v0.4.0 Merge Strategy & Dependency Tracker

[JohnRDOrazio]

v0.4.0 Merge Strategy

This issue tracks the merge order and dependency relationships for v0.4.0 work. The focus of this release is the suggestion/PR workflow redesign, provider abstraction, and entity graph visualization. (SPARQL explorer was deferred to v0.5.0 — see #214.)

Predecessor: ontokit-web#34 — v0.3.0 Merge Strategy & Dependency Tracker
Successor: ontokit-web#214 — v0.5.0 Merge Strategy & Dependency Tracker

---

Bug Fixes

• ontokit-api#48 — Add GET /projects/{id}/ontology/index-status endpoint — PR: ontokit-api#76
• ontokit-web#137 — Use WebSocket for real-time index status updates — PR: feat: replace index status polling with WebSocket updates #138 — depends on ontokit-api#48
• ontokit-web#141 — HealthCheckPanel lint WebSocket fails with 4001 after auth requirement — PR: fix: pass accessToken to lint WebSocket to resolve 4001 auth error #146 — regression from ontokit-api#76 / #138
• ontokit-web#99 — RemoteSyncIndicator: unhandled 500 errors flood browser console (independent) — PR: fix: handle all errors in RemoteSyncIndicator to prevent console flooding #144, fix: handle RemoteSyncIndicator errors and remove aria-hidden from focusable button #153
• ontokit-web#100 — Accessibility: aria-hidden on focusable expand/collapse button in entity tree (independent) — PR: fix(a11y): replace aria-hidden button with role=presentation span in EntityTreeNode #143, fix: handle RemoteSyncIndicator errors and remove aria-hidden from focusable button #153
• ontokit-web#164 — Private tab shows same login prompt as My Projects tab (independent) — PR: Fix Private tab login prompt messaging #165
• ontokit-web#166 — Private tab empty state messaging not specific enough (independent) — PR: Fix Private tab empty state messaging #167
• ontokit-web#101 — Improve webhook setup error messages and auto-show manual instructions on failure (independent) — PR: fix: improve webhook setup error messages and show manual instructions on failure #145
• ontokit-api#117 — Expose property subtype (object/data/annotation) in EntitySearchResult — PR: ontokit-api#120 — must merge before #176
• ontokit-web#176 — Fix property classification in tree view and add Data Properties category — PR: fix(properties): classify by backend property_kind + add Other Properties group #197 — depends on ontokit-api#117 / PR ontokit-api#120 (frontend will fall back to "Other Properties" until backend ships)
• ontokit-api#98 — Similar entities endpoint returns 500 with missing CORS headers (independent)
• ontokit-api#102 — Classifiers in pyproject.toml are stale (missing 3.13) (independent, packaging metadata) — PR: ontokit-api#135
• ontokit-api#111 — Use json.dumps for redis.publish payloads in worker.py (independent, payload escaping) — PR: ontokit-api#118

Security

Defensive hardening surfaced by static analysis (Semgrep, CodeQL). None of these are known active exploits — they're precautionary fixes that close attack surface before it can be abused. Tracked separately from Bug Fixes so the latter stays focused on user-visible defects.

• ontokit-web#191 — Shell injection risk in pr-target-guard.yml workflow (independent, surfaced by Semgrep) — PR: fix(ci): prevent shell injection in pr-target-guard workflow #193
• ontokit-api#112 — Shell injection risk in pr-target-guard.yml workflow (independent, surfaced by Semgrep; API counterpart to ontokit-web#191) — PR: ontokit-api#116
• ontokit-api#113 — URL-encode user-controlled path segments in github_service.py (independent, surfaced by Semgrep) — PR: ontokit-api#116
• ontokit-web#192 — Add Semgrep CI security scan workflow + .semgrepignore (independent, CI/security tooling) — PR: ci: add Semgrep security scan workflow #194
• ontokit-api#114 — Add Semgrep CI security scan workflow + .semgrepignore (independent, CI/security tooling; API counterpart to ontokit-web#192) — PR: ontokit-api#125
• ontokit-api#128 — Drop python-jose in favor of PyJWT for JWT validation (independent, dependency hardening — python-jose pulls in ecdsa with two open advisories: Minerva timing attack + improper input validation) — PR: ontokit-api#129
• chore: Pin all GitHub Actions to commit SHAs (web — supply-chain hardening; prevents a compromised tag from substituting malicious code into CI runners) — PR: chore(ci): pin all GitHub Actions to commit SHAs #196
• chore: Pin all GitHub Actions to commit SHAs (api — supply-chain hardening; mirror of #196, also bumps actions/checkout@v4 → v6 in semgrep.yml for consistency) — PR: ontokit-api#133

Features

• ontokit-web#81 — Entity Graph: server-side BFS + enhanced visualization — PR: Port entity graph to server-side BFS endpoint #88 + ontokit-api#37
• ontokit-web#89 — Migrate manual data fetching to React Query hooks (13 hooks + page components) — PR: feat: migrate data fetching to React Query hooks #105
• ontokit-web#200 — Eliminate setState-in-effect anti-patterns across 16 sites; graduate react-hooks/set-state-in-effect from warn to error (independent) — Category C (server-data-derived state) overlaps with #89
• ontokit-api#26 — Per-project lint rule configuration (backend) — PR: ontokit-api#94 (approved 2026-04-25; awaiting merge) + peer-review follow-up ontokit-api#103 (2 blocker + 3 high fixes: BCP-47 lang-tag case in label-per-language, subject_type CHECK constraint, role-gating tests, empty-rules end-to-end test, XOR validator on LintConfigUpdate) — merge order: ontokit-api#103 → ontokit-api#94 → dev so fixes land in ontokit-api#94's branch before it merges, keeping a single migration — must merge before or alongside #56
• ontokit-web#56 — Lint rule configuration UI in project settings — PR: feat: add lint rule configuration UI in project settings #106
• ontokit-api#81 — Lint auto-fix: deterministic fixes and AI-assisted suggestions — depends on ontokit-api#26 (respects per-project rule config)
• ontokit-web#3 — Custom login UI to replace Zitadel Login V2 container — PR: feat: custom login UI Phase 1 — username + password flow #38
• ontokit-api#30 — Project favorites: database table and API endpoints — must merge before #78
• ontokit-web#78 — Project favorites: star icon and sort-to-top — PR: feat: add project favorites with star icon and sort-to-top #147
• ontokit-web#97 — Replace language tag text inputs with searchable BCP 47 locale picker (independent) — PR: feat: replace language tag inputs with searchable BCP 47 picker #103
• ontokit-web#98 — Preserve entity selection across viewer/editor and unify continuous editing (independent) — PR: feat: preserve entity selection across viewer/editor modes #104
• ontokit-web#201 — Surface dirty-draft indicators in Properties/Individuals trees and on the Entity tab bar (independent) — discovered while testing #98 / PR #104; only Classes currently shows the amber-dot indicator
• ontokit-web#202 — Type-aware label resolution in useIriLabels to eliminate fallback 404 noise (independent) — follow-up to #98 / PR #104; commits 26bd907 + bc35651 on PR feat: preserve entity selection across viewer/editor modes #104 already reduced the noise, this closes it out
• ontokit-web#206 — "Back to project" doesn't preserve viewer/editor state (selection, mode, active tab) — PR: fix(useProjectHomeHref): carry entity selection through Back-to-project links #228 — follow-up to #98 / PR #104; narrower duplicate #227 closed in favor of this
• ontokit-api#79 — Offload quality endpoints to ARQ worker queue — PR: ontokit-api#80
• ontokit-web#150 — Consume async quality API for duplicates and consistency checks — PR: feat: consume async quality API for duplicates and consistency checks #151 — depends on ontokit-api#79
• ontokit-web#168 — Add fixed sidebar navigation to project settings page (independent)
• ontokit-web#170 — Highlight problematic predicate in class detail when navigating from lint issue — follow-up to #56
• ontokit-web#171 — Highlight problematic predicate in source view lint markers — follow-up to #56
• ontokit-web#175 — Add 'View in Source' link to property and individual detail panels (independent)
• ontokit-web#177 — Source view: distinguish entity types in IRI hover hints and Ctrl+Click navigation (independent)
• ontokit-api#82 — Server-side BFS entity graph endpoint — PR: ontokit-api#37 — API counterpart to ontokit-web#81
• ontokit-api#85 — Persist duplicate detection results in PostgreSQL
• ontokit-api#95 — Add skos:hiddenLabel to backend annotation extraction — PR: ontokit-api#94 (delivered alongside ontokit-api#26)
• ontokit-api#96 — New lint rule: redundant-regional-label — PR: ontokit-api#94
• ontokit-api#97 — New lint rule: missing-type-declaration — PR: ontokit-api#94
• ontokit-api#99 — Consolidate consistency checks into the lint rule system — follow-up to ontokit-api#26 / ontokit-api#79
• ontokit-api#121 — Include bare rdf:Property entities in search results (legacy/RDFS support) — follow-up to ontokit-api#117

Architecture & Sync

• ontokit-api#20 — Abstract git remote sync to support GitHub, GitLab, Gitea, and other providers
• ontokit-api#21 — Implement remote sync loop prevention (filter OntoKit-authored commits) — related to ontokit-api#20 — PR: ontokit-api#22
• ontokit-web#5 — Verify: read-only remote sync fields when webhook-driven — PR: fix: dim labels and reposition note for webhook-driven readonly fields #148 — related to ontokit-api#21
• ontokit-web#140 — Decouple useCollaborationStatus from lint WebSocket endpoint — PR: refactor: decouple useCollaborationStatus from lint WebSocket endpoint #154 — refactor, independent
• ontokit-api#78 — Per-project Redis pubsub channels for WebSocket updates — performance optimization, low priority

Documentation

• #198 — Add Properties chapter to the Ontology Guide (rdf:Property + OWL property typology), introduce sticky left-side TOC on the Changelog page, fix JSX whitespace stripping across all guide pages, and pass servers to Scalar so /api-docs code samples render without Invalid URL errors

Suggestion & PR Workflow Redesign

These issues require significant design work before implementation. #65 can be tackled first independently; the rest are interdependent and need design finalization:

1. ontokit-web#65 — Unify suggestions and PRs views with mode-aware labels — PR: feat: unify suggestions and PRs views with mode-aware labels #149 — independent, can merge first
2. ontokit-web#60 — Require suggester role by default; add project-level opt-in for open suggestions — foundation for access control changes
3. ontokit-web#62 — Evaluate suggestion branch naming and user association strategy — informs branch creation logic
4. ontokit-web#63 — Auto-commit suggestion edits to git on save/navigation — depends on branch strategy from Evaluate suggestion branch naming and user association strategy #62
5. ontokit-web#66 — Auto-rebase strategy for open branches after PR merge — depends on branch strategy from Evaluate suggestion branch naming and user association strategy #62

---

Dependency Graph

graph LR
  subgraph "<b>Lint Configuration & Auto-Fix</b>"
    direction TB
    A26["API #26 per-project config"] --> W56["Web #56 lint config UI"]
    A26 --> A81["API #81 lint auto-fix"]
  end

  subgraph "<b>Favorites</b>"
    direction TB
    A30["API #30 favorites API"] --> W78["Web #78 favorites UI"]
  end

  subgraph "<b>Index & WebSocket</b>"
    direction TB
    A48["API #48 index-status"] --> W137["#137 index WS updates"]
    W137 --> W141["#141 HealthCheck WS regression"]
    W140["#140 decouple collab/lint WS"] ~~~ A78["API #78 per-project pubsub"]
    A79["API #79 async quality jobs"] --> W150["#150 async quality API"]
  end

  subgraph "<b>Sync</b>"
    direction TB
    A20["API #20 provider abstraction"] --> A21["API #21 loop prevention"]
    A21 --> W5["Web #5 read-only fields"]
  end

  subgraph "<b>Suggestion / PR Workflow</b>"
    direction TB
    W60["#60 access control"] --> W62["#62 branch strategy"]
    W62 --> W63["#63 auto-commit"]
    W62 --> W66["#66 auto-rebase"]
    W63 --> W65["#65 unified UI"]
    W66 --> W65
  end

  subgraph "<b>Independent</b>"
    direction TB
    W81["#81 entity graph"] ~~~ W89["#89 React Query migration"]
    W89 ~~~ W200["#200 set-state-in-effect cleanup"]
    W200 ~~~ W51["#51 multi-branch index"]
    W51 ~~~ W3["#3 custom login UI"]
    W3 ~~~ W97["#97 BCP 47 language picker"]
    W97 ~~~ W98["#98 viewer/editor selection"]
    W98 ~~~ W201["#201 dirty-draft indicators"]
    W201 ~~~ W202["#202 type-aware useIriLabels"]
    W202 ~~~ W99["#99 remote-sync errors"]
    W99 ~~~ W100["#100 aria-hidden a11y"]
    W100 ~~~ W101["#101 webhook error UX"]
    W101
  end

Loading