docs: lead decision 93, Q91 A, row 74 brief amended for sign-in on 10-12 (#1568)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -1966,3 +1966,28 @@ which stay with him. Each item names who decided it and what happened.
       local process can still forge it, the same exposure the Console's
       reads have today. In-app OIDC would close that and costs several
       rows; it waits for cutover or later.
+
+93. **Q91 A: a signed-in preview amends 48; sign-in on 10-12
+    (2026-10-11).** Jason, relayed by Mos: "Q91: A / I want sign-in on
+    10-12". Decision 48 item 1 is amended for one case only: a read-only
+    Console preview at its own hostname, behind Pocket ID forward auth
+    limited to Jason's group, with the old build at mosaic.woltje.com left
+    up. In-app sign-in and general access beyond localhost stay out of v1.
+    - The route opens once rev-sol-01 passes ops-01's route proposal,
+      without asking Jason again.
+    - Target: Jason signs in on 2026-10-12, at the latest by
+      2026-10-13T05:00Z. This replaces decision 92's preview dates.
+    - Row 74 is unblocked and Dewey starts it now; their row 59 review is
+      done. Darkwing and Filbert review it ahead of their own rows. Both
+      reviewers and Sage's gate rerun stay. No gate is dropped for the
+      date.
+    - Cut for the date: the service script, its unit template and test,
+      and its TOOLS.md entry go to a follow-up row (this also takes row
+      74 off `docs/TOOLS.md`, which row 70 edits). After the row lands
+      Sage starts the preview as a transient user unit with
+      `systemd-run --user` on its own loopback port, 7332. Port 7330
+      holds the operator's foreground Console from 2026-09-26, which
+      stays.
+    - The tradeoff: a transient unit doesn't survive a reboot and isn't
+      reviewed as a file. It runs one reviewed command line, which the
+      install record states, until the follow-up row ships the unit.

docs/plans/2026-10-11_webui-preview.md

@@ -1,10 +1,11 @@
 # WebUI preview behind sign-in (2026-10-11)
 
 Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`.
-One row. No code starts until Jason answers Q91 (amending lead decision
+One row. Amended the same evening for Jason's Q91 answer "A" (lead
-48 for a signed-in preview reachable beyond localhost). Mos relays the
+decision 93): a read-only preview at its own hostname, behind Pocket ID
-answer. If the ruling narrows or changes what follows, this brief is
+forward auth limited to Jason's group, the old build left up. Target:
-amended first.
+Jason signs in on 2026-10-12, by 2026-10-13T05:00Z at the latest. The
+service script is cut from this row for that date; it is a follow-up.
 
 ## WebUI preview: a signed-in, read-only Console behind the edge proxy
 
@@ -27,27 +28,22 @@ design:
 - Nothing runs the Console as a service. It is a foreground `serve`.
 
 Mos approved these cuts for the preview (2026-10-11): sign-in at the edge
-through Pocket ID forward auth, not login code in the Console; a systemd
+through Pocket ID forward auth, not login code in the Console; a preview
-user unit beside the bus; a preview hostname, so the old build at
+hostname, so the old build at mosaic.woltje.com stays; read-only; not
-mosaic.woltje.com stays; read-only; not held for S7 (row 42) or Gate E
+held for S7 (row 42) or Gate E (row 5). ops-01 owns the Pocket ID client
-(row 5). ops-01 owns the Pocket ID client, the DNS name, TLS, the proxy
+(limited to Jason's group), the DNS name, TLS, the proxy and the route
-and the route from the edge to this host. Jason approves that route
+from the edge to this host. The route opens once rev-sol-01 passes
-before anything is served.
+ops-01's proposal (Q91 A).
 
 ### Owner and reviewer
 
-Owner: Dewey, who owns the WebUI, after their row 59 review. Reviewers:
+Owner: Dewey, who owns the WebUI, starting 2026-10-11 evening. Reviewers:
-Darkwing and Filbert.
+Darkwing and Filbert, ahead of their own rows.
 
 ### Files owned
 
 - `packages/webui/src/serve.mjs`, `packages/webui/src/cli.mjs`,
   `packages/webui/README.md` and `packages/webui/tests/`
-- a new `scripts/webui-service.sh` and its unit template, beside
-  `scripts/bus-service.sh` and `packages/cli/systemd/mosaic-bus.service.in`
-- the test for that script, in the package that holds the template
-- `docs/TOOLS.md`, the new script's entry only. Row 70 also edits this
-  file; whichever lands second rebases on the first.
 - `agents/dewey/work/queue-<row>/`
 
 ### What ships
@@ -69,14 +65,10 @@ exactly as today, and the existing tests show it.
 - Tests for each refusal: wrong Host, wrong Origin, missing header, wrong
   user, a POST to each write route, and a partial flag set refused at
   start. A test that the loopback path is unchanged in preview mode.
-- `scripts/webui-service.sh render|install|uninstall|status` for a
+- The minimum for the first sign-in is the inbox, tasks, agents and
-  `mosaic-webui.service` user unit, on the `bus-service.sh` pattern: a
+  trails (`/api/bus/*`) read-only. The other GET routes stay as they are.
-  template, write to a temp file then rename, `daemon-reload` only, no
+  The board panel reads the board already running on 7331; if it is down
-  start, no restart. It runs the board's `serve` and the Console's
+  the panel shows its existing error and the bus views still work.
-  `serve` with the preview flags (as one unit or two, the packet says
-  which and why), with values from flags or an env file the script names.
-  The env file holds no secret: the header name, the user id and the
-  hostname aren't secrets.
 - The README replaces "Do not expose either unauthenticated server
   through a public proxy" with what the preview mode requires of the
   proxy: it strips HEADER from every client request and sets it only
@@ -96,8 +88,14 @@ exactly as today, and the existing tests show it.
   resolution in the CLI; changing that is a ruling and its own row.
 - Live-seat conversations (CHAT-07) and any board change.
 - A container image, CI deploy, or changes to the bus unit.
-- Installing or starting the unit on dragon-lin. Sage does that after the
+- A service script and unit template (`scripts/webui-service.sh` on the
-  row lands, only once Jason has ruled on Q91 and approved ops-01's route.
+  `bus-service.sh` pattern). That is a follow-up row.
+- Starting it on dragon-lin. After the row lands, Sage starts the preview
+  as a transient user unit (`systemd-run --user`, loopback port 7332;
+  7330 holds the operator's own Console). The edge reaches it once
+  rev-sol-01 passes ops-01's route.
+- The group check. Pocket ID and the proxy limit sign-in to Jason's
+  group; the Console checks the header against the one user id.
 
 ### Gate