Add architecture test ViewLayerOutputEscapingContractTest that flags
raw <?php echo in .phtml files. Legitimate uses (pre-built ARIA attrs
from navActive(), hardcoded role values, pre-rendered HTML fragments)
must carry an inline // raw-html-ok: reason marker.
Annotated all 11 existing raw echo sites with justification markers.
Added guard to catalog, enforcement map (automated), CLAUDE.md security
section, and never-do-this list.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The api_docs.view ability was missing from layoutAuth after removing
the sidebar.admin_nav_item slot from the api-docs module. Add a
HelpCenterLayoutProvider that checks the ability via AuthorizationService
and provides the result in layout nav context (help-center.nav). Panel
template now reads can_view_api_docs from the provider instead of
layoutAuth.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add details_storage and details_open_active to the aside.tab_panel
slot declaration, matching the admin panel pattern. Section disclosure
state is now saved and restored across page loads.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rewrite help panel to use the same grouped navigation pattern as the
admin aside panel (details/summary with nav links). Remove inline
keyboard shortcuts table and about section. Panel now shows
permission-gated navigation groups: Documentation (docs viewer, API
docs) and System (system info). Remove custom CSS — panel inherits
existing app-sidebar-admin-nav styling.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New help-center module adds a question-mark icon to the sidebar with
an aside panel containing three sections: Documentation (permission-
gated links to docs viewer and API docs), Keyboard Shortcuts (inline
reference from HotkeyService with Mac/Win variants), and About
(application info). Visible to all logged-in users — individual
resource links respect existing permissions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
