plans: decision 101 and row 83 brief, the unit script takes --send (#1576)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -2187,3 +2187,43 @@ which stay with him. Each item names who decided it and what happened.
     - The tradeoff: round 2 grows by one behaviour change and about seven
       tests. In exchange the 408 case is closed before any send box is
       served, and the new page behaviour has tests before it lands.
+
+101. **The cutover unit signs in by username and sends; row 83 lets the
+    unit script carry `--send` (2026-10-12).** Mos, sage-0065 and
+    sage-0066, after ops-01's read-only check of the proxy path and of
+    the Authentik 2025.10.2 source.
+    - Header and user for the cutover: `--auth-header
+      X-authentik-username --allow-user jason.woltje`. Mos won't add a
+      token read for the uid, since the approved window runs only the
+      reviewed R5 script. The route forwards X-authentik-uid and
+      X-authentik-username and deletes client copies of both first.
+    - The switch to the uid is an operator step after the cutover, not
+      Console code. The uid comes from X-authentik-uid on Jason's first
+      authenticated request; how it is read without a token is settled
+      after the cutover. Sage installs it with `scripts/webui-service.sh
+      install --auth-header X-authentik-uid --allow-user UID` only if
+      the value matches `^[0-9a-f]{64}$`. Otherwise Sage installs
+      nothing, records it, and reports to Mos, because it means the
+      outpost's sub_mode isn't hashed_user_id. Jason restarts the unit
+      (decision 94).
+    - The Console doesn't pin the uid itself. Its config comes from flags
+      a reviewed script renders; a Console that wrote its own allowed
+      user would be new code behind a security check, and a row the
+      cutover doesn't need.
+    - ops-01's redirect gap is already closed for send in c45b948d: the
+      POST uses `redirect: 'manual'`, an opaqueredirect reads as not
+      sent, and a network error reads as unknown, tested in
+      send-browser.test.mjs. Reply and Seen don't reach the board
+      through the preview (403 `read-only`). If the outpost redirects
+      them first, the page follows the redirect and Reply says delivery
+      may be unknown. That's the safe direction, and its wording goes
+      on the follow-up list with the row 76 cosmetic notes.
+    - Row 83 (#1576): `scripts/webui-service.sh` takes `--send`, only
+      with the preview set. It's a cutover row, so the decision 94 hold
+      doesn't apply. Dewey owns it; Darkwing and Filbert review; Sage's
+      gate. Without it, a sending unit needs a hand edit nobody reviews.
+    - The tradeoff: a username can be renamed by an Authentik admin and
+      a uid can't, so for a day or so the allowed-user check rests on
+      the username. The policy binding admits only pk 5, and only admins
+      can rename, so the exposure is to an admin, who controls the
+      outpost anyway.

docs/plans/2026-10-12_console-service-send.md

@@ -0,0 +1,73 @@
+# Console service: the unit script takes `--send` (2026-10-12)
+
+Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`.
+Issue #1576. A cutover row (lead decisions 94, 95 and 101), so the
+decision 94 hold doesn't apply.
+
+## The unit script takes --send
+
+### Problem
+
+`scripts/webui-service.sh` (row 75, #1569) renders and installs the
+Console's systemd user unit. It takes the preview set (`--public-host`,
+`--auth-header`, `--allow-user`) but not `--send`, and
+`packages/webui/README.md` says so: "The script takes no `--send`, so a
+unit it installs is read-only." Row 76 (#1570, c45b948d) added `--send`
+to `serve`, and the cutover needs it: Jason's Q95 yes is for sending a
+human message to a role from the Console. Today the only way to get a
+sending unit is to hand-edit the installed file, which nothing reviews
+and the next `install` overwrites.
+
+### Owner and reviewer
+
+- Owner: Dewey.
+- Reviewers: Darkwing and Filbert. The flag widens what the installed
+  service can do, so it gets two reviewers like row 76.
+
+### Files owned
+
+- `scripts/webui-service.sh`
+- `packages/webui/tests/service.test.mjs`
+- `packages/webui/README.md`, only the paragraph that starts "To run the
+  Console as a systemd user unit" and the `--send` paragraph under
+  "Message a role" if it needs a pointer to the unit
+- `docs/TOOLS.md`, the "Console service" section only
+- `agents/dewey/work/queue-<row>/`
+
+### What ships
+
+- `render` and `install` take `--send`. It is accepted only with all
+  three preview flags. Without them the script refuses before writing
+  anything, with exit 1 and a message naming the preview flags, the way
+  `serve` refuses (`--send needs the preview mode ...`).
+- With `--send`, the rendered ExecStart ends with `--send` after the
+  preview flags. Nothing else in the unit changes.
+- Without `--send`, `render` output is byte-identical to the base for
+  every flag combination the current tests cover.
+- `uninstall` and `status` don't change. `status` may print whether the
+  installed unit sends, if that's a small change; otherwise leave it.
+- The README paragraph and TOOLS.md say the script takes `--send` only
+  with the preview set, and that the Console then needs the system
+  config at start (`--send needs the bus configured`).
+- Tests: `render --send` with the preview set; `--send` alone; `--send`
+  with one or two preview flags; `install --send` into a test `--dir`
+  with `--no-reload`; a no-`--send` render compared byte for byte with
+  the base. Mutants that drop the preview requirement or the ExecStart
+  append survive on the base and are killed on the candidate.
+
+### Out of scope
+
+- Starting, restarting or enabling the unit. Jason does that (decision
+  94). No test starts a real user unit.
+- The script checking the system config or the bus. The Console's own
+  start check covers it.
+- The allowed-user switch from username to uid (decision 101). That is
+  an operator reinstall with this script after the cutover, not code.
+- Row 77's service hardening notes (#1571).
+
+### Gate
+
+Darkwing and Filbert each approve on #1576 naming the candidate
+manifest. The webui node suite and every `scripts/test-*.sh` green on
+Sage's gate rerun. Round 1 is wanted by 2026-10-12T15:00Z so it can land
+before the cutover at about 21:30Z.