queue: rev 523, row 74 round 2 note for Darkwing's finding (sage)
This commit is contained in:
+2
-2
@@ -33,7 +33,7 @@ Gaps found while working go to `docs/plans/DEFERRED.md`, not here.
|
||||
|
||||
<!-- mosaic-queue:begin -->
|
||||
|
||||
Generated from `docs/plans/queue.json` revision 522 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
|
||||
Generated from `docs/plans/queue.json` revision 523 by `queue render`. Do not edit between the markers; change the queue with `scripts/mosaic queue`.
|
||||
|
||||
| # | Piece | Owner | Issues | State | After | Gate | Brief | Note |
|
||||
|---|---|---|---|---|---|---|---|---|
|
||||
@@ -110,7 +110,7 @@ Generated from `docs/plans/queue.json` revision 522 by `queue render`. Do not ed
|
||||
| 71 | Tree read follow-up: confirm-read tests and the fake's view 404 | darkwing; reviewers dewey, filbert | #1565 | blocked (from briefed): deferred until after the mosaic.woltje.com dogfood cutover (lead decision 94) | — | dewey and filbert approve on the issue naming the candidate manifest; tasks and bus node suites and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_tree-read-follow-up.md` § Tree read follow-up: confirm-read tests and the fake's view 404 | — |
|
||||
| 72 | Claude pin tests: a directory pin, a symlink default, a pin with a space | rocko; reviewers filbert | #1566 | in-progress | 68 done | filbert approves on the issue naming the candidate manifest; cli and harness node suites and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_claude-pin-and-coder-grant.md` § Claude pin tests: a directory pin, a symlink default, a pin with a space | — |
|
||||
| 73 | Coder role: drop the task.reassign grant the broker always refuses | rocko; reviewers dewey | #1567 | briefed | — | dewey approves on the issue naming the candidate manifest; tasks, bus, business and harness node suites and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_claude-pin-and-coder-grant.md` § Coder role: drop the task.reassign grant the broker always refuses | — |
|
||||
| 74 | WebUI preview: a signed-in, read-only Console behind the edge proxy | dewey; reviewers darkwing, filbert | #1568 | in-review, round 1, request posted | — | darkwing and filbert approve on the issue naming the candidate manifest; webui, control-board and cli node suites and every scripts/test-*.sh green on Sage's gate rerun; Sage starts it after landing once rev-sol-01 passes ops-01's route (decision 93) (sage) | `docs/plans/2026-10-11_webui-preview.md` § WebUI preview: a signed-in, read-only Console behind the edge proxy | Round 2 by Sage's call (2026-10-11T23Z), not a follow-up: Filbert N1 (a duplicate Host header passes the NAME check; fix: headersDistinct.host length > 1 answers 400, with a test), N2 tests for the surviving gaps (Host compared exactly, HEAD refused, HEADER rejecting _ and its leading-character check), and the README sentence that every hop reaching the loopback port is bound by the proxy contract. NAME:443 refusal stays. Darkwing reviews round 2, not round 1; Filbert re-reviews the delta. |
|
||||
| 74 | WebUI preview: a signed-in, read-only Console behind the edge proxy | dewey; reviewers darkwing, filbert | #1568 | in-review, round 1, request posted | — | darkwing and filbert approve on the issue naming the candidate manifest; webui, control-board and cli node suites and every scripts/test-*.sh green on Sage's gate rerun; Sage starts it after landing once rev-sol-01 passes ops-01's route (decision 93) (sage) | `docs/plans/2026-10-11_webui-preview.md` § WebUI preview: a signed-in, read-only Console behind the edge proxy | Round 2 also carries Darkwing's finding: a proxy that rewrites Host to its upstream lands on the loopback path and skips the ID check (Host 127.0.0.1:PORT, wrong user, 200). In preview mode a request whose Host isn't NAME but carries HEADER is refused. Plus Darkwing's HEAD tests and two README lines for ops-01, including that the edge must forward Host unchanged. |
|
||||
| 75 | Console as a user service: render, install and status, Jason starts it | rocko; reviewers filbert | #1569 | done | — | filbert approves on the issue naming the candidate manifest; webui node suite and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_dogfood-cutover.md` § Console as a user service | — |
|
||||
| 76 | Console sends a human message to a role | dewey; reviewers darkwing, filbert | #1570 | briefed | 74 done | darkwing and filbert approve on the issue naming the candidate manifest; webui, bus, control-board and cli node suites and every scripts/test-*.sh green on Sage's gate rerun; Jason's Q95 recorded first (sage) | `docs/plans/2026-10-11_dogfood-cutover.md` § Console sends a message to a role | From row 74 round 1 (Dewey, point 5): the page shows 'Delivery may be unknown; check the seat before sending again.' for a 403 read-only refusal. That's wrong for a refusal. src/public/app.js is row 76's file, so row 76 fixes the message: a refusal says it was refused, and only outcome-unknown says delivery may be unknown. |
|
||||
| 77 | Console service hardening: row 75 review follow-ups N1-N5 | rocko; reviewers filbert | #1571 | queued | 75 done | filbert approves on the issue naming the candidate manifest; webui node suite and every scripts/test-*.sh green on Sage's gate rerun (sage) | `docs/plans/2026-10-11_console-service-followups.md` § Console service hardening | After the cutover (2026-10-12T21:30Z). Source: Filbert comment 27430 on #1569. |
|
||||
|
||||
+21
-3
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"version": 1,
|
||||
"canonicalRoot": "/mnt/storage/src/mosaic-stack",
|
||||
"revision": 522,
|
||||
"revision": 523,
|
||||
"rows": [
|
||||
{
|
||||
"id": 1,
|
||||
@@ -5428,10 +5428,10 @@
|
||||
"seat": "dewey",
|
||||
"op": "dewey-74-start-1"
|
||||
},
|
||||
"note": "Round 2 by Sage's call (2026-10-11T23Z), not a follow-up: Filbert N1 (a duplicate Host header passes the NAME check; fix: headersDistinct.host length > 1 answers 400, with a test), N2 tests for the surviving gaps (Host compared exactly, HEAD refused, HEADER rejecting _ and its leading-character check), and the README sentence that every hop reaching the loopback port is bound by the proxy contract. NAME:443 refusal stays. Darkwing reviews round 2, not round 1; Filbert re-reviews the delta.",
|
||||
"note": "Round 2 also carries Darkwing's finding: a proxy that rewrites Host to its upstream lands on the loopback path and skips the ID check (Host 127.0.0.1:PORT, wrong user, 200). In preview mode a request whose Host isn't NAME but carries HEADER is refused. Plus Darkwing's HEAD tests and two README lines for ops-01, including that the edge must forward Host unchanged.",
|
||||
"blockedReason": null,
|
||||
"createdAt": "2026-10-11T21:53:29.970Z",
|
||||
"updatedAt": "2026-10-11T22:56:21.953Z",
|
||||
"updatedAt": "2026-10-11T23:04:15.746Z",
|
||||
"updatedBy": "sage"
|
||||
},
|
||||
{
|
||||
@@ -20249,6 +20249,24 @@
|
||||
"receipt": "ok dewey-r67-verdict-1 rev 522 row 67 round 1 approve by dewey (comment 27452)"
|
||||
},
|
||||
"viewSha": "30df67072221987f73cbc43d55aa199bb2e7da73c58bee15103f22080c4e3c3f"
|
||||
},
|
||||
{
|
||||
"rev": 523,
|
||||
"op": "sage-74-note-r2b",
|
||||
"verb": "note",
|
||||
"args": {
|
||||
"id": 74,
|
||||
"text": "Round 2 also carries Darkwing's finding: a proxy that rewrites Host to its upstream lands on the loopback path and skips the ID check (Host 127.0.0.1:PORT, wrong user, 200). In preview mode a request whose Host isn't NAME but carries HEADER is refused. Plus Darkwing's HEAD tests and two README lines for ops-01, including that the edge must forward Host unchanged."
|
||||
},
|
||||
"by": "sage",
|
||||
"at": "2026-10-11T23:04:15.746Z",
|
||||
"semantics": 2,
|
||||
"result": {
|
||||
"row": 74,
|
||||
"field": "note",
|
||||
"receipt": "ok sage-74-note-r2b rev 523 row 74 note"
|
||||
},
|
||||
"viewSha": "a6ef9e26e3935468392a6a22c0bf381a5a66dae29329f94b9a1100302e5ff918"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user