109 lines
5.5 KiB
Markdown
109 lines
5.5 KiB
Markdown
# WEBUI-1507-R1 review verdict
|
|
|
|
## APPROVED
|
|
|
|
Filbert, independent reviewer. Author Dewey. Reviewed 2026-09-13 against
|
|
Piece 4 in `docs/plans/2026-09-12_control-board-mvp.md` and the request at
|
|
`docs/plans/reviews/2026-09-13_webui-review-request.md`.
|
|
|
|
No blocking findings. Approval applies only to the exact package below. It
|
|
passes independent implementation review, not publication, deployment or user
|
|
acceptance. Gate E remains Jason's Monday 2026-09-14 ruling. Keep #1507 open
|
|
pending that acceptance.
|
|
|
|
## Exact candidate
|
|
|
|
HEAD was the requested baseline
|
|
`355b4308c31c4bd500a844787eb1461f98dd2be3` during provenance verification.
|
|
The candidate was the untracked `packages/webui/` overlay, not a committed tree.
|
|
|
|
Manifest: `docs/plans/reviews/webui-1507/manifest.sha256`.
|
|
Recomputed manifest SHA-256:
|
|
`509f20e53292d5731c866d84c73cfaf539a89104b38b12a43260075ee7c3cb4d`.
|
|
Its 21 entries cover all and only the 21 package files. All 21 content hashes
|
|
passed verification before review, in the independent test copy, and after
|
|
checks. This approval incorporates that exact manifest, not later package edits.
|
|
|
|
Behavior-bearing source hashes:
|
|
|
|
```text
|
|
20f8091e5fb3fcaba583b601ce258999d44afbe569e93c979938ace759b4eef4 packages/webui/src/cli.mjs
|
|
c0c1a360ce44a7439e67eea36b9237c59621aa3fd78571a823fd23dc15a950f6 packages/webui/src/serve.mjs
|
|
7f30847ba25eb7e2b176df614d7bcae45ab7d86615c84ad44ffc29f0f261759c packages/webui/src/public/app.js
|
|
db055d5b8a3710f4164193550ac25b7c5d223dd890ae3e9d73daaada38849557 packages/webui/src/public/index.html
|
|
7add449911677c662a05ad5d9c2462f919e759574fe4b85bd13a705cc54f6856 packages/webui/src/public/live.css
|
|
```
|
|
|
|
## Independently reproduced evidence
|
|
|
|
Created `/tmp/filbert-webui-1507-N4Iiyg` from a read-only `git archive` of
|
|
baseline `packages`, `scripts`, and `tools`, then copied only the pinned WebUI
|
|
package over it. No unrelated working-tree source entered this test copy.
|
|
No dependency installation was needed. Node v26.8.1 and installed Chromium.
|
|
|
|
Commands run from that copy:
|
|
|
|
```sh
|
|
sha256sum -c manifest.sha256
|
|
WEBUI_EVIDENCE=/tmp/filbert-webui-1507-N4Iiyg/screenshots node --test packages/webui/tests/
|
|
node --test packages/webui/tests/ packages/control-board/tests/ packages/seat/tests/ packages/ledger/tests/ packages/mosaic/tests/
|
|
```
|
|
|
|
- WebUI: 6 passed, 0 failed, no skips, including both Chromium tests.
|
|
- Combined suite: 208 passed, 0 failed, no skips.
|
|
- Rendered contrast: 330 samples, no failures, minimum 4.504658476260286:1.
|
|
- Layout checks passed at 320, 390, 768, 1440 and 2560px, with and without
|
|
the inspector. Table-local horizontal scrolling is intentional.
|
|
- Inspected all four independently generated screenshots: Harbor light page
|
|
at 320/1440 and Grove dark inspector at 320/1440. Controls and text remain
|
|
readable; the narrow inspector scrolls vertically to its reply controls.
|
|
- `node --check` passed for both server modules, both public scripts and all
|
|
five test modules.
|
|
- `cmp` confirmed copied shared CSS, Console CSS, brand.js and all six font,
|
|
source and license files are unchanged from Dewey's WUI assets.
|
|
|
|
Raw local results are `webui-tests.txt`, `combined-tests.txt` and `hashes.txt`
|
|
in the independent copy. Screenshots are in its `screenshots/` directory.
|
|
These temporary files supplement this durable result summary.
|
|
|
|
## Review conclusions
|
|
|
|
The page implements the approved Console layout using board data only. Project
|
|
counts and filters do not hide another project's waiting requests. The dense
|
|
table and inspector expose the specified fields; unsupported mockup controls
|
|
are absent. Palette and appearance remain on this one page. Refresh uses the
|
|
board page's ten-second cadence, with Pause and manual refresh, not a new scanner.
|
|
|
|
The server binds only to loopback, restricts the upstream to an HTTP loopback
|
|
origin, normalizes localhost without DNS resolution, rejects hostile Host and
|
|
Origin requests, and serves only allowlisted assets. POST routes require a JSON
|
|
object and enforce the 4096-byte limit. The proxy preserves accepted POST bytes,
|
|
upstream status and JSON text, refuses redirects, and does not retry actions.
|
|
Seen and Reply reach only fixture transports during verification.
|
|
|
|
Rendering escapes dynamic text and attributes. Hostile identifiers do not enter
|
|
CSS selectors. Drafts, receipts and caret positions survive refresh; stale
|
|
registration removes reply access without discarding the draft. A per-row
|
|
in-flight set prevents duplicate sends, and text changed during a send survives
|
|
its earlier success. Keyboard row navigation, inspector focus and Escape return
|
|
passed. Unreachable or malformed board data produces a warning without erasing
|
|
the last valid snapshot. Denied localStorage falls back safely.
|
|
|
|
The implementation is small and separated into CLI, proxy and page behavior.
|
|
Copied design assets remain separate from live-page adaptations. Source review
|
|
and tests support the declared boundaries; no board, seat or comms change is
|
|
part of this candidate.
|
|
|
|
## Limits and handoff
|
|
|
|
The checks used synthetic session and registration files and stubbed transport.
|
|
No real board scan, real-seat message, private-session read, credential access,
|
|
source edit or publication was performed. Git use was read-only provenance and
|
|
archive extraction. Browser evidence is Chromium, not a screen-reader audit or
|
|
Jason's workday acceptance. Contrast samples are not an exhaustive accessibility
|
|
certification. The README documents in-memory draft loss on reload and uncertain
|
|
delivery after a lost response.
|
|
|
|
Dewey should reverify the manifest before any separately authorized publication.
|
|
CURRENT.md remains with its existing owner for the verdict/publication transition.
|