From 42faccaa9af436dc5402fdb8e15fd41d44a66fb3 Mon Sep 17 00:00:00 2001 From: archipelago Date: Mon, 3 Aug 2026 19:03:43 -0400 Subject: [PATCH] docs(13-09): carry 13-02's openrouter 404 deviation forward as a truth Operator-accepted deviation from 13-02 Task 3: the relay is structurally gone but /aiui/api/openrouter/ still answers 200 via the SPA catch-all. 13-09 already owns this nginx config, so the explicit return 404 belongs here rather than bolted onto a completed plan. Co-Authored-By: Claude Opus 5 (1M context) --- .../13-09-PLAN.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md b/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md index 93efdff3..3b868415 100644 --- a/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md +++ b/.planning/phases/13-aiui-functional-conversational-node-control-and-content-surf/13-09-PLAN.md @@ -27,6 +27,7 @@ must_haves: - "AIUI's own JavaScript is browser-prevented from reaching /rpc/v1 with the ambient session cookie — the sandbox is an enforced boundary, not only a code-discipline convention (AIUI-04, RESEARCH Open Question 2)" - "AIUI keeps its standalone mode and its own fast dev loop — none of this requires a node to work on the UI (D-17)" - "A same-host deploy whose resolved source and destination differ is refused before rsync --delete can run, whether the mismatch is containment or sibling directories — the 2026-07-31 data-loss guard now covers the shape it originally missed" + - "`/aiui/api/openrouter/` returns an explicit 404, not the SPA catch-all's 200/405. Carried over from 13-02's Task 3 checkpoint (operator-accepted deviation 2026-08-03): the relay is already structurally gone — no `proxy_pass` reaches openrouter.ai and the live config mentions it only in comments — but the path still answers 200 because `location / { try_files ... /index.html; }` serves the SPA shell for any unmatched GET. Verified by a made-up path returning byte-identical HTML. Add the explicit `return 404` here rather than bolting it onto 13-02 after the fact." - "NO script sources AIUI from `$PROJECT_DIR/../AIUI` any more. `grep -rn '\\.\\./AIUI' scripts/*.sh` must return nothing but comments explaining the retirement. Affected: `dev-start.sh`, `deploy-tailscale.sh`, `deploy-to-target.sh` (two sections — primary AND the `--both`/secondary path), `setup-aiui-server.sh`. HISTORY, so the urgency is not misread: when this was written the orphaned pre-migration clone still sat at /home/archipelago/Projects/AIUI WITH a built `packages/app/dist`, so those scripts copied stale bytes and reported success — silent staleness. The operator deleted that clone on 2026-08-03 after the subtree import was proven byte-identical (tree 5ac3173a on both sides), which downgrades this from silent-wrong to loud-broken: the paths now simply do not resolve. Still must be fixed — a deploy script that dies on a missing directory is not a shipping story — but it can no longer ship the wrong bytes." artifacts: - path: "scripts/build-aiui.sh"