POC [01/16]: Full slab CRUD, concurrency, and secrets redaction — API-1, API-2, API-3, API-9 #39

New Issue

2026-09-07T06:19:29Z

grokbot_ty commented

2026-09-07 06:19:29 +00:00

Branch: poc (from gate-b after Gate B accepted)

Sprint: POC · Order 1/16 · Depends on: Gate C acceptance (#33–#38)

Acceptance (IMPL-PLAN): Routers per OPENAPI: slabs CRUD + upload + poll; optimistic concurrency (client_rev/server_rev, 409 paths); PUT stores client-sent derived fields without server recompute; GET settings returns SettingsView without password; DELETE soft-deletes unpublished drafts.

Test-SPEC case IDs: API-1, API-2, API-3, API-9

Same-PR tests: Tests-with-code — API contract tests via httpx TestClient. Revision conflict 409; no server-side recompute asserted; password absent from GET; soft-delete 204 for unpublished drafts, rejected for published.

In scope:

PUT /api/v1/slabs/{id} updates fields with client_rev; server echoes new server_rev; mismatch returns 409 revision_conflict
PUT stores client-sent derived fields (sqft, bdft, widths); server does not recompute as SoT
GET /api/v1/settings returns SettingsView with woo_credentials_configured boolean; woo_app_password never returned
DELETE /api/v1/slabs/{id}: soft-delete returns 204; unpublished drafts only; published slabs undeletable

Out of scope:

Inference endpoints, taxonomy sync, settings UI, Woo publish, capture UI, backup

Done when / evidence: API contract tests green for API-1, API-2, API-3, API-9. Evidence path in commit message.

**Branch:** `poc` (from gate-b after Gate B accepted) **Sprint:** POC · Order 1/16 · Depends on: Gate C acceptance (#33–#38) **Acceptance (IMPL-PLAN):** Routers per OPENAPI: slabs CRUD + upload + poll; optimistic concurrency (client_rev/server_rev, 409 paths); PUT stores client-sent derived fields without server recompute; GET settings returns SettingsView without password; DELETE soft-deletes unpublished drafts. **Test-SPEC case IDs:** API-1, API-2, API-3, API-9 **Same-PR tests:** Tests-with-code — API contract tests via httpx TestClient. Revision conflict 409; no server-side recompute asserted; password absent from GET; soft-delete 204 for unpublished drafts, rejected for published. **In scope:** - PUT /api/v1/slabs/{id} updates fields with client_rev; server echoes new server_rev; mismatch returns 409 revision_conflict - PUT stores client-sent derived fields (sqft, bdft, widths); server does not recompute as SoT - GET /api/v1/settings returns SettingsView with woo_credentials_configured boolean; woo_app_password never returned - DELETE /api/v1/slabs/{id}: soft-delete returns 204; unpublished drafts only; published slabs undeletable **Out of scope:** - Inference endpoints, taxonomy sync, settings UI, Woo publish, capture UI, backup **Done when / evidence:** API contract tests green for API-1, API-2, API-3, API-9. Evidence path in commit message.

grokbot_ty added this to the POC milestone 2026-09-07 06:19:29 +00:00

grokbot_ty added the poc poc-seq-01 labels 2026-09-07 06:19:29 +00:00

grokbot_ty changed title from ~~POC [01/16]: Full slab CRUD, concurrency, and secrets redaction — API-1, API-2, API-3~~ to POC [01/16]: Full slab CRUD, concurrency, and secrets redaction — API-1, API-2, API-3, API-9

2026-09-07 06:27:50 +00:00

grokbot_ty commented

2026-09-24 16:30:36 +00:00

Verified in main @ 0c00d25:

✅ Optimistic concurrency: client_rev compare-and-set, 409 revision_conflict with current_server_rev (slabs.py:252-294)
✅ Client-sent derived fields stored as sent, never recomputed (slabs.py:3,22)
✅ GET settings masking: SETTINGS-75 default, no app_password leaked (settings.py:64-65)
✅ Soft-delete: 204 unpublished, 409 publish_conflict for published (slabs.py:299-307)

All four acceptance criteria met.

Verified in main @ 0c00d25: ✅ Optimistic concurrency: client_rev compare-and-set, 409 revision_conflict with current_server_rev (slabs.py:252-294) ✅ Client-sent derived fields stored as sent, never recomputed (slabs.py:3,22) ✅ GET settings masking: SETTINGS-75 default, no app_password leaked (settings.py:64-65) ✅ Soft-delete: 204 unpublished, 409 publish_conflict for published (slabs.py:299-307) All four acceptance criteria met.

grokbot_ty closed this issue

2026-09-24 16:30:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Ty_Tech/SlabUploader#39