Windows' scalar rounding lands one glyph/tile edge a hair differently
(exactly 1 px on the CI runner), which the zero-diff rule read as
misregistration. Real misregistration swaps whole fills — hundreds of
contiguous pixels — so a 4-pixel isolated budget keeps the guarantee
while absorbing the platform rounding the comment already describes.
The flake pinned jian/casement as fixed github revs while the repo
advances the same code as submodules, so every submodule bump that
forgot the flake broke the whole workflow — most recently op-pen-loader
failing to compile against a jian without the widget-style fields. The
workflow now derives --override-input values from the checked-out
submodule HEADs (with --no-write-lock-file), so it follows the gitlinks
by construction, and the flake.nix default revs are refreshed to the
current pins for local use.
The editor now holds a live SSE stream, and an in-flight network
request pauses headless Chrome's virtual clock — so --dump-dom never
flushes, the DOM grep never matches, and the smoke either timed out
(CI, 45s) or hung on a TERM-immune Chrome behind a bare wait (observed
12 hours locally). The mount marker is now mirrored to the console,
which reaches the stderr log incrementally, and the poll loop treats
that line as readiness, synthesizing the DOM marker the assertions
expect; the timeout path uses SIGKILL. Verified end to end locally:
both the pure CanvasKit page and the daemon host page mount.
The boundary gate's credential scanner greps source literally, so the
redaction test's sk-ant fixture is now assembled with concat! — the
runtime string is unchanged, the source no longer looks like a leaked
key. The relay token-policy test built /policy.json-style paths that
count as relative on Windows, so the config constructor's absolute-path
check failed before the assertion ran; the paths now carry a drive
prefix there.
cjkcheck (CJK line-break simulation), cjkreal (resolved-height cross
check that filters simulator false positives) and gate.sh (audit +
both, per-file verdicts) move from session staging into the generator
tree so the next template batch starts with the gates that vetted
this one. stubcheck is deliberately not kept — the audit's diagnostics
already cover empty decorated stubs via the same predicate.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
A CJK line-break gate over all fifty-eight templates caught eleven
sets whose body copy wrapped into three-character orphan tails or
punctuation-led lines. Each line is shortened to fit its measured
column (paired sides stay symmetric where the layout demands it),
affected root heights re-measured, previews re-baked. The one
remaining gate report is a simulator false positive disproven by the
rendered frame.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Test-only imports and a four-slash comment slipped in ahead of the
canvaskit-feature clippy sweep; the all-targets -D warnings gate
compiles clean again.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Every non-deck, non-web scene now holds ten templates: cards (spec
themes as living samples), infographics, tutorials, comparisons and
carousels (nine spec themes with per-set master-board rules), plus
two web landings whose 'generate from this' pins their measured
style guides — a basis the document swap used to drop before the
turn ever saw it. All fifty-eight ship generator-reproduced (sha256-
matched), audit-clean, with baked preview cards, and the scene tab
row pins Slides second-from-last and Web last. Two prompt-center
entries carry the web pair with re-rendered previews and honest
render provenance.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Two web-landing voices measured from shipped documents, a butter-
paper serif editorial, and four social-card themes (mineral cave
dark, letterpress vermilion, arcade neon night, highlighter
notebook) — palettes derived from real anchors via the sampling
protocol, prose written fresh, platform-tagged for the card shelf.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The agent-loop ack and the web thinking stream carry the itemized
ledger the desktop path already surfaces, so every route can expand
the polish step into its records.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
jian-scene now exposes visible_children() as the single judgment both
paint and hit-test share, so canvas clicks land on the tabs panel the
user sees instead of a hidden sibling occupying the same grid cell
(vendor/jian bump carries the walk change, rebased onto the thumb
registry work). A stroke that declares thickness but resolves no
paint no longer masquerades as opaque black on widget tracks and
borders — three unpaintable shapes drop it and the role defaults take
over, while $ref-driven and ordinary shape strokes keep their
historical behaviour. Zero-thickness tab bar strokes stop painting
skia hairlines.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Columns derive from a card-width ceiling instead of three hardcoded
breakpoints (a 5120px window packs eleven columns, not four plus
half a screen of black), each card carries a palette band memoized
from its document's declared variables in declaration order, long
summaries appear on hover, and the panel's chrome converges on one
segmented control, one chip surface and a two-step pointer ladder
from a shared metrics module. Style import gains a file-picking path
on both hosts that feeds the same pipeline as pasting — the second,
divergent import pipeline is deleted.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The 720x520 box becomes an 88%-of-viewport gallery sharing the asset
center's breakpoint functions — columns follow width, cards keep
their aspect, and the shell clamps instead of overflowing on small
windows.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
A single selected node exports as '<document>-<node>.<ext>' on both
hosts from one shared sanitized stem (dangerous characters swapped,
per-character CJK truncation, no stutter when names match), the deck
PDF route accepts a board subset that filters in deck order rather
than request order, and an empty subset means nothing-to-export
instead of silently shipping the whole deck.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The rail's footer becomes a two-control bar: Present enters the
existing preview, Export PDF opens an upward menu whose second row
exports exactly the selected boards — counted from the same
chips-and-selection intersection the exporter consumes, greyed at
zero so the upward menu never changes height under the pointer.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
One pass over the floating chat panel: the style receipt and
selection chip share a single 28px row (down from two 52px slabs)
with one rect source for paint and hits; the minimized bar borrows
the expanded panel's width instead of a hardcoded 400; a three-state
thinking toggle joins the footer (live even mid-stream — that is
when you want the next turn to stop thinking) and the orphaned
controls row it replaces is deleted; arrow keys walk the input caret
across visual rows with scrolling that follows it, wheel over the
input scrolls the input, and IME composition is never intercepted;
hovering the style chip raises an info card (source badge, palette,
fonts, first summary line) fed by a memoized corpus lookup; and
zero-width footer slots stop answering hits on their origin column.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The hero block shrank to a section heading, provider entries traded
bordered cards for hairline rows, and the scattered paddings, row
heights and section gaps collapsed into one named metrics module the
whole family reads. Paint and hit-test walk the same row ladder, so
the provider rows' four-pixel click offset is gone, and the panel
shell itself comes down to 960x760.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
'Make me a xiaohongshu card set' used to hit the component trigger
and come out 400px wide. Card is now a design type with a 1080x1440
preset (checked ahead of component, vetoed by 组件), its own style
shelf behind a hard platform filter, prompt-inferred card tags, an
aspect lock that still honors explicitly requested dimensions, and a
fallback plan that labels every card as its own screen.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Splits every cleanup pass into contract (an unrepaired screenshot
would show something no author intends) and intent (taste calls the
author already made). Template-provenance documents skip the intent
tier outright — audited template styling is authored truth — and
appended turns run intent only on the inserted roots while contract
checks sweep the whole target root, so trailing sections are no
longer a blind spot when insertion lands empty. Skips are recorded
as ledger notes, never silent.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
A field audit of real generations convicted a family of passes that
asserted redundancy without proving it: section rhythm zeroed because
a machine gap 'stood in' for padding it could not supply, intentional
dark bands stripped as repaints of a ground the root never painted,
headings bound to a border token by hex distance, near-white borders
surviving dark designs, starved rigid rows crushed to 2px, overlays
buried under opaque siblings, watermark numerals flagged as unreadable
collisions, and the whole CJK nav chain dead because label
normalization kept ASCII only. Each rule now states a provable
contract — gap must absorb the inset, the ground must match, slots
reject impossible families, rows respect rigid content, ink decides
collisions, containment decides board ownership — and scrolling-page
sections keep their authored rhythm outright.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
'41 auto-repair(s) applied' told the user nothing about what changed.
A counting-sink decorator now captures each accepted edit as a record
(pass group, node, field-level before/after — removed attributes read
as '(unset)', not a dash) at the one point every command crosses, so
counts derive from records and cannot drift. The polish step expands
into one row per record on desktop and as sub-rows on the text
streams, capped inline with the remainder in the INFO log, and scope
notes (skipped tiers) always precede the repairs that did run.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The replaceable-empty-root snapshot reset per program, so screens a
previous batch inserted (still empty, but named) read as starters and
were swallowed by the next insert. Only an unnamed frame — or the
factory starter's literal name — is replaceable now.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Preserving original-case screen names broke the lowercase existing-
screen guard, quantifier stripping killed whole target lists over one
short latin name, and root-seed inheritance fired on any canvas that
happened to hold a same-class screen — silently overwriting authored
widths and fills. Continuation is now an explicit signal derived from
the same promised-screen parser the orchestrator uses, inheritance
never overrides an authored fill, and the guards are case-robust.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The harness re-derived its reasoning wire shape from a stale
capability check, so kimi-k3 benchmarks ran without the control the
product sends and force-disable posted the exact body field that
model rejects. apply_reasoning_wire_control is now pub and the smoke
clients call the same mutation the live turn does, asserted per model
id against the production body.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
agy 1.1.11 switched 'agy models' from one slug per line to
'id<TAB>display name'; the parser kept whole lines so every --model
value carried the display name and the CLI rejected it. Split rows on
the separator (slug-shaped left cells only), refuse to treat a
--model rejection block as a catalog, drop ids carrying column
separators as a format-change tripwire, and log a version/format
breadcrumb only when the pair changes.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
A failing CLI turn surfaced only its exit code: the stderr drain task
raced the tail read (a ~40% loss under concurrent subtasks), the
fallback branch discarded whatever the tail held, and friendly
classification swallowed the evidence when it did match. Failures now
join the drain within a grace window, quote a head-and-tail excerpt
with secrets redacted before truncation, keep the classified verdict
and the excerpt together, and the ACP connect path stops discarding
its child's stderr line by line. Auth keyword matching gains word
boundaries so 'authored' no longer reads as an auth failure.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The signer daemon's whole security surface (SO_PEERCRED caller
authentication, socket-file mode/owner checks, O_NOFOLLOW opens,
flock single-instance) is unix semantics; config.rs paths are POSIX
too, so windows targets got fifty-five compile errors and a runtime
test failure. Gate the crate at the root with a stub main instead of
porting checks nobody consumes, and move the deps under cfg(unix) so
windows builds stop resolving the PKCS#11 stack entirely.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
socket2 truncates sub-second durations to zero and Linux rejects
TCP_KEEPIDLE=0 with EINVAL, so any sub-second heartbeat config broke
every connection at the socket; macOS silently kept the 7200s default
instead. os_keepalive_period() rounds the period up to the kernel's
whole-second granularity with a 1s floor, and a getsockopt readback
test pins what the kernel actually holds on both platforms.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
Thinking modes, slides export, repair-ledger lines, style import file
picking, template scenes and forty-six new template titles/summaries
land together so every later commit's key lookups resolve. Catalog
integrity count moves 1526 -> 1640.
Claude-Session: https://claude.ai/code/session_01FqKQqNj8exYwopGDpYUU7x
The preview JPEGs (~2.4 MiB, already compressed so gzip passed them
straight through) leave the wasm data segment: a platform-free asset
registry in op-editor-core tracks per-route Absent/Pending/Ready/Failed
with single-flight and install-once semantics, the browser half fetches
over ArrayBuffer XHR with managed-mode headers and a slot-wrapped
callback so no synchronous failure can strand a route in Pending, and
paint sites fall back to the existing placeholder when bytes are not
(yet) there. Native keeps include_bytes verbatim. The staging script
copies the asset dirs into pkg/assets/ — under /pkg/ because the hub
frontend owns /assets/ — and the gate, CI workflow, and web image all
run it and assert the layout. Bundle: 7.13 → 5.10 MiB gzip, so the
tripwire returns to 6 MiB (85% occupancy); the sdk bundle keeps its own
8 MiB pending a real measurement.
Also closes the final review test gaps: the owner-session fixture now
returns a must-use lane guard (a dropped receiver made the saturated
lane read as Disconnected, not Full) and seeds the daemon's baseline
document so the hash check exercises the real path, and the closed
write barrier has a direct multi-page active-page regression test.
Adding the SIGTERM handler had introduced the cfg(unix) dependency
section above five cross-platform dependencies, silently making zip,
memmap2, glam, dirs, and skia-safe unix-only — invisible on mac/linux
gates, fatal on the windows runner. Only libc belongs in that section.
The complex-script test file's shared imports and constant now carry
the same macOS gate as every test in it, so linux clippy stops flagging
them as dead.
A single-slot, self-expiring toast (8s, read-time expiry so the state
stays a pure function of the clock) renders top-centre of the canvas —
the one band with a single occupant, stacking under the align toolbar
and clamped clear of the tool column. Paint sits above panels and the
diagnostics notice, below the missing-font modal, with the press tier
mirrored in both hosts through one shared flow arm; the deadline folds
into the shared frame bookkeeping so each host wakes exactly once at
expiry. The online conflict auto-accept now shows the existing
localEditPreserved string (all 15 locales) naming Undo as the way
back; collab sessions keep their panel notice instead of saying it
twice, and an identity switch dismisses the previous account's toast.
- the AI snapshot path's editor-metadata writes (authored-geometry
flag, active page) now take the same write admission as document
content — they serialise into the tenant snapshot, so a post-close
write could still lose acked state; a closed barrier skips them
while the chat reply streams on
- op-collab-host gains a cfg-gated test-support fixture (activated
owner session, saturated command lane) so op-host-services drives
the real begin→install→finish path: Rejected restores the thumbnail
snapshot, a standalone-fallback Failed keeps the new thumbnails —
both mutation-checked, replacing two assertions that never reached
the branch; a test-only registry lock stops the process-global
thumbnail table from crossing test isolation
- the three remaining AI closed-barrier paths (starter clear, modify
reply, design doc sink) are pinned by tests, and the identity-reset
comment no longer claims an epoch re-tag that would itself be the
bug
The pairing-code hardening changed the admission exchange's
expected-subject parameter into PeerIdentityPolicy, but the smoke
harness only builds under --features test-issuer, which no workspace
gate compiles — CI's two-process collaboration step was the first
thing to notice. All four call sites now pass the SameAccount policy;
the full 8-scenario smoke run passes again.
- credential-sync callbacks compare the epoch captured when their
request was issued instead of a shared cell the reset itself
rewrote, so a stale callback can no longer pass as current; the
first identified partition reload also restarts the sync flow,
clearing the in-flight latch a mount-time policy fetch left wedged
- AI standard-turn commits (snapshot replace, starter clear, modify
apply, doc sink) each take a write pass at the commit instant — the
streamed conversation never holds the barrier — and a closed
barrier leaves the document untouched while the reply still
streams; /api/ai/stream was verified to have no commit points
- the shutdown write drain has no ceiling: flush runs only once no
write is in flight, with escalating logs and stop_grace_period
documented as the one true upper bound
- LocalEditOutcome::Failed reports whether the document rolled back,
and the thumbnail snapshot is restored only when it did — the
delivery-failure fallback keeps the edited document, so restoring
old thumbnails there described a document that no longer existed
The idle-heartbeat test failed deterministically on linux (not the
timing flake it was first read as): TCP_KEEPIDLE/TCP_KEEPINTVL have
whole-second granularity there, so the test config's 50ms heartbeat
truncated to zero and setsockopt returned EINVAL on both ends of the
handshake — a real runtime bug for any sub-second heartbeat config,
fixed by clamping only the kernel keepalive cadence to >= 1s.
The 6 MiB gzip tripwire was set when the bundle measured ~4.5 MiB;
feature growth since (collab, prompt center, templates) added ~4.5 MiB
of embedded product assets, ~2 MiB of it pre-compressed JPEG that gzip
passes through. Reset the tripwire to 8 MiB and document that it is a
regression guard, not a budget, with the asset-split TODO that brings
the bundle back down.
Re-audit round: an aborted edit script had silently dropped half a
prior fix, so each item here is grep-verified in the report trail.
- identity reset now actually drains the credential sync queue and
epoch-tags in-flight callbacks so account A's completing upload
cannot become account B's state; an empty partition resets every
account-scoped setting (locale, recents, agent settings, theme)
instead of inheriting the previous account's; rebuilt persistence
baselines go through the CredentialLoad seams so settings keep
saving and unsupported snapshots stay fail-closed after a switch
- mutation admission is one helper shared by the REST push and /mcp:
write tools take a WritePass (read tools stay free) and refuse with
a proper tools/call error once shutdown closes the barrier; the
write drain escalates to a 60s hard cap with blocked-writer logging
instead of flushing past active writers at 10s
- a runtime-rejected ingest restores the thumbnail registry snapshot
captured before install (vendor/jian gains the restore_snapshot
counterpart), so a rejected document's thumbnails no longer stay
active locally
- an empty settings partition now clears the previous account's
in-memory credentials instead of keeping them; identity reset also
drains the credential upload queue and rebuilds both persistence
fingerprints after the partition load (before it would re-measure
the old account's state as a pending write); partitions key on the
stable subject the daemon now advertises, so a handle rename cannot
move or merge accounts
- online shutdown closes a write barrier before draining: late writes
get 503 shutting-down instead of an ack that will not persist, and
the flush logs its duration so stop_grace_period can be sized
- a conflict auto-accept that cannot stash skips the accept and
retries rather than overwriting unpushed work without a backup
- the collab gate runs before the push surrenders its document, so
refused pushes release their thumbnail seed through Drop; the
runtime-reject path discards explicitly, and the seed tests now use
the same allocation the parse produced instead of a clone that
could never match
The re-review found several remedies that existed but were not
reachable; this closes them:
- online answers /api/auth/status with the verified identity
projection (login/logout stay 404), so the account-switch epoch
actually fires; first identification reloads the account's settings
partition, identity reset also tears down the id allocator, and an
Active projection whose namespace disagrees rebuilds it
- finish_local_edit reports Committed/NoChange/Rejected/Failed and a
real runtime rejection answers 409 version-conflict with the
authoritative version — the one shape the browser's recovery parses
- the REST scope gate runs ahead of every dispatch path including
share, AI, figma, and SSE (/mcp keeps its stronger per-tool check)
- shutdown drains connections (bounded) before the flush, the tenant
store probes create/write/rename/delete at startup and fails closed
naming the container uid, and worker-thread spawn failures abort
startup instead of silently never persisting
- ACL flushes hold the same guard as updates, and the 257th grant is
refused rather than silently truncated on the next write
- the conflict stash lost its call site in an earlier split and is
invoked again before accept; SSE subscribe prunes dead slots; an
uninstalled document push drops its pending thumbnail seed
Closes the remaining review findings:
- an online conflict auto-accept stashes the overwritten document
(single slot, cleared on identity change) and tells the user the
remote version was applied and Undo restores their work — the apply
was already undoable via the initialized() latch, now pinned by
tests on both sides of the seam and named in all 15 locales
- every wasm daemon request goes through one tenant-aware URL builder
(idempotent stamping at construction and dispatch), fixing the AI
transport, model catalog, and image panel requests that dropped the
?tenant= parameter on shared pages
- tenant restore and eviction persistence no longer touch the
process-global thumbnail registry, so two restored accounts cannot
capture or overwrite each other's image state
- document pushes parse and validate before the state lock; only the
baseVersion re-check, gate, and infallible install run under it
- SSE subscribers hold a single latest-value slot (weak-pruned) so a
stalled reader coalesces ticks instead of growing an unbounded queue
- /api/file/save clears the same whole-document gate as open-recent:
409 collab-active during a session instead of silently desyncing the
runtime's hash and commit log
- document ingest returns a typed outcome; only Committed bumps the
version, Rejected/Failed surface codes the browser's existing
conflict recovery already handles, and the local-edit capture closes
through an RAII guard on every path including unwind
- a ?tenant= request now passes persisted-ACL admission before any
tenant materialises, so unauthorised probes cannot occupy capacity
- ACL edits and their durable write serialise under one mutex with
unique temp files; a failed write rolls back and returns 500 rather
than resurrecting revoked grants after restart
- API-token REST calls are scope-checked by method (session cookies
exempt) and a token naming no mcp:* scope now gets nothing instead
of everything — hub-issued tokens must carry explicit scopes
- SIGTERM/SIGINT in the online loop raise the existing shutdown flag
so container stops run the tenant flush
Three review blockers:
- the session push gate refused every id absent from the daemon
snapshot, which included all ids the namespace allocator mints — so
nodes created during a session never synced and were erased by the
next pull. Unknown ids now pass when they parse into this peer's
namespace (parsed comparison, not prefix match); with no allocator
the old fail-closed behaviour stands
- a same-tab account switch kept the previous account's document,
sync baseline, and stored credentials. An identity epoch keyed on
the auth subject (tri-state, so sign-out then sign-in is not
mistaken for first contact) resets the sync client, gate, document,
collab state and latches; 401/403 suppress pushes until the reset;
browser storage partitions by subject with legacy keys deliberately
not adopted
- online tenants lived only in memory under the default deploy:
compose now mounts a data volume, startup fails closed when
eviction is enabled without a store (OPENPENCIL_ONLINE_EPHEMERAL=1
is the loud demo bypass), a dedicated sweeper replaces the
connection-triggered sweep that never ran while idle, and shutdown
flushes every resident tenant
Tier-1 online collaboration: an owner grants accounts into their
tenant's ACL (grant/revoke/list under /api/share/), and a visitor
addresses it per request with ?tenant=<ownerId> — query rather than
header because EventSource cannot set headers, and share routes always
administer the caller's own tenant so a grant is not re-shareable.
The wasm shell threads the parameter through its four XHR helpers and
the event stream in one place. A shared tenant has no collaboration
session, so the 409 auto-resolve now also accepts when the daemon
advertises serveMode online (the daemon's counter is the total order
and SSE is already delivering the newer document; the old latch would
freeze a visitor permanently). Evicted tenants persist document + ACL
under sha256(user_id) directories via atomic writes — written before
the registry remove so no instant lacks both copies; unwritable
tenants stay resident and unloadable files are set aside as .corrupt
rather than overwritten. Also restores the Dockerfile entrypoint
literal the M2 CMD restructure dropped (its CI test only ran in the
workspace suite) and splits live_sync_glue under the file cap.
A public bearer client previously reached the full 160-tool catalog,
including save_document (fs::write at a caller-chosen path), the
process-global codegen plan store, and host diagnostics. Online mode
now classifies every tool by surface in one reviewable table and denies
the 17 that touch the daemon host (filesystem, outbound fetch,
unscoped globals, diagnostics, future process spawn) in both tools/list
and tools/call — refusal happens before argument parsing, so traversal
payloads never reach a handler. mcp:read/mcp:write scopes gate write
tools ahead of dispatch (deny-then-scope, so a filesystem tool reports
denial rather than inviting a bigger token); session cookies keep full
scope and unclassified static tools fail the build. Local and managed
catalogs are unchanged. The deployment-boundaries script now refuses
direct invocation instead of green-exiting with every helper missing.
HubVerifier resolves both credential shapes onto the tenant registry —
Authorization: Bearer through the hub's internal token introspection
(shared-secret header, constant-time compared) and the op_hub_session
cookie through /api/v1/session — so a browser and an MCP token for the
same account share one document. Verdicts cache under SHA-256 keys
(session 60s, token min(300s, expiry), definitive negatives 15s);
upstream failures are never cached so a hub blip cannot become a 15s
outage, and a configured-but-unbuildable hub fails 503 rather than
silently downgrading to the dev verifier. Cookie-authenticated writes
now require an allowlisted Origin (bearer exempt), CORS echoes the
allowlist instead of *, and the web image gains online mode, a non-root
user, and a healthcheck.
--online turns the single-user daemon into an identity-keyed
multi-account host while leaving local and managed byte-identical
(the legacy serve_one is preserved under cfg(test) to prove it):
- TenantRegistry maps verified user ids to per-tenant WebCanvasState +
SseHub; leases are taken under the registry lock so a live
connection can never race eviction, and eviction compare-and-removes
with the M4 persistence seam marked in place
- ServeMode routes through 11 const predicates, all true for
local/managed; online locks down file IO, device-login proxy,
settings persistence, indicators, the POST / alias, generic
shutdown, sync-reset (safe no-op), LAN/relay collab actions (SSRF
surface), and the process-global thumbnail registry
- credentials arrive as Bearer or cookie via new HttpRequest capture;
IdentityVerifier starts with a static env-mapped verifier (hub
introspection lands in M2); missing verifier fails closed with 503
- /api/ai/* routes moved verbatim to connection_ai_routes.rs to keep
connection.rs under the file cap
POST /api/collab/avatar resolves a roster participant key to image
bytes via the daemon's public-only HTTPS client, so the browser never
sees signed CDN URLs. The handler lives on the connection thread beside
the account avatar proxy (bounded IO stays off the editor mutex) and
stands in for the desktop's frame-loop avatar pump. VS Code's daemon
contract test now pins the /api/collab auth gate (401 bare, 200 with
the managed token), and the crate map documents the collab-host split.
Browser-side consumption needs an avatarRevision on the participant
wire and an install seam in collab_avatar_runtime; until then web
participants keep the initials fallback.
