docs: resume artifact for the fix→deploy→test loop
Everything needed to continue cold: the loop protocol with real deploy and verify commands, the ordered work list with each item's evidence, Phase 13's exact remaining state (13-15 only, check 4 passed on-device), and the traps that cost time tonight — verify on the node not from source, rustls does not check key/cert pairing, build-aiui.sh hangs after succeeding, AIUI needs VITE_BASE_PATH=/aiui/. STATE.md's stopped_at now points at it, so /gsd-resume-work lands correctly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago
co-authored by
Claude Opus 5
Claude Opus 5
parent
5f343f5ef9
commit
11aa276f58
@@ -0,0 +1,89 @@
|
||||
# RESUME — 2026-08-06 night. Fix → deploy → test → fix, in a loop.
|
||||
|
||||
Start here. Read this, then `.planning/MEDIA-AND-INDEEHUB-SCOPE.md` (the evidence), then
|
||||
`.planning/todos/pending/2026-08-06-open-operational-tasks.md` (everything else open).
|
||||
|
||||
Branch `gsd/phase-13-...` @ `5f343f5e`+, merged with `main`. Working tree clean, pushed.
|
||||
|
||||
## The loop the operator asked for
|
||||
|
||||
For each item below, in order:
|
||||
|
||||
1. Fix on the phase branch. Small, focused commit.
|
||||
2. Build: `cd core && CARGO_INCREMENTAL=0 cargo build --release -p archipelago` (~7-8 min)
|
||||
and/or `cd neode-ui && npm run build`, `bash scripts/build-aiui.sh`.
|
||||
3. Deploy to archi-dev-box (it IS this box — hostname `archi-dev-box`, also `archi-thinkpad`,
|
||||
LAN `192.168.63.240`, Tailscale `100.69.68.39`):
|
||||
- frontend: `sudo rsync -a --exclude 'aiui/' --exclude 'archipelago-runtime/' web/dist/neode-ui/ /opt/archipelago/web-ui/`
|
||||
- AIUI: `sudo rsync -a --delete aiui/packages/app/dist/ /opt/archipelago/web-ui/aiui/`
|
||||
- binary: `sudo cp -f /usr/local/bin/archipelago /opt/archipelago/rollback/archipelago.bak && sudo install -m 755 core/target/release/archipelago /usr/local/bin/archipelago && sudo systemctl restart archipelago`
|
||||
4. **Test live with curl before asking the operator to look.** Restarting the daemon does
|
||||
NOT kill containers — verified: they live in `/user.slice`, the service cgroup holds 3 PIDs.
|
||||
5. Verify the built bundle actually contains the change (`grep` the dist) — builds no-op silently.
|
||||
6. Commit, push (`git push gitea-ai HEAD`), then loop.
|
||||
|
||||
**Do not report a fix as done without a live check on the node.** Two bugs tonight only
|
||||
appeared on deployment: nginx edits went into the ISO template not the running config
|
||||
(`/etc/nginx/sites-enabled/archipelago`), and the TLS key was root-only while the daemon runs
|
||||
as `archipelago`.
|
||||
|
||||
## Ordered work list
|
||||
|
||||
### 1. Gate vs app-owned auth (fleet-wide) — HALF DONE
|
||||
Done + deployed + verified: credential-less allowlist, `manifest.json` 401→200, root and
|
||||
`/api/auth/*` still 401 (`is_credentialless_public_path`, exact match only, 2 tests).
|
||||
**Remaining:** the app's own `/api/auth/*` is still intercepted, so IndeeHub cannot establish
|
||||
its Nostr session. Needs a session-aware rule: once a VALID gate session exists, proxy the
|
||||
app's auth endpoints through instead of challenging. Security-critical — justify in code.
|
||||
|
||||
### 2. AI Data Access grants → node-side (unblocks everything AI)
|
||||
`aiPermissions.ts` uses `localStorage` (`archipelago-ai-permissions`), which is PER-ORIGIN.
|
||||
A node has many origins, so grants vanish when you switch address/device. Move behind an RPC,
|
||||
localStorage as offline fallback, migrate existing local grants. This is what made a films
|
||||
search look broken.
|
||||
|
||||
### 3. Content-card parser (the "idiotic responses")
|
||||
`updatePanelFromText` in `useContentPanel.ts` pairs title *n* with description *n-1* and
|
||||
promotes section headers ("Documentaries:") to titles. The model's prose was CORRECT.
|
||||
Fix the pairing + exclude headers; the real answer is structured model output, not regex.
|
||||
|
||||
### 4. IndeeHub (needs 1 and 2 first)
|
||||
- Content source: films are `projects`, `GET /api/projects` via its nginx on :7778.
|
||||
Public count on this node is **0**. Port 4000 is not host-mapped. `/graphql` is the SPA.
|
||||
- Private films need a **Nostr session** (`/api/projects/private` says Cognito is disabled).
|
||||
- `/relay` is 502 **direct on loopback** — IndeeHub's own nginx can't reach its relay
|
||||
container. Independent of the gate. Fix separately.
|
||||
|
||||
### 5. Node-side Nostr signer — the highest-leverage piece
|
||||
Collapses IndeeHub's private auth, the app-auth half of item 1, and Phase C's zaps into one
|
||||
design, with keys out of the browser and the model (the phase's non-negotiable). Precedent:
|
||||
`nostr-provider.js` already built for BotFights. **Research from AIUI's seed/history and the
|
||||
Nostr-first ethos before designing** — operator instruction.
|
||||
|
||||
### 6. Operator's late asks
|
||||
Cmd/Ctrl+K → "search with AIUI" must open the EXPANDED chat with the query actually sent and
|
||||
answered. More mock content types. Performance across the content path. Audit all ten
|
||||
`AIContextCategory` values in `fetchAndSanitize` for real coverage, not stubs.
|
||||
|
||||
### 7. Loose ends observed
|
||||
`/api/app-catalog` → 502 repeatedly · AIUI web search blocked by CSP (confirms 13-09: the
|
||||
web-search setting must drive the CSP node-side) · `Failed to scroll to index N` in
|
||||
ChatWindow · `strfry.png`/`.svg` 404.
|
||||
|
||||
## Phase 13 GSD state
|
||||
|
||||
14/15 plans done. **13-15 only** — device-close, `autonomous: false`, blocking human-verify.
|
||||
Check 4 (CSP boundary) **PASSED on-device tonight**: BLOCKED in the AIUI frame, GOT 200 from
|
||||
top. Checks 1, 2, 3 still need the operator in a browser; check 2's peer/owned half now has
|
||||
code behind it but this node has no film content.
|
||||
Resume with `/gsd-resume-work`, or `/gsd-plan-phase --research-phase 13` for the research pass.
|
||||
|
||||
## Traps that cost time tonight — do not repeat
|
||||
|
||||
- Verify on the NODE, not from source (nginx template vs `/etc/nginx/sites-enabled/`).
|
||||
- rustls does NOT check that a key matches its certificate — the explicit pairing check in
|
||||
`appgate/tls.rs` is load-bearing, not redundant.
|
||||
- `build-aiui.sh` hangs after a successful build; the dist is complete — kill by PID/timeout.
|
||||
- AIUI must build with `VITE_BASE_PATH=/aiui/` or you get a black page.
|
||||
- Never `rm -rf /opt/archipelago/web-ui/*` — it destroys `aiui/`.
|
||||
- The `.planning` dirs on `main` and the phase branch diverge; merge before deploying both.
|
||||
+11
-3
@@ -5,7 +5,7 @@ milestone_name: milestone
|
||||
current_phase: 13
|
||||
current_phase_name: aiui-functional-conversational-node-control-and-content-surf
|
||||
status: executing
|
||||
stopped_at: "13-14 COMPLETE 2026-08-06 (14/15). ONLY 13-15 REMAINS (device-close, autonomous:false, blocking human-verify). archi-dev-box runs the current merged stack (binary 2d10b710-era + history replay + persona fix; neode-ui + AIUI deployed, live-chunk verified). Grants apps+system. 13-15 needs FOUR browser checks by the operator — see .planning/todos/pending/2026-08-06-open-operational-tasks.md for the exact list plus every open non-phase task and the follow-on phase proposal. Known gaps to RECORD not fix: music view (D-13 independent), Routstr live paid request, E-09 naive-user study."
|
||||
stopped_at: "2026-08-06 night. READ .planning/RESUME-2026-08-06-media-loop.md FIRST — it carries the fix→deploy→test loop, the ordered work list, and the deploy/test commands. Evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase: 14/15, ONLY 13-15 left (device-close, blocking human-verify); its CHECK 4 (CSP boundary) PASSED on-device tonight — BLOCKED in the AIUI frame, GOT 200 from top. Checks 1/2/3 still need the operator. Deployed+verified on archi-dev-box tonight: IndeeHub gate regression fixed (manifest.json 401->200, root and /api/auth/* still 401), content-grid sequence guard, owned+peer scopes, per-scope permission logging, warm-up app status, scheme-following app frames, per-node CA + Settings flow, app-port TLS alongside HTTP on one socket. NEXT, in order: (1) gate must proxy an app's own /api/auth/* once a valid session exists, (2) move AI Data Access grants node-side out of per-origin localStorage, (3) fix the content-card parser pairing title n with description n-1, (4) IndeeHub, (5) node-side Nostr signer — the highest-leverage piece."
|
||||
last_updated: "2026-08-06T18:07:49.641Z"
|
||||
last_activity: 2026-08-06
|
||||
last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run)
|
||||
@@ -230,8 +230,16 @@ The 5x lifecycle gate was NOT run.
|
||||
|
||||
## Session Continuity
|
||||
|
||||
Last session: 2026-08-06T18:07:49.600Z
|
||||
Stopped at: 13-14 COMPLETE 2026-08-06, next 13-15 device-close
|
||||
Last session: 2026-08-06 (resumed)
|
||||
Stopped at: Session resumed 2026-08-06 via /gsd-resume-work. Tree clean, in sync with
|
||||
gitea-ai @ 7bb09ffe. 13-14 COMPLETE (14/15), next 13-15 device-close — BLOCKED on four
|
||||
operator browser checks (list in .planning/todos/pending/2026-08-06-open-operational-tasks.md,
|
||||
which also carries the four non-phase node/infra tasks and the follow-on A/B/C proposal).
|
||||
Awaiting operator choice between: (a) run the four checks and close 13-15/the phase,
|
||||
(b) start follow-on Phase B (web-search setting derives the CSP, node-side), (c) take a
|
||||
node/infra task (app-gate iframe login decision, Starting-vs-Unreachable, .228 frontend).
|
||||
NOTE: .planning/HANDOFF.json + .planning/.continue-here.md are STALE (phase 09, 2026-08-02,
|
||||
fully reconciled) and should not be read as live resume context.
|
||||
|
||||
Prior (13-12) stop note, retained for history: Completed 13-12-PLAN.md (D-10 untrusted-content boundary, G-B1/G-B2 cloud-egress screen, G-B3 read-only-loop rate limit + owner notices).
|
||||
`assistant::` tests incl. `approval_nonce_binds_to_exact_action` individually; dispatcher.rs
|
||||
|
||||
Reference in New Issue
Block a user