From 9e86d18921a4cd9d72c9adf19a4ea138d89fbacf Mon Sep 17 00:00:00 2001 From: archipelago Date: Thu, 6 Aug 2026 20:23:03 -0400 Subject: [PATCH] =?UTF-8?q?docs:=20refresh=20resume=20pointer=20=E2=80=94?= =?UTF-8?q?=20item=201=20done=20and=20proven=20end=20to=20end?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5 (1M context) --- .planning/STATE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.planning/STATE.md b/.planning/STATE.md index 6d7b557b..3056fdc3 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -5,8 +5,8 @@ milestone_name: milestone current_phase: 13 current_phase_name: aiui-functional-conversational-node-control-and-content-surf status: executing -stopped_at: "2026-08-06 night. READ .planning/RESUME-2026-08-06-media-loop.md FIRST — it carries the fix→deploy→test loop, the ordered work list, and the deploy/test commands. Evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase: 14/15, ONLY 13-15 left (device-close, blocking human-verify); its CHECK 4 (CSP boundary) PASSED on-device tonight — BLOCKED in the AIUI frame, GOT 200 from top. Checks 1/2/3 still need the operator. Deployed+verified on archi-dev-box tonight: IndeeHub gate regression fixed (manifest.json 401->200, root and /api/auth/* still 401), content-grid sequence guard, owned+peer scopes, per-scope permission logging, warm-up app status, scheme-following app frames, per-node CA + Settings flow, app-port TLS alongside HTTP on one socket. NEXT, in order: (1) gate must proxy an app's own /api/auth/* once a valid session exists, (2) move AI Data Access grants node-side out of per-origin localStorage, (3) fix the content-card parser pairing title n with description n-1, (4) IndeeHub, (5) node-side Nostr signer — the highest-leverage piece." -last_updated: "2026-08-06T18:07:49.641Z" +stopped_at: "2026-08-07 resume. READ .planning/RESUME-2026-08-06-media-loop.md FIRST (loop protocol + deploy/test commands); evidence in .planning/MEDIA-AND-INDEEHUB-SCOPE.md. Phase 14/15 — ONLY 13-15 left (device-close, blocking human-verify); CHECK 4 (CSP boundary) PASSED on-device. Checks 1/2/3 still need the operator. ITEM 1 (gate vs app-owned auth) is now DONE+PROVEN: round 2 (d9592c72) found the real cause — the gate DELETED the app's own Authorization header on every proxied request, so no Nostr signer anywhere could work (extension, iframe bridge, or AIUI); end-to-end proof aeb40b93 shows a node-signed NIP-98 event through the gate yielding a real IndeeHub JWT and /api/projects/private 200. IndeeHub relay 502 also fixed (root-owned volume vs uid-1000 container user) — same ownership-bug family still open for btcpay-server. NEXT, in order: (2) move AI Data Access grants node-side out of per-origin localStorage, (3) content-card parser pairs title n with description n-1, (4) IndeeHub content source, (5) node-side Nostr signer, (6) AIUI answers in prose where the content/context surfaces should carry it — only 1 of 10 transcript turns used a surface." +last_updated: "2026-08-07T00:00:00.000Z" last_activity: 2026-08-06 last_activity_desc: 13-14 complete (18-case adversarial eval harness EV-01..EV-18, ScriptedBackend-driven, offline/zero-footprint; E-02 confirmation-copy sign-off operator-approved with three verbatim dialog texts; E-09 naive-user comprehension study recorded as an open residual, not run) progress: