ahmed/sql-server-query-ai
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: karpathy-pattern wiki built from the spec, plan, design contract and decisions ledger

Browse Source 
kb/ is its own wiki root: 34 pages across 7 categories, index.md catalog, log.md, AGENTS.md schema layer, and raw/ holding copies of README, the spec, the 13-task plan, the design master and the SDD ledger.

Every page cross-references 3 to 6 others and all 107 wikilinks resolve except two [["list"]] artefacts inside JSON snippets in the copied plan.

Kept separate from the repository root on purpose: its generated graph lands in kb/.ua/ instead of overwriting the code graph.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
ahmed mohammed
2026-09-22 12:14:05 +03:00
co-authored by Claude Opus 4.7
parent 735a57bfd6
commit 8b42a0931c
42 changed files with 3534 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kb/Session cookie rules.md
+12
View File
@@ -0,0 +1,12 @@
# Session cookie rules
The session cookie holds a 32-byte random token; only its hash is stored, and the expiry is enforced in SQL.
`httpOnly` and `sameSite: lax` always.
`Secure` is set from the request, not the build: only when `X-Forwarded-Proto` reports `https`, or when
`COOKIE_SECURE=1` is set for a direct TLS deploy. The previous rule (`secure: NODE_ENV === "production"`) meant a
production build on plain `http://localhost` asked browsers for a Secure cookie. Chromium allows that on localhost;
Safari refuses to store it at all, so every page after signup looked signed-out and the wizard appeared to sign
users out. A Chromium-only suite could never observe it.
Related: [[WebKit in QA]], [[First-run gate]], [[Running locally]].