Sync stage fixes into dev #11

2026-05-07T06:05:44Z

will.anderson commented

2026-05-07 06:05:44 +00:00

Resolves divergence between dev and stage. Dev CI approach (elb + pre-installed SDK) kept. Stage app fixes brought in: -DHAVE_CURL, free-tier checkout, Stripe dedup, escaped styles in styles.el.

will.anderson added 14 commits 2026-05-07 06:05:45 +00:00

Merge pull request 'feat(account): email/password sign-up on account page' (#2 ) from dev into stage

Stage — Build, push & deploy to marketing-stage / deploy-stage (push) Successful in 2m47s

Details

6075f49e8a

Merge pull request 'promote: dev → stage' (#2 ) from dev into stage c49a838aad

promote: dev to stage

ci: trigger stage build after API merge a936d2ebb7

ci: trigger stage CI after API merge 8a8762ad4f

ci: fix EL_HOME to use lang/ subdirectory for El repo clone 28c47c11c9

El repo is organized under lang/ — runtime and dist/platform binaries
are at lang/el-compiler/runtime/ and lang/dist/platform/, not at root.
Setting EL_HOME=$DEST/lang makes RUNTIME_SRC resolve correctly so
build-stage.sh can cp el_runtime.{c,h,js} from the right location.

Fix pentest security findings 8d741fac20

- Turnstile server-side verification: reject requests with no cf_token;
  read secret from TURNSTILE_SECRET_KEY env (no longer hardcoded); fix
  siteverify URL from v0 to v1
- Security headers: wrap all responses via http_response() with HSTS,
  X-Content-Type-Options, X-Frame-Options, Referrer-Policy,
  Permissions-Policy, and Content-Security-Policy
- GCS error info leak: guard /share/<id> response — only return content
  that starts with '<' (valid HTML); GCS error JSON is silently 404d
- robots.txt: remove Sitemap reference to sitemap.xml that returns 404
- SRI hash: add integrity + crossorigin attributes to marked.min.js CDN tag
- Attestations bucket: write /api/attest records to GCS_ATTEST_BUCKET
  (dedicated private bucket) instead of the share bucket; falls back to
  GCS_SHARE_BUCKET if GCS_ATTEST_BUCKET is not set (legacy deploys)

Merge pull request 'fix: security hardening from pentest findings' (#6 ) from fix/pentest-security-hardening into stage

Stage — Build, push & deploy to marketing-stage / deploy-stage (push) Failing after 2m37s

Details

f19403ba68

fix: rebuild soul-demo.c from source, compile against el_runtime.c directly 0202b09d37

soul-demo.c was previously an older compiled artifact that triggered an
undefined reference to emit_metric/emit_log/trace_span_* at link time in CI.

Two fixes:
1. Rebuild soul-demo.c from soul-demo.el using current elc — cleaner
   codegen (no double-wrapped el_from_float), same logic, unix_timestamp
   collision with el_runtime.c removed.
2. Dockerfile.stage: compile soul-demo against el_runtime.c directly
   (not el_runtime.o) so all runtime symbols are always resolved from the
   staged source, bypassing any Docker layer cache divergence on el_runtime.o.

Merge pull request 'fix: soul-demo emit_metric linker error — rebuild from source, compile with el_runtime.c' (#7 ) from fix/soul-demo-emit-metric into stage

Stage — Build, push & deploy to marketing-stage / deploy-stage (push) Failing after 2m26s

Details

843b6e07a7

fix: add -DHAVE_CURL to el_runtime.c compilation, restore el_runtime.o for soul-demo f0a6b55a13

Root cause: the staged el_runtime.c (from el.git) wraps the entire OTLP
observability section (emit_metric, emit_log, trace_span_start/end) in
#ifdef HAVE_CURL. Without -DHAVE_CURL, those symbols are compiled out,
causing the undefined reference linker errors.

libcurl IS available (installed via libcurl4-openssl-dev), so -DHAVE_CURL
correctly enables the OTLP code path.

Also reverts the soul-demo compile to use el_runtime.o (the pre-compiled
cached object) now that the object will contain the correct symbols.

Merge pull request 'fix: -DHAVE_CURL for el_runtime OTLP — resolves emit_metric linker error' (#8 ) from fix/have-curl-define into stage

Stage — Build, push & deploy to marketing-stage / deploy-stage (push) Successful in 3m12s

Details

1cf2ef8835

Fix free tier checkout and Stripe duplicate customers 00e62bb010

Free tier:
- checkout-stripe.el bails out immediately for plan=free (no Stripe init)
- checkout-auth.el skips payment section reveal and initStripe for free plan
- checkout-free.el shows #free-success panel after auth (no card ever shown)
- /api/payment-intent returns early for free plan — no Stripe call

Stripe dedup (all paid plans):
- Stripe init now deferred to window.initStripe(email, name), called by
  checkout-auth.el after sign-in — email is known before intent is created
- /api/payment-intent finds-or-creates Stripe Customer by email before
  creating the PaymentIntent/SetupIntent and attaches customer upfront
- Eliminates the window between intent creation and /api/link-customer
  that was producing duplicate guest customers

Merge pull request 'Fix free tier checkout and Stripe duplicate customers' (#10 ) from fix/have-curl-define into stage

Stage — Build, push & deploy to marketing-stage / deploy-stage (push) Successful in 3m41s

Details

e68de7892f

Merge stage fixes into dev — HAVE_CURL, free-tier checkout, Stripe dedup, escaped styles 494f4ef585

will.anderson merged commit fef846e6f5 into dev

2026-05-07 06:05:54 +00:00

will.anderson referenced this issue from a commit

2026-05-07 06:05:55 +00:00

Merge pull request 'Sync stage fixes into dev' (#11) from sync/dev-stage into dev

Sign in to join this conversation.