lead decisions: 98, the preview serves the credentials read as built (#1549, Dewey N2)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-11 19:15:29 -05:00
parent a8032d6a0e
commit 179129c5f4
1 changed files with 17 additions and 0 deletions
@@ -2126,3 +2126,20 @@ which stay with him. Each item names who decided it and what happened.
    - The tradeoff: on cutover day Jason sends from the browser and reads
      the answer in the CLI. In exchange no broker change lands before the
      cutover and row 76 needs no extra review round.
 98. **The preview serves the credentials read as built (2026-10-12).**
    Dewey's N2 on row 60 (#1549, comment 27431): with row 74's preview
    mode, `/api/bus/credentials` is readable from the edge by the one
    signed-in user. It is the first bus read whose content is about
    credentials.
    - It ships unchanged. Each row carries service, bot account, role,
      date kind, date and state. No token, file path or variable name
      reaches the output, and row 60's tests pin that.
    - Only the allowed user gets past the sign-in proxy, and that user is
      Jason, who already reads the same business file locally. An expiring
      or overdue token is what he should see from the browser.
    - No README edit. Row 74's preview section already says the GET
      routes, the bus views included, are unchanged.
    - The tradeoff: the bot account names and token dates leave the host
      on every signed-in page load. If the preview ever admits a second
      user, this read goes back for review first.