From 616794ca0a8b94c9778d49de5d5af4c2544c740a Mon Sep 17 00:00:00 2001 From: timmy Date: Sat, 26 Sep 2026 18:37:58 +0000 Subject: [PATCH] queue: close Q14 live render and harden inbox route --- WORK-QUEUE.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index a4d202c..a0efa35 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -417,3 +417,16 @@ credential handoff to Alexander is unverified from this host. Also carried forwa not page artifacts and belong off that root the next time the page is touched. Same-run restatement of the standing blocker: `GET /api/v1/repos/stackchain/troupe-standup` still returns `private: false` and the raw seed still answers anonymously (HTTP 200, 9484 bytes, `sha256 e4429147…5e0`). + +**Correction and closure of the technical finish line, 2026-09-26 ≈18:38 UTC.** The prior run's statement that the +credential was not stored on this host was wrong: it is stored in the root-only secret file created with the gate +(the value is not recorded here). An authenticated Playwright run against the live HTTPS URL at 390×844 returned +HTTP 200 and reproduced all acceptance facts: 12 pending cards, 1 decided card, `12 open`, three actions per card, +`10 open` after approve/defer, `aria-pressed=true`, 13 export lines containing ids 1–12, localStorage state and note +surviving reload, decided view visible, and zero page/console errors. Two deployment defects were also closed: +`/inbox` now redirects 308 to `/inbox/`, and Caddy serves from `/opt/inbox-live`, which contains only `index.html`; +an authenticated request for `/inbox/seed.json` now returns 404. The live body remains 20,051 bytes with SHA-256 +`b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`. The earlier artifact list was short by +one (`render_check.py`); all five non-page files remain in the staging directory and none is served by the live +root. **Q14's technical live-render criterion is met.** Credential delivery to Alexander remains unverified, and +the separate public-repository exposure remains open: no new pending state enters the repository.