From 1473f6336207122618b8a1ade7412f9d71d83148 Mon Sep 17 00:00:00 2001 From: timmy Date: Sat, 26 Sep 2026 18:20:52 +0000 Subject: [PATCH] queue: record Q14 re-verification and mark its render finish line still open --- WORK-QUEUE.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index d2663ef..a4d202c 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -405,3 +405,15 @@ to staged `index.html`. `caddy validate` passes and the pre-change file is retai numbers above. The public-repository blocker is unchanged: the raw seed still answers anonymously with HTTP 200, so no additional pending state goes into this repo. Hardening follow-up: narrow the authenticated file-server root before placing any non-page build artifacts there. + +**Re-verified 2026-09-26 ≈18:20 UTC by a later run, and one limit recorded.** Anonymous fetches of four paths on +that vhost — the page path and three files served from the same root, including the seed copy — all return **HTTP +401**; `systemctl is-active caddy` → `active`; `caddy validate --config /etc/caddy/Caddyfile` → `Valid +configuration`. What I could **not** reproduce is the authenticated 200 and the body hash above: the credential is +not stored on this host, so that part stands on the run that created the gate, not on this one. Therefore **Q14 is +not finished by its own criterion**: the mobile-width render against the live URL has not been performed, and the +credential handoff to Alexander is unverified from this host. Also carried forward: `/opt/inbox-site` holds +`seed.json`, `build_page.py` and two render PNGs beside `index.html`; they sit behind the same credential but are +not page artifacts and belong off that root the next time the page is touched. Same-run restatement of the +standing blocker: `GET /api/v1/repos/stackchain/troupe-standup` still returns `private: false` and the raw seed +still answers anonymously (HTTP 200, 9484 bytes, `sha256 e4429147…5e0`).