E09: Product documentation backlog #101

domverse · 2026-08-23T15:04:17+02:00

domverse commented

2026-08-23 15:04:17 +02:00

Adds the E09 epic and its five stories: in-app documentation view, installation manual, architecture overview, illustrated user manual, and the documentation acceptance gate.

No application code changes. tests/story_traceability.json lists US09-01..05 as planned so the release gate's story matrix stays complete.

Decisions recorded in the epic: markdown as the source, a vendored renderer (marked) rather than a CDN or a hand-written one, and mermaid diagrams rendered with script-src untouched — measured, not assumed: mermaid's bundle has no eval(/new Function, and under this app's exact CSP it rendered an SVG with zero script-src violations. Only style-src gains 'unsafe-inline'.

🤖 Generated with Claude Code

https://claude.ai/code/session_015csGY8XV1M92fHfKnMmjtu

Adds the E09 epic and its five stories: in-app documentation view, installation manual, architecture overview, illustrated user manual, and the documentation acceptance gate. No application code changes. `tests/story_traceability.json` lists US09-01..05 as planned so the release gate's story matrix stays complete. Decisions recorded in the epic: markdown as the source, a vendored renderer (marked) rather than a CDN or a hand-written one, and mermaid diagrams rendered with `script-src` untouched — measured, not assumed: mermaid's bundle has no `eval(`/`new Function`, and under this app's exact CSP it rendered an SVG with zero `script-src` violations. Only `style-src` gains `'unsafe-inline'`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015csGY8XV1M92fHfKnMmjtu

domverse added 1 commit 2026-08-23 15:04:18 +02:00

docs: add E09, the product documentation epic

Test / suites (pull_request) Failing after 3m27s

Details

Test / container (pull_request) Has been skipped

Details

792134c72d

Adds the installation manual, architecture overview, and illustrated user
manual as a five-story epic, plus the acceptance gate that keeps them true.

The documentation is markdown under docs/, so the same files are readable in
the repository and rendered by the deployed application at /app/#/docs. An
operator who was handed a URL and an access secret has no repository checkout
in front of them, and the network the application is deployed to is not
assumed to reach a CDN.

Two decisions are recorded in the epic rather than left to implementation:

- The renderer is vendored (marked), not written and not fetched.
- Diagrams are mermaid, rendered client-side, with script-src untouched.
  Whether mermaid needs 'unsafe-eval' was measured rather than assumed: its
  bundle contains no eval( and no new Function, and rendered under this
  application's exact CSP it produced an SVG with no script-src violation.
  What it does violate is style-src, which gains 'unsafe-inline'. With
  script-src, img-src, connect-src, and font-src all unchanged, that leaves
  defacement rather than execution or exfiltration. The alternative --
  pre-rendering diagrams to committed SVG with the already-installed
  Playwright -- is recorded as the migration if that trade is ever refused.

Screenshots are generated from the running application, never pasted, and
every documented setting, command, exit code, error code, and state is
cross-checked against the code that implements it, so stale documentation
fails a test instead of misleading an operator.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015csGY8XV1M92fHfKnMmjtu

domverse merged commit 370f966d29 into main

2026-08-23 15:04:46 +02:00

domverse referenced this issue from a commit

2026-08-23 15:04:48 +02:00

E09: Product documentation backlog (#101)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: domverse/photoanalyzer#101