63 main commits since the fork point — gate cookie-strip fix, named-volume
create fix, appgate catalog classification, RNode error surfacing — merged
so 13-14/13-15 on-device verification runs against current production code.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
D-04's chain complete (Ollama -> Claude -> Routstr); D-05's prepaid
allowance is a hard arithmetic ceiling, verified by fault injection.
Task 1 decision: proceed-docs-with-probe-first (0/9 protocol claims
independently confirmed; first live call doubles as the capability probe).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Task 3 (checkpoint:human-verify, blocking) approved by the operator after a
full on-device pass on archi-dev-box: deny/approve/read-only/fail-safe-timeout
all verified with a real Claude 4.5 Haiku backend against a real container.
cargo assistant:: 29/29 green (incl. declined_action_never_reprompts_same_turn),
vitest toolConfirm/contextBroker/chatAiuiEmbed 40/40 green. STATE.md/ROADMAP.md/
REQUIREMENTS.md updated (9/15 plans, AIUI-01/AIUI-04 marked complete for this
plan's contribution). Next: wave 4 (13-10, then 13-11).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tasks 1+2 verified complete on HEAD (ae042db9, record commit fc09d7a2);
plan closes only after operator's on-device dialog inspection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Continuation of the operator-restarted 13-08 session. Verified rather than
reshaped, per the pushed-history constraint on fc09d7a2/1a664be1:
- fc09d7a2's tools.rs/grants.rs/backends/mod.rs diffs confirmed rustfmt-only
(line-wrap reformatting), no behavior change.
- Task 1 re-verified green on current HEAD: 28/28 assistant:: tests pass,
approval_nonce_binds_to_exact_action passes individually, dispatcher.rs
untouched (git diff --exit-code clean).
- Task 2 was already complete in fc09d7a2's uncommitted-state snapshot: all
10 toolConfirm.test.ts cases pass (one per <behavior> bullet including
iframe_message_cannot_open_or_resolve_confirmation), pre-existing
contextBroker.test.ts + chatAiuiEmbed.test.ts (28 tests) still green,
vue-tsc --noEmit clean, and every acceptance-criteria grep passes
(Teleport to="body", zero postMessage/v-html in the modal, distinct
aiui:tool-confirm-request event pair not reusing aiui:install-request,
assistant.pending RPC-fetch, ToolConfirmModal mounted in Chat.vue).
fc09d7a2 stands as the commit of record for both Task 1 and Task 2 — no new
source changes were needed. STOPPING at Task 3 (checkpoint:human-verify,
gate=blocking): the anti-spoofing and clear-signing properties are visual/
judgement calls that require a human on archi-dev-box, not cargo test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Task 1 checkpoint:decision resolved by operator: hybrid-identity (path
row key, lazily-backfilled content-hash dedupe column), derived-albums
(computed at read time from track tags, not stored rows), a single
JSON index at data_dir/music/index.json matching content_server.rs's
load_catalog precedent, and both own-library + peer sources indexed.
MUSIC_SCHEMA_VERSION starts at 1; a newer-version index on an older
binary is treated as absent rather than reinterpreted or overwritten.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Recovered after a broken-pipe session cut off right after Task 4 finished:
the summary was fully written (Self-Check PASSED) but never committed.
Re-verified on resume before committing: /aiui/-scoped CSP header live on
archi-dev-box, build/verify scripts present+executable, render screenshot
intact. STATE.md advanced: 6/15 plans done, next is 13-04.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Continuation executor (post-reboot) ground-truthed the 30b2e02f WIP
build-aiui.sh checkpoint as complete/correct, finished Tasks 2-3 and
scripts/verify-aiui-deploy.sh, and proved the build+deploy+verify cycle
end-to-end on the real archi-dev-box node (this machine). Paused at Task
4's remaining human/browser-required steps because the live node's nginx
config predates even 13-02 — syncing it is a bigger diff than this plan's
own CSP addition and belongs to a human-supervised deploy, not an
unsupervised executor push to a live node.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mobile load speed and the 'how to use AIUI' brief not opening. Both noted with
the caveat that the deployed AIUI bundle is stale (pre-D-14), so they must be
reproduced against a fresh in-repo build before being chased.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
21 passed / 0 failed across assistant::, plus assistant_methods_require_session
run explicitly. Both windows had non-defect root causes: window 19 was lane
staleness (missing 0de67ca6's PortMapping test-constructor fix, which made the
whole crate's test build fail), and window 16's repeated kills were the
orchestrator's own too-short timeout sending SIGTERM on a cold build, which I
had wrongly attributed to memory contention.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The lane merged main at 0c4826f8, one commit before 0de67ca6 added
auth/auth_rationale to PortMapping's test constructors in prod_orchestrator.rs.
That left the lane unable to compile ANY test in the archipelago crate, which
is why 13-05 could not observe its 13 tests pass (window 19). Not a defect in
this phase's work — just staleness.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
# Conflicts:
# core/archipelago/src/main.rs
13-06 delivered the content pipeline and unit-tested it, but nothing in the
live UI invokes it, and 13-11 as written only added an equally-uncalled
sibling. No plan in the phase triggers the fetch from a UI event. Without this
AIUI-03 ships green-tested and visibly broken — empty grids. Wiring belongs
here, where useArchy.ts and ChatPage.vue's render tree are already in scope.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Operator-accepted deviation from 13-02 Task 3: the relay is structurally gone
but /aiui/api/openrouter/ still answers 200 via the SPA catch-all. 13-09 already
owns this nginx config, so the explicit return 404 belongs here rather than
bolted onto a completed plan.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Positive path confirmed by the operator on real hardware. Machine half
independently re-probed by the orchestrator rather than taken from the
executor's report. Openrouter status-code finding accepted as a deviation with
the reasoning recorded; explicit 404 scheduled in 13-09.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
run_runtime_assets() reinstalls a second on-node copy of the nginx template
over /etc/nginx/sites-available on every daemon restart. Found on
archy-x250-dev3 during 13-02 Task 3, where a hand-patched deploy was reverted
within ~5s of the restart. Live OTA hazard: an operator can deploy an nginx
fix, watch it apply, restart, and lose it with no error.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds tests/production-quality/aiui-proxy-closed.sh (follows lnd-cors-test.sh's
shape) and deploys+runs it against a real, genuinely remote node
(archy-x250-dev3, operator-approved deviation from archi-dev-box — see
SUMMARY key-decisions for why).
Confirmed on the node: unauthenticated /aiui/api/claude/v1/messages and
/aiui/api/ollama/api/tags both 401; claude-api-proxy sidecar unit gone;
nothing listens on :3142; the second key ledger (claude-api-proxy.env) is
gone. Along the way, root-caused and worked around a real deploy-topology
gap — the daemon self-heals nginx config from a second, stale on-node
template copy on every restart, silently reverting a hand-patched fix.
One finding is reported honestly rather than tuned away: deleted
/aiui/api/openrouter/ returns 200/405 via this app's SPA catch-all, not the
plan's literal 404 — the relay is structurally gone (zero proxy_pass to
openrouter.ai), but the exact status code doesn't match the acceptance
criterion. Left open for a human decision, per this task's own instruction
not to force a probe to pass.
This is Task 3 of a checkpoint:human-verify plan with gate="blocking". The
positive-path browser check and the openrouter-finding disposition remain
for a human; this executor does not self-approve the gate.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Operator deleted /home/archipelago/Projects/AIUI after the subtree import was
proven byte-identical (tree 5ac3173a on both sides, every branch contained in
development, no stashes, clean tree). The ../AIUI script paths no longer
resolve, so they fail loudly instead of shipping stale bytes. Still in scope
for this plan — a deploy script that dies on a missing directory is not a
shipping story — but the severity note is corrected so a future executor does
not act on a stale premise.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The planner correctly flagged dev-start.sh and deploy-tailscale.sh as out of
its mandate. Verified the risk is live, not theoretical: the orphaned
pre-migration clone still exists AND still has a built packages/app/dist, so
both scripts copy stale AIUI bytes and report success rather than failing
loudly. That is the same silent-staleness class as the /assets 404. Same
one-line fix as the two scripts already in scope, so it belongs in this plan
rather than in a follow-up nobody schedules.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Substantive rework, not a path swap:
- Retires D-15's pin-and-verify model. scripts/aiui.pin, pin_commit and
--update-pin are dropped outright — there is no second repository left
to pin, so build-aiui.sh now attributes a build to this repo's own
`git rev-parse HEAD` instead.
- Re-derives the build: aiui/ is an in-repo pnpm/turbo workspace with its
own package.json and lockfile but no committed node_modules, so
build-aiui.sh must `pnpm install --frozen-lockfile` before it can build
(new requirement; the old model assumed a developer's separate AIUI
clone was already installed).
- Retargets deploy-to-target.sh (both its primary and --both/secondary
AIUI sections) and setup-aiui-server.sh off the stale
$PROJECT_DIR/../AIUI/packages/app/dist path, which still resolves on
disk to a stale pre-migration clone and would otherwise silently ship
old bytes instead of failing loudly.
- Carries the /aiui/-scoped CSP sandbox work (AIUI-04) through unchanged
per D-19, and fixes two acceptance-criteria drifts discovered while
verifying the plan against deploy-to-target.sh's post-13-02 state and
nginx-archipelago.conf's post-pentest-hardening state (CSP header count
and the "no session gate needed" grep), neither of which is a D-19
effect.
- Folds in a real defect found while doing this work: the 2026-07-31
same-host deploy guard only catches path containment, not sibling
directories — the exact shape this worktree's own topology exhibits
(archy-phase13 as a sibling of the main checkout, reachable over
loopback SSH). New Task 3 widens it to refuse any same-host
source/destination mismatch, extracted into a testable
assert_safe_same_host_deploy in scripts/lib/common.sh and pinned by
tests/production-quality/deploy-guard-same-host.sh. The checkpoint task
is renumbered Task 3 -> Task 4 accordingly.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mechanical path swap: useArchy.ts now lives at aiui/packages/app/... in
this repo (D-19), not the old separate clone. Drops the separate-branch/
push language. Verified paths and referenced symbols still exist and at
essentially the same line numbers post-subtree-import; task content and
must_haves are otherwise unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mechanical path swap: AIUI's composables now live at aiui/packages/app/...
in this repo (git subtree import, D-19), not at the old separate clone
/home/archipelago/Projects/AIUI. Drops the "separate development branch to
push" language accordingly. Verified every retargeted path exists on disk
before rewriting; task content and must_haves are otherwise unchanged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Reproduced again on this node today: with no session cookie, six app
ports answered HTTP 200 with their real UIs (18083 LND, 8334, 8175
Fedimint Guardian, 8336 FIPS Mesh, 8090, 7777), all bound 0.0.0.0 and so
served on every host address. Same bug class as the /lnd-connect-info
and /bitcoin-rpc/ leaks closed in v1.7.120, but across every app.
LAN, Tailscale, Tor and the FIPS mesh all converge on 127.0.0.1:<port>,
so this is one gate rather than four. It lives in the daemon rather than
a per-app sidecar (umbrel's app_proxy model): rootless, no extra
container per app, and it can reuse machinery that already exists.
It invents no authentication policy. verify_password, TOTP secret
decryption, verify_code with used-step replay protection, the session
store, and — importantly — the SAME LoginRateLimiter instance as the
JSON-RPC path, so an attacker cannot get a fresh budget of password
guesses by moving to an app port. Only the transport differs, an HTML
form instead of JSON-RPC, because a browser being sent to an app cannot
speak JSON-RPC.
2FA comes for free: a session still pending its TOTP step fails
validate(), so the gate rejects it without knowing what a second factor
is.
Details worth keeping:
- 401, not a redirect. A redirect to a login page is indistinguishable
from the app itself redirecting, and machine clients would follow it
and parse HTML as their API response.
- Cookie and Authorization are stripped before proxying. The app has no
use for the node session and must never be able to log or forward it.
- The challenge page names and pictures the app being opened, so the
visitor can confirm what they are authenticating to.
- device_tokens grew `apps: Option<Vec<String>>` and verify_for_app for
machine clients. None = node-wide, which every existing companion
token is; migrating them by guessing a scope would silently revoke
access nobody asked to revoke. An empty list is rejected rather than
minted, since it reads as unrestricted while authorising nothing.
The rollout is necessarily per-app and the gate is built to say so. A
container publishing 0.0.0.0:<port> claims every host address, so the
gate cannot bind that port until the app is pinned to bind: 127.0.0.1
and recreated — gate-first is impossible, and all-at-once would recreate
every container on a node simultaneously. Every port it cannot claim is
logged at warn each sweep and recorded in GateStatus::unprotected,
surfaced by security.app-gate-status. The failure mode being designed
against is a gate that binds nothing, logs at debug, and reports success
while every app stays exactly as open as before — worse than no gate,
because it stops anyone looking. Same reasoning that ruled out an
nft drop-in, whose absence is a silent no-op.
Not yet done: pinning the 39 gated ports to loopback, repointing
HiddenServicePort at the gate, and on-node verification.
Tests: 21/21 appgate, workspace builds clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
D-19 supersedes D-15's two-repo premise and voids D-18. Flags 13-06/13-09/13-11
as needing a re-plan against aiui/ before wave 2 runs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Brings AIUI's full 230-commit history under aiui/ via git subtree, plus main's
current head. Operator decision 2026-08-03: AIUI moves into this repo rather
than staying at git.tx1138.com. This also lands e30ac1d (13-01 Task 3), which
was stranded local-only while that remote was unreachable.
Plans 13-06, 13-09 and 13-11 still target /home/archipelago/Projects/AIUI paths
and must be re-planned against aiui/ before wave 2 runs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tasks 1 (session-gated model forwarder, 97921d99) and 2 (retire the Python
sidecar/OpenRouter relay, b28cc3ee) are committed, cargo build --package
archipelago succeeds, and all 5 model_proxy:: unit tests are confirmed
passing (via direct execution of the compiled test binary, since a fresh
`cargo test` invocation was too slow to complete under severe host resource
contention — see the SUMMARY's Issues Encountered for the full account).
Task 3 (checkpoint:human-verify, gate="blocking" — real-node curl/systemd
proof, S-15) is intentionally NOT executed. Per the plan and this
executor's instructions, it halts here and returns a structured checkpoint
rather than self-approving.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Records the continuation ground-truth review of WIP checkpoint 6ba52b22,
the atomic per-task re-commit (fe6ccff7 Rust spine, 0ab9bdc7 neode-ui
broker), and the external-repo Task 3 commit (AIUI e30ac1d, not yet
pushed). Logs two open WINDOWS.md items: the cargo test run that never
completed under machine resource contention (id 16), and the AIUI push
blocked by an unreachable git.tx1138.com (id 17).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
4 cores, load 35, 15G of 23G swap in use, rustc at 8.3G RSS while a live
node (bitcoind/electrumx/lnd) shares the machine. Two concurrent cargo
builds in separate worktrees (no shared target dir) made wave 1 crawl for
over an hour with zero commits. Wave 2 has four plans, so this would have
gotten worse before it got better.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Promotion to Trusted is a privilege escalation — a Trusted peer can read
node state, be deployed to, and is exempt from the `!= Untrusted` gates
federation/DWN/messaging use. It must therefore cost a fresh proof that
the person at the keyboard is the operator, not merely that a session
cookie exists. Same reasoning as node.rotate-identity and TOTP setup,
both of which already re-verify.
Both entry points are covered:
- `federation.invite` gates on the RESOLVED level, not on an explicit
request for Trusted: "Link Your Nodes" sends no `trust_level` at all
and falls through to the Trusted default. The invite is a bearer grant
of Trusted to whoever redeems it, so minting it IS the escalation.
Observer invites are untouched.
- `federation.set-trust` gates only when the peer is not already
Trusted, so the dropdown re-emitting its own value doesn't demand a
password for a no-op.
Demotion is deliberately NOT gated: making something less privileged
must never be harder than leaving it alone, or the safe action becomes
the inconvenient one.
The backend is the sole authority on what counts as an escalation — it
returns a `PASSWORD_REQUIRED:`-prefixed error and the UI prompts and
retries only on that, so the rule lives in exactly one place and the
frontend never pre-judges. TrustPasswordModal.vue (modelled on
RotateDidModal.vue) serves both flows. NodeDetailModal's select snaps
back to the node's real level on change, since a cancelled or failed
promotion would otherwise leave the dropdown displaying a level the node
never accepted.
The operator path stamps TrustSource::Manual; set_trust_level grew an
`Option<TrustSource>` so automatic adjustments (the discovery-handshake
demotion safety net) pass None and leave the recorded provenance alone
rather than laundering an uninvited-join peer into looking approved.
Follow-up, deliberately out of scope: `federation.join` also reaches
Trusted when redeeming someone else's Trusted invite, with no re-auth.
Tests: 44/44 federation, 79/79 rpc-client, vue-tsc clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Wave 1 recovery: 13-03 was complete and is merged into the lane; 13-01 and
13-02 had uncommitted executor work rescued into WIP checkpoints and are
being continued in their existing worktrees.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
