Built onbbd22f1b, rebased on row 60 (3d298920): the bus.mjs header comment conflict merged, serve.mjs BUS_VERBS and the README credentials paragraphs merged cleanly. 21 of 21 mutants killed, full gate green. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,346 @@
|
|||||||
|
# Row 76 (#1570): Console sends a human message to a role, round 1
|
||||||
|
|
||||||
|
Owner: Dewey. Reviewers: Darkwing and Filbert. Brief:
|
||||||
|
`docs/plans/2026-10-11_dogfood-cutover.md` § "Console sends a message to a
|
||||||
|
role", blob `f5d56554` (rev 552). Jason's Q95 answer is lead decision 95;
|
||||||
|
the reply view question is lead decision 97, option (a). Base `3d298920`
|
||||||
|
(row 60 landed). None of the candidate's paths changed between `3d298920`
|
||||||
|
and `refactor` HEAD (`3d298920`) when the packet was built.
|
||||||
|
|
||||||
|
`build.patch` is `git diff --binary 3d298920 -- packages/webui`, the two
|
||||||
|
new test files included. Apply it with `git apply --index` to a detached
|
||||||
|
worktree of the base; `candidate-manifest.sha256` then checks 9/9 OK.
|
||||||
|
|
||||||
|
## What ships
|
||||||
|
|
||||||
|
`serve --public-host NAME --auth-header HEADER --allow-user ID --send`.
|
||||||
|
`--send` is off by default; without it the Console behaves as after row 74
|
||||||
|
(`preview.test.mjs` and `serve.test.mjs` unchanged and green).
|
||||||
|
|
||||||
|
**Start (`cli.mjs`, `serve.mjs`).** `--send` is the one flag without a
|
||||||
|
value. Without all three preview flags the CLI exits 2 with `refused:
|
||||||
|
--send needs the preview mode (...)`, and `startServer` throws the same
|
||||||
|
for a direct caller, or for a `send` that isn't a function. With `--send`
|
||||||
|
and no system config the start refuses (`--send needs the bus configured
|
||||||
|
(...)`, the reason redacted as before) instead of serving a box that can't
|
||||||
|
send; a read-only Console still serves without the config. The `Preview:`
|
||||||
|
line says reads and human messages to roles, one line per send below.
|
||||||
|
`busReader` is split into `busCaller` (the human transport call, the
|
||||||
|
business resolved per request as before) and `views` over it, so the
|
||||||
|
reads and the send use the same transport.
|
||||||
|
|
||||||
|
**The route.** With `--send`, `POST /api/bus/message` is the one write
|
||||||
|
preview mode lets past its read-only check; any other method on that path
|
||||||
|
is 405, and every other write is still 403 `read-only`. Order, each on
|
||||||
|
every request:
|
||||||
|
|
||||||
|
1. The shared checks from row 74 run first: repeated Host 400, HEADER with
|
||||||
|
a Host other than NAME 403 `proxy Host refused`, a NAME request without
|
||||||
|
HEADER = ID once 401, a sent Origin other than `https://NAME` 403. These
|
||||||
|
write no log line.
|
||||||
|
2. `busSend` checks HEADER = ID once again itself (401), so the route
|
||||||
|
never runs on a loopback Host: a loopback request without HEADER is
|
||||||
|
401, with it 403 `proxy Host refused`. There is no loopback send.
|
||||||
|
3. Origin sent once and exactly `https://NAME` (a missing Origin passes
|
||||||
|
the shared check and stops here), else 403 `cross-origin request
|
||||||
|
refused`.
|
||||||
|
4. `Sec-Fetch-Site` sent once and exactly `same-origin`, else 403
|
||||||
|
`cross-site request refused`.
|
||||||
|
5. `Content-Type: application/json`, at most 16384 bytes, a JSON object
|
||||||
|
with `to` and `body`, optionally `in_reply_to`, no other key; else 400
|
||||||
|
`invalid-request`.
|
||||||
|
6. `message.send` with exactly those keys. The broker judges `to` and the
|
||||||
|
body. Its limit, 32768 characters, is past the request limit, so 16 KiB
|
||||||
|
binds first.
|
||||||
|
|
||||||
|
Every answer after step 2 carries `sent`: `false` for a refusal, `"unknown"`
|
||||||
|
when the message may exist. Success is 200 `{id, at}`.
|
||||||
|
|
||||||
|
**Outcomes (`bus.mjs` `sendOutcome`).** The broker writes in one
|
||||||
|
transaction, so any code it returns means nothing was written:
|
||||||
|
`{error: code, sent: false}` at the read routes' statuses (`busStatus`),
|
||||||
|
with `unknown-role`, `message-not-found` and `request-too-large` added as
|
||||||
|
400. `outcome-unknown`, `invalid-response` and `response-too-large` from
|
||||||
|
the transport, any error that isn't a `BusReadError`, and an answer
|
||||||
|
without a valid message id leave it open: 503 `outcome-unknown` with
|
||||||
|
`sent: "unknown"`. Nothing retries.
|
||||||
|
|
||||||
|
**Log.** One stdout line per request that gets past step 2: the time,
|
||||||
|
`send`, `user=` (JSON-quoted), `to=` (JSON-quoted, cut to 64 characters, or
|
||||||
|
`none`), then `id=<message id>` or `error=<code>`. Never the body. A test
|
||||||
|
shows a `to` with a newline can't forge a second line.
|
||||||
|
|
||||||
|
**`/api/config`** gains `send`: true only with `--send` on a NAME request,
|
||||||
|
so the operator's loopback page never shows a box that would get 401.
|
||||||
|
|
||||||
|
**The page (`public/bus.js`).** With `send` true the Inbox has "Message a
|
||||||
|
role": a picker of held roles from the agents read, a text box and Send.
|
||||||
|
|
||||||
|
- The draft (role and text) lives in page memory, so the ten-second
|
||||||
|
refresh redraws the form without losing it; focus and the caret are
|
||||||
|
kept. A reload loses it. A role no longer held stays selected, marked
|
||||||
|
"(not held now)".
|
||||||
|
- Send is disabled while a send is pending; a second press sends nothing.
|
||||||
|
An empty role or text is refused in the page without a request.
|
||||||
|
- One POST per Send, `redirect: 'manual'`. Sent: an id came back; the
|
||||||
|
receipt shows it and links `#/trail/message/<id>` (a new trail kind: the
|
||||||
|
message and its deliveries, back link to the Inbox, not-found for an id
|
||||||
|
the trail doesn't hold). The text is cleared unless it was edited during
|
||||||
|
the send.
|
||||||
|
- Not sent: a 4xx, or the server's `sent: false` (a 503 `no-bus-host`
|
||||||
|
too), or a redirect. Only the sign-in proxy redirects, when its session
|
||||||
|
has expired, so the request never reached the Console; the receipt asks
|
||||||
|
for a reload. The draft is kept.
|
||||||
|
- Anything else, a lost answer included: outcome unknown. The receipt says
|
||||||
|
the message may have been sent, that nothing was sent again, and that
|
||||||
|
there is no trail to link without an id; the draft is kept.
|
||||||
|
- The box says a reply comes back as a message the Console doesn't show
|
||||||
|
yet, and the next `mosaic talk` prints it after sending its own message
|
||||||
|
(decision 97).
|
||||||
|
|
||||||
|
**Reply in the board (`public/app.js`).** A refused Reply said "Delivery
|
||||||
|
may be unknown; check the seat before sending again" for a 403. A 4xx now
|
||||||
|
says "Not sent."; no answer, an unreadable one or a 5xx keeps the old
|
||||||
|
text. Row 74 left this for this row.
|
||||||
|
|
||||||
|
**README.** A "Message a role" section: the command, what `--send` grants
|
||||||
|
(anyone the proxy lets through as ID, and any local process that reaches
|
||||||
|
the port and sets HEADER with `Host: NAME`; decisions 62 and 95), the
|
||||||
|
request and each check, the broker's refusals and their statuses, the
|
||||||
|
unknown outcome, the log line, the page's three receipts, and the reply
|
||||||
|
path with `mosaic talk`'s limits (decision 97). The routes list gains the
|
||||||
|
message trail; the "nothing writes" lines name the exception. Folded in
|
||||||
|
from row 74 per the row note: Filbert N1 ("its first signed-in request"),
|
||||||
|
Darkwing's tunnel sentence (anything reaching a tunnel's local end can
|
||||||
|
send a loopback Host without HEADER, so bind it to loopback), and a
|
||||||
|
pointer to `scripts/webui-service.sh`, which takes no `--send`.
|
||||||
|
|
||||||
|
## Decisions and tradeoffs
|
||||||
|
|
||||||
|
1. **No loopback send.** The brief asks for the header on every request,
|
||||||
|
loopback included. A loopback request can't carry it (row 74 refuses
|
||||||
|
HEADER with a loopback Host), so the operator's browser on `127.0.0.1`
|
||||||
|
reads but can't send. `/api/config` hides the box there.
|
||||||
|
2. **The route checks the header itself** even though the shared check
|
||||||
|
already did for NAME requests. It costs one line and keeps the route
|
||||||
|
closed if the shared check changes.
|
||||||
|
3. **A missing Origin is refused on the send** (the shared check allows a
|
||||||
|
missing one for reads). The brief asks for the request's own origin,
|
||||||
|
and browsers send Origin on a POST.
|
||||||
|
4. **`Sec-Fetch-Site` is compared exactly**, so `Same-Origin` and a
|
||||||
|
repeated header are refused. Browsers send the lowercase value once.
|
||||||
|
5. **Which errors mean "not sent".** The brief maps broker codes like the
|
||||||
|
reads'. I treat every coded broker answer as definite, since the broker
|
||||||
|
writes in one transaction, and only the transport's three lost-answer
|
||||||
|
codes, an uncoded error or a missing id as unknown. The page adds 4xx
|
||||||
|
and the redirect as definite. A proxy 4xx means the request wasn't
|
||||||
|
accepted for forwarding; a proxy 5xx (502, 504) can come after the
|
||||||
|
Console got it, so it stays unknown.
|
||||||
|
6. **The draft is in page memory, not storage.** The brief asks for it to
|
||||||
|
survive the periodic refresh. Keeping it out of `localStorage` keeps a
|
||||||
|
message body off disk on a shared browser profile.
|
||||||
|
7. **`--send` without the bus refuses to start.** The brief doesn't say.
|
||||||
|
Serving a box that can only answer `not-configured` seemed worse than
|
||||||
|
a refusal at start.
|
||||||
|
|
||||||
|
## Where the brief and the code differ (for Sage)
|
||||||
|
|
||||||
|
- "Replies show in the inbox as today": they don't; the inbox shows
|
||||||
|
decisions. Decision 97 settled it: the README and the box give `mosaic
|
||||||
|
talk`'s limits, and the reply view is row 81 (#1575).
|
||||||
|
- "Points at the trail" on an unknown outcome: there's no id to link, so
|
||||||
|
the receipt points at the role's side and the bus trail from a terminal.
|
||||||
|
- The log's `error=` value is the code as answered, unquoted; for the 403s
|
||||||
|
it has spaces (`error=cross-origin request refused`). It is always last
|
||||||
|
on the line.
|
||||||
|
|
||||||
|
## Rebase on row 60
|
||||||
|
|
||||||
|
I built this row on `bbd22f1b`. Row 60 landed first (`1771bf98`), so I
|
||||||
|
applied my patch to `3d298920` with `git apply --3way`. Row 60's hunks in
|
||||||
|
this row's files, and how each merged:
|
||||||
|
|
||||||
|
- `packages/webui/src/serve.mjs`: row 60's `BUS_VERBS` line (adds
|
||||||
|
`credentials`). It merged cleanly; my changes there are elsewhere in the
|
||||||
|
file.
|
||||||
|
- `packages/webui/README.md`: row 60's credentials read and its line in
|
||||||
|
the exposure list. Merged cleanly, in different paragraphs from my
|
||||||
|
"Message a role" section and the "nothing writes" lines.
|
||||||
|
- `packages/webui/src/bus.mjs`: the header comment, the one conflict. Row
|
||||||
|
60 named its `credentials` read and I named the one write. The merged
|
||||||
|
comment says both:
|
||||||
|
|
||||||
|
```
|
||||||
|
// Only the four verbs of the Q1 module (lead decision 56), row 57's
|
||||||
|
// `decisions` and row 60's `credentials` reads are reachable as reads: no
|
||||||
|
// read writes, not even seen (Q4). The one write is row 76's human
|
||||||
|
// `message.send` (lead decision 95), built by the CLI only with --send. The
|
||||||
|
// bus does the proof; a server started inside an agent run gets
|
||||||
|
// `human-required` from the broker.
|
||||||
|
```
|
||||||
|
|
||||||
|
Row 60's `tests/bus.test.mjs` change isn't in a file this row touches. The
|
||||||
|
mutants, the suites and the demonstration below ran on the rebased tree.
|
||||||
|
|
||||||
|
## Files
|
||||||
|
|
||||||
|
| File | Change |
|
||||||
|
|---|---|
|
||||||
|
| `packages/webui/src/serve.mjs` | `busSend`, the route under `send`, `body()` limit parameter, `send`/`log` options, `/api/config` `send` |
|
||||||
|
| `packages/webui/src/bus.mjs` | `busCaller` split out of `busReader`; `sendOutcome`; three codes added to the status map |
|
||||||
|
| `packages/webui/src/cli.mjs` | `--send`, refused without the preview flags or the bus; the `Preview:` line |
|
||||||
|
| `packages/webui/src/public/bus.js` | the "Message a role" box, the message trail kind, focus and caret kept across a refresh |
|
||||||
|
| `packages/webui/src/public/app.js` | the Reply 4xx text |
|
||||||
|
| `packages/webui/README.md` | the "Message a role" section and the folded-in row 74 notes |
|
||||||
|
| `packages/webui/tests/send.test.mjs` | new, 13 tests |
|
||||||
|
| `packages/webui/tests/send-browser.test.mjs` | new, 1 browser test |
|
||||||
|
| `packages/webui/tests/shell.test.mjs` | the pinned write boundary: bus.js has exactly one write, this one |
|
||||||
|
|
||||||
|
## Tests
|
||||||
|
|
||||||
|
`send.test.mjs` (13): `startServer` refuses `send` without the preview
|
||||||
|
mode or as a non-function; the CLI refuses `--send` without the flags and
|
||||||
|
without a configured bus (exit 2, nothing on stdout, the config path not
|
||||||
|
named); the CLI with `--send` and a configured bus but no bus host running
|
||||||
|
prints the `Preview:` line, answers a send 503 `no-bus-host` with `sent:
|
||||||
|
false` through the real human transport, and logs one line without the
|
||||||
|
body; without `--send` the route is 403 `read-only` and
|
||||||
|
config says no send; with `--send` every other write (POST, PUT, DELETE,
|
||||||
|
PATCH on the board, bus and page routes) is still 403 `read-only` and
|
||||||
|
nothing reaches the board or bus; config says send only on NAME; 401 for no
|
||||||
|
header, another user, a suffix, two values, loopback without the header
|
||||||
|
and `localhost` with no Origin, and 403 `proxy Host refused` for loopback
|
||||||
|
with it, none sent or logged; each request check (no Origin, no or wrong
|
||||||
|
or repeated `Sec-Fetch-Site`, no or wrong Content-Type, a form, 16385
|
||||||
|
bytes, extra keys, `business`, missing `to` or `body`, not JSON, null, an
|
||||||
|
array, a string) refused with `sent: false`, logged without the body, and
|
||||||
|
16384 bytes accepted; wrong Origins refused by the shared check; GET and
|
||||||
|
PUT 405; exactly `to`, `body` and `in_reply_to` passed on; a crafted `to`
|
||||||
|
can't forge a log line; each bus refusal with its status and `sent:
|
||||||
|
false`, each open outcome 503 `unknown`, a missing id unknown, and one
|
||||||
|
call each (no retry); the human transport request is exactly the business,
|
||||||
|
`message.send` and the keys; against a real broker the message is written
|
||||||
|
once as a human send (`from_role` human, `from_run` human-cli, class INFO)
|
||||||
|
and `unknown-role`, `invalid-request` and `message-not-found` map to 400.
|
||||||
|
|
||||||
|
`send-browser.test.mjs` drives the page in Chrome with an in-process
|
||||||
|
broker for the roles and the trail and a stub for the POST (a send passes
|
||||||
|
only with the proxy's https Origin, which a loopback page can't have): no
|
||||||
|
box without `send`; the held roles; empty role and text refused without a
|
||||||
|
request; the draft across a refresh; a 400 and a 503 `sent: false`
|
||||||
|
refused with the draft kept; a redirect refused as `sign-in`; an unknown
|
||||||
|
outcome, a network failure and a 200 without an id each unknown, with no
|
||||||
|
trail link and no resend; one POST per Send, pinned as
|
||||||
|
`{method, headers, body, redirect: 'manual'}`; Send disabled while
|
||||||
|
pending and a second press ignored; text typed during a send kept; a plain
|
||||||
|
success clears the text and keeps the role; the receipt's trail link opens
|
||||||
|
the message's trail; an unknown message id is not found.
|
||||||
|
|
||||||
|
## Mutants
|
||||||
|
|
||||||
|
`mutants.py` makes 21 single-site edits, one at a time, in a separate
|
||||||
|
worktree of the rebased candidate (never the build tree). Each mutant runs
|
||||||
|
against the whole webui suite, and the file is restored from the copy read
|
||||||
|
before the edit. The baseline passed, the worktree was unchanged afterwards,
|
||||||
|
and **21 of 21 were killed** (2026-10-12T00:40:39Z to 01:02:24Z).
|
||||||
|
`mutants.txt` lists each mutant with the tests that killed it.
|
||||||
|
|
||||||
|
- Route (`serve.mjs`): the route's own header check removed; Origin
|
||||||
|
unchecked; `Sec-Fetch-Site` unchecked, or `same-site` let through; the
|
||||||
|
limit raised to 64 KiB; extra keys allowed; `in_reply_to` dropped; the
|
||||||
|
id check removed; the log's `to` unquoted and uncut; `/api/config`
|
||||||
|
`send` true on loopback; the route open without `--send`; every write
|
||||||
|
opened by `--send` (`send-opens-writes`, killed by the new "every other
|
||||||
|
write is still 403" test).
|
||||||
|
- Outcomes (`bus.mjs`): only `outcome-unknown` left open; `unknown-role`
|
||||||
|
dropped from the status map.
|
||||||
|
- Page (`bus.js`): no pending guard; the text cleared though edited during
|
||||||
|
the send; a 5xx `sent: false` treated as unknown; an unknown outcome
|
||||||
|
resent; a redirect treated as unknown; redirects followed; the message
|
||||||
|
trail shown for any id.
|
||||||
|
|
||||||
|
I ran 20 of these on the `bbd22f1b` build before the rebase. The 18 that
|
||||||
|
finished there were killed too; the run was stopped for the rebase and its
|
||||||
|
log is not in the packet.
|
||||||
|
|
||||||
|
## Demonstration
|
||||||
|
|
||||||
|
`demo.mjs` runs the candidate's `startServer` with `--send`'s options
|
||||||
|
against a real in-process broker (pm, cto and coder; coder claimed),
|
||||||
|
driven over `node:http` on loopback with the headers the proxy and the
|
||||||
|
browser send (`Host: NAME`, `x-authentik-uid: jason`, Origin,
|
||||||
|
`Sec-Fetch-Site`). Three servers: `send`, `lost` (the broker writes, then
|
||||||
|
the call throws `outcome-unknown`, as when the transport loses the
|
||||||
|
answer) and `readonly` (no `--send`). `demo.txt` is its output on the gate
|
||||||
|
worktree:
|
||||||
|
|
||||||
|
```text
|
||||||
|
== a send, and a reply to the coder
|
||||||
|
to coder 200 {"id":"8f66630d-cb38-4879-8119-fb3defd532c8","at":"2026-10-12T00:40:48.392Z"}
|
||||||
|
to coder, in_reply_to the coder's message 200 {"id":"3a35d7b4-2020-464e-9bc3-5ee870c8b53f","at":"2026-10-12T00:40:49.041Z"}
|
||||||
|
== refused before the bus
|
||||||
|
no sign-in header (401, no log line) 401 {"error":"sign-in required"}
|
||||||
|
loopback Host with the header 403 {"error":"proxy Host refused","message":"the proxy must forward Host unchanged"}
|
||||||
|
another Origin (shared check, no log line) 403 {"error":"cross-origin request refused"}
|
||||||
|
no Origin 403 {"error":"cross-origin request refused","message":"a send needs the Console's own Origin","sent":false}
|
||||||
|
Sec-Fetch-Site: same-site 403 {"error":"cross-site request refused","message":"a send needs Sec-Fetch-Site: same-origin","sent":false}
|
||||||
|
Content-Type: text/plain 400 {"error":"invalid-request","message":"Content-Type must be application/json","sent":false}
|
||||||
|
16385 bytes 400 {"error":"invalid-request","message":"body larger than 16384 bytes","sent":false}
|
||||||
|
an extra key 400 {"error":"invalid-request","message":"a send takes to, body and an optional in_reply_to, nothing else","sent":false}
|
||||||
|
GET 405 {"error":"method not allowed"}
|
||||||
|
== refused by the broker
|
||||||
|
a role the business lacks 400 {"error":"unknown-role","message":"not sent: the bus refused it (unknown-role)","sent":false}
|
||||||
|
an empty body 400 {"error":"invalid-request","message":"not sent: the bus refused it (invalid-request)","sent":false}
|
||||||
|
in_reply_to a missing message 400 {"error":"message-not-found","message":"not sent: the bus refused it (message-not-found)","sent":false}
|
||||||
|
== the answer lost after the broker wrote
|
||||||
|
unknown, not retried 503 {"error":"outcome-unknown","message":"the message may have been sent; nothing was retried. Check the trail before sending again","sent":"unknown"}
|
||||||
|
== without --send
|
||||||
|
POST is read-only 403 {"error":"read-only","message":"the Console preview is read-only"}
|
||||||
|
== what the broker holds
|
||||||
|
8f66630d from=human/human-cli to=coder class=INFO in_reply_to=- body="Please look at row 76 before the cutover."
|
||||||
|
3a35d7b4 from=human/human-cli to=coder class=INFO in_reply_to=0536126f-c54a-40a5-999d-c7fe1c01d9a2 body="refactor"
|
||||||
|
pm receives 1 message(s) from the lost-answer send: ["Lost answer test"]
|
||||||
|
== the Console log, one line per send past sign-in
|
||||||
|
2026-10-12T00:40:48.392Z send user="jason" to="coder" id=8f66630d-cb38-4879-8119-fb3defd532c8
|
||||||
|
2026-10-12T00:40:49.041Z send user="jason" to="coder" id=3a35d7b4-2020-464e-9bc3-5ee870c8b53f
|
||||||
|
2026-10-12T00:40:49.057Z send user="jason" to=none error=cross-origin request refused
|
||||||
|
2026-10-12T00:40:49.058Z send user="jason" to=none error=cross-site request refused
|
||||||
|
2026-10-12T00:40:49.061Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.066Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.072Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.281Z send user="jason" to="auditor" error=unknown-role
|
||||||
|
2026-10-12T00:40:49.535Z send user="jason" to="coder" error=invalid-request
|
||||||
|
2026-10-12T00:40:49.802Z send user="jason" to="coder" error=message-not-found
|
||||||
|
2026-10-12T00:40:50.173Z send user="jason" to="pm" error=outcome-unknown
|
||||||
|
a body in the log: false
|
||||||
|
```
|
||||||
|
|
||||||
|
## Gate (my run on the candidate)
|
||||||
|
|
||||||
|
Detached worktree of `3d298920`, `build.patch` applied with `git apply
|
||||||
|
--index`, the manifest 9/9 OK before and after. Suites one after another,
|
||||||
|
`TMPDIR` in my scratch, Docker on, 2026-10-12T01:02:24Z to 01:09:40Z:
|
||||||
|
|
||||||
|
| Suite | Result |
|
||||||
|
|---|---|
|
||||||
|
| `packages/webui` | 76 pass, 0 fail, 0 skipped, the browser tests included (14 new) |
|
||||||
|
| `packages/bus` | 88 pass, 0 fail |
|
||||||
|
| `packages/cli` | 114 pass, 0 fail |
|
||||||
|
| `packages/control-board` | 124 pass, 0 fail |
|
||||||
|
| business, conversation, discord, harness, ledger, mosaic, queue, runs, seat, tasks | all 0 fail (60, 182, 178, 59, 78, 69, 150, 41, 27, 71 pass) |
|
||||||
|
| build-tokens `--check` | exit 0 |
|
||||||
|
| test-auth, test-conductor, test-config, test-discord, test-extension-package, test-foundation | exit 0 (15, 17, 24, 66, 18, 44 passed) |
|
||||||
|
| test-queue | 27 passed, 0 failed; its `verify`/`render --check` case skips outside the canonical checkout |
|
||||||
|
| test-release | 14 passed, 0 failed (Docker, nothing skipped) |
|
||||||
|
| test-task | 98 passed, 0 failed (Docker, nothing skipped) |
|
||||||
|
|
||||||
|
`git status` afterwards shows only the patch's 9 staged files and the
|
||||||
|
`node_modules` link. `core.hooksPath` stayed unset.
|
||||||
|
|
||||||
|
## Questions for reviewers
|
||||||
|
|
||||||
|
1. Decision 5: is a proxy 4xx safe to show as "not sent"? I think so for
|
||||||
|
the proxies we'd use, but a reviewer who knows one that answers 4xx
|
||||||
|
after forwarding should say.
|
||||||
|
2. Decision 7: refusing `--send` at start without the bus config, rather
|
||||||
|
than serving reads and answering `not-configured` on each send.
|
||||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,9 @@
|
|||||||
|
c6cf1714407803d21a5757f39333a396c76abf582da0df51aeee4294e00cff06 packages/webui/README.md
|
||||||
|
a0661abb7de79ce2854884c99f7d8db114d8028d99048e7387a9b2f8534cd422 packages/webui/src/bus.mjs
|
||||||
|
c8f9845c66793b0516d5f356f6be9f8ae2d46c40fdd044945aac2a606d024bee packages/webui/src/cli.mjs
|
||||||
|
a259dd523625a83237ebc98d0361ff6de1732729a661f9e0f37492f99e3b3f60 packages/webui/src/serve.mjs
|
||||||
|
6ec0ff037d91ba52cce3361b079131d255df8484bcc6e924956731d2b2f86de1 packages/webui/src/public/app.js
|
||||||
|
643178391c4e5dc2ac05a9c1d2972dd374bf6f692a5f28717ec0289d74a64a91 packages/webui/src/public/bus.js
|
||||||
|
7dfceeaf485bc9b636fb12c7bc5a0f12ca74d6b43c351feaf2d335f527f31ee9 packages/webui/tests/send.test.mjs
|
||||||
|
fdf0d30c097ab425fe8426f940892b7422a00ab5d6b7d30cefa0c4c5feafaa35 packages/webui/tests/send-browser.test.mjs
|
||||||
|
17cb39097414bd685d68305dd5e402fd645020695f3dee86cd6bb567dd410eff packages/webui/tests/shell.test.mjs
|
||||||
@@ -0,0 +1,104 @@
|
|||||||
|
// Row 76 (#1570): `serve --send` end to end against a real broker, driven over HTTP on loopback
|
||||||
|
// with the headers the sign-in proxy and the browser would send.
|
||||||
|
// Run: TMPDIR=<scratch> node demo.mjs <worktree with the candidate>.
|
||||||
|
// The broker is in this process, as in send-browser.test.mjs; the human transport between the
|
||||||
|
// Console and a bus host is send.test.mjs's. `send` maps the broker's refusal the way humanCall does.
|
||||||
|
import { request } from 'node:http';
|
||||||
|
import { mkdtempSync, rmSync } from 'node:fs';
|
||||||
|
import { tmpdir } from 'node:os';
|
||||||
|
import { join, resolve } from 'node:path';
|
||||||
|
import { pathToFileURL } from 'node:url';
|
||||||
|
|
||||||
|
const tree = resolve(process.argv[2]);
|
||||||
|
const load = p => import(pathToFileURL(join(tree, p)).href);
|
||||||
|
const { Store } = await load('packages/bus/src/store.mjs');
|
||||||
|
const { Broker } = await load('packages/bus/src/broker.mjs');
|
||||||
|
const { views } = await load('packages/bus/src/views.mjs');
|
||||||
|
const { startServer } = await load('packages/webui/src/serve.mjs');
|
||||||
|
const { BusReadError } = await load('packages/webui/src/bus.mjs');
|
||||||
|
|
||||||
|
const NAME = 'mosaic-preview.example.com', HEADER = 'x-authentik-uid', ID = 'jason';
|
||||||
|
const preview = { host: NAME, header: HEADER, user: ID };
|
||||||
|
const role = { authority: { withinRole: ['message.send'], crossRole: [] } };
|
||||||
|
const businesses = { demo: { id: 'demo', human: 'jason', arbiters: { technical: 'cto', delivery: 'pm' }, roles: { pm: role, cto: role, coder: role } } };
|
||||||
|
const root = mkdtempSync(join(tmpdir(), 'r76-demo-'));
|
||||||
|
const store = new Store(root), b = new Broker({ store, businesses });
|
||||||
|
const coder = b.bindLaunch({ business: 'demo', role: 'coder', run: 'coder-run', harness: 'pi', address: 'coder-run' });
|
||||||
|
b.request(coder, { verb: 'role.claim' });
|
||||||
|
const human = b.bindHuman({ business: 'demo', human: 'jason', via: 'cli', outsideAgent: true });
|
||||||
|
const reader = b.bindReader({ business: 'demo' });
|
||||||
|
const bus = views({ call: async (verb, args = {}) => structuredClone(b.request(reader, { verb, args })) });
|
||||||
|
const toBus = fn => async args => { try { return await fn(args); } catch (e) { throw new BusReadError(e.code ?? 'outcome-unknown'); } };
|
||||||
|
const send = toBus(async args => structuredClone(b.request(human, { verb: 'message.send', args })));
|
||||||
|
// A transport that loses the answer after the broker wrote: the outcome is unknown.
|
||||||
|
const lost = toBus(async args => { b.request(human, { verb: 'message.send', args }); throw Object.assign(new Error('lost'), { code: 'outcome-unknown' }); });
|
||||||
|
const lines = [];
|
||||||
|
const log = l => lines.push(l);
|
||||||
|
const servers = {
|
||||||
|
send: await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, preview, send, log }),
|
||||||
|
lost: await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, preview, send: lost, log }),
|
||||||
|
readonly: await startServer({ port: 0, board: 'http://127.0.0.1:9', bus, preview, log }),
|
||||||
|
};
|
||||||
|
|
||||||
|
const signed = { [HEADER]: ID, origin: `https://${NAME}`, 'sec-fetch-site': 'same-origin', 'content-type': 'application/json' };
|
||||||
|
function call(server, { method = 'POST', headers = signed, body, host = NAME } = {}) {
|
||||||
|
return new Promise((done, fail) => {
|
||||||
|
const length = body === undefined ? {} : { 'content-length': Buffer.byteLength(body) };
|
||||||
|
const req = request({ host: '127.0.0.1', port: servers[server].address().port, method, path: '/api/bus/message', headers: { host, ...length, ...headers } }, res => {
|
||||||
|
let text = '';
|
||||||
|
res.on('data', c => (text += c));
|
||||||
|
res.on('end', () => done(`${res.statusCode} ${text}`));
|
||||||
|
});
|
||||||
|
req.on('error', fail);
|
||||||
|
req.end(body);
|
||||||
|
});
|
||||||
|
}
|
||||||
|
const omit = (k, extra = {}) => ({ ...Object.fromEntries(Object.entries(signed).filter(([n]) => n !== k)), ...extra });
|
||||||
|
const show = async (what, server, options) => console.log(`${what.padEnd(46)} ${await call(server, options)}`);
|
||||||
|
const BODY = 'Please look at row 76 before the cutover.';
|
||||||
|
const sent = [];
|
||||||
|
|
||||||
|
console.log('== a send, and a reply to the coder');
|
||||||
|
const first = await call('send', { body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
console.log(`${'to coder'.padEnd(46)} ${first}`);
|
||||||
|
sent.push(JSON.parse(first.slice(5)).id);
|
||||||
|
const asked = b.request(coder, { verb: 'message.send', args: { to: 'human', body: 'Which branch?' } });
|
||||||
|
const reply = await call('send', { body: JSON.stringify({ to: 'coder', body: 'refactor', in_reply_to: asked.id }) });
|
||||||
|
console.log(`${'to coder, in_reply_to the coder\'s message'.padEnd(46)} ${reply}`);
|
||||||
|
sent.push(JSON.parse(reply.slice(5)).id);
|
||||||
|
|
||||||
|
console.log('== refused before the bus');
|
||||||
|
await show('no sign-in header (401, no log line)', 'send', { headers: omit(HEADER), body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('loopback Host with the header', 'send', { host: '127.0.0.1', body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('another Origin (shared check, no log line)', 'send', { headers: omit('origin', { origin: 'https://evil.example' }), body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('no Origin', 'send', { headers: omit('origin'), body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('Sec-Fetch-Site: same-site', 'send', { headers: omit('sec-fetch-site', { 'sec-fetch-site': 'same-site' }), body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('Content-Type: text/plain', 'send', { headers: omit('content-type', { 'content-type': 'text/plain' }), body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
await show('16385 bytes', 'send', { body: JSON.stringify({ to: 'coder', body: 'x'.repeat(16385 - 23) }) });
|
||||||
|
await show('an extra key', 'send', { body: JSON.stringify({ to: 'coder', body: BODY, class: 'BLOCKING' }) });
|
||||||
|
await show('GET', 'send', { method: 'GET', body: undefined });
|
||||||
|
console.log('== refused by the broker');
|
||||||
|
await show('a role the business lacks', 'send', { body: JSON.stringify({ to: 'auditor', body: BODY }) });
|
||||||
|
await show('an empty body', 'send', { body: JSON.stringify({ to: 'coder', body: '' }) });
|
||||||
|
await show('in_reply_to a missing message', 'send', { body: JSON.stringify({ to: 'coder', body: BODY, in_reply_to: 'msg-none' }) });
|
||||||
|
console.log('== the answer lost after the broker wrote');
|
||||||
|
await show('unknown, not retried', 'lost', { body: JSON.stringify({ to: 'pm', body: 'Lost answer test' }) });
|
||||||
|
console.log('== without --send');
|
||||||
|
await show('POST is read-only', 'readonly', { body: JSON.stringify({ to: 'coder', body: BODY }) });
|
||||||
|
|
||||||
|
console.log('== what the broker holds');
|
||||||
|
for (const id of sent) {
|
||||||
|
const [m] = b.request(human, { verb: 'trail', args: { subject: id } }).filter(r => r.table === 'messages' && r.id === id);
|
||||||
|
console.log(`${id.slice(0, 8)} from=${m.from_role}/${m.from_run} to=${m.to_role} class=${m.class} in_reply_to=${m.in_reply_to ?? '-'} body=${JSON.stringify(m.body)}`);
|
||||||
|
}
|
||||||
|
const pm = b.bindLaunch({ business: 'demo', role: 'pm', run: 'pm-run', harness: 'pi', address: 'pm-run' });
|
||||||
|
b.request(pm, { verb: 'role.claim' });
|
||||||
|
const lostRows = b.request(pm, { verb: 'message.receive', args: {} });
|
||||||
|
console.log(`pm receives ${lostRows.length} message(s) from the lost-answer send: ${JSON.stringify(lostRows.map(m => m.body))}`);
|
||||||
|
|
||||||
|
console.log('== the Console log, one line per send past sign-in');
|
||||||
|
for (const l of lines) console.log(l);
|
||||||
|
console.log(`a body in the log: ${lines.some(l => l.includes(BODY) || l.includes('refactor') || l.includes('Lost answer'))}`);
|
||||||
|
for (const s of Object.values(servers)) await new Promise(r => s.close(r));
|
||||||
|
store.close();
|
||||||
|
rmSync(root, { recursive: true, force: true });
|
||||||
@@ -0,0 +1,38 @@
|
|||||||
|
== a send, and a reply to the coder
|
||||||
|
to coder 200 {"id":"8f66630d-cb38-4879-8119-fb3defd532c8","at":"2026-10-12T00:40:48.392Z"}
|
||||||
|
to coder, in_reply_to the coder's message 200 {"id":"3a35d7b4-2020-464e-9bc3-5ee870c8b53f","at":"2026-10-12T00:40:49.041Z"}
|
||||||
|
== refused before the bus
|
||||||
|
no sign-in header (401, no log line) 401 {"error":"sign-in required"}
|
||||||
|
loopback Host with the header 403 {"error":"proxy Host refused","message":"the proxy must forward Host unchanged"}
|
||||||
|
another Origin (shared check, no log line) 403 {"error":"cross-origin request refused"}
|
||||||
|
no Origin 403 {"error":"cross-origin request refused","message":"a send needs the Console's own Origin","sent":false}
|
||||||
|
Sec-Fetch-Site: same-site 403 {"error":"cross-site request refused","message":"a send needs Sec-Fetch-Site: same-origin","sent":false}
|
||||||
|
Content-Type: text/plain 400 {"error":"invalid-request","message":"Content-Type must be application/json","sent":false}
|
||||||
|
16385 bytes 400 {"error":"invalid-request","message":"body larger than 16384 bytes","sent":false}
|
||||||
|
an extra key 400 {"error":"invalid-request","message":"a send takes to, body and an optional in_reply_to, nothing else","sent":false}
|
||||||
|
GET 405 {"error":"method not allowed"}
|
||||||
|
== refused by the broker
|
||||||
|
a role the business lacks 400 {"error":"unknown-role","message":"not sent: the bus refused it (unknown-role)","sent":false}
|
||||||
|
an empty body 400 {"error":"invalid-request","message":"not sent: the bus refused it (invalid-request)","sent":false}
|
||||||
|
in_reply_to a missing message 400 {"error":"message-not-found","message":"not sent: the bus refused it (message-not-found)","sent":false}
|
||||||
|
== the answer lost after the broker wrote
|
||||||
|
unknown, not retried 503 {"error":"outcome-unknown","message":"the message may have been sent; nothing was retried. Check the trail before sending again","sent":"unknown"}
|
||||||
|
== without --send
|
||||||
|
POST is read-only 403 {"error":"read-only","message":"the Console preview is read-only"}
|
||||||
|
== what the broker holds
|
||||||
|
8f66630d from=human/human-cli to=coder class=INFO in_reply_to=- body="Please look at row 76 before the cutover."
|
||||||
|
3a35d7b4 from=human/human-cli to=coder class=INFO in_reply_to=0536126f-c54a-40a5-999d-c7fe1c01d9a2 body="refactor"
|
||||||
|
pm receives 1 message(s) from the lost-answer send: ["Lost answer test"]
|
||||||
|
== the Console log, one line per send past sign-in
|
||||||
|
2026-10-12T00:40:48.392Z send user="jason" to="coder" id=8f66630d-cb38-4879-8119-fb3defd532c8
|
||||||
|
2026-10-12T00:40:49.041Z send user="jason" to="coder" id=3a35d7b4-2020-464e-9bc3-5ee870c8b53f
|
||||||
|
2026-10-12T00:40:49.057Z send user="jason" to=none error=cross-origin request refused
|
||||||
|
2026-10-12T00:40:49.058Z send user="jason" to=none error=cross-site request refused
|
||||||
|
2026-10-12T00:40:49.061Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.066Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.072Z send user="jason" to=none error=invalid-request
|
||||||
|
2026-10-12T00:40:49.281Z send user="jason" to="auditor" error=unknown-role
|
||||||
|
2026-10-12T00:40:49.535Z send user="jason" to="coder" error=invalid-request
|
||||||
|
2026-10-12T00:40:49.802Z send user="jason" to="coder" error=message-not-found
|
||||||
|
2026-10-12T00:40:50.173Z send user="jason" to="pm" error=outcome-unknown
|
||||||
|
a body in the log: false
|
||||||
@@ -0,0 +1,81 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# Dewey row 76 mutants: single-site edits in a mutant worktree (never the build tree), each run
|
||||||
|
# against the whole webui suite. The candidate is uncommitted there, so each file is restored
|
||||||
|
# from the copy read before the edit, not from git.
|
||||||
|
# Usage: mutants.py [mutant ...]. A site that doesn't match exactly once is BAD-SITE.
|
||||||
|
import os, subprocess, sys
|
||||||
|
|
||||||
|
R = os.path.expanduser('~/dewey-scratch/r76')
|
||||||
|
T = R + '/mut'
|
||||||
|
OUT = R + '/out/mut'
|
||||||
|
SERVE = 'packages/webui/src/serve.mjs'
|
||||||
|
BUS = 'packages/webui/src/bus.mjs'
|
||||||
|
PAGE = 'packages/webui/src/public/bus.js'
|
||||||
|
TESTS = ['node', '--test', 'packages/webui/tests/*.test.mjs']
|
||||||
|
|
||||||
|
MUTANTS = [
|
||||||
|
# name, file, edits [(old, new)]
|
||||||
|
('send-header-unchecked', SERVE, [(" if (one(req, preview.header) !== preview.user) return json(res, 401, { error: 'sign-in required' });\n", "")]),
|
||||||
|
('send-origin-unchecked', SERVE, [(" if (one(req, 'origin') !== `https://${preview.host}`) return refuse(", " if (false) return refuse(")]),
|
||||||
|
('send-sfs-unchecked', SERVE, [(" if (one(req, 'sec-fetch-site') !== 'same-origin') return refuse(", " if (false) return refuse(")]),
|
||||||
|
('send-sfs-same-site', SERVE, [(" if (one(req, 'sec-fetch-site') !== 'same-origin') return", " if (!['same-origin', 'same-site'].includes(one(req, 'sec-fetch-site'))) return")]),
|
||||||
|
('send-limit-64k', SERVE, [("await body(req, 16384)", "await body(req, 65536)")]),
|
||||||
|
('send-extra-keys', SERVE, [(" || Object.keys(value).some(k => !SEND_KEYS.includes(k))", "")]),
|
||||||
|
('send-drops-reply-to', SERVE, [(" if ('in_reply_to' in value) args.in_reply_to = value.in_reply_to;\n", "")]),
|
||||||
|
('send-no-id-check', SERVE, [(" if (!subjectOk(result?.id)) return refuse(", " if (false) return refuse(")]),
|
||||||
|
('send-log-unbounded', SERVE, [("JSON.stringify(to.slice(0, 64))", "to")]),
|
||||||
|
('config-send-loopback', SERVE, [("send: Boolean(send) && named", "send: Boolean(send)")]),
|
||||||
|
('route-open-without-send', SERVE, [(" if (send && path === '/api/bus/message') {", " if (path === '/api/bus/message') {")]),
|
||||||
|
('send-opens-writes', SERVE, [(" if (preview !== null && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only'", " if (preview !== null && !send && req.method !== 'GET' && req.method !== 'HEAD') return json(res, 403, { error: 'read-only'")]),
|
||||||
|
('outcome-all-definite', BUS, [("const OPEN = ['outcome-unknown', 'invalid-response', 'response-too-large'];", "const OPEN = ['outcome-unknown'];")]),
|
||||||
|
('status-unknown-role-502', BUS, [("'unknown-role': 400, ", "")]),
|
||||||
|
('page-no-pending-guard', PAGE, [(" if (sending) return;\n", "")]),
|
||||||
|
('page-clears-edited-text', PAGE, [(" if (draft.body === text) draft.body = '';", " draft.body = '';")]),
|
||||||
|
('page-5xx-refusal-unknown', PAGE, [(" || body?.sent === false)", ")")]),
|
||||||
|
('page-retries-unknown', PAGE, [(" } else receipt = { kind: 'unknown', to };", " } else { receipt = { kind: 'unknown', to }; await fetch('/api/bus/message', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ to, body: text }), cache: 'no-store', redirect: 'manual' }).catch(() => {}); }")]),
|
||||||
|
('page-redirect-unknown', PAGE, [(" if (res?.type === 'opaqueredirect') {", " if (false) {")]),
|
||||||
|
('page-follows-redirect', PAGE, [(", cache: 'no-store', redirect: 'manual' });", ", cache: 'no-store' });")]),
|
||||||
|
('page-trail-any-id', PAGE, [(" if (!of(tr, 'messages').some(m => m.id === ref)) return notFound(", " if (false) return notFound(")]),
|
||||||
|
]
|
||||||
|
|
||||||
|
def run(cmd):
|
||||||
|
try:
|
||||||
|
p = subprocess.run(cmd, cwd=T, capture_output=True, text=True, env={**os.environ, 'TMPDIR': R + '/tmp'}, timeout=600)
|
||||||
|
except subprocess.TimeoutExpired:
|
||||||
|
return 'TIMEOUT', 'timed out after 600 s'
|
||||||
|
return p.returncode, p.stdout + p.stderr
|
||||||
|
|
||||||
|
os.makedirs(OUT, exist_ok=True)
|
||||||
|
os.makedirs(R + '/tmp', exist_ok=True)
|
||||||
|
before = run(['git', 'diff'])[1]
|
||||||
|
rc, out = run(TESTS)
|
||||||
|
open(f'{OUT}/baseline.txt', 'w').write(out)
|
||||||
|
print('baseline', 'pass' if rc == 0 else f'FAIL rc={rc}', flush=True)
|
||||||
|
want = sys.argv[1:]
|
||||||
|
results = []
|
||||||
|
for name, f, edits in MUTANTS:
|
||||||
|
if want and name not in want:
|
||||||
|
continue
|
||||||
|
path = os.path.join(T, f)
|
||||||
|
original = open(path).read()
|
||||||
|
bad = [old for old, _ in edits if original.count(old) != 1]
|
||||||
|
if bad:
|
||||||
|
results.append(f'{name} BAD-SITE ({[original.count(o) for o in bad]} matches)')
|
||||||
|
print(results[-1], flush=True)
|
||||||
|
continue
|
||||||
|
src = original
|
||||||
|
for old, new in edits:
|
||||||
|
src = src.replace(old, new)
|
||||||
|
open(path, 'w').write(src)
|
||||||
|
try:
|
||||||
|
rc, out = run(TESTS)
|
||||||
|
finally:
|
||||||
|
open(path, 'w').write(original)
|
||||||
|
open(f'{OUT}/mut-{name}.txt', 'w').write(out)
|
||||||
|
failed = [l[2:].split(' (')[0] for l in out.splitlines() if l.startswith('✖ ') and 'failing tests' not in l]
|
||||||
|
verdict = 'TIMEOUT' if rc == 'TIMEOUT' else 'killed' if rc else 'SURVIVED'
|
||||||
|
results.append(f"{name} {verdict}" + (f": {sorted(set(failed))}" if failed else ''))
|
||||||
|
print(results[-1], flush=True)
|
||||||
|
print('worktree unchanged after:', run(['git', 'diff'])[1] == before)
|
||||||
|
ran = [r for r in results if 'BAD-SITE' not in r]
|
||||||
|
print(f'summary {sum(1 for r in ran if " killed" in r)} of {len(ran)} killed')
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
baseline pass
|
||||||
|
send-header-unchecked killed: ['a send without the signed-in user is 401 and is neither sent nor logged, loopback included']
|
||||||
|
send-origin-unchecked killed: ['each request check refuses before anything is sent, and logs the refusal without the body']
|
||||||
|
send-sfs-unchecked killed: ['each request check refuses before anything is sent, and logs the refusal without the body']
|
||||||
|
send-sfs-same-site killed: ['each request check refuses before anything is sent, and logs the refusal without the body']
|
||||||
|
send-limit-64k killed: ['each request check refuses before anything is sent, and logs the refusal without the body']
|
||||||
|
send-extra-keys killed: ['each request check refuses before anything is sent, and logs the refusal without the body']
|
||||||
|
send-drops-reply-to killed: ['a send passes exactly to, body and in_reply_to, answers the id, and logs it', 'against a real broker: the message is written once as a human send, and its refusals map']
|
||||||
|
send-no-id-check killed: ['a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried']
|
||||||
|
send-log-unbounded killed: ['a crafted role name cannot forge a log line', 'a send passes exactly to, body and in_reply_to, answers the id, and logs it', 'the CLI with --send and a configured bus sends through the human transport and logs one line']
|
||||||
|
config-send-loopback killed: ['config says send only on the public name with --send on']
|
||||||
|
route-open-without-send killed: ['without --send the route is read-only like every other write, and config says no send']
|
||||||
|
send-opens-writes killed: ['with --send every other write is still 403 read-only, and nothing reaches the board or bus']
|
||||||
|
outcome-all-definite killed: ['a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried', 'through the human transport the request is exactly the business, message.send and the keys']
|
||||||
|
status-unknown-role-502 killed: ['a bus refusal is not sent, with its status; an outcome the bus could not confirm is unknown and never retried', 'against a real broker: the message is written once as a human send, and its refusals map', 'through the human transport the request is exactly the business, message.send and the keys']
|
||||||
|
page-no-pending-guard killed: ['the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-clears-edited-text killed: ['the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-5xx-refusal-unknown killed: ['the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-retries-unknown killed: ['shipped strings are unchanged, and the web keeps its write boundary', 'the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-redirect-unknown killed: ['the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-follows-redirect killed: ['shipped strings are unchanged, and the web keeps its write boundary', 'the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
page-trail-any-id killed: ['the send box: held roles, the draft across a refresh, each receipt, one POST per Send, and the trail link']
|
||||||
|
worktree unchanged after: True
|
||||||
|
summary 21 of 21 killed
|
||||||
Reference in New Issue
Block a user