#244: mode marked — flag profile-violating configuration in the UI #293

fable-5 · 2026-07-31T18:33:47+02:00

fable-5 commented

2026-07-31 18:33:47 +02:00

Second issue of M32, chained on #292 (merge that first, fast-forward-only).

In mode marked, every catalog-listed control on the admin surfaces shows an accessible deviation marking — text + icon, never colour alone, i18n de+en, wired into the control's accessible description via aria-describedby (ADR 0017). The check evaluates the current control value, so a violating selection is marked at the point of choice, before saving.

Covered controls: registration mode, new-page classification default, classified-upload policy, SVG policy, the four master switches (api/mcp/feeds/plugins), both legal texts (violating while empty), and the Nextcloud backup toggle on the system panel. The profile card from #243 gains the warning summary line (icon + violation count) and the hardening-guide reference — the guide is a repo document, so the card cites its path and per-entry section rather than hyperlinking outside the instance.

e2e: new vs-nfd-marking.spec.ts with two env-selected halves — CI now starts the e2e api with VS_NFD_MODE=marked and runs the marked half (which also puts the marked state into the a11y admin scan); the off half runs in local default stacks. Both halves verified live locally (marked: card + checkbox marking + point-of-choice marking green; off: no card, no markings green).

No behavioural change to any option — marking only. hidden/enforced follow in #245/#246.

Issue #244 will be closed manually after green CI + merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

Second issue of M32, chained on #292 (merge that first, fast-forward-only). In mode `marked`, every catalog-listed control on the admin surfaces shows an accessible deviation marking — text + icon, never colour alone, i18n de+en, wired into the control's accessible description via `aria-describedby` (ADR 0017). The check evaluates the **current** control value, so a violating selection is marked at the point of choice, before saving. Covered controls: registration mode, new-page classification default, classified-upload policy, SVG policy, the four master switches (api/mcp/feeds/plugins), both legal texts (violating while empty), and the Nextcloud backup toggle on the system panel. The profile card from #243 gains the warning summary line (icon + violation count) and the hardening-guide reference — the guide is a repo document, so the card cites its path and per-entry section rather than hyperlinking outside the instance. e2e: new `vs-nfd-marking.spec.ts` with two env-selected halves — CI now starts the e2e api with `VS_NFD_MODE=marked` and runs the marked half (which also puts the marked state into the a11y admin scan); the off half runs in local default stacks. **Both halves verified live locally** (marked: card + checkbox marking + point-of-choice marking green; off: no card, no markings green). No behavioural change to any option — marking only. `hidden`/`enforced` follow in #245/#246. Issue #244 will be closed manually after green CI + merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 added 2 commits 2026-07-31 18:33:48 +02:00

#243 : VS_NFD_MODE and the machine-readable hardening-profile catalog

CI / Lint, typecheck, test (pull_request) Successful in 6m12s

Details

CI / Build container images (pull_request) Successful in 4m2s

Details

CI / Auth e2e pack (pull_request) Successful in 8m29s

Details

CI / Import/export fidelity gate (pull_request) Successful in 54s

Details

CD / Build and push images (push) Successful in 31s

Details

CD / Deploy to Test (push) Successful in 14s

Details

CD / Smoke tests against Test (push) Successful in 1m29s

Details

CD / Promote to Int (push) Successful in 14s

Details

CI / Build container images (push) Has been skipped

Details

CI / Lint, typecheck, test (push) Successful in 6m30s

Details

CI / Auth e2e pack (push) Successful in 8m6s

Details

CI / Import/export fidelity gate (push) Successful in 57s

Details

da5fd7c770

The deployment declares through VS_NFD_MODE (off | marked | hidden |
enforced, default off) how the application treats configuration that
violates the VS-NfD reference profile — deploy-level like
BACKUP_ALLOWED_TARGETS, so a compromised Site Admin cannot widen it.
The catalog in shared (vs-nfd-profile.ts) is the single source of
truth: every profile-relevant setting with a decidable compliant value,
judgement calls in an explicit advisory list, and a fence test parsing
the hardening guide's reference tables so neither can drift (pattern
#201). The api evaluates the catalog against the typed settings
registry and validated env and exposes mode + verdict on
GET /admin/system/vs-nfd-profile; the admin settings view shows the
card whenever the mode is not off. Display only — the treatments land
with #244–#246 (ADR 0027, proposed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

#244 : mode marked — flag profile-violating configuration in the UI

CI / Auth e2e pack (pull_request) Failing after 8m21s

Details

CI / Import/export fidelity gate (pull_request) Has been skipped

Details

CI / Lint, typecheck, test (pull_request) Successful in 6m21s

Details

CI / Build container images (pull_request) Successful in 3m53s

Details

1c774596e1

Every catalog-listed control on the admin surfaces carries an accessible
deviation marking in mode marked: text + icon under the control (never
colour alone), part of the control's accessible description
(aria-describedby), i18n de+en. The check runs against the CURRENT
control value, so a violating choice is marked before saving. Covered
controls: registration mode, new-page classification, upload policy,
SVG policy, the four master switches (api/mcp/feeds/plugins), the legal
texts (violating while empty), and the Nextcloud backup toggle on the
system panel. The profile card (#243) gains the warning summary and the
hardening-guide reference. e2e: new vs-nfd-marking pack (marked half in
CI — the e2e api now runs VS_NFD_MODE=marked, which also puts the
marked state into the a11y admin scan; off half in local default runs;
both halves verified live). hidden/enforced follow in #245/#246.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 force-pushed issue-244-vs-nfd-marked from 1c774596e1 to 5fdef95f67

2026-07-31 18:49:31 +02:00

Compare

fable-5 merged commit 5fdef95f67 into main

2026-07-31 19:06:21 +02:00

fable-5 referenced this pull request

2026-07-31 19:06:36 +02:00

[VS-NfD] Mode "marked": flag profile-violating configuration options in the UI #244

fable-5 referenced this pull request

2026-07-31 19:11:07 +02:00

#245: mode hidden — hide profile-violating options, mark the hiding #294

Sign in to join this conversation.