docs(ui): capture protected athlete coverage - #625
Merged
zacjones93 merged 37 commits intoJul 15, 2026
Merged
Conversation
Contributor
WalkthroughThis change adds authenticated protected-athlete UI evidence for dashboard, log, programming, settings, and workout routes, then records the scenarios in coverage plans, ledgers, and audit documentation. ChangesProtected Athlete Evidence
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This was referenced Jul 10, 2026
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Contributor
Author
|
Addressed the independent P2 privacy finding in Delta verification: privacy scan passed; 33 captures / 145 unique artifacts with zero bad hashes, missing files, or orphans; focused page-coverage tests 29/29; ledger freshness, LAT, diff check, repository lint, and repository type-check all pass. @coderabbitai review |
Contributor
|
✅ Action performedReview finished.
|
Contributor
Author
|
Independent delta review at exact head The sole P2 is resolved. All 33 network logs use stable |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 11
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
🟡 Minor comments (22)
docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.network.json-38-39 (1)
38-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove absolute local filesystem paths from committed network evidence.
The
/Users/zacjones/.codex/worktrees/...paths expose a developer username and local workspace structure. Normalize@fsrequests to repository-relative or redacted paths before committing; apply this to all repeated entries in the file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.network.json` around lines 38 - 39, Remove the developer-specific absolute filesystem prefix from all repeated Vite `@fs` request paths in the recorded network evidence, replacing it with a repository-relative or consistently redacted path while preserving the requested file location and valid JSON.docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.network.json-39-39 (1)
39-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove host-specific filesystem paths from committed evidence.
The capture includes absolute
/Users/zacjones/...paths, exposing a local username/worktree layout and making the artifact machine-specific. Sanitize or normalize all/@fs/Users/...entries before committing the evidence.Also applies to: 74-74, 95-95
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.network.json` at line 39, Remove machine-specific absolute filesystem paths from the committed network evidence, including all `/@fs/Users/...` entries at the referenced locations. Replace them with a stable sanitized or normalized path that does not expose usernames, worktree names, or local directory layouts.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.network.json-39-39 (1)
39-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove host-specific filesystem paths from committed evidence.
This network capture also embeds absolute
/Users/zacjones/...paths. Normalize or omit these entries so the evidence does not leak local environment details.Also applies to: 74-74, 81-81
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.network.json` at line 39, Remove the absolute host-specific `/Users/zacjones/...` filesystem paths from the network evidence entries, including the occurrences corresponding to the referenced additional locations. Normalize them to a repository-independent path or omit the entries while preserving valid evidence JSON.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.network.json-39-39 (1)
39-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove host-specific filesystem paths from committed evidence.
The not-found network artifact contains absolute
/Users/zacjones/...paths as well. Sanitize these paths consistently across all generated network evidence.Also applies to: 74-74, 102-102
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.network.json` at line 39, Sanitize the generated network evidence artifacts by removing host-specific absolute filesystem paths such as `/Users/zacjones/...` from all affected entries, including the paths at the referenced locations. Update the evidence-generation or normalization logic responsible for these artifacts so future outputs consistently use portable paths.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.network.json-38-42 (1)
38-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove absolute local filesystem paths from the committed network evidence.
The
/@fs/Users/zacjones/.codex/worktrees/...entries expose a developer username and local workspace layout, and the same environment-specific paths recur throughout this artifact. Redact these paths or capture against a production-like server before committing the evidence.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.network.json` around lines 38 - 42, The committed network evidence contains environment-specific absolute filesystem paths in request path entries. Remove or redact the /@fs/Users/... paths throughout this artifact, or recapture the evidence using a production-like server so no developer username or local workspace layout is recorded.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.a11y.txt-10-12 (1)
10-12: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winGive the icon-only link an accessible name.
The accessibility tree reports
link [ref=e14]without a name. Add an accessible label, or remove the link role if this element is decorative.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.a11y.txt` around lines 10 - 12, The icon-only link represented by ref e14 has no accessible name. Locate the component rendering this link and add a meaningful aria-label or accessible text; if it is purely decorative, remove its link semantics instead.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.network.json-39-42 (1)
39-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winSanitize machine-specific filesystem paths before committing this artifact.
The
/@fs/Users/zacjones/.codex/worktrees/...entries expose a developer username, local workspace structure, and non-portable paths. Normalize or redact these paths in the capture pipeline, then update any corresponding evidence hashes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.network.json` around lines 39 - 42, The recorded network artifact contains machine-specific filesystem paths. Update the evidence capture or sanitization pipeline producing the authenticated desktop network fixture to normalize or redact `/@fs/...` paths, remove usernames and workspace details, and regenerate the affected artifact and corresponding evidence hashes.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.network.json-39-42 (1)
39-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winSanitize machine-specific filesystem paths before committing this artifact.
The
/@fs/Users/zacjones/.codex/worktrees/...entries expose a developer username, local workspace structure, and non-portable paths. Normalize or redact these paths in the capture pipeline, then update any corresponding evidence hashes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.network.json` around lines 39 - 42, Sanitize machine-specific filesystem paths in the evidence capture pipeline before generating network artifacts, especially entries like the script request path shown in settings-athlete-authenticated-mobile-dark.network.json. Normalize or redact user, worktree, and local workspace segments, then regenerate the affected evidence artifacts and update their corresponding hashes.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.network.json-74-77 (1)
74-77: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRedact machine-specific filesystem paths from committed evidence.
This capture commits
/@fs/Users/zacjones/...URLs, exposing local environment metadata and making the artifact dependent on one developer’s worktree. Replace the workspace prefix with a stable placeholder throughout the network evidence before merge.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.network.json` around lines 74 - 77, Redact the machine-specific `/@fs/Users/zacjones/...` workspace prefix in the network evidence, replacing it with a stable placeholder everywhere in the captured artifact while preserving the remaining dependency path and request details.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.network.json-38-42 (1)
38-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRedact machine-specific filesystem paths from committed evidence.
The
/@fs/Users/zacjones/...URL exposes a developer username and absolute worktree layout, while also making the capture non-portable. Normalize these paths to a stable placeholder or omit dev-only module requests before committing; the same pattern repeats throughout this file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.network.json` around lines 38 - 42, Redact machine-specific absolute filesystem URLs throughout the captured network evidence, including the GET request for Vite’s env.mjs module. Replace `/@fs/Users/...` paths with a stable placeholder or remove dev-only module requests, and apply the same normalization to every repeated occurrence in this file.docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.network.json-44-47 (1)
44-47: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove machine-specific filesystem paths from the committed trace.
The captured
/@fs/Users/zacjones/.codex/worktrees/...paths expose local identity/worktree details and make the evidence machine-specific. Redact or normalize these entries before finalizing hashes and manifests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.network.json` around lines 44 - 47, Remove the machine-specific /@fs/Users/zacjones/.codex/worktrees/... prefix from the committed network trace entry, replacing it with a machine-independent normalized path while preserving the Vite env.mjs resource reference. Regenerate any associated hashes or manifests after updating the trace.docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.redirect.json-2-17 (1)
2-17: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAdd redirect response metadata to this trace. It only records
requestedUrl,finalUrl, and document fetches; there’s no 3xx,Location, or client-side redirect event, so/dashboardbecoming/isn’t shown.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.redirect.json` around lines 2 - 17, The redirect trace should include response metadata explaining the navigation from /dashboard to /. Update the trace fixture associated with the redirect capture to record the 3xx response status, its Location header, and any client-side redirect event, while preserving the existing requestedUrl, finalUrl, and document entries.docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.network.json-38-42 (1)
38-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove machine-specific filesystem paths from committed evidence.
The captured
/@fs/Users/zacjones/.codex/worktrees/...URLs expose a developer username and local checkout path, and the same pattern repeats throughout this artifact. Regenerate or sanitize these entries before committing, then refresh the corresponding hashes and manifest references.Also applies to: 72-77
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.network.json` around lines 38 - 42, Committed evidence contains machine-specific /@fs filesystem paths that expose a developer username and checkout location. Sanitize or regenerate all affected URL entries in the authenticated desktop network artifact, including the repeated entries around the referenced ranges, then update the corresponding hashes and manifest references.docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.network.json-45-49 (1)
45-49: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove machine-specific filesystem paths from committed evidence.
Line 46 exposes
/Users/zacjones/...and makes the artifact environment-specific. Normalize/@fspaths to stable project-relative placeholders or omit development-only module requests before committing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.network.json` around lines 45 - 49, Remove the machine-specific absolute filesystem path from the committed network evidence at the affected GET request, either by replacing the /@fs path with a stable project-relative placeholder or omitting this development-only Vite module request entirely; ensure no user-specific paths remain in the artifact.docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt-8-10 (1)
8-10: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAvoid skipping heading levels in the log form.
LOG RESULTis an h1 followed byFranas an h3, with no h2 in between. Use h2 for the nested workout heading or add the missing section heading.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt` around lines 8 - 10, Fix the heading hierarchy in the log form: update the nested workout heading for “Fran” from h3 to h2 following the “LOG RESULT” h1, or add an appropriate h2 section heading before it. Locate the relevant log form heading markup or accessibility label producing “LOG RESULT” and “Fran”.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txt-12-16 (1)
12-16: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winName the icon-only navigation controls.
The accessibility snapshot exposes an unnamed link at Line 12 and an unnamed button at Line 16. Add accessible names, or remove interactive semantics if these elements are decorative.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txt` around lines 12 - 16, The icon-only navigation controls are missing accessible names: identify the corresponding link and button in the affected UI component, add meaningful accessible labels via aria-label or an equivalent visible/semantic name, or remove their interactive semantics if they are decorative.docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.a11y.txt-11-15 (1)
11-15: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAdd accessible names to the unnamed links.
The snapshot exposes actionable links at Line 11 and Line 15 without accessible names. Add visible text or
aria-label; if either is decorative, remove its link semantics.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.a11y.txt` around lines 11 - 15, Add accessible names to the unnamed actionable links in the affected page by providing meaningful visible text or an appropriate aria-label; if either link is decorative and non-actionable, remove its link semantics. Verify the resulting accessibility snapshot no longer reports unnamed links.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.network.json-39-42 (1)
39-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRedact host-specific filesystem paths from the evidence.
The network artifact repeatedly exposes
/Users/zacjones/.codex/worktrees/..., leaking a local username and making the capture machine-specific. Normalize or redact/@fs/...paths before committing these artifacts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.network.json` around lines 39 - 42, The evidence artifact contains a machine-specific `/@fs/...` filesystem path exposing a local username and worktree. Update the recorded network artifact, particularly the affected `path` entry, to normalize or redact host-specific filesystem prefixes while preserving the request identity and response metadata.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.network.json-39-42 (1)
39-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRedact host-specific filesystem paths from the evidence.
The network artifact repeatedly exposes
/Users/zacjones/.codex/worktrees/..., leaking a local username and making the capture machine-specific. Normalize or redact/@fs/...paths before committing these artifacts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.network.json` around lines 39 - 42, The evidence artifact contains a host-specific `/@fs/...` filesystem path exposing a local username and worktree. Normalize or redact all `/@fs/` paths in the captured network artifacts, including the referenced script path, so committed evidence is machine-independent.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txt-72-75 (1)
72-75: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAssociate labels with the scheme and scope comboboxes.
The snapshot shows empty
LabelTextnodes, while the comboboxes are announced only by their current values. Provide programmatic labels such as “Scheme” and “Scope”.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txt` around lines 72 - 75, Associate accessible labels with the scheme and scope comboboxes represented by refs e8 and e9, replacing the empty LabelText nodes with programmatic labels “Scheme” and “Scope” via the component’s label, aria-label, or equivalent labeling mechanism.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.network.json-39-39 (1)
39-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove developer-local filesystem paths from committed evidence.
Line [39] and many later entries include
/Users/zacjones/.codex/worktrees/.... Redact or normalize these paths before committing the network artifact to avoid leaking workstation details.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.network.json` at line 39, Remove developer-specific absolute filesystem paths from the committed network evidence, including the path in the relevant JSON “path” entries. Replace them with a portable normalized path such as the package-relative module path, and verify no `/Users/...` or worktree-specific paths remain in the artifact.docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.network.json-39-39 (1)
39-39: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winRemove developer-local filesystem paths from committed evidence.
Line [39] and many later entries expose
/Users/zacjones/.codex/worktrees/..., including local dependency paths. Redact or normalize these paths before committing the artifact.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.network.json` at line 39, Committed evidence contains developer-specific absolute filesystem paths in the network artifact. Update the recorded request paths, including entries like the Vite env.mjs path, to use normalized project-relative or redacted paths throughout the artifact; verify no /Users/... or worktree-specific paths remain.
🧹 Nitpick comments (1)
docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.network.json (1)
39-39: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winCaptured network evidence embeds local developer filesystem paths and username.
Many
@fs/...entries expose the capture operator's local absolute path (e.g./Users/zacjones/.codex/worktrees/ui-protected-athlete-coverage/thewodapp/...), leaking a real username and local directory layout into a permanently committed evidence artifact. Consider sanitizing/normalizing these paths (e.g. replacing the home/worktree prefix with a placeholder) in the capture tooling before committing evidence.Also applies to: 74-74, 101-101, 700-782
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.network.json` at line 39, Sanitize absolute local filesystem paths in the network evidence before writing artifacts. Update the capture/normalization logic responsible for the affected evidence entries to replace user-specific home/worktree prefixes in `@fs` paths with a stable placeholder, and apply this consistently across all recorded requests and responses.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.network.json`:
- Around line 39-42: Redact machine-specific absolute workspace paths from all
network evidence artifacts, replacing usernames, worktree directories, and local
dependency roots with stable placeholders or repository-relative paths.
Regenerate the affected artifact and update every hash-pinned manifest reference
to match the sanitized content.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.network.json`:
- Around line 39-42: Remove the machine-specific /@fs/Users/zacjones/... Vite
module URL from the committed network evidence, normalizing or excluding
development-module requests as appropriate; preferably regenerate the artifact
against a production build so no host-specific filesystem paths remain.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.network.json`:
- Around line 37-42: Committed network traces contain machine-specific /@fs
filesystem paths. Update the capture writer to normalize or redact local
absolute paths before serialization, then regenerate the authenticated mobile
dark network artifacts, including the appearance and overview traces, so every
affected Vite path is portable.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt`:
- Line 7: The main-content link is exposed without an accessible name in the
authenticated mobile dark evidence snapshot. Update the corresponding link in
the protected-athlete UI to include meaningful visible text or an accessible
name describing its destination, then regenerate the affected accessibility
evidence.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.network.json`:
- Around line 45-49: Remove the machine-specific
/@fs/Users/zacjones/.codex/worktrees/... prefix from the recorded request path
in the authenticated mobile dark network evidence, replacing it with a portable
normalized path. Then regenerate the manifest and coverage-plan hashes so they
match the sanitized artifact.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.network.json`:
- Around line 38-39: The committed network evidence contains an absolute
developer-specific Vite filesystem path in the GET request entry. Update the
evidence normalization or capture logic for the affected request records to
convert `@fs` paths into repository-relative/browser-visible paths or omit them
before hashing and committing, ensuring both occurrences are handled
consistently.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.network.json`:
- Line 39: Sanitize absolute workstation paths in the evidence export, including
the network trace containing the Vite env module path. Normalize workspace
prefixes to repository-relative paths (or a stable placeholder) before
serialization, and apply the same transformation across all network traces and
related exported artifacts.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.a11y.txt`:
- Line 15: Give the main-content link represented by ref=e2 a meaningful
accessible name by adding descriptive visible text or an appropriate accessible
labeling attribute to the corresponding link element.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.network.json`:
- Around line 39-42: Sanitize local workspace paths in the network evidence
capture before writing artifacts, including the username and worktree layout
visible in the vite env.mjs request path. Update the capture sanitization logic
used to generate the evidence, then regenerate the hash-pinned evidence file and
all corresponding manifest references so they match the sanitized output.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.a11y.txt`:
- Line 15: Add an accessible name to the icon-only back button rendered by the
not-found workout page. Locate the button in the route component and add an
aria-label such as “Back to workouts” (or an equivalent accessible naming
mechanism), preserving its existing behavior and styling.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.a11y.txt`:
- Around line 21-25: In the protected-athlete workouts empty state, give both
unnamed buttons accessible names that describe their actions, and change the “No
workouts scheduled for today” heading to the appropriate level 3 heading to
preserve hierarchy; update the corresponding UI component and accessibility
snapshot.
---
Minor comments:
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.network.json`:
- Line 39: Remove machine-specific absolute filesystem paths from the committed
network evidence, including all `/@fs/Users/...` entries at the referenced
locations. Replace them with a stable sanitized or normalized path that does not
expose usernames, worktree names, or local directory layouts.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.network.json`:
- Around line 44-47: Remove the machine-specific
/@fs/Users/zacjones/.codex/worktrees/... prefix from the committed network trace
entry, replacing it with a machine-independent normalized path while preserving
the Vite env.mjs resource reference. Regenerate any associated hashes or
manifests after updating the trace.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.redirect.json`:
- Around line 2-17: The redirect trace should include response metadata
explaining the navigation from /dashboard to /. Update the trace fixture
associated with the redirect capture to record the 3xx response status, its
Location header, and any client-side redirect event, while preserving the
existing requestedUrl, finalUrl, and document entries.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.network.json`:
- Around line 45-49: Remove the machine-specific absolute filesystem path from
the committed network evidence at the affected GET request, either by replacing
the /@fs path with a stable project-relative placeholder or omitting this
development-only Vite module request entirely; ensure no user-specific paths
remain in the artifact.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt`:
- Around line 8-10: Fix the heading hierarchy in the log form: update the nested
workout heading for “Fran” from h3 to h2 following the “LOG RESULT” h1, or add
an appropriate h2 section heading before it. Locate the relevant log form
heading markup or accessibility label producing “LOG RESULT” and “Fran”.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.a11y.txt`:
- Around line 11-15: Add accessible names to the unnamed actionable links in the
affected page by providing meaningful visible text or an appropriate aria-label;
if either link is decorative and non-actionable, remove its link semantics.
Verify the resulting accessibility snapshot no longer reports unnamed links.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.network.json`:
- Line 39: Committed evidence contains developer-specific absolute filesystem
paths in the network artifact. Update the recorded request paths, including
entries like the Vite env.mjs path, to use normalized project-relative or
redacted paths throughout the artifact; verify no /Users/... or
worktree-specific paths remain.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.network.json`:
- Around line 39-42: The recorded network artifact contains machine-specific
filesystem paths. Update the evidence capture or sanitization pipeline producing
the authenticated desktop network fixture to normalize or redact `/@fs/...`
paths, remove usernames and workspace details, and regenerate the affected
artifact and corresponding evidence hashes.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.network.json`:
- Around line 39-42: Sanitize machine-specific filesystem paths in the evidence
capture pipeline before generating network artifacts, especially entries like
the script request path shown in
settings-athlete-authenticated-mobile-dark.network.json. Normalize or redact
user, worktree, and local workspace segments, then regenerate the affected
evidence artifacts and update their corresponding hashes.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.a11y.txt`:
- Around line 10-12: The icon-only link represented by ref e14 has no accessible
name. Locate the component rendering this link and add a meaningful aria-label
or accessible text; if it is purely decorative, remove its link semantics
instead.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.network.json`:
- Around line 38-42: The committed network evidence contains
environment-specific absolute filesystem paths in request path entries. Remove
or redact the /@fs/Users/... paths throughout this artifact, or recapture the
evidence using a production-like server so no developer username or local
workspace layout is recorded.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.network.json`:
- Around line 38-42: Redact machine-specific absolute filesystem URLs throughout
the captured network evidence, including the GET request for Vite’s env.mjs
module. Replace `/@fs/Users/...` paths with a stable placeholder or remove
dev-only module requests, and apply the same normalization to every repeated
occurrence in this file.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.network.json`:
- Around line 74-77: Redact the machine-specific `/@fs/Users/zacjones/...`
workspace prefix in the network evidence, replacing it with a stable placeholder
everywhere in the captured artifact while preserving the remaining dependency
path and request details.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.network.json`:
- Line 39: Remove the absolute host-specific `/Users/zacjones/...` filesystem
paths from the network evidence entries, including the occurrences corresponding
to the referenced additional locations. Normalize them to a
repository-independent path or omit the entries while preserving valid evidence
JSON.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.network.json`:
- Line 39: Sanitize the generated network evidence artifacts by removing
host-specific absolute filesystem paths such as `/Users/zacjones/...` from all
affected entries, including the paths at the referenced locations. Update the
evidence-generation or normalization logic responsible for these artifacts so
future outputs consistently use portable paths.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.network.json`:
- Around line 38-39: Remove the developer-specific absolute filesystem prefix
from all repeated Vite `@fs` request paths in the recorded network evidence,
replacing it with a repository-relative or consistently redacted path while
preserving the requested file location and valid JSON.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.network.json`:
- Around line 39-42: The evidence artifact contains a host-specific `/@fs/...`
filesystem path exposing a local username and worktree. Normalize or redact all
`/@fs/` paths in the captured network artifacts, including the referenced script
path, so committed evidence is machine-independent.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txt`:
- Around line 12-16: The icon-only navigation controls are missing accessible
names: identify the corresponding link and button in the affected UI component,
add meaningful accessible labels via aria-label or an equivalent
visible/semantic name, or remove their interactive semantics if they are
decorative.
- Around line 72-75: Associate accessible labels with the scheme and scope
comboboxes represented by refs e8 and e9, replacing the empty LabelText nodes
with programmatic labels “Scheme” and “Scope” via the component’s label,
aria-label, or equivalent labeling mechanism.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.network.json`:
- Around line 39-42: The evidence artifact contains a machine-specific
`/@fs/...` filesystem path exposing a local username and worktree. Update the
recorded network artifact, particularly the affected `path` entry, to normalize
or redact host-specific filesystem prefixes while preserving the request
identity and response metadata.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.network.json`:
- Line 39: Remove developer-specific absolute filesystem paths from the
committed network evidence, including the path in the relevant JSON “path”
entries. Replace them with a portable normalized path such as the
package-relative module path, and verify no `/Users/...` or worktree-specific
paths remain in the artifact.
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.network.json`:
- Around line 38-42: Committed evidence contains machine-specific /@fs
filesystem paths that expose a developer username and checkout location.
Sanitize or regenerate all affected URL entries in the authenticated desktop
network artifact, including the repeated entries around the referenced ranges,
then update the corresponding hashes and manifest references.
---
Nitpick comments:
In
`@docs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.network.json`:
- Line 39: Sanitize absolute local filesystem paths in the network evidence
before writing artifacts. Update the capture/normalization logic responsible for
the affected evidence entries to replace user-specific home/worktree prefixes in
`@fs` paths with a stable placeholder, and apply this consistently across all
recorded requests and responses.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 180a5a2e-b0d5-480b-945d-658cb1bb78da
⛔ Files ignored due to path filters (12)
docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-mobile-dark.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.pngis excluded by!**/*.pngdocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-mobile-dark.pngis excluded by!**/*.png
📒 Files selected for processing (139)
docs/ui-library/evidence/protected-athlete/2026-07-10/capture-manifest.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-no-workout-tracking-desktop-light.redirect.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/programming-subscriptions-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-appearance-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-athlete-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-overview-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-not-found-desktop-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-new-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-not-found-desktop-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-not-found-desktop-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-not-found-desktop-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workout-schedule-not-found-desktop-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-desktop-light.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-mobile-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-mobile-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-mobile-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-authenticated-mobile-dark.network.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.a11y.txtdocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.console.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.dom.jsondocs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.network.jsondocs/ui-library/page-coverage-ledger.jsondocs/ui-library/page-coverage-ledger.mddocs/ui-library/page-coverage.plan.jsondocs/ui-library/protected-athlete-coverage-audit.mdlat.md/ui-library.md
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
🛑 Comments failed to post (11)
docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.network.json (1)
39-42: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact local workspace paths before committing network evidence.
This request path exposes the capture machine’s username and worktree layout, and the same pattern repeats throughout the artifact. Sanitize these paths and regenerate the artifact plus its hash-pinned manifest references.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/dashboard-authenticated-mobile-dark.network.json` around lines 39 - 42, Redact machine-specific absolute workspace paths from all network evidence artifacts, replacing usernames, worktree directories, and local dependency roots with stable placeholders or repository-relative paths. Regenerate the affected artifact and update every hash-pinned manifest reference to match the sanitized content.docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.network.json (1)
39-42: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove machine-specific filesystem paths from committed evidence.
The captured
/@fs/Users/zacjones/...URLs expose a developer username and local worktree structure, and make future captures host-specific. Normalize or exclude these Vite development-module requests, or capture against a production build before committing the artifact.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-desktop-light.network.json` around lines 39 - 42, Remove the machine-specific /@fs/Users/zacjones/... Vite module URL from the committed network evidence, normalizing or excluding development-module requests as appropriate; preferably regenerate the artifact against a production build so no host-specific filesystem paths remain.docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.network.json (1)
37-42: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Strip machine-specific filesystem paths from committed traces.
Lines 39-42 and 74-77 expose
/@fs/Users/zacjones/.codex/worktrees/..., leaking local path metadata and making the evidence non-portable. Normalize these paths in the capture writer, then regenerate all network artifacts; the same issue appears in the appearance and overview traces.Also applies to: 72-77
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-authenticated-mobile-dark.network.json` around lines 37 - 42, Committed network traces contain machine-specific /@fs filesystem paths. Update the capture writer to normalize or redact local absolute paths before serialization, then regenerate the authenticated mobile dark network artifacts, including the appearance and overview traces, so every affected Vite path is portable.docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt (1)
7-7: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Give the main-content link an accessible name.
The accessibility tree exposes
link [ref=e2]without a name, so screen-reader users cannot determine its destination. Add an accessible name or visible link text.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.a11y.txt` at line 7, The main-content link is exposed without an accessible name in the authenticated mobile dark evidence snapshot. Update the corresponding link in the protected-athlete UI to include meaningful visible text or an accessible name describing its destination, then regenerate the affected accessibility evidence.docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.network.json (1)
45-49: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove machine-specific absolute paths from committed evidence.
The
/@fs/Users/zacjones/.codex/worktrees/...request path exposes a local username and absolute workspace layout, making the artifact environment-specific. Normalize these paths before committing, then regenerate the manifest and coverage-plan hashes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/log-new-authenticated-mobile-dark.network.json` around lines 45 - 49, Remove the machine-specific /@fs/Users/zacjones/.codex/worktrees/... prefix from the recorded request path in the authenticated mobile dark network evidence, replacing it with a portable normalized path. Then regenerate the manifest and coverage-plan hashes so they match the sanitized artifact.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.network.json (1)
38-39: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove absolute local filesystem paths from committed network evidence.
The
@fs/Users/zacjones/.codex/worktrees/...entries expose developer-specific paths and make the artifact environment-dependent. Normalize these requests to repository-relative or browser-visible paths, or omit them before hashing and committing the evidence.Also applies to: 74-74
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-profile-authenticated-desktop-light.network.json` around lines 38 - 39, The committed network evidence contains an absolute developer-specific Vite filesystem path in the GET request entry. Update the evidence normalization or capture logic for the affected request records to convert `@fs` paths into repository-relative/browser-visible paths or omit them before hashing and committing, ensuring both occurrences are handled consistently.docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.network.json (1)
39-39: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact absolute workstation paths before committing evidence.
Line [39] and many later entries expose
/Users/zacjones/.codex/worktrees/...in a checked-in artifact. Normalize the workspace prefix during export, or emit repository-relative paths; apply the same sanitization to the other network traces.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/settings-sessions-authenticated-mobile-dark.network.json` at line 39, Sanitize absolute workstation paths in the evidence export, including the network trace containing the Vite env module path. Normalize workspace prefixes to repository-relative paths (or a stable placeholder) before serialization, and apply the same transformation across all network traces and related exported artifacts.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.a11y.txt (1)
15-15: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Give the main-content link an accessible name.
The accessibility tree exposes
link [ref=e2]without a name. Add an accessible name or visible link text so assistive-technology users can identify its destination.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-detail-authenticated-desktop-light.a11y.txt` at line 15, Give the main-content link represented by ref=e2 a meaningful accessible name by adding descriptive visible text or an appropriate accessible labeling attribute to the corresponding link element.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.network.json (1)
39-42: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Redact local workspace paths before committing network evidence.
This artifact also exposes the capture machine’s username and worktree layout. Apply capture-level path sanitization and regenerate the hash-pinned evidence and manifest references.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-authenticated-desktop-light.network.json` around lines 39 - 42, Sanitize local workspace paths in the network evidence capture before writing artifacts, including the username and worktree layout visible in the vite env.mjs request path. Update the capture sanitization logic used to generate the evidence, then regenerate the hash-pinned evidence file and all corresponding manifest references so they match the sanitized output.docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.a11y.txt (1)
15-15: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Add an accessible name to the back button.
The captured not-found page exposes an unnamed button. The route source also renders the icon-only button without
aria-labelor equivalent, so screen-reader users cannot discover its purpose. Use a label such asBack to workouts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workout-edit-not-found-desktop-dark.a11y.txt` at line 15, Add an accessible name to the icon-only back button rendered by the not-found workout page. Locate the button in the route component and add an aria-label such as “Back to workouts” (or an equivalent accessible naming mechanism), preserving its existing behavior and styling.docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.a11y.txt (1)
21-25: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Add accessible names and correct the heading hierarchy.
The snapshot exposes two unnamed buttons, so assistive-technology users cannot identify their actions. It also jumps from level 2 to level 4 for “No workouts scheduled for today.” Add labels to both controls and use the appropriate heading level.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/ui-library/evidence/protected-athlete/2026-07-10/workouts-search-empty-desktop-dark.a11y.txt` around lines 21 - 25, In the protected-athlete workouts empty state, give both unnamed buttons accessible names that describe their actions, and change the “No workouts scheduled for today” heading to the appropriate level 3 heading to preserve hierarchy; update the corresponding UI component and accessibility snapshot.
This was referenced Jul 11, 2026
zacjones93
merged commit Jul 15, 2026
d6316c1
into
codex/ui-auth-entry-pattern
53 of 184 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Findings
FormLabelcallsuseFormFieldoutsideFormField/; child-route guard coverage is documented without overgeneralizingVerification
lat checkpassedgit diff --checkpassedProvenance
Captured with agent-browser 0.26.0 against parent revision
6df6cfbae0fcab6eb30bb3a5f698f7c1d11dad19, using a disposable MySQL 8.4 container bound only to127.0.0.1:33317and a local Vite runtime on127.0.0.1:3317. Both were removed after verification.mainSummary by cubic
Adds verified UI evidence beyond protected athlete routes and introduces shared UI primitives adopted across Start and Crew. Fixes settings error boundaries and mobile nav overflow while tightening accessibility and semantics in organizer and admin panels.
New Features
@repo/ui/field,@repo/ui/empty-state, and@repo/ui/metricwith thin app re-exports; adopted in rotation editors, scaling dialogs, import previews, and organizer empty panels; Storybook stories included.Bug Fixes
FieldGroup.Written for commit d6316c1. Summary will update on new commits.
Summary by CodeRabbit