Commit Graph
3 Commits
Author SHA1 Message Date
archipelagoandClaude Opus 5 b2c7592840 security: parameterize node addresses; drop dead APP_URLS config
Demo images / Build & push demo images (push) Failing after 2m16s
Keeps the dev and test tooling an outside contributor would want, and takes
our node addresses out of it.

Scripts that silently defaulted to one of our nodes now require an explicit
host and exit 2 without one: smoke-test.sh, trust-archipelago-cert.sh,
dev-container-test.sh (which also derives its RPC and health URLs from the
SSH target instead of a second hardcoded copy), and image-recipe/dev-branding.sh.
A default that points at a machine the user does not own is worse than no
default: it fails confusingly, or reaches a stranger's device.

Usage examples, mock data and test fixtures move to the RFC 5737
documentation range (192.0.2.0/24). CGNAT test values stay inside
100.64.0.0/10 so the range-check semantics they exercise still hold, and
192.168.1.0/.1/.254 are left alone — those are gateway logic and UI
placeholders, not our addresses.

Playwright and the perf spec defaulted their baseURL to one of our nodes;
they now default to localhost:8100, the local dev server.

Removed neode-ui APP_URLS entirely. It is dead code — exported, never
imported — and it pinned fedimint's *prod* launch URL to 192.168.1.228:8175.
Had anything consumed it, every user's node would have tried to reach an
address that on their LAN is either nothing or someone else's machine.
Deleting beats sanitizing dead config.

Verified: frontend 868/868 vitest across 108 files; archipelago-container
75/75; mesh tests 9/9; audit-secrets 5/5. Zero node addresses and zero node
names remain in tracked files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-07 10:53:25 -04:00
archipelagoandClaude Fable 5 361451400c fix(02-01): record archi-dev-box baseline; harden harness against cascade
- 02-PERF-BASELINE.json: on-device baseline recorded against archi-dev-box
  (real hardware, D-11's verification target). 13/15 surfaces measured
  cleanly across 3 runs each; Mesh and Chat are recorded as unmeasured with
  their reasons (Mesh: no connected mesh device on this node within the
  wait window; Chat: AIUI's own loading overlay outlives the close-button
  click budget) rather than silently marked already-fast, per plan rule.
- measure.ts: goHome() now falls back to a hard `page.goto('/dashboard')`
  when the Chat surface's own close button is unreachable (blocked behind
  AIUI's connecting overlay on real hardware) — without this, every
  surface after Chat inherited a permanently hidden sidebar
  (`v-show="!chatFullscreen"`) and cascaded to unmeasured. This recovery
  path is exempted from the "no page.goto between surfaces" rule because
  it exists only to break out of a stuck state, not to measure one.
- surface-perf.spec.ts: currentCommit() now shells out with `process.cwd()`
  instead of `__dirname`, which is unavailable under this package's
  `"type": "module"` runtime and was silently recording every run header's
  `commit` field as 'unknown'.

No file under neode-ui/src/ was modified by this task (git diff --name-only
HEAD -- neode-ui/src is empty).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-30 06:32:56 -04:00
archipelagoandClaude Fable 5 a75b670918 feat(02-01): build re-runnable D-09 surface perf harness
- surfaces.ts: SURFACES table covering all D-09 surfaces (home/wallet,
  apps, marketplace, discover, cloud, mesh, server, web5, fleet, chat) plus
  four secondary screens (AppDetails, MarketplaceAppDetails, CloudFolder,
  OpenWrtGateway) and the located wallet-send modal. Navigation is via real
  RouterLink/button clicks (never page.goto) so revisit measures actual
  Vue Router client-side transitions.
- measure.ts: measureSurface() records first-visit vs revisit timing, an
  RPC method+timing trace (no bodies), a dataset-stamp remount probe, and
  derives maxConcurrentRpc/rpcWallClockMs via sweep-line so serial
  waterfalls are distinguishable from parallel fan-outs. Includes a
  dismiss-and-retry click guard for stray modals (Companion app intro) that
  would otherwise cascade failures across surfaces.
- surface-perf.spec.ts: logs in via the existing app-launch flow, walks
  every SURFACES row, writes results + a run header to ARCHY_PERF_OUT.

Verified end-to-end against the local mock-backend + vite dev server
(14/15 surfaces measured cleanly across 3 runs each; the 15th, Mesh, times
out only because the mock backend never reports a connected mesh device —
expected to resolve against a real node in Task 2).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-30 05:59:15 -04:00