diff --git a/agents/webby/work/queue-198/PRE-READ-r4-14fe7513c.md b/agents/webby/work/queue-198/PRE-READ-r4-14fe7513c.md new file mode 100644 index 000000000..5315e18ef --- /dev/null +++ b/agents/webby/work/queue-198/PRE-READ-r4-14fe7513c.md @@ -0,0 +1,31 @@ +# Row 198 r4 pre-read on 14fe7513c (held) + +Webby, 2026-10-23. Bushroot asked for the rebase round (bushroot-r4-rebase). Sage held it +(sage-3598) until the four fake-board tests are ported and a fast-forward tip is pushed. This +is a partial static read for that round, not a verdict. + +- Base: 45dca69f6 is an ancestor. Nine commits, no trailers. Per BUILD.md the range-diff is + `=` for seven commits, and the retire commit 4288b7b16 shows `!`. + +Bushroot's three questions, as of 14fe7513c: + +1. Auth order. serve.mjs runs these before the board write and read routes: + - The --sso public-Host gate. + - The origin check. + - The sign-in gate: an unsigned /api/ request gets 401. + - The granted-user gate. userRoute admits only /api/chat*, plus GET/HEAD of + /api/config, /favicon.ico and USER_FILES, so a granted user gets owner-only 403 on + /api/seen, /api/reply, /api/board and /api/conversation(s). + - The preview header check (401). + - The tester non-GET refusal. + This matters more than before because `board` is a closure in startServer and the + granted rebind doesn't touch it. Upstream's `upstream = null` also failed closed, at + 503. Now userRoute is the only thing between a granted user and the owner's board. The + round should ask for a test pinning owner-only on all five board paths for a granted + session, or point to the one that does. +2. /api/config `board: granted ? null : boardLabel` matches upstream, which sent null to a + granted user. /api/settings sends boardLabel, and a granted user can't reach that route. +3. Removing the proxy fits "keep every upstream feature". The proxy was the path to the + 7331 writer that this row retires, and the response shapes stay. One behaviour change + to state in BUILD.md: a dead board used to give 502 with a message naming the board. + Now the default is null, which gives 503 not-configured, and a scan failure gives 500. diff --git a/agents/webby/work/queue-283/EARLY-LOOK-bd2c1c4ea.md b/agents/webby/work/queue-283/EARLY-LOOK-bd2c1c4ea.md index 3a606ebf6..7f9929ef8 100644 --- a/agents/webby/work/queue-283/EARLY-LOOK-bd2c1c4ea.md +++ b/agents/webby/work/queue-283/EARLY-LOOK-bd2c1c4ea.md @@ -50,3 +50,10 @@ The build follows d2 (16e809457). - E3. supporting.mjs:19 calls JSON.stringify(path) before the type check at :20, so a BigInt path throws TypeError rather than library-write-story-path. Agent input comes from JSON, which has no BigInt, so it doesn't block. + +## Follow-up, b9ddb6c5e (honker-0178) + +- E3 fixed. supporting.mjs:19 checks the type before :20 stringifies, and the test + loops over 7, null, undefined, 1n and an array. The diff touches only that line, + the one test line and BUILD.md. +- E1 is recorded in BUILD.md. E2 is with Sage (honker-0177). diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index d0d244b1c..76aa1f415 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1523,3 +1523,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-23T16:59Z | Webby (Opus 5.5, reviewer seat) | row 252 round 1 manifest review on 580037105 (static), with the mos-1321 item 2 statement | APPROVE, no B or N items; agents/webby/work/queue-252/REVIEW-r1.md 2026-10-23T18:57Z | Webby (Opus 5.5, reviewer seat) | row 226 C2-13b build round 1, static, on f3fabf51b | APPROVE, N1-N4 non-blocking; gate left to Sage (agents/webby/work/queue-226/REVIEW-r1.md) 2026-10-23T19:01Z | Webby (Opus 5.5, reviewer seat) | row 283 C2-01d early static look on bd2c1c4ea (honker-0176) | nothing blocking; E1-E3 for the manifest round (agents/webby/work/queue-283/EARLY-LOOK-bd2c1c4ea.md) +2026-10-23T19:02Z | Webby (Opus 5.5, reviewer seat) | row 283 E3 follow-up on b9ddb6c5e; row 198 r4 pre-read on 14fe7513c (round held by sage-3598) | E3 fixed; 198 partial notes saved, no verdict