docs: show the console in the README, plus two fixes it exposed - #97
Merged
Conversation
…t exposed Seven screenshots of a locally-seeded instance: the overview in both themes, the findings queue, a triaged finding with its event trail, a scan mid-flight, a source, and the engine fleet. Palette-quantised and served at 1x — 664 KB for the set, since these live in git for good. Capturing them found two defects that only show up on a rendered page: * `.field-hint` sits inside `.stack > label`, so every line of form guidance inherited the label's mono/uppercase/tracked treatment and rendered as shouted monospace. It is prose, so it now resets all three rather than inheriting them. * An assign event records the assignee's *id*, which is what stays correct when somebody is renamed — but the history rendered it raw, so the trail read "assign — → 966d7342-…". A `person` filter substitutes the name where the reader is allowed to know it and shortens the id where they are not. docs/web.md notes that the screenshots are hand-captured and why reproducing them needs a seeding script and a login shim that deliberately live outside the tree: the console is OIDC-only, and a dev bypass that trusts a query string is exactly the kind of thing that survives into a production image. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #96, which merged while this was being captured.
Screenshots
Seven shots of a locally-seeded instance, embedded in the README behind a
<details>gallery with the overview as the hero:overview-light/overview-darkfindings-lightfinding-detail-lightFindingEventtrailscan-live-darksource-detail-lightengines-lightPalette-quantised and served at 1x — 664 KB for the set, down from 4.3 MB raw, because these live in git for good. Every reference resolves and nothing is orphaned;
docs/is already in.dockerignore, so none of it reaches an image.Two fixes the screenshots exposed
Both are the kind of thing that only shows up on a rendered page, which is rather the point of looking at one.
.field-hintinherited its label's shouting. Hints sit inside.stack > label, which is mono, uppercase and letter-spaced because it is a field label. So every line of form guidance rendered asA JUDGEMENT CAN ONLY GO BACK TO OPEN, NEVER STRAIGHT TO ANOTHER JUDGEMENT…. It is prose, so it now resets font, case and tracking rather than inheriting them.The audit trail printed a raw UUID. An assign event records the assignee's id — correct, because that is what survives a rename — but the history rendered
from → toverbatim, so the trail readassign — → 966d7342-4991-4f42-97b1-dd2aef9085e1. Apersonfilter substitutes the display name where the reader is allowed to know it (the names map is already in the context, and is admin-only by construction) and shortens the id where they are not. Assign events now readunassigned → **Chidi Vance**.On reproducing them
docs/web.mdnow says the screenshots are hand-captured and will drift — a stale one is a doc bug, not a broken build.It also says why they cannot simply be regenerated by a script in this repo: doing so needs a database of fabricated findings and a way to sign in, and the console is OIDC-only (ADR 0005). A development bypass — a login route that trusts a query string — is exactly the kind of thing that survives into a production image, so both the seeding script and the
/dev-loginwrapper live outside the tree. Nothing underapps/knows either exists.make checkgreen: ruff, mypy, 985 tests.🤖 Generated with Claude Code