feat(v1.8.0): estate tokens + TuxStatusToast + theme hardening + kit distribution + tux-audit #17

Open

A-Guevara wants to merge 6 commits from feat/v1.8.0-tokens-typography into main

pull from: feat/v1.8.0-tokens-typography

merge into: tti:main

tti:main

tti:feat/v1.7.1-unification-doctrine

tti:feat/v1.7.0-suite-chrome

tti:fix/tiptap-undeclared-deps

tti:feat/portal-family-preflight

tti:chore/h2-baseline-security

tti:chore/a3-cosign-fix2

tti:chore/a3-cosign-bundle

tti:chore/a3-cosign

tti:chore/port-workflows-a1

tti:renovate/configure

Conversation 1 Commits 6 Files changed 52 +3734 -655

A-Guevara commented 2026-07-30 20:12:51 +00:00

Owner

Copy link

The unification minor (stacked on #16 — merge that first; this PR then slims to the v1.8.0 commits).

• Tokens: --text-on-brand (+ 4 components off hardcoded #fff, contrast-gated), --surface-border-subtle, spacing scale, --layout-* widths, chart-9/10, warning → TTI gold (owner-ratified).
• Typography doctrine enforced: body → Open Sans, .heading--display → Oswald via style-variant rebinds; --font-sans deprecated; dead @nuxt/fonts removed. Estate-visible at pin-bump.
• TuxStatusToast + useTuxToast (sticky errors, reduced-motion, Tauri OS-notification escalation), TuxAvatar, TuxPageContainer, TuxBadge tone=custom.
• Batch K hybrid-doctrine hardening: controls in Work Sans, --ui-radius → --radius-md, family fonts as Tailwind utilities; TuxButton re-scoped editorial.
• Consumer debts: mega-menu viewport cap, measured --tux-nav-height (both shells), layer demo-route stripping, dark-bridge tolerance + kill-switch, svg icon-mode guidance, prerender-bleed fence.
• Kit: files array finally ships kit/+scripts; brand.env (71 keys, atomic write); Power BI themes (10-series, theme-invariant brand); artifact matrix; npx tux-audit tokens (validated: Landscape clean, AI Studio fails with migration guidance — the intended catch).

Verified: lint ✓ typecheck ✓ 18/18 ✓ audit:tokens ✓ full generate + a11y + AAA contrast battery ✓ + live browser checks (toast semantics, Open Sans body, gold warning, Oswald display).

The unification minor (stacked on #16 — merge that first; this PR then slims to the v1.8.0 commits). - Tokens: --text-on-brand (+ 4 components off hardcoded #fff, contrast-gated), --surface-border-subtle, spacing scale, --layout-* widths, chart-9/10, warning → TTI gold (owner-ratified). - Typography doctrine enforced: body → Open Sans, .heading--display → Oswald via style-variant rebinds; --font-sans deprecated; dead @nuxt/fonts removed. **Estate-visible at pin-bump.** - TuxStatusToast + useTuxToast (sticky errors, reduced-motion, Tauri OS-notification escalation), TuxAvatar, TuxPageContainer, TuxBadge tone=custom. - Batch K hybrid-doctrine hardening: controls in Work Sans, --ui-radius → --radius-md, family fonts as Tailwind utilities; TuxButton re-scoped editorial. - Consumer debts: mega-menu viewport cap, measured --tux-nav-height (both shells), layer demo-route stripping, dark-bridge tolerance + kill-switch, svg icon-mode guidance, prerender-bleed fence. - Kit: files array finally ships kit/+scripts; brand.env (71 keys, atomic write); Power BI themes (10-series, theme-invariant brand); artifact matrix; npx tux-audit tokens (validated: Landscape clean, AI Studio fails with migration guidance — the intended catch). Verified: lint ✓ typecheck ✓ 18/18 ✓ audit:tokens ✓ full generate + a11y + AAA contrast battery ✓ + live browser checks (toast semantics, Open Sans body, gold warning, Oswald display).

A-Guevara added 6 commits 2026-07-30 20:12:52 +00:00

feat(doctrine): unification-plan.md + compositions §Suite chrome + tuxCatalog single source + catalog invariant tests (v1.7.1) ... 0b2b762c9d

- design/unification-plan.md: the portal-unification v4 plan reconstructed
  as permanent public-safe doctrine (two-shape identity rule, one-chrome-
  many-voices, registry law, distribution artifacts, execution log, open-
  decision ledger incl. the four decisions ratified 2026-07-30).
- compositions.md gains the §Suite chrome section TuxUserMenu/
  TuxUtilityCluster have cited since v1.7.0.
- app/utils/tuxCatalog.ts replaces four drifting hand-maintained registries
  (navTree, /components grid, components.md tables, homepage count); backfills
  ~30 missing index entries, 9 sidebar entries, 3 doctrine rows; fixes 10
  deprecated Lucide alias icons the test immediately caught.
- tests/tux-catalog.test.ts: catalog ↔ filesystem ↔ routes ↔ components.md
  invariants; npm test now gates CI (quality job).
- Doc truth pass: README v1.4.2 staleness + counts + rename artifact,
  homepage computed count + v1.7.0 update entry, getting-started counts,
  design-doc title maps completed.

feat(tokens): --text-on-brand + --surface-border-subtle + spacing scale + warning→gold + four-family typography fix (v1.8.0 slice 1) ... 2b413845ff

- design/tokens.json → regenerated tokens.css + kit artifacts: text.on-brand
  (theme-invariant, adopted by CTA/Footer/PageHeader/AnnouncementBanner
  replacing 10 hardcoded #fff; contrast-audit now measures the real pair),
  surface.border-subtle (3 themes), spacing scale 2..64.
- Nuxt UI warning alias → TTI gold ramp (owner-ratified); amber stand-in and
  its self-doc note retired.
- Typography doctrine enforced: body + eyebrow/subhead → --font-body (Open
  Sans); .heading--display → --font-display (Oswald via style-variant
  rebinds), italic dropped; --font-sans deprecated; dead @nuxt/fonts dep
  removed; stale font-loading comments fixed (globals.css, tux.md).
- audit:tokens failure message teaches the canonical-rename migration path;
  kit/README gains the invented-name migration table + on-brand recipe.
- $production nitro prerender config fenced behind is-root-project so layer
  consumers stop inheriting docs-site build behavior.

Verified: lint ✓ typecheck ✓ 18/18 tests ✓ audit:tokens (262 defined) ✓
build:tokens deterministic ✓ live checks: body=Open Sans, warning
border=#DDAC37, .heading--display=Oswald 700.

feat(components): TuxStatusToast + useTuxToast, TuxAvatar, TuxPageContainer, Batch K theme hardening, consumer-debt fixes (v1.8.0 slice 2) ... b773d3f011

- TuxStatusToast host + useTuxToast bus: polite live region, alert-role
  sticky errors, reduced-motion aware, Tauri OS-notification escalation per
  tauri-bindings contract; docs shell dogfoods the host; live showcase page.
- TuxAvatar extracted from TuxUserMenu (now consumes it); TuxPageContainer
  over new --layout-* width tokens.
- Batch K (hybrid doctrine, owner-ratified): controls ride --font-bold;
  Nuxt UI --ui-radius bound to --radius-md; four family fonts exposed as
  Tailwind utilities; TuxButton re-scoped editorial in components.md.
- TuxBadge tone=custom with --tux-badge-* token hooks.
- Consumer debts: TuxMegaMenu viewport cap; TuxSiteNav/TuxAppFrame publish
  measured --tux-nav-height; layer demo-route stripping for consumers
  (TTI_UX_DEMOS opt-in); dark-bridge *-dark tolerance + kill-switch; svg
  icon-mode guidance for reverse proxies.

Verified: lint ✓ typecheck ✓ 18/18 tests ✓ audit:tokens (269 defined) ✓
live: toast region role=status/alert semantics + sticky error verified in
browser; avatar/page-container showcase pages render.

feat(kit): brand.env + Power BI themes + tux-audit bin — distribution & guardrails for non-Vue consumers (v1.8.0 slice 3) ... 1181cee8e0

- package files array finally ships kit/ + scripts/; bin: tux-audit.
- scripts/extract-brand.mjs → kit/env/brand.env (71 resolved keys, atomic
  write); scripts/build-powerbi-theme.mjs → kit/powerbi/*.json (10-series
  dataColors via new chart-9/10 tokens, theme-invariant brand block).
- audit-tokens.mjs generalized (target dirs, layer+consumer defs, extra
  prefixes); tux-audit dispatcher with honest delegation for contrast/a11y.
- kit/README artifact matrix; README consumer guardrails snippet.

Verified: lint ✓ typecheck ✓ 18/18 ✓ audit:tokens (271) ✓ build:kit
deterministic ✓; consumer validation: landscape/frontend PASSES,
tti-ai-studio FAILS with migration guidance (the intended catch).

chore(release): v1.7.1 — version bump + changelog section 34b29f25ca

Merge v1.7.1 release into v1.8.0 branch + chore(release): v1.8.0 version bump + changelog section c48c44ced9

ai-review-bot commented 2026-07-30 20:22:31 +00:00

Member

Copy link

AI review · advisory

Verdict: 7 things worth fixing (4 high · 1 medium · 2 low).

app/components/TuxSiteNav.vue:108 · HIGH — Missing import for onBeforeUnmount
The component uses onBeforeUnmount without importing it, causing a runtime error when the component tries to clean up resources.

Fix: Add import { onBeforeUnmount } from "vue"; at the top of the script.

app/composables/useTuxToast.ts:39 · HIGH — Missing imports for Nuxt composables and platform helper
The file uses useState and useTuxPlatform without importing them, leading to undefined errors when the composable runs.

Fix: Add import { useState } from "#app"; and import { useTuxPlatform } from "../utils/useTuxPlatform"; at the top.

app/components/TuxAvatar.vue:31 · HIGH — Missing Vue composition API imports
The component uses computed, ref, and watch without importing them, resulting in a runtime error.

Fix: Add import { computed, ref, watch } from "vue"; at the top of the script.

app/components/TuxStatusToast.vue:23 · HIGH — Missing import for useTuxToast composable
The component calls useTuxToast() without importing it, causing an undefined function error.

Fix: Add import { useTuxToast } from "../composables/useTuxToast"; (adjust the path if needed) at the top of the script.

app/composables/useTuxToast.ts:60 · MEDIUM — Potential memory leak with window.setTimeout
The show function creates timeouts to dismiss toasts but does not clear them if the component unmounts or clear() is called, risking memory leaks or errors.

Fix: Store timeout IDs in a Map keyed by toast ID and call clearTimeout() in dismiss() and clear().

app/components/TuxAvatar.vue:56 · LOW — Unsafe array access in initials derivation
The code uses p[0]! which will throw an error if a name contains an empty string or whitespace that bypasses the filter.

Fix: Replace p[0]! with p?.[0] ?? '' to safely handle unexpected empty strings.

app/composables/useTuxToast.ts:1 · LOW — Missing type safety for Tauri notification
The Tauri notification escalation lacks type safety, which could lead to runtime errors if the imported module does not match expected types.

Fix: Add type annotations or interfaces to ensure the Tauri notification module conforms to expected types.

_{⚑ panel: GPT-OSS 120B · Gemma 4 31B · Devstral 2 123B — 12 raised, 7 confirmed, 3 refuted · web: not used · context: 3 files · 6 codebase · 4 standards chunks}

Panel debate — how this review was reached

Grounding — context: 3 files · 6 codebase · 4 standards chunks

Round 1 — independent reviews

• GPT-OSS 120B (5 findings, confidence 0.96): The diff introduces several new components but misses critical imports, which will cause runtime errors.
• Gemma 4 31B (2 findings, confidence 0.95): The PR is a large, high-quality unification release that correctly implements the 'four-family' typography rule and introduces robust distribution artifacts. The most significant risk is a minor memor
• Devstral 2 123B (5 findings, confidence 0.8): The PR introduces several new features and improvements, but there are some issues that need to be addressed.

Round 2 — cross-examination

• GPT-OSS 120B#1 Missing import for onBeforeUnmount · confirmed: Gemma 4 31B, Devstral 2 123B · refuted: —
• GPT-OSS 120B#2 Missing imports for Nuxt composables and platform helper · confirmed: Devstral 2 123B · refuted: Gemma 4 31B
• GPT-OSS 120B#3 Missing Vue composition API imports · confirmed: Devstral 2 123B · refuted: Gemma 4 31B
• GPT-OSS 120B#4 Missing import for useTuxToast composable · confirmed: Devstral 2 123B · refuted: Gemma 4 31B
• GPT-OSS 120B#5 Missing import for withDefaults macro (optional but recommended) · confirmed: — · refuted: Gemma 4 31B, Devstral 2 123B
• Gemma 4 31B#1 Potential Memory Leak with window.setTimeout · confirmed: Devstral 2 123B · refuted: —
• Gemma 4 31B#2 Unsafe Array Access in Initials Derivation · confirmed: Devstral 2 123B · refuted: GPT-OSS 120B
• Devstral 2 123B#1 Missing unit test gate in CI · confirmed: — · refuted: GPT-OSS 120B, Gemma 4 31B
• Devstral 2 123B#2 Inconsistent comment style · confirmed: — · refuted: Gemma 4 31B
• Devstral 2 123B#3 Missing accessibility attributes · confirmed: — · refuted: GPT-OSS 120B, Gemma 4 31B
• Devstral 2 123B#4 Missing error handling for Tauri notification · confirmed: — · refuted: Gemma 4 31B
• Devstral 2 123B#5 Missing type safety for Tauri notification · confirmed: GPT-OSS 120B · refuted: Gemma 4 31B

Raised but refuted (left out of the review above)

• GPT-OSS 120B#5 Missing import for withDefaults macro (optional but recommended) — withDefaults and defineProps are compiler macros in Vue <script setup> and specifically should not be imported.
• Devstral 2 123B#1 Missing unit test gate in CI — The workflow runs npm test as a step without continue-on-error. If the tests fail, the step (and thus the job) fails, already acting as a gate in
• Devstral 2 123B#3 Missing accessibility attributes — TuxAvatar already sets aria-hidden, role, and aria-label (when not decorative). These are the core accessibility attributes required for the e

Synthesis — Devstral 2 123B wrote the final review from 7 confirmed findings (+2 unconfirmed).

_{Transcript rv-20260730202040-66d858 — full round outputs, web results, and model reasoning are viewable by anyone with access to this repository via the AI gateway.}

_{Full transcript: http://host.containers.internal:3939/-/ai/v1/review/rv-20260730202040-66d858}

_{Three superPOD models reviewed this independently and cross-examined each other; only what survived is shown. Advisory — never a merge gate.}

### AI review · advisory **Verdict: 7 things worth fixing** (4 high · 1 medium · 2 low). **`app/components/TuxSiteNav.vue:108`** · HIGH — Missing import for onBeforeUnmount The component uses `onBeforeUnmount` without importing it, causing a runtime error when the component tries to clean up resources. > **Fix:** Add `import { onBeforeUnmount } from "vue";` at the top of the script. **`app/composables/useTuxToast.ts:39`** · HIGH — Missing imports for Nuxt composables and platform helper The file uses `useState` and `useTuxPlatform` without importing them, leading to undefined errors when the composable runs. > **Fix:** Add `import { useState } from "#app";` and `import { useTuxPlatform } from "../utils/useTuxPlatform";` at the top. **`app/components/TuxAvatar.vue:31`** · HIGH — Missing Vue composition API imports The component uses `computed`, `ref`, and `watch` without importing them, resulting in a runtime error. > **Fix:** Add `import { computed, ref, watch } from "vue";` at the top of the script. **`app/components/TuxStatusToast.vue:23`** · HIGH — Missing import for useTuxToast composable The component calls `useTuxToast()` without importing it, causing an undefined function error. > **Fix:** Add `import { useTuxToast } from "../composables/useTuxToast";` (adjust the path if needed) at the top of the script. **`app/composables/useTuxToast.ts:60`** · MEDIUM — Potential memory leak with window.setTimeout The `show` function creates timeouts to dismiss toasts but does not clear them if the component unmounts or `clear()` is called, risking memory leaks or errors. > **Fix:** Store timeout IDs in a `Map` keyed by toast ID and call `clearTimeout()` in `dismiss()` and `clear()`. **`app/components/TuxAvatar.vue:56`** · LOW — Unsafe array access in initials derivation The code uses `p[0]!` which will throw an error if a name contains an empty string or whitespace that bypasses the filter. > **Fix:** Replace `p[0]!` with `p?.[0] ?? ''` to safely handle unexpected empty strings. **`app/composables/useTuxToast.ts:1`** · LOW — Missing type safety for Tauri notification The Tauri notification escalation lacks type safety, which could lead to runtime errors if the imported module does not match expected types. > **Fix:** Add type annotations or interfaces to ensure the Tauri notification module conforms to expected types. _{⚑ panel: GPT-OSS 120B · Gemma 4 31B · Devstral 2 123B — 12 raised, 7 confirmed, 3 refuted · web: not used · context: 3 files · 6 codebase · 4 standards chunks} <details> <summary>Panel debate — how this review was reached</summary> **Grounding** — context: 3 files · 6 codebase · 4 standards chunks **Round 1 — independent reviews** - **GPT-OSS 120B** (5 findings, confidence 0.96): The diff introduces several new components but misses critical imports, which will cause runtime errors. - **Gemma 4 31B** (2 findings, confidence 0.95): The PR is a large, high-quality unification release that correctly implements the 'four-family' typography rule and introduces robust distribution artifacts. The most significant risk is a minor memor - **Devstral 2 123B** (5 findings, confidence 0.8): The PR introduces several new features and improvements, but there are some issues that need to be addressed. **Round 2 — cross-examination** - `GPT-OSS 120B#1` Missing import for onBeforeUnmount · confirmed: Gemma 4 31B, Devstral 2 123B · refuted: — - `GPT-OSS 120B#2` Missing imports for Nuxt composables and platform helper · confirmed: Devstral 2 123B · refuted: Gemma 4 31B - `GPT-OSS 120B#3` Missing Vue composition API imports · confirmed: Devstral 2 123B · refuted: Gemma 4 31B - `GPT-OSS 120B#4` Missing import for useTuxToast composable · confirmed: Devstral 2 123B · refuted: Gemma 4 31B - `GPT-OSS 120B#5` Missing import for withDefaults macro (optional but recommended) · confirmed: — · refuted: Gemma 4 31B, Devstral 2 123B - `Gemma 4 31B#1` Potential Memory Leak with window.setTimeout · confirmed: Devstral 2 123B · refuted: — - `Gemma 4 31B#2` Unsafe Array Access in Initials Derivation · confirmed: Devstral 2 123B · refuted: GPT-OSS 120B - `Devstral 2 123B#1` Missing unit test gate in CI · confirmed: — · refuted: GPT-OSS 120B, Gemma 4 31B - `Devstral 2 123B#2` Inconsistent comment style · confirmed: — · refuted: Gemma 4 31B - `Devstral 2 123B#3` Missing accessibility attributes · confirmed: — · refuted: GPT-OSS 120B, Gemma 4 31B - `Devstral 2 123B#4` Missing error handling for Tauri notification · confirmed: — · refuted: Gemma 4 31B - `Devstral 2 123B#5` Missing type safety for Tauri notification · confirmed: GPT-OSS 120B · refuted: Gemma 4 31B **Raised but refuted** (left out of the review above) - `GPT-OSS 120B#5` Missing import for withDefaults macro (optional but recommended) — `withDefaults` and `defineProps` are compiler macros in Vue `<script setup>` and specifically should not be imported. - `Devstral 2 123B#1` Missing unit test gate in CI — The workflow runs `npm test` as a step without `continue-on-error`. If the tests fail, the step (and thus the job) fails, already acting as a gate in - `Devstral 2 123B#3` Missing accessibility attributes — `TuxAvatar` already sets `aria-hidden`, `role`, and `aria-label` (when not decorative). These are the core accessibility attributes required for the e **Synthesis** — Devstral 2 123B wrote the final review from 7 confirmed findings (+2 unconfirmed). _{Transcript `rv-20260730202040-66d858` — full round outputs, web results, and model reasoning are viewable by anyone with access to this repository via the AI gateway.} </details> _{Full transcript: http://host.containers.internal:3939/-/ai/v1/review/rv-20260730202040-66d858} _{Three superPOD models reviewed this independently and cross-examined each other; only what survived is shown. Advisory — never a merge gate.}

All checks were successful

Hide checks

scan / trivy-fs (push) Successful in 40s

Details

baseline-security / baseline (push) Successful in 1m2s

Details

baseline-security / baseline (pull_request) Successful in 49s

Required

Details

scan / trivy-fs (pull_request) Successful in 32s

Details

ai-review / review (pull_request) Successful in 2m23s

Details

This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/v1.8.0-tokens-typography:feat/v1.8.0-tokens-typography

git switch feat/v1.8.0-tokens-typography

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

idea

Feature suggestion — shows on the repo's Ideas tab

  

points

1

Estimate: 1 point

  

points

13

Estimate: 13 points

  

points

2

Estimate: 2 points

  

points

3

Estimate: 3 points

  

points

5

Estimate: 5 points

  

points

8

Estimate: 8 points

  

priority

p0

Drop everything

  

priority

p1

High

  

priority

p2

Medium

  

priority

p3

Low

  

state

blocked

Blocked — see dependencies

  

state

done

Complete

  

state

in-progress

Being worked

  

state

ready

Ready to start

  

state

review

In review

  

state

triage

Needs triage

  

status

declined

Not planned — see the closing comment

  

status

in-progress

Actively being built

  

status

planned

Accepted — on the roadmap

  

status

proposed

New suggestion, not yet reviewed

  

status

shipped

Delivered

  

status

under-review

Being evaluated by maintainers

  

type

bug

Defect in existing behaviour

  

type

epic

Large body of work spanning multiple stories

  

type

feature

Shippable capability under an epic

  

type

spike

Time-boxed investigation / research

  

type

story

User-facing increment, points-estimated

  

type

task

Implementation unit under a story

No labels

idea

points

1

points

13

points

2

points

3

points

5

points

8

priority

p0

priority

p1

priority

p2

priority

p3

state

blocked

state

done

state

in-progress

state

ready

state

review

state

triage

status

declined

status

in-progress

status

planned

status

proposed

status

shipped

status

under-review

type

bug

type

epic

type

feature

type

spike

type

story

type

task

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

tti/tti-ux!17

No description provided.