You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This issue tracks the merge order and dependency relationships for v0.4.0 work. The focus of this release is the suggestion/PR workflow redesign, provider abstraction, and entity graph visualization. (SPARQL explorer was deferred to v0.5.0 — see #214.)
ontokit-api#98 — Similar entities endpoint returns 500 with missing CORS headers (independent)
ontokit-api#102 — Classifiers in pyproject.toml are stale (missing 3.13) (independent, packaging metadata) — PR: ontokit-api#135
ontokit-api#111 — Use json.dumps for redis.publish payloads in worker.py (independent, payload escaping) — PR: ontokit-api#118
ontokit-web#364 — Delete is permanently disabled for entities with no references (independent) — PR: #365 — surfaced while refactoring Category A of #200; DeleteImpactAnalysis pushed the confirm gate to false from a mount effect and nothing reset it when the entity had zero cross-references
Defensive hardening surfaced by static analysis (Semgrep, CodeQL). None of these are known active exploits — they're precautionary fixes that close attack surface before it can be abused. Tracked separately from Bug Fixes so the latter stays focused on user-visible defects.
ontokit-api#128 — Drop python-jose in favor of PyJWT for JWT validation (independent, dependency hardening — python-jose pulls in ecdsa with two open advisories: Minerva timing attack + improper input validation) — PR: ontokit-api#129
chore: Pin all GitHub Actions to commit SHAs (web — supply-chain hardening; prevents a compromised tag from substituting malicious code into CI runners) — PR: chore(ci): pin all GitHub Actions to commit SHAs #196
chore: Pin all GitHub Actions to commit SHAs (api — supply-chain hardening; mirror of #196, also bumps actions/checkout@v4 → v6 in semgrep.yml for consistency) — PR: ontokit-api#133
ontokit-web#200 — Eliminate setState-in-effect anti-patterns across 16 sites; graduate react-hooks/set-state-in-effect from warn to error (independent) — PRs: #362 (Category D, 4 sites) + a stack #365 → #367 → #369 (Categories A, B, C — all three complete, 9 sites) — 10 of 16 done (1 landed via #104); one more disappears with #154, leaving only editor/page.tsx:311 (needs a latch-vs-derivation decision) before the rule can graduate to error — Category C (server-data-derived state) overlaps with #89
ontokit-api#26 — Per-project lint rule configuration (backend) — PR: ontokit-api#94 (approved 2026-04-25; awaiting merge) + peer-review follow-up ontokit-api#103 (2 blocker + 3 high fixes: BCP-47 lang-tag case in label-per-language, subject_type CHECK constraint, role-gating tests, empty-rules end-to-end test, XOR validator on LintConfigUpdate) — merge order: ontokit-api#103 → ontokit-api#94 → dev so fixes land in ontokit-api#94's branch before it merges, keeping a single migration — must merge before or alongside #56
ontokit-api#30 — Project favorites: database table and API endpoints — must merge before #78
ontokit-web#78 — Project favorites: star icon and sort-to-top — PR: feat: add project favorites with star icon and sort-to-top #147 — frontend ready and reviewed; blocked on ontokit-api#30, which has no PR yet. Merging first would ship a star that 404s on every click. Worth folding ORDER BY is_favorited DESC, created_at DESC into ontokit-api#30 so favorites sort across pages, not just within the loaded set
ontokit-web#201 — Surface dirty-draft indicators in Properties/Individuals trees and on the Entity tab bar (independent) — discovered while testing #98 / PR #104; only Classes currently shows the amber-dot indicator
#198 — Add Properties chapter to the Ontology Guide (rdf:Property + OWL property typology), introduce sticky left-side TOC on the Changelog page, fix JSX whitespace stripping across all guide pages, and pass servers to Scalar so /api-docs code samples render without Invalid URL errors
Suggestion & PR Workflow Redesign
These issues require significant design work before implementation. #65 can be tackled first independently; the rest are interdependent and need design finalization:
ontokit-api#217 — Subsume suggestion sessions into the PR model: draft state + auto-submitted marker + beacon auth — prerequisite for the whole section; SuggestionSession.pr_id is already an FK to pull_requests.id, and a field-by-field audit found only three things the PR model genuinely lacks: active (no draft PRStatus), auto-submitted (no marker), and beacon_token (no home for the unload beacon)
ontokit-web#370 — Retire the suggestion-session subsystem; make the PR workflow the suggestion workflow — depends on ontokit-api#217 — deletes lib/api/suggestions.ts and the /suggestions* routes, redirects them to /pull-requests, rewires the beacon and status bar onto draft PRs
ontokit-web#65 — Unify suggestions and PRs views with mode-aware labels — PR: feat: unify suggestions and PRs views with mode-aware labels #149 — the label + author-scoping half is independent and mergeable now; the editor/page.tsx toolbar unification must land after #370, since it removes the only link to /suggestions while active drafts and changes-requested feedback still live there. Split that one hunk out to merge the rest early
ontokit-web#60 — Require suggester role by default; add project-level opt-in for open suggestions — foundation for access control changes
ontokit-web#62 — Evaluate suggestion branch naming and user association strategy — informs branch creation logic
v0.4.0 Merge Strategy
This issue tracks the merge order and dependency relationships for v0.4.0 work. The focus of this release is the suggestion/PR workflow redesign, provider abstraction, and entity graph visualization. (SPARQL explorer was deferred to v0.5.0 — see #214.)
Bug Fixes
/projects/{id}/ontology/index-statusendpoint — PR: ontokit-api#76EntitySearchResult— PR: ontokit-api#120 — must merge before #176pyproject.tomlare stale (missing 3.13) (independent, packaging metadata) — PR: ontokit-api#135json.dumpsforredis.publishpayloads inworker.py(independent, payload escaping) — PR: ontokit-api#118DeleteImpactAnalysispushed the confirm gate tofalsefrom a mount effect and nothing reset it when the entity had zero cross-referencesRefs #5; Verify: read-only upstream sync fields when webhook-driven #5 is a verification issue with a fully-ticked checklist, so the defect needed a home of its ownSecurity
Defensive hardening surfaced by static analysis (Semgrep, CodeQL). None of these are known active exploits — they're precautionary fixes that close attack surface before it can be abused. Tracked separately from Bug Fixes so the latter stays focused on user-visible defects.
pr-target-guard.ymlworkflow (independent, surfaced by Semgrep) — PR: fix(ci): prevent shell injection in pr-target-guard workflow #193pr-target-guard.ymlworkflow (independent, surfaced by Semgrep; API counterpart to ontokit-web#191) — PR: ontokit-api#116github_service.py(independent, surfaced by Semgrep) — PR: ontokit-api#116.semgrepignore(independent, CI/security tooling) — PR: ci: add Semgrep security scan workflow #194.semgrepignore(independent, CI/security tooling; API counterpart to ontokit-web#192) — PR: ontokit-api#125python-josepulls inecdsawith two open advisories: Minerva timing attack + improper input validation) — PR: ontokit-api#129actions/checkout@v4 → v6insemgrep.ymlfor consistency) — PR: ontokit-api#133Features
setState-in-effect anti-patterns across 16 sites; graduatereact-hooks/set-state-in-effectfromwarntoerror(independent) — PRs: #362 (Category D, 4 sites) + a stack #365 → #367 → #369 (Categories A, B, C — all three complete, 9 sites) — 10 of 16 done (1 landed via #104); one more disappears with #154, leaving onlyeditor/page.tsx:311(needs a latch-vs-derivation decision) before the rule can graduate toerror— Category C (server-data-derived state) overlaps with #89label-per-language,subject_typeCHECK constraint, role-gating tests, empty-rules end-to-end test, XOR validator onLintConfigUpdate) — merge order: ontokit-api#103 → ontokit-api#94 →devso fixes land in ontokit-api#94's branch before it merges, keeping a single migration — must merge before or alongside #56ORDER BY is_favorited DESC, created_at DESCinto ontokit-api#30 so favorites sort across pages, not just within the loaded setuseIriLabelsto eliminate fallback 404 noise (independent) — follow-up to #98 / PR #104; commits26bd907+bc35651on PR feat: preserve entity selection across viewer/editor modes #104 already reduced the noise, this closes it outskos:hiddenLabelto backend annotation extraction — PR: ontokit-api#94 (delivered alongside ontokit-api#26)redundant-regional-label— PR: ontokit-api#94missing-type-declaration— PR: ontokit-api#94rdf:Propertyentities in search results (legacy/RDFS support) — follow-up to ontokit-api#117Architecture & Sync
/lint/wssocket, collab icon driven by the hook in both editor and viewer)Documentation
rdf:Property+ OWL property typology), introduce sticky left-side TOC on the Changelog page, fix JSX whitespace stripping across all guide pages, and passserversto Scalar so/api-docscode samples render withoutInvalid URLerrorsSuggestion & PR Workflow Redesign
These issues require significant design work before implementation. #65 can be tackled first independently; the rest are interdependent and need design finalization:
SuggestionSession.pr_idis already an FK topull_requests.id, and a field-by-field audit found only three things the PR model genuinely lacks:active(no draftPRStatus),auto-submitted(no marker), andbeacon_token(no home for the unload beacon)lib/api/suggestions.tsand the/suggestions*routes, redirects them to/pull-requests, rewires the beacon and status bar onto draft PRseditor/page.tsxtoolbar unification must land after #370, since it removes the only link to/suggestionswhileactivedrafts andchanges-requestedfeedback still live there. Split that one hunk out to merge the rest earlyDependency Graph
graph LR subgraph "<b>Lint Configuration & Auto-Fix</b>" direction TB A26["API #26 per-project config"] --> W56["Web #56 lint config UI"] A26 --> A81["API #81 lint auto-fix"] end subgraph "<b>Favorites</b>" direction TB A30["API #30 favorites API<br/>(no PR yet — blocks #78)"] --> W78["Web #78 favorites UI<br/>(PR #147 ready)"] end subgraph "<b>Index & WebSocket</b>" direction TB A48["API #48 index-status"] --> W137["#137 index WS updates"] W137 --> W141["#141 HealthCheck WS regression"] W140["#140 decouple collab/lint WS"] ~~~ A78["API #78 per-project pubsub"] A79["API #79 async quality jobs"] --> W150["#150 async quality API"] end subgraph "<b>Sync</b>" direction TB A20["API #20 provider abstraction"] --> A21["API #21 loop prevention"] A21 --> W5["Web #5 read-only fields"] end subgraph "<b>Suggestion / PR Workflow</b>" direction TB A217["API #217 draft PR + auto-submitted"] --> W370["#370 retire session subsystem"] W370 --> W65["#65 unified UI"] W60["#60 access control"] --> W62["#62 branch strategy"] W62 --> W63["#63 auto-commit"] W62 --> W66["#66 auto-rebase"] W63 --> W370 W66 --> W65 end subgraph "<b>Independent</b>" direction TB W81["#81 entity graph"] ~~~ W89["#89 React Query migration"] W89 ~~~ W200["#200 set-state-in-effect cleanup"] W200 ~~~ W51["#51 multi-branch index"] W51 ~~~ W3["#3 custom login UI"] W3 ~~~ W97["#97 BCP 47 language picker"] W97 ~~~ W98["#98 viewer/editor selection"] W98 ~~~ W201["#201 dirty-draft indicators"] W201 ~~~ W202["#202 type-aware useIriLabels"] W202 ~~~ W99["#99 remote-sync errors"] W99 ~~~ W100["#100 aria-hidden a11y"] W100 ~~~ W101["#101 webhook error UX"] W101 end