Dawarich

2026.08.01.1

Two changes are bundled into this first version bump since 2026.07.16.2: the wave-2c test backfill (previously unreleased, source unmodified) and a hardening fix for the two HIGH credential-exposure findings that backfill surfaced, tracked in the local dawarich-hardening issue-lifecycle model (never a Lab issue).

Hardening fix

• [HIGH] api_key no longer rides in the request URL query string. apiRequest()'s shared builder+fetch site now sends the credential as an Authorization: Bearer <apiKey> header instead of a ?api_key=... / &api_key=... query parameter. The Dawarich ApiController accepts either transport (params[:api_key] OR an Authorization header matched by /\ABearer\s+(\S+)\z/i), so this is a behavior-preserving transport change: every one of the 10 methods routes through this single builder, so one edit closes the exposure everywhere. The previously dead sep local (endpoint.includes("?") ? "&" : "?") was removed along with it.
• [HIGH] globalArguments.apiKey is now .meta({ sensitive: true }) on GlobalArgsSchema, so swamp routes it through the vault instead of rendering it in cleartext on CLI/log surfaces. Mirrors the telegram_send.ts botToken pattern.
• 8 characterization pins across dawarich_methods_test.ts, dawarich_adversarial_test.ts, and dawarich_coverage_test.ts flipped from asserting the leaky behavior to asserting the hardened behavior (7 transport pins + 1 sensitive-meta pin); behavior-preserving pins (api_key never in a written resource, never in a happy-path thrown error) stayed green throughout.
• Deferred, NOT fixed here (out of scope for this two-HIGH pass, still tracked): the 3 MED / 2 LOW findings from the original bug — the Array.isArray silent-[] coercion (including the CONFIRMED-real tracks GeoJSON break), non-numeric pagination-header NaN coercion, and the missing encodeURIComponent on interpolated query params. The hostile-server-echo residual (a server response can still echo a credential-adjacent value back into a thrown error's text) is also unchanged — closing it needs a redacting error mapper, tracked as a separate follow-up like headphones/telegram-send.

Test backfill (wave-2c, previously unreleased)

Test backfill to the STANDARD.md five-suite quality bar (wave-2c of the extension-quality backfill program, ext-quality-test-backfill). This part made no behavior change on its own — it added tests/fixtures only, with dawarich.ts unmodified at the time — but it was never separately released, so it ships as part of this same version bump.

• Added extensions/models/dawarich_test.ts (contract-fixture), dawarich_methods_test.ts (methods), dawarich_adversarial_test.ts (adversarial), dawarich_coverage_test.ts (coverage), dawarich_property_test.ts (property-invariant-flow) — 0 tests before this change, 142 tests after.
• Added fixtures/ — pure doc-derived, synthetic Dawarich API wire-shape fixtures (health, stats, points, tracked-months, visits, tracks, settings, digests, photos) plus PROVENANCE.md. No live call was made against any Dawarich instance (including the homelab's own my-atlas); every coordinate is one of exactly five public, globally documented tourist landmarks (Sydney Opera House, Christ the Redeemer, the Mount Everest summit, Uluru/Ayers Rock, Ushuaia) — an EXACT-VALUE allowlist, never a region — with a coarse country-level Netherlands denylist box as a secondary tripwire only. No real point, visit, track, photo, host, or api_key appears anywhere in the corpus.
• deno.json: default test task stays network-less and filesystem-less (no --allow-net, no --allow-read), scoped to --allow-env=FC_NUM_RUNS; added test:soak for the high-count nightly property soak. Both the fixtures-secret-scan and the coordinate-allowlist-scan consume statically-imported (with { type: "json" }) fixture modules — zero runtime filesystem access.
• quality.yaml: all five required suites plus docs.readme/docs.changelog flip from backlog to present; docs.skill recorded na (dawarich bundles no Claude skill); ratchet measured via swamp extension quality (rubricVersion 3, 100%, Grade A) and recorded. Removed from quality-allowlist.txt in the same change.
• Several gaps were surfaced by the adversarial/security review at backfill time and tracked as a local follow-up hardening bug (dawarich-hardening, filed via the local @magistr/issue-lifecycle model, never the Lab). Items 1 and 2

Notes trimmed at a line boundary to fit the registry's 4900-byte per-version cap. Full section: https://github.com/umag/swamp-workspace/blob/d850d8e8372d4c0008c9245959a090b37095de7a/dawarich/CHANGELOG.md

Release 2026.07.16.2 — align model versions with manifests

Maintenance release across the @magistr extensions. For most packages this carries no functional change: the only edit is the model's version: field, brought back in line with its manifest version so the published model type version and the package version no longer drift.

Functional changes in this release are limited to:

• anime-cron: normalizeTitle now strips a ": subtitle" suffix and a trailing parenthesized year before comparison, fixing dedup false-misses where the torrent title carries a subtitle or year that the AniList romaji does not.

• arckit: first publish. Standalone ArcKit port — a 12-phase architecture governance state machine with 65 bundled templates, driven by a bundled skill.

Also tracks three extensions (kaiten, observability-agent, music-library) that previously existed only as untracked working-tree directories, recovered from stashes.

Merge pull request #5 from umag/extensions/jscad-stl-pair

extensions: add 15 more @magistr extensions + auto-discover CI