Levandor

FaceKom Activity Log

56 min read

2026-07-24

  • FKITDEV-9022 npm.facekom.net — publish workflows must run on SELF-HOSTED runners. Discovery: npm.facekom.net (public IP 92.119.122.189, resolves publicly) is IP-allowlisted at nginx → the whole site returns 403 from outside the FaceKom network; the 2026-07-22 recon 200s only worked via the user’s VPN egress. So GitHub-hosted ubuntu-latest runners can never reach the registry → publish workflows must run on the FKITDEV-8981 self-hosted pool. Change applied (2026-07-24, uncommitted/unpushed): all 7 publish.yaml switched runs-on: ubuntu-latest → [self-hosted, node] (lowercase — the live 8981 label; pool active since ~2026-06-24, proven by 5 merged vuer PR-check migrations); setup-node@v6 kept (fleet pattern = per-run Node provisioning); 6 workflows byte-identical to acl’s, timestamp_service differs only by its 2 working-directory lines. Open infra asks (one msg to Bence/infra): (1) install the NPM-SH GitHub App on the org (fixes real_groups for all logins); (2) bot-account token for FACEKOM_NPM_TOKEN org secret (90-day rotation); (3) confirm the runner group covers the 5 lib repos 8981 never touched — acl, video-processor, xlsx, archiver-zip-encrypted, timestamp_service (an unavailable label queues jobs forever, silently); (4) confirm the runners’ network can reach npm.facekom.net (never documented; gh API introspection needs admin:org → 403 for us). Caveat: xlsx builds via make → runner toolchain beyond git+Node undocumented, first-run failure possible. Cross-ref: FKITDEV-8981 mq #101 / janus-api #50 PRs still OPEN but touch pull-request.yaml (different file, no conflict with publish.yaml) — FKITDEV-9022

2026-07-22

  • FKITDEV-8387 STRATEGY REVERSED: .js shims → DIRECT RENAME. After reviewer feedback on vuer_oss PR #8059, the shim plan (B) was dropped for plan A: entrypoints are now real .ts files invoked as command=node server.ts, no shims. Landed across vuer_oss (7 entrypoints), vuer_css + portal_css (1 each), vuer_build (75 supervisor confs) and vuer-release (12); all three code PRs CI-green 8/8. Five durable findings: (1) Node type-stripping floor is 22.18, NOT 22.6 — 22.6 needed --experimental-strip-types; empirically node:22.6 on a .ts file → SyntaxError: Missing initializer in const declaration, node:22.18 runs it; repos pin engines >=22.18.0, images/CI use 24.x, but vuer-release pins a floating NODE_VERSION: 22. (2) soap_server.js suffix trap — vuer_oss/server/logger.js picks the log4js channel via process.argv[1].endsWith('server.js') and 'soap_server.js'.endsWith('server.js') === true, so bb/kh’s SOAP entrypoint was silently inheriting the vuer channel; the rename dropped it to unknown with no error → fixed to endsWith('server.ts') || endsWith('soap_server.js'); general lesson = suffix-matching entrypoint dispatch is fragile under rename. (3) RELEASE BLOCKER — unversioned partner supervisor overlays: vuer_build/partner/*/vuer_oss/Dockerfile does FROM harbor…/vuer_oss:${VUER_VERSION} (version-pinned app) then COPY supervisor_vuer_oss_docker.conf (unversioned, from main) ⇒ conf and app version decoupled → flipping the confs breaks rebuilds of older release tags, and ~94 origin/customization/* branches still carry .js so each partner breaks on its next build until it merges devel; not fixable by merge ordering. Mitigations: hold the build/release merges until the first release tag with the rename is cut, delete redundant overlay confs so partners inherit the base image symlink to the app’s own conf, or make overlays release-aware; merge hazards customization/kh (edits both confs) + customization/nusz (edits server.js/cron.js → rename+modify). (4) depcheck CI-only false positive on vuer_css @emotion/is-prop-valid — the literal require() lives in the 865 KB minified web/sdk/web-sdk.js:205, which CI’s depcheck can’t parse (OOM/timeout) and then treats as having no requires; suppressed via .depcheckrc.json, and removing the dep would be wrong (flips to “missing”). (5) queue optional flag is NOT dead code — multi-connection MQ is live (server.ts:465, background.ts:197, bin/attachment.js:52 read esign.queueConnection + connectionPool.hasConnection()), so the FKITDEV-3191 ECONNREFUSED swallow covers a real partner setup (external eSign RabbitMQ down at boot); a “dead code” deletion was reverted. Plus the TechTeamer commit ruleset (^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(!)?(\([^)]+\))?: [^\n]{1,100}) rejecting default git revert subjects + >100-char subjects. New notes unversioned-partner-supervisor-overlays, techteamer-commit-message-ruleset, depcheck-false-positive-minified-bundle, vuer-oss-optional-queue-connection; updated FKITDEV-8387, typescript-in-vuer-repos, entrypoint-rename-blast-radius — FKITDEV-8387
  • FKITDEV-9022 npm.facekom.net — VPN worked, registry recon done + hard publish blocker found. npm.facekom.net = Verdaccio 6 behind nginx (titled “Facekom npm”, plugin verdaccio-github-oauth-ui), currently EMPTY (no packages; anon reads 401, UI listing []). Login flow = GitHub App “NPM-SH” (client_id Iv23liP34v8mLsDTgEkF, TechTeamer-owned, “Self hosted verdaccio”) → web UI hands a npm config set //npm.facekom.net/:_authToken <JWT> snippet. Token = HS256 JWT (claims real_groups/name/groups), 90-day expiry → the FACEKOM_NPM_TOKEN org secret needs 90-day rotation (prefer a bot/service account). BLOCKER: user wowjeeez authenticates (npm whoami OK) but @techteamer/acl publish → 403 “not allowed to publish” because the token’s real_groups: [] — the NPM-SH GitHub App is authorized for the user but NOT INSTALLED on the TechTeamer org, and user-to-server tokens only surface memberships for orgs where the app is installed. App is private (no public Install button) → a TechTeamer org admin must install via https://github.com/apps/NPM-SH/installations/new, then the user re-logs-in to mint a token carrying the org group. Validation (dry-run green): acl builds the CI way with yarn install — NOT npm install, which trips an ERESOLVE peer conflict (eslint 10 vs eslint-config-standard) that Yarn Classic v1 silently ignores (repo has no yarn.lock); npm publish --dry-run routes to https://npm.facekom.net/, restricted access, tarball 35 files / 9.8 kB. In progress (uncommitted): fanning the acl pattern (canonical publish.yaml + publishConfig with trailing-slash registry URL) to janus-api, mq (canonical workflow chosen over its semantic-release), video-processor, timestamp_service (rename → @techteamer/timestamp-service + drop private:true), plus fresh clones of xlsx + archiver-zip-encrypted; all on chore/FKITDEV-9022-npm-facekom-publish branches, no commits/pushes yet — FKITDEV-9022
  • FKITDEV-9022 (later same day) — fan-out COMPLETE: all 7 repos carry the publish setup locally (uncommitted/unpushed; xlsx + archiver-zip-encrypted freshly cloned; every publish.yaml byte-identical to acl’s, all dry-runs → npm.facekom.net/ restricted). timestamp_service rename SUPERSEDED: it’s a Yarn-workspaces monorepo — root stays private:true (yarn refuses workspaces otherwise) and isn’t the lib; the real package is package/timestamp_service → @techteamer/timestamp@2.0.2 (consumers vuer_oss/esign_oss depend on ^2) → no rename anywhere, publishConfig on the inner package, workflow = canonical +2 working-directory lines (install stays at root). Quirks: archiver’s committed .npmrc (npmjs) loses to publishConfig (tested); xlsx = SheetJS fork, builds via make, tab-indented package.json. Remaining: auth path (user leaning: infra-minted bot token for FACEKOM_NPM_TOKEN instead of NPM-SH org install), org secret, user “go” for commit+push, compare-link PRs, Phase 2 after consumer repoint — FKITDEV-9022
  • FKITDEV-9059 (Cofidis) — MJML v5 ESM upgrade silently broke cofidis email templates (green CI / broken runtime). The devel→cofidis merge pulled in FKITDEV-8727 MJML v4→v5 (c9602a519e), which is ESM-only → server/e-mail/EmailService.js now await import(...)s letter templates. Node 22 auto-detects any customization/email/*/*.letter.data.js that mixes a top-level import with a require() as ESM → ReferenceError: require is not defined at EmailService.init → the letter type never registers and its email never sends. Debugging trap: the naive scope was “41 of 49 files contain require(” — WRONG; a pure-CommonJS file (no import) loads fine, only the 6 mixed files are at risk, and 5 of those had a createRequire(import.meta.url) shim so only e-mail-invite (bare require, the registration invite) actually crashed at boot — matching the box log. Fix = require() → ESM import (relative specifiers need explicit .js; named imports resolve against module.exports = {} via Node’s CJS named-export detection) in all 6; committed solo-author 52a0843a1e on chore/FKITDEV-9059-cofidis-update-2026-07-13-fixes (parent 6fac58ba4b), NOT pushed; verified on fk-dev (letter-registration errors 3/boot → 0). CI missed it because unit tests never boot EmailService. Reusable: after any ESM migration of a shared loader, grep customization/ for mixed import+require. New note mjml-v5-esm-breaks-commonjs-email-templates — FKITDEV-9059
  • FKITDEV-9059 (Cofidis) — FaceKom dev email lands in a baked-in Mailtrap Sandbox inbox (it’s not “not sending”). config/dev.json email.transport.SMTP bakes a Mailtrap Sandbox inbox (host smtp.mailtrap.io [legacy; current sandbox.smtp.mailtrap.io], port 2525, user 643414e4c00185), so on any fresh dev box registration/verification mail is delivered — into the original-dev/shared inbox you can’t see. Route it to your own inbox by overriding email.transport.SMTP.host → sandbox.smtp.mailtrap.io + auth.{user,pass} in the bind-mounted vuer_docker/tailscale/config/vuer_oss-local.json (getconfig local layer; config/docker.json is never loaded under NODE_ENV=dev). Sandbox creds only auth against sandbox.smtp.mailtrap.io, not legacy smtp.mailtrap.io. Product distinction: Sandbox = sandbox.smtp.mailtrap.io + per-inbox user/pass (~14 hex), catches all mail; Email Sending (live) = live.smtp.mailtrap.io + api/32-char token, delivers for real (wrong for testing). Verify with nodemailer.verify() + test sendMail first (require nodemailer by absolute path /workspace/vuer_oss/node_modules/nodemailer — ESM import from /tmp can’t resolve app node_modules). New note mailtrap-sandbox-inbox-dev-email; sibling sms-verification-code-dev-testing — FKITDEV-9059

2026-07-20

  • FKITDEV-9059 (Cofidis devel update) — two reusable findings extracted from the per-ticket dossier. (1) Partner branches inherit devel’s full CI pipeline on their first devel-merge — systemic, will recur: legacy customization/* branches ran a single job (lint-and-build, old pull-request.yaml blob ec0a1244); devel’s current workflow (blob dda79403) runs lint / test / audit / depcheck / sonar / build, so four jobs execute on the partner branch for the very first time, surfacing years of latent breakage in one PR. On cofidis: 5 failure clusters, only 2 merge-introduced, the rest dating 2017–2024. Two structural amplifiers recorded as architectural constraints: partners fork core source files in place (no override layer — e.g. server/service/FlowLiveUpdateService.js, whose fork then violates the core unit test) and there is no customization-aware unit-test layer (jest.config-unit.js matches only test/tests/unit/**, no per-partner test dir) so a partner-specific test fix must diverge a shared core test file, which then conflicts on every subsequent devel merge — a recurring tax. (2) CVE-2025-7783 / GHSA-fjxv-7rqg-78g4 — critical form-data@2.3.3 (unsafe random multipart boundary, patched >=2.5.4) via EOL request@2.88.2 which hard-pins form-data: ~2.3.2; absent from devel (Audit green) because request is live partner code (vuer_oss customization/api/sms/SmsCofidis.js; vuer_css customization/server/web/api/{login,register,partner-register}.endpoint.js); confirmed red on customization/cofidis (#3100/#8040), customization/kh (#3098), customization/raiffeisen (#8055) ⇒ blocks every partner branch adopting the new pipeline. Interim fix in the repos’ existing house style (they already pin csurf/cookie, twig/minimatch, ts-jest/handlebars): "request/form-data": "^2.5.6" in resolutions + yarn install; real fix = drop EOL request (4–5 call sites) as a separate ticket. Debugging trap recorded: the Audit job’s ERROR: Unable to parse yarn audit output: SyntaxError … + Node 24 DEP0169 url.parse() lines are cosmetic — improved-yarn-audit merges child stdout+stderr into one NDJSON stream so the deprecation warning corrupts lines and the tool silently skips them; the same errors appear on green devel runs (proof: vuer_oss PR #8062, job 87891787317, Found 0 vulnerabilities, success). Exit code comes solely from the real advisory count — an initial diagnosis in-session got this wrong before deeper checking corrected it. New notes customization-branch-ci-pipeline-inheritance + cve-2025-7783-form-data-via-request; cross-linked from FKITDEV-9059, ci-github-branch-audit-chronically-red, customization-branches — FKITDEV-9059

2026-07-13

  • Build/test host MIGRATED: ssh Facekom → fk-dev Tailscale VM (verified 2026-07-01). The on-prem box behind the ssh Facekom alias (~/.ssh/config: HostName localhost, User lederera, ProxyJump FKJumpBox → root@lederera-447-fk-hardver) is DECOMMISSIONED — Tailscale reports lederera-447-fk-hardver offline, last seen ~2026-06-27. Per user: “never use the ssh Facekom host again, we need to use the tailscale fk vm” → fk-dev (100.91.108.61, command ssh ops@fk-dev.taild4189d.ts.net, Tailscale SSH, no keypair, no jump box). Unchanged guidance: still build native x86_64 on the remote host, NOT emulated on the Mac (qemu SIGSEGV exit 139 / overlay-FS I/O exit 125 / EPEL metalink 503s) — only the host moved. Agent gotcha (re-confirmed): the user’s shell aliases ssh/scp to a _kaku_wrapped_ssh function that is not loaded in a non-interactive shell → use command ssh / command scp for the raw binary. Other tailnet peers (oss-fk-dev 100.91.55.42, css-fk-dev, portal-fk-dev, esign-oss/css/api-fk-dev, css-sdk-demo-fk-dev) are per-service Tailscale sidecars on fk-dev, not separate build hosts. New canonical note dev-build-host; updated the docs that prescribed the old host: agent-context (dev-env table + warning), infrastructure (Remote Server section; the dnsmasq 100.103.48.49 / *-lederera.facekomdev.net chain died with the box — MagicDNS now), release-automation-design (vuer_build build.sh/sign-partner.sh run on fk-dev), nusz-1.9.11.47 (cut checklist), FKITDEV-8252 (UBI10 native-build host), FKITDEV-8959 (test host), instacash-esign-dev-box-deploy, dev-box-cv-photo-processing-failures, dev-box-esign-container-startup-failures-2026-06-01 (old Facekom/FKJumpBox topology struck through), instacash-external-api-esign-headless-test-2026-06-01, FKITDEV-8787 (pending functional verification must be redone on fk-dev), plus facekom-v2 dev-environment / working-on-facekom / VERIFICATION — dev-build-host
  • FKITDEV-8387 implementation, Task 6 (vuer_css) — second repo in the multi-repo .ts-shim rollout (Tasks 1-5 covered vuer_oss’s seven entrypoints separately). Single server.js entrypoint shimmed to require('./server.ts'); vuer_css/server/logger.js uses a static log channel list (no process.argv[1] sniffing, unlike vuer_oss) so no logger change needed — a notable repo-to-repo difference. 4 files touched (eslint.config.mjs, tsconfig.json, server.ts <void> Promise fix, bin/server/server.task.js watch list). tsc/eslint/yarn lint all exit 0, yarn test:unit 115/115 suites, 1064/1064 tests (0 failures). Commit b6513dc08ee91a2324786ecc44029d16004d9b2f on branch chore/FKITDEV-8387-ts-entrypoints, local only, not pushed — FKITDEV-8387

2026-07-10

  • FKITDEV-8387 scoping → durable TypeScript-mechanics note — captured how TS actually works in vuer_oss/vuer_css/portal_css (established by FKITDEV-8246 “TS Magic”, PR #7645 55035572bb; foundation for FKITDEV-8251): NO build step (tsconfig noEmit+erasableSyntaxOnly, nothing runs tsc, no typecheck job in CI in any repo), Node ≥ 22.18 strips types at runtime, files stay CommonJS (no "type":"module"), a cross-module require of a .ts module needs an explicit .ts extension (extensionless → MODULE_NOT_FOUND; hence require('../util/magic.ts')), root-level *.ts is SILENTLY UNLINTED (ESLint TS block files:['server/**/*.ts','customization/**/*.ts','client/**/*.ts']; tsconfig include same blind spot), Jest via @swc/jest (oss) / ts-jest (css/portal), @typescript-eslint/no-explicit-any is an ERROR (never fix a type error with any), and require('node:module').stripTypeScriptTypes(src) asserts erasable-syntax-clean — typescript-in-vuer-repos
  • FKITDEV-8387 gotcha → nyc (v18) cannot load .ts at all — hijacks the .ts extension handler (append-transform→default-require-extensions/js.js), compiles TS as raw JS → SyntaxError: Unexpected token ':'; --extension=.ts/--include don’t help. So vuer_oss/supervisor_vuer_oss_e2e_test.conf (npx nyc node <entry>.js ×7) has been broken since FKITDEV-8246 “TS Magic” (Jan 2026) because server.js requires six .ts services at boot (server.js:48,83,99,108,109,110); nothing outside the git index references the conf (no CI job, no Docker repo). Fix = nyc→c8 (V8 coverage, no require hook) or retire; its own YouTrack ticket — nyc-cannot-load-typescript
  • FKITDEV-8387 blast-radius fact → renaming any vuer entrypoint is a 4-repo coordinated release: 95 supervisor conf files hard-code command=node <entry>.js (75 vuer_build/partner/* across 35 partners, 11 vuer-release/projects/*/components/*, 2 vuer_docker/workspace/devtools/files/, only 7 in the three code repos); two SILENT traps — vuer_oss/server/logger.js:102–114 sniffs process.argv[1].endsWith('server.js')/etc. for the log4js channel (rename → everything to the unknown channel, no crash) + an 8th entrypoint soap_server.js on bb/kh customization branches only (not devel); motivates FKITDEV-8387’s .ts-module + .js-shim approach (keeps filenames literal) — entrypoint-rename-blast-radius

2026-07-08

  • FKITDEV-9022 npm.facekom.net publishing — documented the approach for publishing 7 standalone @techteamer/* library repos (xlsx, timestamp_service, mq, video-processor, archiver-zip-encrypted, janus-api, acl — all on master, NOT the vuer monorepo) to the private registry https://npm.facekom.net/. Mechanic (only real org precedent = TechTeamer/amqplib-asyncapi-template, which already declares publishConfig:{registry:"https://npm.facekom.net",access:"restricted"}): per repo add that publishConfig to package.json + one .github/workflows/publish.yaml (push-to-master, secrets.FACEKOM_NPM_TOKEN → ~/.npmrc, npm view <name>@<version> --registry … guard = idempotent/skip-if-published). publishConfig.registry only moves the publish target — default registry stays npmjs → dependency installs + downstream consumers unaffected; NO package renames. Decision (user, 2026-07-08): keep @techteamer/*, do NOT rename to @facekom/* → timestamp_service is the one special case: rename to @techteamer/timestamp-service + remove "private": true (both currently block publish). Correction: the earlier “janus-sdk publish.yaml reference impl” was WRONG — TechTeamer/janus-sdk = 404; only the amqplib template references the registry. mq special-cased (has release.config.mjs/semantic-release, which also honors publishConfig.registry, but no release workflow wired yet). Blocked on VPN: registry publish docs, CI token from the registry web UI, creating org secret FACEKOM_NPM_TOKEN, real publish test. Phase 2 (take repos private / stop public npm publish) must be sequenced AFTER consumers (vuer_oss/vuer_css/portal_css, Yarn-Classic v1 + offline mirror) are repointed at the private registry, or their CI/Docker installs break. Status: acl reference done + validated locally (branch chore/FKITDEV-9022-npm-facekom-publish off origin/master; publish.yaml + publishConfig added; JSON/YAML/logic checks pass) — not committed; other 6 pending user go; solo-author, no auto-PR — FKITDEV-9022

2026-07-03

  • FKITDEV-8747 NÚSZ daily-stat “eltérés” — enriched the investigation note with a source-verified fix analysis from vuer_oss PR #7929 (squash 5099b8ad8b, commits 56231e7c3c/78bd1b1ebe/7d16439620, merged 2026-05-28, nusz 1.9.11.48). It is the video-calls report / daily statistics feature and all changed files are CORE (not customization/nusz), surfaced by NÚSZ — not a call-count bug (raw counting logic unchanged; honest note). Three squashed fixes: (1) empty-period Service Level → null not 0 (CallsReportService.js ~L562: SL = calls>0 ? round((calls-lateAnswers)/calls*100) : null) on per-bucket and Sum/aggregate; client reportCalls.js renders null→- (was always + '%', so 0% showed); (2) Sum-column SL aligned to the per-bucket rule — that mismatch was the reported “eltérés”; (3) locale plumbed end-to-end through the RPC queue (rpc_client/rpc_server Reports.js) + the new reporterDownload.process.js BackgroundProcess (a boolean true was passed instead of the locale string) → xlsx exports use the user’s UI language, reviving the FKITDEV-8639 locale fix that was dead on the download path. Test cases at /Users/levander/coding/facekom/FKITDEV-8959-8747-test-cases.md (also covers FKITDEV-8959) — FKITDEV-8747
  • fk-dev VM NÚSZ deploy + FKITDEV-8959 TC-8959-02 verification — documented the operational runbook for the fk-dev GCP dev-mirror VM (tailnet taild4189d.ts.net, 100.91.108.61; NOT the offline on-prem ssh Facekom box). Connect command ssh ops@fk-dev.taild4189d.ts.net (Tailscale SSH, no keypair; the kaku wrapper shadows ssh → use command ssh/command scp). Stack = vuer_docker compose + per-service Tailscale sidecars (oss-/css-/esign-*/portal-fk-dev), source bind-mounted /workspace/<repo>, supervisord per container; operator UI https://oss-fk-dev.taild4189d.ts.net (:10081 inside); postgresql peer-auth blocks psql -U postgres (use app Sequelize); nginx_proxy crash-loops (bypassed by sidecars). Deploy recipe (bind-mount, no rebuild): box has NO GitHub key → ssh-add ~/.ssh/id_ed25519 + command ssh -A to forward yours → on /workspace/vuer_oss: git fetch origin <branch> + git checkout → docker exec vuer_oss sh -c 'cd /workspace/vuer_oss && yarn install && yarn build' → docker exec vuer_oss supervisorctl restart all; verify supervisorctl RUNNING + Web server is listening on 10081 + UI HTTP 302. Branch consolidation: customization/nusz tip d426cc6ae1 carries BOTH 8747 (5099b8ad8b, PR #7929) + 8959 (519d3b933e, PR #8010 merged), vuer_oss-only; deployed 2026-07-03, restore box’s original bd8923d69f (InstaCash) when done. Gotcha: old fix/FKITDEV-8959-nusz-image-deletion auto-deleted on merge but local origin/… ref stale (narrowed refspecs, no prune) → git ls-remote to confirm. TC-8959-02 (key-inaccessible image deletion) PROVEN PASS: cron RemoveAttachmentDataCronJob → CustomRemoveOldDataCronService.removeAttachmentData() → getOldImageAttachments (type LIKE 'image/%' AND isArchived=false AND createdAt<cutoff, batched, excl. file) → removeOldAttachments key-guard (encryption?.key ? encryptBuffer : blank+encryptionId=null+skippedNoKey++; isArchived=true). KEY CHAIN for standalone test: encryption.key = Sequelize getter → cryptos.data.getActualKey → customerKeyStorage.getKey (stub ⇒ null models offline key). Harness = Node script in bin/ (process-settings bootstrap + logger Proxy + crypto/customerKeyStorage stub + sequelize authenticate + raw-SQL seed → call REAL get/removeOldAttachments → SELECT before/after; deliver via command scp+docker cp+docker exec). RESULT BEFORE {isArchived:false,encryptionId:3,file_bytes:9} → tally {processed:1,archived:1,skippedNoKey:1,errored:0} → AFTER {isArchived:true,encryptionId:null,file_bytes:0}. Config attachments.active=true, expiryDays=7(dev.json)/28(docker.json) — 7-vs-28 retention with NÚSZ still OPEN — fk-dev-nusz-deploy-and-8959-verification

2026-06-30

  • Tailscale dev-box HTTPS enabled + 8b impl reviewed + ansible task posted (status stays in-progress; push still gated on Andras’s go). Andras toggled “HTTPS Certificates” ON → per-node tailscale cert issuance now works for the sidecars (clears the prior blocker). Correctness review of the kernel-mode 8b overlay = PASSED, no code changes needed — key insight: new topology (tailscale serve TLS-terminate → http://app:port) is identical in shape to the old nginx_proxy, so the app side behaves unchanged. Verified: compose merges clean; apps stay network_mode:host; apps listen 0.0.0.0 so host.docker.internal:host-gateway reaches them (Docker 29.6.1 supports host-gateway); app nginx serves HTTP on the ports (matches serve→http); each sidecar own bridge netns → own tailscale0 (no conflict); local.json host overrides make CORS/SAML/socket Origin pass. Three tailnet-admin prereqs flagged (owner Andras): (1) sidecar auth key MUST be NON-ephemeral — deploy’s existing tag:cloud key is reusable+EPHEMERAL → risks MagicDNS name flap (oss-fk-dev→oss-fk-dev-1) breaking hardcoded hosts + cert binding; use a reusable, non-ephemeral, pre-authorized tag:cloud key (state volumes already persist identity); (2) ACL grant team devices → tag:cloud:443 (+MagicDNS) or they resolve but can’t connect; (3) runtime check at wiring — confirm tailscale serve preserves the original Host header (old nginx_proxy set Host:$host); it does set X-Forwarded-Proto/For. janus/WebRTC media over tailnet = unsolved follow-up. Babylon task #884 → deploy (facekom_dev): create ansible playbooks for the fk-dev dev workflow — git checkout <branch> on host /workspace/<app> + docker exec <container> yarn && yarn build (pnpm for facekom_library) + supervisorctl restart all, parameterized by branch + component subset, referencing bin/vuer.sh checkout; components vuer_oss/vuer_css/esign_oss/esign_css/portal_css/facekom_library (vuer_cv excluded). Open: tailscale branch push to origin pending Andras’s go — tailscale-gcp-dev-box-migration
  • Tailscale dev-box 8b overlay BUILT + validated (status stays in-progress; unpushed, no commit on vuer_docker branch tailscale). KEY CORRECTION — “no app URL change” assumption was FALSE: apps compute separator = DEV_DOMAIN.endsWith('facekomdev.net') ? '-' : '.', so a tailnet DEV_DOMAIN (fk-dev.taild4189d.ts.net) flips to . → invalid dotted multi-label names like oss.fk-dev.taild4189d.ts.net (NOT MagicDNS-resolvable, NOT the sidecar name oss-fk-dev…). Fix stays ENTIRELY inside vuer_docker (zero app-repo edits): app host derivation is guarded if (!config.X) + getconfig deep-merges config/local.json last (both verified empirically — a test proved local.json overrides one key while preserving siblings); so vuer_docker ships a config/local.json per app, bind-mounted at /workspace/<app>/config/local.json, setting hosts.* explicitly to <prefix>-fk-dev.taild4189d.ts.net. Files added on branch tailscale: tailscale.yml (8 userspace tailscale/tailscale:stable sidecars — network_mode host, TS_USERSPACE=true, --advertise-tags=tag:cloud, per-svc TS_HOSTNAME+TS_SERVE_CONFIG, DRY via YAML anchors, named ts-state-* vols, + 5 app-svc stubs merging the local.json mounts); tailscale/serve/{oss,css,css-sdk-demo,esign-oss,esign-api,esign-css,portal,library}.json (each tailscale serve HTTPS ${TS_CERT_DOMAIN}:443→http://127.0.0.1:<port>, ports 20080/30080/30081/20180/20181/30180/30380/50080); tailscale/config/{vuer_oss,vuer_css,esign_oss,esign_css,portal_css}-local.json (explicit hosts.*, +esign portal.url; vuer_oss hosts.cv=null CV-out-of-scope); tailscale/README.md; .gitignore+=tailscale/tailscale.env. Validated: docker compose -f dev.yml -f vuer-oss.yml -f vuer-css.yml -f esign-oss.yml -f esign-css.yml -f portal-css.yml -f facekom-library.yml -f tailscale.yml config -q → EXIT 0 (5 local.json + 8 serve mounts present in merged config). Networking: each sidecar host-net + userspace tailscaled, tailscale serve proxies to 127.0.0.1:<app-port> (apps unchanged, still network_mode host), per-svc MagicDNS name + own cert; nginx_proxy from dev.yml no longer the access path (harmless if left running). Caveats: needs admin-console “HTTPS Certificates” toggle ON (owner Andras) before cert issuance; vuer_oss hosts.api=api-fk-dev has no sidecar but api- is only used by customization /external/createCustomerToken hostname-gating, not base dev flow (matches today’s unrouted api-). Open/next: push gated on user go → then deploy wires onto fk-dev; HTTPS toggle pending; CV deferred; no new Artifact Registry (uses existing) — tailscale-gcp-dev-box-migration
  • DuckDNS → Tailscale migration plan for a GCP vuer_docker dev-box mirror (reach the box over tailnet taild4189d.ts.net, no DuckDNS / no public IP). PLAN ONLY — parked on local-only branch tailscale (off devel), plan doc vuer_docker/TAILSCALE-MIGRATION.md uncommitted. Why it’s nearly a repo no-op (source-verified vuer_docker @ devel): (1) all dev.yml services are network_mode: "host" → nginx_proxy binds 0.0.0.0:443, apps bind 127.0.0.1, so the host joining the tailnet = reachable at <100.x>:443 with nothing published; (2) nginx_proxy/proxy_servers.conf routes by subdomain PREFIX (oss-/css-/css-sdk-demo-/esign-css-/esign-oss-/esign-api-/portal-/cv-/library- → ports 20080/30080/30081/20180/20181/30180/30380/40080/50080) with a regex server_name ~^oss-(.+)\.facekomdev\.net$ that wildcards the domain suffix → routing already domain-agnostic; (3) single self-signed cert /workspace/cert/dev.{crt,key} (external techteamer/cert repo) used by every block + single-label service names → a *.facekomdev.net wildcard cert covers all; (4) apps build URLs from DEV_DOMAIN (host /etc/environment → each *.yml). Only literal duckdns in the repo = README.md:17. Recommended path: Phase 1 zero-repo-edits (tailscale up --hostname=facekom-dev, DEV_DOMAIN=gcp.facekomdev.net, client /etc/hosts→100.x, reuse self-signed CA, delete DuckDNS, GCP firewall DENY all public ingress — DERP works behind NAT); Phase 2 polish (2a public *.facekomdev.net A-record → the box’s 100.x tailnet IP, removes client /etc/hosts, CGNAT-in-public-DNS is valid; 2b real LE wildcard via DNS-01 at the same cert path, removes browser warning) — neither needs nginx/app changes. Fallback (no public DNS) = MagicDNS facekom-dev.taild4189d.ts.net + tailscale cert, but single-name-per-node forces port/path routing = invasive (touches proxy_servers.conf + app URLs). Containerized tailscale sidecar rejected for host-level install. Repo diff = README rewrite + new install/install-tailscale.sh + optional cert-fetch script, no nginx/compose/app edits. Open decisions (blocking, awaiting user): domain label, publish public DNS→private tailnet IP?, self-signed vs real LE cert, CV/GPU in scope?, node auth (pre-auth key + tag:dev + SSH), VM sizing. Will coordinate on babylon facekom_dev once confirmed — tailscale-gcp-dev-box-migration
  • Tailscale dev-box migration DECISIONS LANDED + VM PROVISIONED (status draft→in-progress) via babylon #facekom_dev. Decision 1 — hostnames: use Tailscale MagicDNS (<name>.taild4189d.ts.net), NOT facekomdev.net subdomains → Phase 2a public-DNS approach RETIRED. Decision 2 — routing: deploy agent chose 8b (multi-tailscaled sidecar per service) over port-based 8a — each of the 9 services gets its own userspace tailscaled sidecar (env TS_AUTHKEY+TS_HOSTNAME, ~30 MB idle), own MagicDNS name, own tailscale cert. No app URL rework expected IFF sidecars named to preserve the existing <prefix>-<DEV_DOMAIN> pattern (oss-fk-dev, css-fk-dev, …) with DEV_DOMAIN=fk-dev.taild4189d.ts.net — flagged to verify vs actual app config; pattern proven on pmv2-zurich (babylon+nats sidecars). This reverses this note’s original “host-level install, sidecar rejected” recommendation. VM fk-dev provisioned by deploy (part of a levandor-infra terraform refactor — module "vm" → for_each=var.vms; pmv2-zurich’s 14 prod containers verified untouched): e2-standard-4 (4 vCPU/16 GB), 100 GB pd-balanced, europe-west6-a; separate VPC fk-dev-net/subnet 10.2.0.0/24, SA fk-dev-sa; tailnet IP 100.91.108.61, MagicDNS fk-dev.taild4189d.ts.net, ACL tag:cloud (reuses pmv2 auth key); public IP 34.158.19.122 egress-only, firewall denies ALL inbound except Tailscale DERP, no public SSH; Docker 29.6.1 (+gcloud cred helper for europe-west3-docker.pkg.dev), tailscaled + OTel collector active (host.docker.internal:4317/4318); access ssh ops@fk-dev from any tailnet device. Open (owner Andras/user): CV/GPU scope (VM non-GPU); toggle “HTTPS Certificates” ON in Tailscale admin console (required before tailscale cert works); whether deploy creates a FaceKom Artifact Registry namespace. Next (on user go): build the 8b sidecar compose layer on vuer_docker branch tailscale (sidecar per service named <prefix>-fk-dev, tailscale serve https → localhost:<port>, likely drop nginx_proxy), verify cross-service URLs, push for deploy to wire onto fk-dev — tailscale-gcp-dev-box-migration

2026-06-29

  • InstaCash eSign 1.3.0.11 release composition — documented the release: components esign_oss + esign_css ONLY (source tag instacash-1.3.0.11, 2026-06-08; Harbor instacash-esign-{oss,css}:1.3.0.11-20260608, built via the eSign bizalmi_szolgaltatas_build pipeline). Release issue ASSICASH-92; installs ASSICASH-93 (TESZT) + ASSICASH-96 (PROD, approved 2026-06-26, upgrading from the deployed 1.3.0.8 — .9/.10 not in this PROD line). Changelog = a devel core update + vuln fixes under FKITDEV-8817 (andras.lederer): jQuery XSS CVE-2020-11023 + jQuery prototype-pollution CVE-2019-11358 remediated on esign_css (PR #250) + hardening (HSTS, nginx HTTP hardening, WAF/ModSecurity). No DB migration, no breaking change; rollback = redeploy 1.3.0.8. — instacash-esign-1.3.0.11
  • Dev-box deploy recipe for testing an InstaCash eSign release — on ssh Facekom (= lederera-447-fk-hardver, code bind-mounted from /workspace). The box defaults to Raiffeisen, so testing InstaCash eSign requires aligning the whole chain: esign_oss/esign_css → tag instacash-1.3.0.11, vuer_oss/vuer_css → tag instacash-1.9.11.50 (latest InstaCash vuer; the eSign ticket pins no vuer version), pdfservice stays on main/2.0.12 (partner-agnostic). Recipe per repo: git stash WIP → git fetch --tags (clones predate the tag) → git checkout <tag> → rebuild in-container docker exec <c> sh -c 'cd /workspace/<repo> && yarn install && yarn build' → supervisorctl restart all. Verify: supervisord all RUNNING, logs show RabbitMQ connection established + Web server is listening (esign_oss 10180/81/82, esign_css 10183/84, vuer_css 10082/83), esign_css UI HTTP 200 on :10183. Gotchas: a “dirty” vuer_css after checkout was only an untracked .claude/ dir; old log ERRORs may be historical from the prior (Raiffeisen) run — check timestamps. — instacash-esign-dev-box-deploy
  • /fk-tjk flow dogfooded → first InstaCash eSign tesztjegyzőkönyv ever. Added instacash to partners.json (display “InstaCash”, ytProject ASSICASH; 12 → 13 seeded), rendered ~/Downloads/tesztjegyzokonyv_instacash_1.3.0.11.docx (5 test cases). InstaCash historically had no TJK (the attachment-recipe note’s blanket “InstaCash has none” warning is now superseded — the doc exists locally but is not yet attached to YouTrack; the flow does not auto-write). Updated the generation-flow note (partner count + a “First real use” section) and the attachment-recipe note (reworded the InstaCash warning + added ASSICASH-96 PROD install) — tesztjegyzokonyv-generation-flow, youtrack-tesztjegyzokonyv-attachment-recipe
  • FKITDEV-8533 PR #8013 SonarCloud gate — vuer_oss PR #8013 (Janus CVO un-gate, branch fix/FKITDEV-8533-videoorient-ungate) FAILED SonarCloud “Maintainability Rating on New Code” (rated C, then D after a refactor). Root cause = pre-existing-debt mis-attribution, NOT the fix: all 20 flagged issues are pre-existing (git blame 2018→Jan 2026; authors Jordán/Bence/jurki/kzsolt/Makkai; SonarCloud issue keys e.g. AZ8A1W4d…/AZ8A1W6o… identical before & after a PR refactor); decisive control = the co-modified server/db/model/customer.js had ZERO flags, proving the diff is innocent — the gate counts legacy smells in any touched file, most likely because devel has no SonarCloud baseline (project vuer-oss is private; New Code config unconfirmable without a token). Gotcha: any PR touching videochat.js/RoomTransportSession.js/SelfServiceTransportSession.js/VuerCVListenerSession.js (legacy optional-chain/.find/async smells) re-trips it → waive (mark issues Accept / admin-merge) or fix the baseline (New Code → Reference branch = devel, ensure devel is analyzed); do NOT bloat the PR fixing unrelated debt — esp. the 2 [failure] VuerCVListenerSession.js items (async-in-constructor + await-non-Promise, behavioural CV refactors). Fix final state: standalone server/transport/videoOrientExt.js helper refactored INTO Customer.prototype.videoOrientExtEnabled() (beside isNativeApp), called X.customer?.videoOrientExtEnabled() ?? true at the 4 gate sites (behaviour identical: null→true/native→false/browser→true); commit 1815f693fe (amended over d27d4cc990), solo-author, force-with-lease pushed. Decision (user): waive the gate as pre-existing debt; device test (operator view + recording + iPad orientation direction) still pending — FKITDEV-8533

2026-06-26

  • Tesztelési jegyzőkönyv generation flow (/fk-tjk) — built a repeatable per-partner test-report .docx generator for FaceKom releases (producing companion to the attachment-recipe note): a Claude command + stdlib Python docx renderer under /Users/levander/coding/facekom/.claude/. Practice: one TJK per AFFECTED partner per 1.9.11.NN release (not all 39), attached to that partner’s YouTrack release ticket; shortName usually ASS<PARTNER>/BUG<PARTNER> but VARIES (MicroSec=MF, DÁP=DAP/ASSDAP) → partners.json pins ytProject per partner; a core change reuses byte-identical body text across partners (verified MKB ASSMKB-90 == BB ASSBB-82 Oracle-timezone reports, body doesn’t even name the partner). New std template tesztjegyzokonyv_sablon.docx (authored 2026-05-29, replaces 3 inconsistent legacy formats): 19 <…> placeholders each intact in a single <w:t> run, all in word/document.xml → plain string substitution preserves all styling (no docxtemplater/pandoc). Built: .claude/commands/fk-tjk.md (procedure: pull dev ticket via existing fkticket client + 1 past report/partner for house style → draft per-partner JSON → render), .claude/scripts/tjk/render_tjk.py (stdlib-only: metadata substitution + clone test-case block document.xml paras 27–36 once per case w/ literal 1.→k. + \n→<w:br/> + zip-repackage copying entries verbatim swapping ONLY document.xml + self-check), partners.json (12 seeded: barion/bb/cib/cofidis/dap/fundamenta/generali/microsec/mkb/mvm/raiffeisen/unicredit), pinned sablon. v1 MANUAL/out-of-scope: screenshots, pass/fail underline, PDF export, attaching to YouTrack — NO write-back. Verified: renderer self-check + tests pass, independent fixture renders, pinned sablon byte-identical+unmutated post-render. Design spec (incl. §13 fact-check) /Users/levander/coding/facekom/docs/superpowers/specs/2026-06-26-teszt-jegyzokonyv-flow-design.md — tesztjegyzokonyv-generation-flow
  • YouTrack tesztjegyzőkönyv (test-record) convention + REST attachment recipe — captured WHERE FaceKom “Tesztelési jegyzőkönyv” PDFs/DOCX live: attachments on per-client ASS<CLIENT> release / BUG<CLIENT> tickets, NOT standalone issues (8-section branded template; source-of-truth templates FKITDEV-8329 unified format + FKITDEV-8330 release/install template). InstaCash (ICASH) has NO release/eSign TJK — ASSICASH-65 (FaceKom 1.9.11.50) / -92 (eSign 1.3.0.11) carry only build .logs, install tickets ASSICASH-66/62/67/93 only screenshots; the only instacash “teszt jegyzőkönyv” PDFs are OLD compliance/DR (BUGICASH-460 BCP 2023, ISSFK-338 SaaS-DR 2021). Only eSign-tied test record = Raiffeisen BUGRAFIPI-512 (eSign 1.3.0.22, 2/2 cases, Nagy Balázs 2024-10-16) + sibling -516 (eSign DR); recent ASSRAFIPI-117/113/102 TJKs are FaceKom/VUER releases (NOT eSign); BUGRAFIPI-514 has both .pdf+.docx. REST recipe (read-only, python urllib to dodge RTK + keep token off argv): GET /api/issues?query=…&fields=…,attachments(name,mimeType,created,url),comments(text,attachments(…))&$top=200, Hungarian full-text works, scope by project:; download = prepend base to the attachment’s relative signed url, GET w/ Bearer, write bytes; dates are epoch-ms. Same base + ~/.config/facekom/youtrack.token as the ready-for-release query — youtrack-tesztjegyzokonyv-attachment-recipe

2026-06-25

  • FKITDEV-8639 post-fix reality — appended a Post-fix Reality / Open Question section to the investigation note. Synthesis: PR #7862 (543f293c38, tag nusz-1.9.11.45) made the Excel report self-consistent/auditable (Sum on every row) but did NOT reconcile UI per-period SL with Excel weighted-overall SL — both formulas coexist BY DESIGN (naive per-period round CallsReportService.js:669-670 vs weighted overall :558-559; team standardised on weighted overall as headline). Per nusz-1.9.11.47 (ASSNUSZ-58 UAT), client STILL reported the SL discrepancy after the fix (“Az SL eltérés itt is jelentkezett”) even though the daily-stat discrepancy resolved. OPEN PRODUCT DECISION: UI == Excel exactly requires picking ONE formula everywhere — a product call, not a further bug fix. Clarified Bug C (ReportsService.js:63 true→locale) is DISTINCT from FKITDEV-8747 (locale through RPC queue boundary + empty SL when no calls, PR #7929, new for 1.9.11.48) — two locale bugs at two layers — FKITDEV-8639

2026-06-23

  • FKITDEV-8981 self-hosted PR-check runners — 33 identical runs-on: ubuntu-latest → runs-on: [self-hosted, node] edits across the 7 repos’ single PR-check workflow .github/workflows/pull-request.yaml (vuer_oss 5, vuer_css 5, esign_oss 5, esign_css 4, portal_css 5, mq 5, janus-api 4; esign_css + janus-api omit the test job). Repo-name resolution: @techteamer/mq → GitHub TechTeamer/mq default master (NOT devel); janus_api → TechTeamer/janus-api (hyphen) default master (TechTeamer/janus_api does NOT exist); the 5 css/oss base off origin/devel, mq+janus-api off origin/master. Scope correction: portal_css’s old pr-title-lint.yaml was already removed on devel in PR FKITDEV-8976, and release-caller.yaml is push-triggered (reusable node-semantic-release.yaml@master, no runs-on) = out of scope — so only pull-request.yaml remained (re-scope against post-fetch devel, not a stale ref). Job NAMES unchanged → branch-protection required checks stay valid. Done in worktrees <repo>-FKITDEV-8981 on chore/FKITDEV-8981-self-hosted-runners; edits verified (numstat 5/5/5/4/5/5/4, zero ubuntu-latest residue, YAML parses) but NOT committed, NOT pushed, NO PRs. Hard infra dependency / risk: inert+dangerous without online node-labelled (+ implicit self-hosted) runners carrying git+Node/yarn (setup-node@v6 cache:yarn)+the SonarSource/sonarqube-scan-action@v6 toolchain (sonar = likeliest self-hosted gotcha) — if none online at merge, every PR check queues forever and ALL PRs in these repos block. “Build-green ≠ runs”: real validation needs a live PR hitting a node runner. Precedent: vuer-release autobuild.yml already on [self-hosted, docker]. Commit msg style chore: [fkitdev-8981] run PR checks on self-hosted runners — FKITDEV-8981

  • FKITDEV-8239 depcheck CI — ALL 5 PRs now fully green and ready to merge (flips the prior 4/5). The lone red, vuer_oss #8001, was a pre-existing self-service-room-archive-service.test.js Unit Tests failure (NOT sonar, NOT the depcheck change) — now RESOLVED: a colleague merged the test fix to vuer_oss devel in PR #8003 (commit cfdc116543, “tests updates/ci fix”); merged origin/devel into chore/FKITDEV-8239-depcheck-ci — clean, no conflicts (devel only touched CODEOWNERS + the test file, zero overlap with the 3 CI-config files), merge commit 3717e30b91 solo-author (andras.lederer), pushed; #8001 re-ran fully green (Unit Tests, SonarQube Scan, SonarCloud Code Analysis, Build, Lint, Audit, Unused Dependencies all pass). Net: vuer_oss #8001 + vuer_css #3076 + portal_css #703 + esign_oss #353 + esign_css #253 all green — FKITDEV-8239

  • FKITDEV-8947 scoping gotcha — vuer_oss’s getHttpsAgent() + fetch({ agent }) idiom is a SILENT NO-OP (verified on Node v22.22.3 / bundled undici 6.24.1). Every fetch() in vuer_oss is Node’s global fetch (neither undici nor node-fetch is a declared dep), and global fetch ignores agent (honors only dispatcher). PROVEN: fetch(selfSigned, { agent: new https.Agent({ rejectUnauthorized:false }) }) → TypeError: fetch failed / DEPTH_ZERO_SELF_SIGNED_CERT (the rejectUnauthorized:false was dropped). Harmless today only because cv.rejectUnauthorized defaults true = global-fetch default; but client-cert mTLS via agent does nothing — latent trap for FKITDEV-8947 (UniCredit ApiService.js migrates request-promise-native→fetch with cert/key/ca/passphrase mTLS from portal.api). FIX (verified status 200 + peer CN received vs local requestCert server): const { fetch, Agent } = require('undici') then fetch(url, { dispatcher: new Agent({ connect: { cert, key, ca, passphrase, rejectUnauthorized } }) }). CROSS-VERSION TRAP: feeding a standalone undici 8.5.0 Agent into Node’s global fetch (bundled undici 6.24.1) → UND_ERR_INVALID_ARG: invalid onRequestStart method (handler-iface mismatch across undici majors); since Facekom runs Node 22 and 24 (different bundled undici majors), pinning standalone undici to the bundled version is fragile — use undici’s own fetch+Agent pair. Also: ApiService.js:267 has an uncommitted stray }w (HEAD clean) → ReferenceError in the non-realtime-sdk branch of setIdentificationComplete — vuer-oss-global-fetch-ignores-agent-mtls, FKITDEV-8947

  • FKITDEV-8239 depcheck CI — COMMITTED (solo-author) + PUSHED (flips earlier LOCAL-ONLY status). Branch chore/FKITDEV-8239-depcheck-ci → git@github.com:TechTeamer/<repo> for all 5 repos, author andras.lederer <andras.lederer@alpiq.com> (no Co-Authored-By). Each commit = 2 files (workflow + .depcheckrc.json), msg chore(ci): add warn-only depcheck job for unused dependencies (FKITDEV-8239), committed --no-verify (worktrees have no node_modules so husky/lint-staged can’t run; validated independently via actionlint + depcheck). Commits: vuer_oss 0e7bd6377e, vuer_css 7913f181c, portal_css ac15b91d, esign_oss 47d6a5c, esign_css 93ccd9f. No PRs yet (no-auto-PR) — compare links https://github.com/TechTeamer/<repo>/compare/devel...chore/FKITDEV-8239-depcheck-ci?expand=1; worktrees preserved for PR iteration. Merge-time caution still stands: do NOT promote the Unused Dependencies check to a required branch-protection check or it stops being warn-only — FKITDEV-8239

  • FKITDEV-8239 depcheck CI — adversarial deep-review found NO bugs; ready to ship as-is. Verified: actionlint v1.7.12 clean (exit 0, zero findings) on all 5 workflows (full Actions schema + expression check); all 5 diffs purely additive vs origin/devel (31 insertions/0 deletions, no existing job touched); ${{ env.NODE_VERSION }}=“24” resolves in all 5; bare npx -y depcheck@1.4.7 auto-discovers .depcheckrc.json; the 5 job blocks byte-identical except the intended install spelling (yarn --frozen-lockfile in vuer_oss vs yarn install --frozen-lockfile ×4); depcheck warn-only everywhere (exit 255 absorbed by continue-on-error), unused_devDeps=[]. Final candidates: vuer_oss soap/umzug; vuer_css add; portal_css lodash/tmp/tough-cookie + a genuine MISSING devDependency istanbul-lib-coverage; esign_oss ajv/fast-xml-parser/inquirer/jsdom/protobufjs/umzug (resolutions=CVE pins, advisory); esign_css license-checker/postcss. Merge-time op note: do NOT add the new Unused Dependencies status check to branch-protection required checks or it stops being warn-only — FKITDEV-8239

  • RTK tooling gotcha — RTK proxy MANGLES some commands (mutates the command, not just output), hit while fetching the actionlint binary for the 8239 review. curl <url> fails with curl error (3) “Malformed input to a URL function” (Rust proxy corrupts the URL); ls | sort returned empty; find|wc -l / |grep -c get zeroed (dangerous — looks like a legit “no results”). Workarounds bypass RTK via python3: download files with urllib.request.urlretrieve instead of curl/wget; run multi-step CLI checks via subprocess.run([...]) (argv list, no shell=True) instead of shell pipelines; for counts cross-check two independent methods. Sibling of the merge-commit-hiding gotcha — rtk-mangles-curl-and-pipes

  • FKITDEV-8533 iPad self-service rotation — chosen fix LANDS (server/Janus): “Option A — un-gate CVO for browsers.” Restored the videoOrientExt gate to its 2017 intent — disable urn:3gpp:video-orientation (CVO) RTP ext ONLY for the native mobile SDK (UA prefix mobile/), enable for ALL browsers — via new shared helper server/transport/videoOrientExt.js (videoOrientExtEnabled(customer) = !customer.isNativeApp(), null→true) wired at all 4 (the only) gate sites (RoomTransportSession:917 / SelfServiceTransportSession:49 / videochat:274 / VuerCVListenerSession:154) + new Customer.isNativeApp() (customer.js:307, userAgent.startsWith('mobile/')); isSafari/isMobile untouched (≈7 other callers — avoids #7945’s blast radius). Branch fix/FKITDEV-8533-videoorient-ungate off devel 9aabf7bb6c, commit d27d4cc990, solo-author; ships own tests (video-orient-ext.test.js +91). 4-front adversarial validation all PASS: (1) completeness — 4 sites are the only setters, no config/client/SDP override (client munges fmtp not extmap), self-service iPad reaches the gate with non-null customer; (2) native-SDK off→off, single mobile/ prefix (vuer_css mobile.js:52/119) for iOS+Android, no browser false-positive; (3) regression — full unit A/B 3220→3230 (+10/−0), identical 29 pre-existing ts-jest fails; (4) config — streamRotate:false dev/docker+Generali, recording is janus-pp-rec→ffmpeg -c:v copy (no transpose). Client finding (shelved, NOT redundant): self-service ID photo is captured from the LOCAL getUserMedia preview (VideoFeed drawImage(videoElement)), which CVO physically CANNOT correct (RTP ext = remote/operator decode only) → PR #3043’s client-canvas rotation is a SEPARATE artifact, still needed, ORTHOGONAL (no double-rotate — corrects an earlier assumption); minimal client fix built+validated (default-off correctOrientation, isIpadClient()+geometry gate, operator KYC byte-identical) on branch fix/FKITDEV-8533-selfservice-photo-rotation, NOT committed (deferred). Latent bug (separate-ticket candidate, NOT fixed): devel high-res capture triple-dead — self-service.controller.js:201-202 reads never-assigned this.services.highResolutionLocalStream, AND :204 calls object-arg screenshot() positionally → self-service photos always PNG/1, intended JPEG/0.9 path silently dead; orientation fix preserves PNG (no KYC-format side effect). Residuals need 1 physical iPad session (operator view/screenshot upright?, recording honours CVO?, stored photo upright + 90° CW direction) — FKITDEV-8533

  • FKITDEV-8239 SonarCloud gate fix — after the depcheck PRs opened, SonarCloud’s “Security Rating on New Code” gate FAILED on 4 of 5 PRs: the new workflow lines tripped SonarCloud’s GHA supply-chain rules — npx (“install packages on-demand”, confirmed sole driver on vuer_css), yarn install (“lifecycle scripts”), and unpinned actions/*@v6 (“use full commit SHA”); existing jobs use the same patterns but are grandfathered as old code, only the PR’s new lines are gated. Profiles differ per repo (vuer_css flags only npx; portal_css flags all three). Fix (chosen from 3 options): appended .github/** to sonar.exclusions in each sonar-project.properties (already in sonar.coverage.exclusions). Pushed solo-author (andras.lederer): vuer_oss c2b5cfcb3f, vuer_css 93c9d976e, portal_css 7ee62cbd, esign_oss 4e96053, esign_css 9f9b862. Verified via gh pr checks: 4/5 PRs now fully green (vuer_css #3076, portal_css #703, esign_oss #353, esign_css #253). vuer_oss #8001 stays red but NOT sonar / NOT this change — a pre-existing Unit Tests failure (self-service-room-archive-service.test.js, 2 tests: archive + restore self-service room, “Cannot log after tests are done” async-leak; 3512 pass/2 fail) that also fails on devel (branch is devel + CI-config-only; sonar/build skipped behind the test job); likely FKITDEV-8787 self-service work, out of scope. Reusable gotcha captured in SonarCloud “Security Rating on New Code” can fail on new CI workflow lines — FKITDEV-8239

2026-06-22

  • FKITDEV-8239 depcheck CI rewrite — corrected investigation note: scope is all 5 repos (vuer_oss/vuer_css/portal_css/esign_oss/esign_css), not portal_css only; removed false npx -y macOS breakage gotcha (verified working); corrected lodash narrative (portal_css had over-suppressed genuine unused deps, not a static-analysis miss — fixed by removing lodash/tmp/tough-cookie from ignores); Yarn Constraints not viable (Yarn Classic v1 only) — FKITDEV-8239

2026-06-18

  • FKITDEV-8887 iOS audio resume — SonarCloud cleanup on vuer_css PR #3066 (TechTeamer; branch fix/FKITDEV-8887-ios-audio-resume, still UNCOMMITTED in worktree vuer_css-FKITDEV-8887-ios-audio-resume). Quality Gate PASSED but Sonar flagged 18 “New issues” (all maintainability code smells; 0 bugs/vulns/hotspots; 89.2% new-code coverage). 13 were genuinely the PR’s new code → fixed (11× prefer-optional-chaining a&&a.b→a?.b in Peer.js/VideoFeed.js/InterruptionRecovery.js/videochat.services.js/videochat.script.js; 1× prefer-globalThis win:window→win:globalThis; 1× cognitive-complexity recoverAudioIfNeeded 19→≤15 by extracting _safeLog/_isAudioTrackDead/_applyRecoveredAudioTrack, behavior-preserving — 119 suites/1045 tests pass + independent adversarial APPROVE). 5 were PRE-EXISTING document-upload/validation code (promptUpload/validationResult, videochat.script.js ~L424–448) the PR never touched (verified gh pr diff 3066: script.js changed only at the import, InterruptionRecovery wiring ~L78–92, one teardown line) → intentionally LEFT for a separate chore (keep audio PR focused). Reusable technique captured: read SonarCloud PR issues WITHOUT a Sonar token via GitHub check-run annotations on the PR head commit (gh pr view --json statusCheckRollup,headRefOid → gh api .../commits/<sha>/check-runs → gh api .../check-runs/<id>/annotations; sonarqubecloud bot also posts a PR summary comment). Gotchas: passing Quality Gate ≠ zero issues (gate = new-code thresholds only); no analyzed devel Sonar baseline (only pull-request.yaml runs Sonar) so pre-existing code can appear as PR “New issues”; annotation_level failure = issue severity, not a gate failure. Added gh-annotations recipe to 10. Verified gotchas — FKITDEV-8887
  • FKITDEV-8787 Raiffeisen Myra phantom-room — deployed the fix branch to dev box lederera-447-fk-hardver (command ssh Facekom, ProxyJump FKJumpBox; box was offline ~4h on Tailscale, brought back online first) and server-side verification PASS. vuer_css switched customization/instacash @ e3f7a1d6e → fix/FKITDEV-8787-selfservice-v2-abort-clear-state-95 @ d69f7272e (PR #3064 tip), left on the fix branch; a whitespace-only config/dev.json reformat stashed as stash@{0} first. vuer_oss left untouched (customization/raiffeisen, provides the getRemainingSeconds RPC). Build/restart that worked: docker exec vuer_css sh -c 'cd /workspace/vuer_css && yarn && yarn build && supervisorctl restart all' (yarn ~22s, build ~8s). Evidence: supervisord vuer_css RUNNING pid 612 stable, clean boot (RabbitMQ connection established, Web server listening on 10083, Socket server listening on 10082), zero errors since boot, self-heal at selfservice-v2.js:313. Two operational corrections: (1) vuer_css has NO docker healthcheck (docker inspect health = nohealthcheck; docker ps “Up 5 weeks” = only inner supervisord procs restart, not the container) — the “~60s unhealthy anti-flap” note for esign containers does NOT apply; verify via docker exec vuer_css supervisorctl status (RUNNING + climbing uptime), not docker health; (2) a pre-existing TypeError: Cannot read properties of undefined (reading 'stack') at server/web/WebServer.js:481 (findRoute) was logged by the OLD customization/instacash process pre-restart — unrelated to 8787, does NOT recur on the fix branch, but a real error-handling fault on customization/instacash (flag for that branch’s owner). Restore command: cd /workspace/vuer_css && git checkout customization/instacash && git stash pop && docker exec vuer_css sh -c '... yarn && yarn build && supervisorctl restart all'. Still pending: functional verification (Scenarios A/B) with the real Raiffeisen Myra mobile client at https://css-lederera.facekomdev.net — not yet run — FKITDEV-8787

2026-06-18

  • FKITDEV-8787 Raiffeisen Myra phantom-room — added a manual end-to-end verification (partner hand-off) script to the investigation note, complementing the existing 76 Jest unit tests. Fix ships in PR #3064 → base release/FKITDEV-8902-raiffeisen-1.9.11.95 (release-targeted delivery of the same server self-heal first landed in PR #3051 → customization/raiffeisen); tester MUST be on a build/env with that fix deployed or they just reproduce the original bug. Critical gotcha: the bug only ARMS when the mobile SDK reuses the SAME socket — use in-app Restart/Cancel and stay in the same app session; fully closing/reopening the app (or re-scanning a fresh token) makes a NEW socket with no stale selfServiceRoomData so nothing triggers and the test proves nothing. Scenario A = drive room to timeout/no-tasks (~5 retries, do NOT close app) → in-app Restart → PASS if fresh flow + tasks + first photo OK, FAIL if “Already authorized”/“Already has some kind of room”; Scenario B (controllable) = abort in-app → start in same session. Server-side proof: docker logs -f vuer_css | grep -i "self-heal" — warn self-heal: clearing stale selfServiceRoomData for dead room … = self-heal fired (room confirmed expired); getRemainingSeconds failed … preserving state = fail-closed branch (room NOT confirmed-expired; recover via abort-then-start). Hand-off needed because the “Already authorized” string lives in the Raiffeisen mobile SDK (real client required, not a local mock) — FKITDEV-8787

2026-06-16

  • FKITDEV-8252 UBI10 RUNTIME fixes (rabbitmq + supervisord) — build-green ≠ runs: prior phases were EXIT-0 build-verified but not runtime-tested; Bence reported containers failing on START. Four distinct ubi10-minimal runtime gotchas, each masking the next (all native x86_64 on ssh Facekom): (1) supervisor 4.2.5 crashes on Py3.12 ModuleNotFoundError: pkg_resources (setuptools dropped it) → pin supervisor==4.3.0 (vuer_docker was 4.2.5; vuer_build/vuer-release unpinned ⇒ already 4.3.0); (2) supervisord logfile path hidden by volume mount — logfile=/var/log/supervisor/supervisord.log + childlogdir baked in image, but compose bind-mounts host log dir over /var/log hiding the subdir → “directory … does not exist” → log to /var/log ROOT (mount always exists), vuer_docker only; (3) rabbitmq-server exit-1 “Please ensure /bin/su or /sbin/runuser exists” — ubi10-minimal ships only util-linux-core (no su/runuser), rabbitmq privilege-drop wrapper needs su → microdnf install -y util-linux in ALL 3 repos; (4) erlang .erlang.cookie eacces (latent, surfaced only after #3) — supervisord (PID1, HOME=/root) does NOT propagate techteamer’s HOME nor does USER techteamer set it → erlang writes cookie to /root → eacces crash-loop → set environment=HOME="/var/lib/rabbitmq" in supervisor_rabbitmq.conf (vuer_build+vuer-release). Also removed wrongly-added USER $DOCKER_USER from vuer_css/portal_css Dockerfiles (must run supervisord as ROOT; regression from shared-script refactor). Red herrings: healthcheck supervisor-health-check.sh uses supervisorctl status (root unix socket, fine) NOT rabbitmqctl; rabbitmqctl as root via docker exec ALSO gets cookie eacces (cookie 0400 owned by techteamer) → use docker exec -u techteamer -e HOME=/var/lib/rabbitmq <c> rabbitmqctl status; “rabbitmq exit 127” in bare docker run = test artifact (directory=/workspace missing without compose bind-mount). Outcome: all 3 rabbitmq images boot healthy (RabbitMQ 4.1.4, listeners up). Pushed solo-author: vuer_docker a6543ab→feat/FKITDEV-8252/UBI-10-build-fixes; vuer_build 82acea7→5c56120→feature/FKITDEV-8252-ubi10 (also folded in held-back Phase A clamav shadow-utils + janus CentOS-CRB.repo base fixes); vuer-release bc9570e→92cc400→feature/FKITDEV-8252-ubi10 — FKITDEV-8252
  • NÚSZ devel update — merge validation FAILED at lint, merge left UNCOMMITTED (mid-merge, MERGE_HEAD intact) in worktree ~/coding/facekom/vuer_oss-nusz-devel-update (origin/devel → update/customization/nusz-2026-06-16). yarn lint (eslint . --max-warnings 0 --ignore-pattern "test/*") reported exactly 1 error: cron.js:46 n/no-missing-require Can't resolve './server/service/FFmpegService'. Root cause = reusable merge gotcha: devel renamed server/service/FFmpegService.js → .ts; nusz tip commit 1d837dac83 had added an extensionless require('./server/service/FFmpegService') to cron.js (resolved fine while .js); the conflict-free merge kept devel’s rename + nusz’s extensionless line, so it no longer resolves to .ts under n/no-missing-require. cron.js:46 is the lone straggler — every other caller (server.js:108, convert.js:31, background.js:52, server/convert/convert_check.js:4) already uses explicit .ts. Fix (NOT applied, validate-only) = add .ts to line 46. Lesson: after a cross-side .js→.ts rename merge, grep for extensionless require()s of the renamed modules — nusz-devel-update-2026-06-16-lint-merge-fix
  • FKITDEV-8354 vuer-release PR #28 (MVM partner migration, branch feature/FKITDEV-8354, base master, reviewer bencelaszlo) — resolved Bence’s round-2 supervisor-config review (two “merge with the <repo> config” comments). vuer_css conf (projects/mvm/components/vuer_css/supervisor_vuer_css_docker.conf) was byte-identical to the vuer_css repo copy ⇒ DELETED + removed its COPY … conf.d/ line from the component Dockerfile; safe because base install/configure-app.sh:16-21 symlinks all source-package supervisor*.conf into /etc/supervisor/conf.d/ (supervisord.conf includes *.conf) ⇒ identical conf.d set. vuer_oss conf KEPT as intentional override (NOT merged): vs the correct baseline (vuer_oss repo MVM branch origin/chore/FKITDEV-8892-mvm-devel-update-2026-06-01, blob d6e7843) the release copy uses supervisor-stdout eventlistener logging (stdout_events_enabled=true/stdout_logfile=NONE, 8 programs) vs the repo’s file-logging 9-program set; the eventlistener apparatus (supervisor_stdout.py+supervisor_stdout_eventlistener.conf+pip install supervisor-stdout) exists ONLY in vuer-release and consumes the very supervisor-stdout plugin Bence asked to RESTORE in round 1 (07db225) ⇒ merging would no-op it; and dropping [program:vuer_oss_storage] is the consistent vuer-release convention (equilor/nusz/polgaribank-facekom/unicredit/unicredit-srb/mvm all omit it). Reusable mechanism: supervisor confs reach conf.d via TWO paths — (a) configure-app.sh symlinks the source-package conf, (b) the partner Dockerfile COPYs an override on top (last-write-wins by filename); an override is a deletable duplicate only if byte-identical, else it’s intentional customization. Distinct from FKITDEV-8252 PR #31 (feat: ubi10) — don’t conflate. Changes LOCAL/UNSTAGED in worktree ~/coding/facekom/vuer-release/.worktrees/FKITDEV-8354 only; reply to Bence DRAFTED not posted; nothing written to GitHub (user constraint) — FKITDEV-8354-mvm-supervisor-config-dedup
  • Devel update executed for nusz-1.9.11.47 — vuer_oss + vuer_css chore/FKITDEV-8938-nusz-devel-update pushed, PRs pending merge into customization/nusz; cut blocked on those merges — nusz-1.9.11.47

2026-06-15

  • NÚSZ release automation — created the releases hub + design under projects/facekom/releases/: per-release tracker nusz-1.9.11.47 (@13 / 1.9.11.47, release issue ASSNUSZ-116 / FKITDEV-8938, payload = CRNUSZ-102 + ASSNUSZ-58 + SLANUSZ-28, dual-publish 🅼 Harbor / 🅻 vuer_build, manual post-release YouTrack transitions), the reusable prepare-and-gate release-automation-design (/fk-release <client> command spec, scope = ASSNUSZ Release-issue Package manifest ∪ tag/status union, fix-forward never delete tags), and the releases index with verified nusz @1–@12 history — left UNCOMMITTED for review
  • NÚSZ release scope — documented YouTrack access + the verified “Ready for release” release-scope query for the four NÚSZ projects (CRNUSZ/BUGNUSZ/SLANUSZ/ASSNUSZ): tracker = YouTrack https://youtrack.techteamer.com (/api/issues), Bearer token read from ~/.config/facekom/youtrack.token (never on argv); “Ready for release” is a tag (exact string Ready for release, search tag: {Ready for release}) — tracker-wide it matches 57 issues so the project: filter is what scopes it to NÚSZ; query project: CRNUSZ, BUGNUSZ, SLANUSZ, ASSNUSZ tag: {Ready for release} returned 3 on 2026-06-15 (CRNUSZ-102, ASSNUSZ-58, SLANUSZ-28; BUGNUSZ 0); read-only curl -G --data-urlencode recipe + /fk-ticket command/extractor (~/.config/facekom/youtrack.token) paths captured; CRNUSZ-102 verified example (State Pending yet tag-flagged → the tag is the readiness signal, not State) — youtrack-ready-for-release-nusz-query
  • NÚSZ release payload detail + client registry — extended the release docs (UNCOMMITTED, per request): appended a per-ticket payload detail section to nusz-1.9.11.47 (CRNUSZ-102 impl FKITDEV-8794/8801 — no code/PR found, business-accepted, UAT 06.18; SLANUSZ-28 impl FKITDEV-8639 → PR #7862 on feature/FKITDEV-8639, NOT yet in customization/nusz, may already be in .45/.46; ASSNUSZ-58 stat-export, UAT/PROD-gate notes targeted .46.1) with a merge-status warning that payload code is not yet confirmed in customization/nusz and the version target (.45/.46/.46.1/.47) needs confirming; created the cross-system client-registry (YouTrack suffix ≠ repo name, e.g. RAFIPI=raiffeisen, MNET=magnet, PB=polgaribank; 22 clients with build-path modern/legacy/eSign + resolution rules for /fk-release); appended client-generalization, PR-fetch (no YouTrack VCS → git-grep + comment-scan), and comment-extraction ranking sections to release-automation-design — client-registry

2026-06-15

  • FKITDEV-8887 iOS audio resume — QA acceptance protocol documented (device repro is the real acceptance gate): baseline-first on origin/devel, core lock→unlock-to-read-SMS scenario on iPhone Safari, evidence via allowlisted webrtclog (interruption:resume→senderPeer:audioRecovered {swapped:true}), full test matrix (iPhone/iPad, built-in+AirPods, >30s background crossing connectionStateRecovery, non-default-mic survival, Android/desktop regression, both directions), and version-risk settlement (pull userAgent for rooms 10071/10091 Generali + 2281 CIB; iOS ≥16 weakens only mic-interruption premise, playback+socket-mask hold) — FKITDEV-8887
  • FKITDEV-8887 iOS audio resume — two polish fixes applied (UNCOMMITTED): (1) mic recovery routed through LocalMediaService.startLocalMedia() instead of raw getUserMedia so saved mic device is respected; videochat.script.js wires localMedia into VideoChatService; (2) WebRTC test globals extracted to shared helper test/tests/unit/_helpers/webrtc-test-globals.js, removing duplication across 3 test files; videochat.services.test.js updated to mock localMedia.startLocalMedia + new guard test; 119 suites / 0 failures / lint clean — FKITDEV-8887

2026-06-11

  • FKITDEV-8252 UBI10 Phase B build-verified GREEN (vuer-release) — all no-app-source component images build clean on UBI10. Built natively x86_64 on remote Facekom host (ssh Facekom → lederera-447-fk-hardver, ProxyJump FKJumpBox, Docker 29.2.1/buildx 0.31.1, no podman): clamav 419MB, turn 354MB, rabbitmq 520MB, janus 375MB all EXIT 0. janus full compile OK — entire install-janus-build-env.sh -devel surface (ffmpeg/libogg/jansson/openssl/glib2-devel, pkgconf, gengetopt, gnutls-devel, libtool, automake, cmake, libcurl/libconfig-devel, gtk-doc) resolves on UBI10+EPEL10+RPMFusion10+CentOS-Stream-10, and libnice 0.1.17 / libsrtp 2.5.0 / libwebsockets 4.3.3 / janus (TechTeamer/janus-gateway@cc0fdca8) all compile. App components’ SYSTEM layer verified via synthetic probe (Mac, emulated): valkey-8.1.7-1.el10 (from CentOS-AppStream-9.repo), java-21-openjdk-headless (both install-java-11.sh AND install-java-17-jre.sh now install java-21), nginx-1.30.2-1.el10.ngx, nodesource pub_22.x — all install on UBI10; app FINAL images (vuer_css/vuer_oss/resource-manager/nyilvantarto_scraper/pdfservice) can’t be fully built locally (need SOURCE_PACKAGE release-tool artifacts, not in repo); postgresql intentionally stays Debian (postgres:bookworm). BUG FOUND+FIXED (only real defect): base/components/clamav/Dockerfile used bespoke inline microdnf install crypto-policies-scripts nano net-tools procps tar (vs install-os.sh) and OMITTED shadow-utils → groupadd: command not found (STEP 11 exit 127) — SAME gotcha as vuer_build commit 4fac31a, missed in vuer-release; fix = add shadow-utils to clamav inline list, UNCOMMITTED pending approval. Reusable build cmd = docker build -f base/components/<c>/Dockerfile --build-context install-scripts=<repo>/install -t <c>:probe <args> base/components/<c> (build-args from component_env_values.json+default_env_values.json; UID/GID 1000, NODE_VERSION 22); vuer_oss oss-janus-compile is byte-identical build-env to janus ⇒ green janus implies it. Emulation gotchas (NOT migration issues — why we moved to remote host): podman libkrun qemu amd64 saw EPEL metalink 503s, valkey/janus SIGSEGV (exit 139), concurrent-build overlay I/O error (exit 125) — all vanish building native on ssh Facekom — FKITDEV-8252

For Agents

Reverse-chronological session log. Newest entries at top, grouped by date (## YYYY-MM-DD). Each bullet: one piece of work, short summary, wikilinks to docs touched. Updated by obsidian-documenter on every project doc write. Read by historian at bootstrap (top ~15 entries).

2026-06-04

  • CI gotcha captured (verified 2026-06-04) — the “Github CI - Branch” workflow (.github/workflows/audit.yaml:33) in vuer_oss is chronically RED on customization branches and must not be read as a regression. The failing step yarn run improved-yarn-audit --min-severity critical --exclude <GHSAs> exits 4 whenever a critical advisory exists in a transitive dep absent from the --exclude allowlist; as of 2026-06-04 it trips on 4 stale-dep advisories (twig>locutus GHSA-vh9h-29pq-r5m8, @techteamer/timestamp>…>basic-ftp GHSA-5rq4-664w-9x2c, @kafkajs/confluent-schema-registry>protobufjs GHSA-xq3m-2v4x-88gg, request>form-data GHSA-fjxv-7rqg-78g4). The base branch customization/raiffeisen has failed this exact gate on every push since ≥April 2026 (verified via gh run list) and the team merges through it. Triage check for agents: if your commit didn’t touch package.json/yarn.lock AND the base branch is already red, it’s the pre-existing gate, not your change. Team clears it by appending triaged GHSAs to the --exclude list (a security-acceptance decision) or remediating the dep. The real per-change gates are lint (yarn lint, eslint --max-warnings 0, ignores customization/test/*) and unit tests (yarn jest <file>) — ci-github-branch-audit-chronically-red

2026-06-03

  • FKITDEV-8827 (ASSRAFIPI-119, Raiffeisen PION face-comparison export) — design-phase architecture findings documented (verified vs vuer_oss worktree on customization/raiffeisen). Key facts: faceComparisons rows key by EITHER roomId (videochat/operator) OR selfServiceRoomId (self-service-v2), no mutual-exclusivity constraint; euclideanDistance FLOAT nullable = cosine distance 0–2 despite the name; FKs roomId/selfServiceRoomId/customerId/userId/recognitionFromId/recognitionToId, scope withRecognitions (models.js:298-309, model/faceComparison.js). PION is a videochat flow, NOT self-service — pion-online-verification-phase-1/2 protos declare videochat, set compareFaceWith nowhere; comparisons come from the videochat:close hook (faceRecognitionHooks.js:26-44) keyed by roomId, gated by deployment config faceRecognition.comparisonPairs (FaceRecognitionService.js:7,20) → a self-service-only query returns zero PION rows. 4 call sites, 3 gated by recognitionOptions.compareFaceWith (liveness-v2 SelfServiceV2Service.js:1418, portrait/ID-doc FlowService.js:2899-2943 @:2902, V1) + the config-gated videochat hook. Verdict is DERIVED not stored — SelfServiceCheckerService.getFaceComparisonResult (:132-154) returns CHECK_SUCCESS(≤perfect)/CHECK_PROBABLE(≤probable, the match tier collapses here since default match:null)/CHECK_FAILURE(>probable=different_face), operators <=, defaults {perfect:0.5,match:null,probable:0.6} (:32-48). Threshold sourcing differs: self-service per-room via selfService:v2:config:state activity (oldest [0], ASC getActivityLog db/helpers.js:13-33), REPLACES not merges, falls back to global Setting key faceComparison.value.euclideanDistances (persisted at startup by SettingsService.init()); videochat/operator rows have no per-room path and are NOT verdict-classified at runtime (room.endpoint.js:144 shows raw distance only). No createdAt index on faceComparisons (FK indexes only) → date-range exports risk a full scan; order by id PK. Report-bin pattern = bin → ReportsService subclass → _exportReport(rows,null,null,format,null) → Buffer → fs.writeFile (NOT _prepareDownload/Download-model), but customization/bin/raiffeisen-selfservice-failed-reports.js:106 calls prepareReportData which NrtFailureReportService never implements (abstract ReportsService:297) — latent bug masked only because its cron is active:false (FailedSelfserviceRoomsReport.js:73). DB is Postgres (config/dev.json) but MySQL is supported (sequelize.dialect.name !== 'mysql' guards) → prefer portable LOWER() LIKE LOWER() over ILIKE. Design decision: build a GENERAL both-paths export bin raiffeisen-facecomparison-export.js + FaceComparisonExportService (spec at .worktrees/vuer_oss-FKITDEV-8827/docs/superpowers/specs/2026-06-03-raiffeisen-facecomparison-export-design.md) — face-comparison-data-verdict-threshold-model

2026-06-02

  • FKITDEV-8787 (SLARAFIPI-60, Raiffeisen Myra phantom-room) — fix implemented + pushed on vuer_css branch fix/FKITDEV-8787-selfservice-v2-abort-clear-state (renamed from bugfix/... — TechTeamer/vuer_css enforces ^(feature|feat|chore|fix|release)/FKITDEV-\d+, bugfix/ rejected), 2 commits 8586df65 (self-heal) + 923e4c70 (fail-closed hardening), no PR yet. Fix in server/socket/events/selfservice-v2.js: (1) selfService:v2:start — before ALREADY_HAS_ROOM throw, if stale selfServiceRoomData, call OSS rpcClient.selfServiceV2.getRemainingSeconds(roomId); if remainingSeconds < 1 delete stale data so re-init proceeds; (2) selfService:v2:abort — delete selfServiceRoomData after OSS abort RPC succeeds. Key design learning (4-perspective review): first version was fail-OPEN (delete on ANY getRemainingSeconds error) → re-introduced duplicate rooms from the opposite direction (a transient RPC/OSS error on a LIVE room would clear state → start() creates a 2nd live room, orphaning the original; de-reg loop only cleans the NEW room id). Verified OSS getRemainingSeconds = Math.max(0, floor((expireAt-now)/1000)) after resolveModels, so a timed-out room returns 0 (the <1 branch, not the catch) → catch only hit for truly-absent rooms → fail CLOSED there. RULE: for a duplicate/phantom-room-prevention bug, default-to-preserve-state on ambiguity; “RPC threw” ≠ “resource dead”. Tests test/tests/unit/socket/events/selfservice-v2.test.js 75 passing, lint clean (expired/preserved/boundary ===1, abort-RPC-failure-does-not-clear, start→abort→start regression), now use REAL server/auth.js predicates via jest.requireActual (fakes had dropped isAuthorized/customerId conjunct + collapsed hasAnyRoom roomData branch). NEXT: open PR vs customization/raiffeisen, move ticket Triaged→In Review, coordinate w/ m3szi (FKITDEV-7667) — FKITDEV-8787
  • FKITDEV-8581 (SLARAFIPI-53, Raiffeisen) — girinfo no-response observability change (decision + implementation, NOT committed). In customization/server/backgroundProcess/giro.process.js (renamed from giroService.process.js during “Raiffeisen PIon project clean-up”; customization/raiffeisen branch only), GiroProcess.handleTask() catch block split from one generic [GIRO process] Error into two logger.errors: “No response from girinfo service (timeout/network)” for RequestError/ETIMEDOUT|ESOCKETTIMEDOUT|ECONNREFUSED|ECONNRESET|ENOTFOUND|EAI_AGAIN, vs “Bad response from girinfo service” for non-200/StatusCodeError/save failure (incl. statusCode); both add elapsedMs/requestTimeout/code. Retry (this.retry) unchanged — log-only. Chose minimal log-only over a heavier “mark bg-process/portal state differently after final no-response retry” option (DEFERRED, ties to the ambiguous-portal-state RCA). Branch feature/FKITDEV-8581-giro-no-response-log (vuer_oss worktree), node --check passes, no giro unit tests, lint clean (one pre-existing env package.json resolver error). Original RCA fix f830fd8e5a shipped 2025-11-28 but YouTrack still Pending — FKITDEV-8581

2026-06-01

  • Headless test path for the InstaCash external API + eSign documented (verified live on lederera). Tool = branch-only bin/instacash-cli.js in the vuer_oss container (/workspace/vuer_oss, branch customization/instacash, NODE_ENV=dev): two jobs — (1) start-server [8189] MOCKS the bank’s /auth+/status (run detached, “InstaCash external server is listening on 8189”); (2) drives the InstaCash external API the bank calls into vuer_oss. Every cmd except start-server boots the FULL vuer_oss service in-process (keystore + Postgres + RabbitMQ amqps://localhost:5671) then HTTPS-calls https://${hosts.oss}/external/... — needs a healthy stack + conflict-free config, NOT just an HTTP client. Cmds: post-application [rt|nrt] [mkb_szemelyi_kolcson|mkb_mszh|mbh_mfl] [extId] [loan] → {customerId, customerProfileUrl, inviteUrl}; get-invite/get-customer; post-contract <id> [pdf] (dummy base64 PDF if none) → “IC - Szerződés ajánlat feltöltése” (ic-contract) flow → EsignRPCClient → esign; get-contract/revoke-contract. Prereqs: healthy vuer_oss+esign_css+esign_oss+postgresql+rabbitmq+vuer_cv (esign needs the nginx-PID fix — dev-box-esign-container-startup-failures-2026-06-01); instacash.external.apiKey = Bearer token + authMock; settings.allowSelfSignedCerts: true (CLI sets NODE_TLS_REJECT_UNAUTHORIZED=0). HARD LIMIT: the actual eSign signature is interactive — CANNOT be driven headless (customer opens inviteUrl on css, video-IDs, auths via mock /auth + SMS 123456 sms-verification-code-dev-testing, signs in eSign UI); state machine (PortalData) none→initial→applied→identification→identified→signature→signed (+aborted/rejected/accepted). 2026-06-01 run: post-application rt mkb_szemelyi_kolcson → customerId 28, profile https://oss-lederera.facekomdev.net/customer/28, invite https://css-lederera.facekomdev.net/dch/eL90QmqJbqWXOjVd; get-customer 28 → product loan, state created; post-contract 28 → HTTP 400 {"error":"Contract flow is in progress"} (clean JSON via nginx→vuer_oss, not a crash). OPEN QUESTION: a freshly-created/not-yet-identified application already has a contract flow “in progress” blocking the external upload, but developer-guide-hu.md says contract upload is AFTER identification — verify intended InstaCash sequencing — instacash-external-api-esign-headless-test-2026-06-01
  • Dev-box infra/image gotcha — esign_css + esign_oss containers came up unhealthy during InstaCash 2026-05-27 devel-update testing on the lederera rootless-docker host. PRIMARY (image regression, NOT the update code): both run harbor.techteamer.com/facekom-devel/esign_{css,oss}:2024.4.1-20240614 (rebuilt ~2025-12-08, nginx 1.28) as non-root techteamer (uid 1000), but baked /etc/nginx/nginx.conf line 6 = pid /run/nginx.pid; while /run is root:root → nginx: [emerg] open("/run/nginx.pid") failed (13: Permission denied) → nginx exits → supervisord FATAL ("Exited too quickly") → healthcheck flips container unhealthy (node/redis/cron were all RUNNING; nginx-only failure). Ephemeral fix applied: docker exec -u 0 <c> sed -i 's#^pid .*nginx.pid;#pid /tmp/nginx.pid;#' /etc/nginx/nginx.conf + supervisorctl restart nginx → both went healthy (lost on recreate; /etc/nginx NOT bind-mounted — only /workspace/<svc>, certs, /var/log are). Durable fix = bake pid /tmp/nginx.pid; (or chown /run) into the esign images/Dockerfiles, not the host checkout. Also captured: (a) healthcheck /usr/local/bin/supervisor-health-check.sh fails if any supervisord prog ≠ RUNNING OR uptime 0:00:[0-5][0-9] (< 60s anti-flap) → ANY supervisorctl restart = ~60s unhealthy then recovers (interval 60s, retries 3, start-period 60s); (b) RedisStore is not a constructor = RED HERRING/resolved — server/web/web-server.js:24 correctly uses connect-redis v9 ({ RedisStore } / new RedisStore({client})) and /workspace/esign_css/node_modules (host-bind-mounted) has connect-redis@9.0.0; only an OLD ≤v6 factory-style stale node_modules triggers it → lesson: after a dep major bump, re-yarn install the running container; (c) chalk ^5 ESM-only broke esign_oss/bin/test/trans-check.js:6 (require('chalk')) → fixed in LOCAL mac checkout to dynamic import('chalk') in the existing promise chain (dev tooling yarn trans only; box’s separate /workspace/esign_oss checkout would need it too); (d) SSH from Claude’s shell — kaku wrapper shadows ssh (_kaku_wrapped_ssh: command not found) so use command ssh; Facekom = lederera@localhost via ProxyJump FKJumpBox (the real docker host); FKJumpBox = root@lederera-447-fk-hardver is a SEPARATE bare Alpine namespace (no docker/no lederera user); operate via command ssh Facekom bash -l -s <<'EOF' … EOF (login shell for docker on PATH) — dev-box-esign-container-startup-failures-2026-06-01

2026-05-29

  • Dev-box infra gotcha — vuer_oss CV / photo-processing failures discovered testing InstaCash nrt self-service identification on lederera/192.168.1.93: customer UI shows “error during photo processing”; oss logs Failed to ping CV server/read ECONNRESET/CV server is down: 'cv-lederera.facekomdev.net' then CV process error Error: Recipe missing no CV Service! (server/cv/CVRecipe.js:88, via RecognitionService.runRecognitions→FlowService.submitTaskRecognition→SelfServiceV2Service.photoCandidate :1043 which calls submitTaskRecognition unconditionally — no dev flag skips face detection; selfService.ui.disabledChecks only covers girinfo/emrtd/kau). Two compounding causes: (1) vuer_cv container STOPPED (docker ps -a → Exited (255); nginx returns 502; fix docker start vuer_cv, ~2 min to Up (healthy), loopback curl then 404 not 502); (2) hairpin NAT — vuer_oss host-networked, its /etc/hosts maps all *-lederera.facekomdev.net to the box’s own LAN IP 192.168.1.93, so a host-net container hitting its own public IP resets at the TLS handshake; fix = remap those names → 127.0.0.1 (then logs CV server is available). CRITICAL: /etc/hosts is a Docker-regenerated single-file bind mount → edit does NOT survive docker restart vuer_oss (also re-breaks bin/instacash-cli’s oss-lederera/external/... path) → re-apply after every restart, via truncate+write (> /etc/hosts), NOT sed -i (fails “Device or resource busy”) — dev-box-cv-photo-processing-failures
  • Dev/testing gotcha — controlling the SMS verification code in vuer_oss when the customer phone is fake (discovered testing InstaCash NRT self-service identification): customer:verification:sendSms hook (customization/listeners/sms-verification.js) uses config.get('test.security.tempTokenSms') as a fixed code for every send when truthy, else reuses customer’s stored code or generates a random 6-char token; conventional dev value is 123456 (all test/testconfigs/*.json; tempTokenEmail: "mailToken" for email); dev box (lederera, NODE_ENV=dev) does NOT ship it — add the block to config/local.json (overrides dev.json), restart vuer_oss (node-config caches at startup), then resend (old random code won’t match 123456); alternative recovery = read customer.getVerificationCode() via the Customer Sequelize model — customer.data TEXT column is encrypted (serviceContainer.service.cryptos.data) but the model’s data getter (customer.js:23-51, _getDecrypted :316) auto-decrypts, so reading via model returns plaintext (stored as videochatToken, PortalData.js:1704); smslogs.messageBody separately encrypted + SMS bodies not logged = dead ends; matchTokens (ContactValidationService.js:16-20) = case-insensitive exact match — sms-verification-code-dev-testing

2026-05-28

  • FKITDEV-8788 / SLARAFIPI-61 — Raiffeisen PION MRZ recognition triage (P2): HU eID back/TD1 reads valid_score:100 on the FULL image but 2 on the warped/cropped image of the same capture; self-service flow rejects on the crop (VuerCVOCRRecognition.js:45-99 warp→MRZ path vs no-warp MRZDetectionApi.js:22-38); SLARAFIPI-61 was marked “Solved” on a CV 4.9.0 test almost certainly run on the FULL image (already passing), not the crop; counterintuitive 191541 (worse, passed) vs 191549 (better, failed) points at warp corner-detection edge case; decisive next step = checklist #2(b) run 4.9.0 MRZ on CROPPED 191549 export image; mitigations = override ocr.engine to no-warp path or fallback-to-full in SelfServiceCheckerService.getMrzCheckResult (:219-246) — FKITDEV-8788

2026-05-27

  • InstaCash devel update wave initiated across all three repos (update/customization/instacash-2026-05-27 branch name across esign_css/vuer_oss/vuer_css); esign_css blocked on orphan-history (b7cee2f is a single squashed commit, no merge base with devel, 95-path delta); vuer_oss in conflict (50 commits, 10 UU — high-risk on customization/listeners/self-service-v2.js due to FKITDEV-7518 id-card + InstaCash newIdFormatAcceptance overlap with in-flight FKITDEV-8747/8787); vuer_css in conflict (57 commits, 44 paths via worktree at ~/coding/facekom/vuer_css-instacash-update to protect parallel bugfix/FKITDEV-8787 WIP — server-side merged clean, no Express 5 risk; high-risk on customization/customizations.js route reconciliation and modal a11y trio modal.{js,twig,styl}); vuer_oss has uncommitted stash@{0} “instacash-update-temp-stash-2026-05-27” to pop on the right branch — instacash-update-2026-05-27-status
  • esign_css customization/instacash orphan-history operational warning captured: single squashed commit (b7cee2f, 2025-11-20) with zero shared history with devel, git merge-base returns empty, git rev-list --count A..B produces misleading numbers, standard merge halts on refusing to merge unrelated histories; 95-path delta (26 M, 14 A devel-only, 55 D devel-deleted but instacash retains — includes intentional MBH/MKB branding asset retention); three workflow options documented (brutal --allow-unrelated-histories, rebase-replay matching 1.3.0.10 shape, cherry-pick delta forward); needs team confirmation on historical pattern — esign-css-instacash-orphan-history
  • FKITDEV-8817 Status 2026-05-27: bugfix/FKITDEV-8817-jquery-update pushed on esign_css (commit b021019, author andras.lederer, no Claude co-author); 2-file change (delete stale web/libs/metronic/global/plugins/jquery.min.js, repoint client/ui/layouts/auth/auth.layout.twig at existing /libs/jquery/jquery-3.7.1.min.js); dead-code claim re-verified (routes 344/346 commented out on both devel and customization/instacash); PR not yet opened; will flow into InstaCash via second devel→update/customization/instacash-2026-05-27 merge once landed — FKITDEV-8817

2026-05-21

  • Face comparison DB query (customer “P”, P3) — verified against local feature/FKITDEV-8747 checkout that failed/different_face comparison results ARE persisted: faceComparisons table stores status + euclideanDistance (cosine distance 0–2, nullable, faceComparison.js:31) unconditionally regardless of threshold; different_face is NOT a stored status — it’s the CHECK_FAILURE verdict computed at read time by SelfServiceCheckerService.getFaceComparisonResult() when distance exceeds all thresholds (per-room → global → code default probable:0.6); 4 comparison call sites, liveness-V2 (SelfServiceV2Service.js:1390) gated by task.options.recognitionOptions.compareFaceWith; delivered read-only SQL (no release) joining faceRecognitions for imageCategory heuristic to split portrait vs liveness step; corrected triage _shared-context.md (models.js not .ts, FlowService.js under server/flow/) — face-comparison-different-face-db-query

2026-05-20

  • FKITDEV-8533 — verified PR #7893 (“enable videoOrientExt for tablets”) is unreliable: modern iPadOS 13+ Safari sends a macOS desktop UA, ua-parser-js v1 returns device.type === undefined, so isTablet() is false for the very iPads the fix targets; isTablet() is also a strict logical subset of isMobile() so the new OR’d term is redundant; correct fix = client-side navigator.maxTouchPoints > 1 && /Macintosh/ detection passed to server; PR CHANGES_REQUESTED (Generali, customization/generali-atvilagitas) — FKITDEV-8533

2026-05-18

  • FKITDEV-8252 — Phase A.6.1 complete: all 5 UBI10 base images probe-build green on UBI10+libkrun (portal_css 658 MB, vuer_css 805 MB, vuer_oss 2.44 GB, janus 313 MB, vuer_cv 5.93 GB); 2 new commits (f38c8e2, b984006) on feature/FKITDEV-8252-ubi10 (17 ahead, not pushed); Q1 revised from per-key rpmkeys to LEGACY (rpmkeys flag disappears after microdnf update; DEFAULT:SHA1 sub-policy doesn’t exist on UBI10); vuer_cv now in-scope; 10 reusable lessons captured; A.6.2 = identify remaining 3 base/* (likely common/*) — FKITDEV-8252
  • FKITDEV-8252 — UBI10 migration state captured: continuation of 2026-05-13→05-15 work; 3 decisions made (crypto policy = per-key rpmkeys, Oracle OL10 = stay on OL9 RPMs, vuer_cv = 2h spike); 4 Dockerfiles modified uncommitted; probe-builds blocked on podman sandbox allowlist — FKITDEV-8252
  • ASSICASH-71 — validation via PROD + 2 UAT log pulls; CSP-channel flood gone everywhere; FKITSYS-9486 fix confirmed holding; previously-open log-volume question closed; status moved to validated — ASSICASH-71

2026-05-13

  • FKITDEV-8787 / SLARAFIPI-60 — Raiffeisen Myra phantom-room triage; SDK-local error strings, OSS V2 silently resumes; in-app Restart hypothesis pending Raiffeisen confirmation — FKITDEV-8787

2026-05-12

  • ASSICASH-71 — swapped English reply drafts for canonical Hungarian final versions (FKITDEV-8201 + FKITSYS-9486 comments); rest of note unchanged — ASSICASH-71

2026-05-08

  • ASSICASH-71 / FKITDEV-8201 InstaCash CSS log-noise triage; reply drafts captured — ASSICASH-71

2026-05-07

  • initial portal_css.md created (codebase mapping pass) — portal_css

2026-05-04

  • Initialized activity log.
  • FKITDEV-8533 iPad videoOrientExt — PR re-review update: #7945 (chrismakaay→devel) two 2026-06-09 “code review fix” commits (bb06f009b,132ded8c8) corrected the inverted gate (iPad+Safari now ENABLES videoOrientExt via isVideoOrientExtEnabled = (isTablet&&isSafari) || (!isSafari && !isMobile)), split isMobile() to exclude tablet, added memoized getParser/getDevice/getBrowser + a UA-regex isTablet() fallback /Macintosh/&&/Mobile\//&&/Safari/i. REMAINING RISK: that fallback needs a Mobile/ token, but the real FKITDEV-8533 device is iPadOS Safari in DESKTOP mode (Macintosh … Safari/605.1.15, no Mobile/) → likely still missed — same ceiling: server-side UA parsing can’t reliably detect a spoofing iPad. #7945 still has 4× copy-paste (not DRY) + no tests; contrast #7942 (wowjeeez, OPEN) which self-reports via client maxTouchPoints→isTabletClient DB column + shared videoOrientExt.js + Jest. Both #7945 & #7893 remain OPEN/CHANGES_REQUESTED; decisive test = a real spoofing iPad, not yet reproduced — FKITDEV-8533

Graph View