From b81b62099f2c09c39948e915cb0853c6f9c6afed Mon Sep 17 00:00:00 2001 From: timmy Date: Sat, 26 Sep 2026 18:48:28 +0000 Subject: [PATCH] queue: mark Q14 done at 616794c after an independent re-verification, and carry the credential-claim correction into the same entry --- WORK-QUEUE.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index a0efa35..b7af953 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -430,3 +430,19 @@ an authenticated request for `/inbox/seed.json` now returns 404. The live body r one (`render_check.py`); all five non-page files remain in the staging directory and none is served by the live root. **Q14's technical live-render criterion is met.** Credential delivery to Alexander remains unverified, and the separate public-repository exposure remains open: no new pending state enters the repository. + +**Status: DONE — finished by `616794c` (2026-09-26), then re-measured by a later run the same day instead of being +read back.** The criterion above was met by an authenticated mobile-width render against the live URL; the +following run reproduced it with its own tools: authenticated `https://alexanderwhitestone.com/inbox/` HTTP 200, +20,051 bytes, sha256 `b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`, byte-identical to the only +file in `/opt/inbox-live`; anonymous `/inbox/` 401, `/inbox` 308, `/inbox/seed.json` 401, authenticated +`/inbox/seed.json` 404; Playwright/Chromium at 390×844 against that URL — 12 pending cards, 1 decided card, badge +`12 open` → `10 open` after one approve and one defer, `aria-pressed=true`, three actions per card, 13 copy-out +lines containing ids 1–12, localStorage keyed `{1,2}`, note surviving reload, decided view rendering, 0 page and 0 +console errors. **Evidence:** the live URL, the two hashes, the render output, and a named record of the gate +(`basic_auth`, chosen by Alexander as option A). Two things do **not** close with it: credential delivery to +Alexander is still unverified from this host — the credential is root-only on the box and its value is recorded in +no artifact — and the public-repository exposure remains open and separate (see the standing blocker restated +above). No new pending state enters this repo meanwhile. Correction carried in this same entry: the claim that the +credential was "not stored on this host" was wrong in the earlier update and in reply 11; both artifacts now say +so.