From 70b9345ad3f0044818b7dd556571de2c41a2deeb Mon Sep 17 00:00:00 2001 From: Jason Woltje Date: Sun, 11 Oct 2026 17:00:10 -0500 Subject: [PATCH] docs: lead decision 93, Q91 A, row 74 brief amended for sign-in on 10-12 (#1568) Co-Authored-By: Claude Opus 5.5 --- docs/plans/2026-09-26_lead-decisions.md | 25 ++++++++++++ docs/plans/2026-10-11_webui-preview.md | 52 ++++++++++++------------- 2 files changed, 50 insertions(+), 27 deletions(-) diff --git a/docs/plans/2026-09-26_lead-decisions.md b/docs/plans/2026-09-26_lead-decisions.md index 5512987e7..d0173d352 100644 --- a/docs/plans/2026-09-26_lead-decisions.md +++ b/docs/plans/2026-09-26_lead-decisions.md @@ -1966,3 +1966,28 @@ which stay with him. Each item names who decided it and what happened. local process can still forge it, the same exposure the Console's reads have today. In-app OIDC would close that and costs several rows; it waits for cutover or later. + +93. **Q91 A: a signed-in preview amends 48; sign-in on 10-12 + (2026-10-11).** Jason, relayed by Mos: "Q91: A / I want sign-in on + 10-12". Decision 48 item 1 is amended for one case only: a read-only + Console preview at its own hostname, behind Pocket ID forward auth + limited to Jason's group, with the old build at mosaic.woltje.com left + up. In-app sign-in and general access beyond localhost stay out of v1. + - The route opens once rev-sol-01 passes ops-01's route proposal, + without asking Jason again. + - Target: Jason signs in on 2026-10-12, at the latest by + 2026-10-13T05:00Z. This replaces decision 92's preview dates. + - Row 74 is unblocked and Dewey starts it now; their row 59 review is + done. Darkwing and Filbert review it ahead of their own rows. Both + reviewers and Sage's gate rerun stay. No gate is dropped for the + date. + - Cut for the date: the service script, its unit template and test, + and its TOOLS.md entry go to a follow-up row (this also takes row + 74 off `docs/TOOLS.md`, which row 70 edits). After the row lands + Sage starts the preview as a transient user unit with + `systemd-run --user` on its own loopback port, 7332. Port 7330 + holds the operator's foreground Console from 2026-09-26, which + stays. + - The tradeoff: a transient unit doesn't survive a reboot and isn't + reviewed as a file. It runs one reviewed command line, which the + install record states, until the follow-up row ships the unit. diff --git a/docs/plans/2026-10-11_webui-preview.md b/docs/plans/2026-10-11_webui-preview.md index f10206964..7f2577b9b 100644 --- a/docs/plans/2026-10-11_webui-preview.md +++ b/docs/plans/2026-10-11_webui-preview.md @@ -1,10 +1,11 @@ # WebUI preview behind sign-in (2026-10-11) Status: written by Sage, lead. It follows `docs/plans/BRIEF-TEMPLATE.md`. -One row. No code starts until Jason answers Q91 (amending lead decision -48 for a signed-in preview reachable beyond localhost). Mos relays the -answer. If the ruling narrows or changes what follows, this brief is -amended first. +One row. Amended the same evening for Jason's Q91 answer "A" (lead +decision 93): a read-only preview at its own hostname, behind Pocket ID +forward auth limited to Jason's group, the old build left up. Target: +Jason signs in on 2026-10-12, by 2026-10-13T05:00Z at the latest. The +service script is cut from this row for that date; it is a follow-up. ## WebUI preview: a signed-in, read-only Console behind the edge proxy @@ -27,27 +28,22 @@ design: - Nothing runs the Console as a service. It is a foreground `serve`. Mos approved these cuts for the preview (2026-10-11): sign-in at the edge -through Pocket ID forward auth, not login code in the Console; a systemd -user unit beside the bus; a preview hostname, so the old build at -mosaic.woltje.com stays; read-only; not held for S7 (row 42) or Gate E -(row 5). ops-01 owns the Pocket ID client, the DNS name, TLS, the proxy -and the route from the edge to this host. Jason approves that route -before anything is served. +through Pocket ID forward auth, not login code in the Console; a preview +hostname, so the old build at mosaic.woltje.com stays; read-only; not +held for S7 (row 42) or Gate E (row 5). ops-01 owns the Pocket ID client +(limited to Jason's group), the DNS name, TLS, the proxy and the route +from the edge to this host. The route opens once rev-sol-01 passes +ops-01's proposal (Q91 A). ### Owner and reviewer -Owner: Dewey, who owns the WebUI, after their row 59 review. Reviewers: -Darkwing and Filbert. +Owner: Dewey, who owns the WebUI, starting 2026-10-11 evening. Reviewers: +Darkwing and Filbert, ahead of their own rows. ### Files owned - `packages/webui/src/serve.mjs`, `packages/webui/src/cli.mjs`, `packages/webui/README.md` and `packages/webui/tests/` -- a new `scripts/webui-service.sh` and its unit template, beside - `scripts/bus-service.sh` and `packages/cli/systemd/mosaic-bus.service.in` -- the test for that script, in the package that holds the template -- `docs/TOOLS.md`, the new script's entry only. Row 70 also edits this - file; whichever lands second rebases on the first. - `agents/dewey/work/queue-/` ### What ships @@ -69,14 +65,10 @@ exactly as today, and the existing tests show it. - Tests for each refusal: wrong Host, wrong Origin, missing header, wrong user, a POST to each write route, and a partial flag set refused at start. A test that the loopback path is unchanged in preview mode. -- `scripts/webui-service.sh render|install|uninstall|status` for a - `mosaic-webui.service` user unit, on the `bus-service.sh` pattern: a - template, write to a temp file then rename, `daemon-reload` only, no - start, no restart. It runs the board's `serve` and the Console's - `serve` with the preview flags (as one unit or two, the packet says - which and why), with values from flags or an env file the script names. - The env file holds no secret: the header name, the user id and the - hostname aren't secrets. +- The minimum for the first sign-in is the inbox, tasks, agents and + trails (`/api/bus/*`) read-only. The other GET routes stay as they are. + The board panel reads the board already running on 7331; if it is down + the panel shows its existing error and the bus views still work. - The README replaces "Do not expose either unauthenticated server through a public proxy" with what the preview mode requires of the proxy: it strips HEADER from every client request and sets it only @@ -96,8 +88,14 @@ exactly as today, and the existing tests show it. resolution in the CLI; changing that is a ruling and its own row. - Live-seat conversations (CHAT-07) and any board change. - A container image, CI deploy, or changes to the bus unit. -- Installing or starting the unit on dragon-lin. Sage does that after the - row lands, only once Jason has ruled on Q91 and approved ops-01's route. +- A service script and unit template (`scripts/webui-service.sh` on the + `bus-service.sh` pattern). That is a follow-up row. +- Starting it on dragon-lin. After the row lands, Sage starts the preview + as a transient user unit (`systemd-run --user`, loopback port 7332; + 7330 holds the operator's own Console). The edge reaches it once + rev-sol-01 passes ops-01's route. +- The group check. Pocket ID and the proxy limit sign-in to Jason's + group; the Console checks the header against the one user id. ### Gate