lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 4 Actions Packages Projects Releases 71 Wiki Activity

docs: refresh resume pointer — item 1 done and proven end to end

Browse Source 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-08-06 20:23:03 -04:00
co-authored by Claude Opus 5
parent aeb40b93d9
commit 9e86d18921
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.planning/STATE.md
+2 -2
View File
@@ -5,8 +5,8 @@ milestone_name: milestone
current_phase: 13
current_phase_name: aiui-functional-conversational-node-control-and-content-surf
status: executing
stopped_at: "2026-08-06 night. READ .planning/RESUME-2026-08-06-media-loop.md FIRST — it carries the fix→deploy→test loop, the ordered work list, and the deploy/test commands. Evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase: 14/15, ONLY 13-15 left (device-close, blocking human-verify); its CHECK 4 (CSP boundary) PASSED on-device tonight — BLOCKED in the AIUI frame, GOT 200 from top. Checks 1/2/3 still need the operator. Deployed+verified on archi-dev-box tonight: IndeeHub gate regression fixed (manifest.json 401->200, root and /api/auth/* still 401), content-grid sequence guard, owned+peer scopes, per-scope permission logging, warm-up app status, scheme-following app frames, per-node CA + Settings flow, app-port TLS alongside HTTP on one socket. NEXT, in order: (1) gate must proxy an app's own /api/auth/* once a valid session exists, (2) move AI Data Access grants node-side out of per-origin localStorage, (3) fix the content-card parser pairing title n with description n-1, (4) IndeeHub, (5) node-side Nostr signer — the highest-leverage piece."
last_updated: "2026-08-06T18:07:49.641Z"
stopped_at: "2026-08-07 resume. READ .planning/RESUME-2026-08-06-media-loop.md FIRST (loop protocol + deploy/test commands); evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase 14/15 — ONLY 13-15 left (device-close, blocking human-verify); CHECK 4 (CSP boundary) PASSED on-device. Checks 1/2/3 still need the operator. ITEM 1 (gate vs app-owned auth) is now DONE+PROVEN: round 2 (d9592c72) found the real cause — the gate DELETED the app's own Authorization header on every proxied request, so no Nostr signer anywhere could work (extension, iframe bridge, or AIUI); end-to-end proof aeb40b93 shows a node-signed NIP-98 event through the gate yielding a real IndeeHub JWT and /api/projects/private 200. IndeeHub relay 502 also fixed (root-owned volume vs uid-1000 container user) — same ownership-bug family still open for btcpay-server. NEXT, in order: (2) move AI Data Access grants node-side out of per-origin localStorage, (3) content-card parser pairs title n with description n-1, (4) IndeeHub content source, (5) node-side Nostr signer, (6) AIUI answers in prose where the content/context surfaces should carry it — only 1 of 10 transcript turns used a surface."
last_updated: "2026-08-07T00:00:00.000Z"
last_activity: 2026-08-06
last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run)
progress: