds.
Useful? React with 👍 / 👎.
…olds The scaffold planner auto-enables autumn-web's storage + multipart features (and uuid v4) when an Attachment field is present, so the generated project compiles with no manual Cargo.toml edits. Addresses PR review feedback.
…ness (#1967) * docs: changelog backfill, TLS/ACME guide (#1860), a11y dedupe + skills freshness - CHANGELOG.md: backfill 21 bullets under the existing [Unreleased] section for work merged since docs batch 3 (#1877) — autumn deploy CLI (#1607), #[lifecycle] state machines (#1675/#1911), SQLite foundation (#1614), a11y primitives + scaffold track (#1706), content negotiation (#1881), nested has_many forms (#1915), security manifest v2 (#1879), owner-scoped codegen (#1882), and assorted CSRF/tenant/multipart/blob/schema fixes. No version bump; no new dated section. - docs/guide/tls.md (NEW): TLS & HTTPS guide — direct in-process TLS, automatic ACME HTTP-01, reverse-proxy termination, certbot + mkcert walkthroughs. Closes #1860. - docs/guide/deployment.md: replace the #1860 placeholder with a live cross-link to the new TLS guide (cross-ref only). - skills/autumn-web/references/api-reference.md: merge two duplicate a11y sections into one canonical section and add a transition_controls entry (#1917). - skills/*: freshness edits for lifecycle, autumn deploy, a11y primitives, SQLite backend, and nested forms. * docs(tls): use literal ampersand in link + reword ACME renewal loop * docs(tls): correct autumn deploy TLS termination claim (does not provision certs) * docs: deploy changelog = binary/systemd workflow; note ACME single-process limitation * docs(tls): show tls/acme feature activation; deploy-path HTTPS is proxy-only * docs(tls): document custom ACME directory inline-table syntax * docs(tls): scope autumn deploy HTTPS to an external front-terminator (managed kamal-proxy is HTTP-only) * docs(changelog): clarify autumn deploy subcommands (build --embed precedes up; check ≠ plan) --------- Co-authored-by: Claude <noreply@anthropic.com>
2 participants
Summary
Documents every user-facing change merged to
trunk-devsince docs batch 2 (PR #1818). Markdown-only diff —CHANGELOG.mdplus theskills/plugin docs. No code, no version bump; bullets land under the existing## [Unreleased].Before / After
Before: the 26 PRs merged after #1818 were absent from
CHANGELOG.mdand theskills/plugin docs (only the model-side cascade PR #1836 was already documented).After:
## [Unreleased]gains 11 Added, 3 Changed, and 5 Fixed bullets, and the existing model-cascade bullet is updated to note the both-sites override diagnostic now ships (#1788). Substantive features are mirrored into the plugin skills.Headline entries
[server.tls](Serve HTTPS directly: TLS config for single-binary self-hosting #1603) and automatic ACME / Let's Encrypt provisioning + renewal[server.tls.acme], HTTP-01, off-by-defaultacmefeature (Provision and renew HTTPS certificates automatically via ACME #1608)[security.submit_token](Prevent duplicate form submissions with one-time submit tokens #1360)autumn routes audit+#[public]marker, non-zero exit on unclassified routes (Prove route auth coverage at build time with a security manifest #1604)autumn_web::a11y, compile-time accessible-name obligation) + advisory best-effortautumn a11y verifyscanner (Prove UI accessibility conformance at build time by construction #1706)autumn new --apiJSON-first projects (feat(cli): add --api flavor to autumn new for JSON-first projects #1847);autumn generate policy+ default-deny scaffolds (Addautumn generate policyand authorize scaffolded mutations #1125); FTS--searchablescaffolds (Scaffold a full-text search box wired to FTS in list views #1319); allowlisted sort/filter list viewsListQuery(Add allowlisted sort and filter to scaffolded list views from params #1126); no-JS multipart uploads (Wire scaffolded file uploads to persist on submit, no JS required #1236); typedpaths!helpers (Generate typed path helpers so scaffolds never hardcode URLs #1133); request-path panic gate (Guarantee a panic-free request path with a CI robustness gate #1611)before_deleteordering (Cascade destroy: two edge cases in mixed soft/hard-delete and multi-sibling restrict graphs (follow-up to #1789) #1800), SSG/ISR compression MIME (Compress static-first SSG responses #752),--passkeyswebauthn-rs 0.5.5 compile (Generated passkeys app fails cargo check: webauthn-rs/base64urlsafedata dependency drift #1822), destroy-scaffold file stranding (autumn destroy scaffold fails on shared-layout preflight before revert #1834), Docker git provenance (Scaffolded Docker images ship null git provenance on /actuator/info #1676)Skipped as CI/test-infra only: #1849, #1857, #1871.
Files
CHANGELOG.md— 19 new bullets + 1 edited under## [Unreleased]skills/generate/SKILL.md,skills/new/SKILL.md,skills/doctor/SKILL.md,skills/routes/SKILL.md,skills/autumn-web/SKILL.md,skills/autumn-web/references/api-reference.mdVerification
Every bullet was verified against actual source (exact config keys, defaults, feature gates, failure-vs-warning semantics), not PR descriptions.
scripts/check-plugin-freshness.sh(skills drift gate) — PASSscripts/check-plugin-freshness.sh --static-only(plugin.json + docs/guide link check) — PASSscripts/check-docs.shnot run: it builds rustdoc to catch broken intra-doc links in the Rust crates; this diff is markdown-only and touches no Rust doc-comments, so it is orthogonal.No version bump — cutting a release is a separate, deliberate step.
Generated by Claude Code