2 Commits

Author	SHA1	Message	Date
Bernd Worsch	ce42607fca	fix(WP-0014/A2): close remaining pure-param and structural compilation errors ... Convert all remaining `<- paramOrNothing / param / paramOrDefault / currentUserOrNothing` monadic binds to `let` — these functions are pure (ImplicitParams-based) in IHP v1.5, so `<-` is a type error in an IO do-block. Controllers fixed: AgentDelegations, AiGovernancePolicies, Annotations, ApiConsumers, CollectiveProposals, DecisionRecords, DeploymentRecords, HubCapabilityManifests, HubRoutingRules, InstitutionalKnowledge, OutcomeCorrelations, RequirementCandidates, TypeRegistries, WebhookSubscriptions, Widgets, Api/V2/{Annotations,InteractionEvents,Token} WebhookSubscriptions: remove orphaned `Right () ->` case arm that was left inside a bare `unless` block (structural parse error). Also carries forward all in-progress fixes from the working tree: helpers (AgentBridge, ApiRateLimit, BottleneckDetector, CrossHubPropagation, FrictionScore), views (CanSelect instances, HSX lambda extraction, formFor wrappers), env/build (envrc GHCi perms, flake.nix Tailwind + GHC resource limits, static/app.css additional Tailwind output). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-10 01:14:08 +00:00
Bernd Worsch	3cac021213	feat(WP-0010): IHF Phase 9 — External API Surface and Consumer SDKs ... Delivers the full Phase 9 external API layer: - Versioned REST API (/api/v2/) with OpenAPI 3.1 spec; enum arrays for widget_type, event_type, annotation category drawn live from registry tables - OAuth 2.0 client credentials flow (/api/v2/token); hub:*:write scopes gated on active HubCapabilityManifest FK - API key management: SHA256-hashed tokens, key_prefix for display, one-time reveal on creation, revocation support - TypeScript and Python consumer SDKs generated from registry tables (/api/v2/sdk/ihf-client.ts, /api/v2/sdk/ihf-client.py) - Webhook delivery: HMAC-SHA256 signing, append-only webhook_deliveries, fire-and-forget dispatch via forkIO, 3-retry logic - Admin API dashboard with 24h stats (request count, error rate, last seen) - Rate limiting (per-minute) and daily quota enforcement via api_request_log - Schema migration: api_consumers, api_keys, webhook_subscriptions (CHECK constraint on 6 framework lifecycle topics), webhook_deliveries (append-only trigger), api_request_log - ARCHITECTURE-LAYERS.md scorecard: 3.34 → 3.41 (approaching Strong) - contracts/functional/interaction-reporting-v1.md extended with Phase 9 endpoint catalogue and 422 validation error format GAAF: no bare TEXT discriminators; webhook event_type uses CHECK constraint over 6 allowed framework lifecycle topic strings (not widget event types). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-01 19:52:20 +00:00