From c76658159e2f804d4ee5aca27e655157628d33a4 Mon Sep 17 00:00:00 2001 From: timmy Date: Sat, 26 Sep 2026 18:15:20 +0000 Subject: [PATCH] queue: record live inbox gate and remaining visibility blocker --- WORK-QUEUE.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index 31fb70b..d2663ef 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -395,3 +395,13 @@ with Alexander; until it is made, nothing here publishes or duplicates pending m render with all seed items present. **Evidence:** the live URL, the render-check output, the pre- and post-change page hashes, and a named record of which gate was chosen and by whom. Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle. + +**Update 2026-09-26 — gate live, visibility blocker remains.** Alexander chose option A. The production vhost now +serves `https://alexanderwhitestone.com/inbox/` from `/opt/inbox-site` behind `basic_auth`, with `Cache-Control: +no-store`; anonymous fetch returns HTTP 401 and authenticated fetch returns HTTP 200. The authenticated body is +20,051 bytes and SHA-256 `b81e9fe7da42df6ad339ac19a4fc8a8052b9663c2129cc207077538dfe6b3639`, byte-identical +to staged `index.html`. `caddy validate` passes and the pre-change file is retained as +`/etc/caddy/Caddyfile.bak-inbox-20260926`. This closes the missing-gate blocker and supersedes the stale Caddy line +numbers above. The public-repository blocker is unchanged: the raw seed still answers anonymously with HTTP 200, +so no additional pending state goes into this repo. Hardening follow-up: narrow the authenticated file-server root +before placing any non-page build artifacts there.