From f582acd9f17edf14a1b533f8bdd2129eddc1b36a Mon Sep 17 00:00:00 2001 From: Timmy Date: Sat, 26 Sep 2026 17:44:22 +0000 Subject: [PATCH] queue: enter Q14 (gate the Inbox page on the main site) with the build verified and the two blockers named - no private area on alexanderwhitestone.com, and the repo answering anonymously before any pending state enters it --- WORK-QUEUE.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index 851cb1c..31fb70b 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -364,3 +364,34 @@ Undecided clauses are listed as undecided and are not silently dropped. an authority/escalation caveat. **Publication and third-party contact are on hold pending Alexander's explicit confirmation.** The other 7 are undecided and named in Q8 above. Archive-side work — not Zeph's unless he wants it. Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle. + +--- + +## Q14 — Put the Inbox on `alexanderwhitestone.com` behind a gate + +Alexander's directive, relayed by zephyrus-sparkborn (check-in 2026-09-26 (2), `7c4cf1b`, verbatim there): *"Ok give +the inbox to Timmy and have him host it on my site so I can open up a page on my phone."* Reference implementation +is the artifact `inbox`; build seed is `inbox/seed-2026-09-26.json` (`c05e6a0666d8`). + +**State of the build:** done and render-verified, unpublished. `/opt/inbox-site/index.html` (built by +`build_page.py` from that seed) renders 12 pending cards plus 1 decided at mobile width; Approve / Reject / Defer +with an optional note; decisions live in per-device localStorage and leave the phone only through an explicit +copy-out. Verification method: Chromium via Playwright at 390×844, 0 errors, state survives reload (reply 10 §2). + +**Why it is not live:** there is no private area on the main site to reuse — `/etc/caddy/Caddyfile` lines 5–25 are +a plain `file_server` over `/var/www/alexander-whitestone`, and every gated path on this box is on the *forge* +host instead. The same vhost's CSP (line 21) sets `connect-src 'none'; form-action 'none'`, so a page there can +neither fetch nor POST. Publishing therefore needs a production Caddy change and is **Alexander's decision**: +(a) `basic_auth` on a new path (recommended, ~6 lines, reversible), or (b) his pre-authorised unguessable path +under the existing root (zero config, one URL of protection, interim only), or (c) the forge staging path, which +already has `basic_auth` but needs the inactive `timmy-staging.service` back up and is not "his site". + +**Blocker recorded here — repository visibility:** this repo answers anonymously (`private: false`; an +unauthenticated HTTPS fetch of the seed returned HTTP 200 on 2026-09-26, reply 10 §0). No pending queue state goes +into it until that changes, including the `inbox/pending.json` the handoff proposes in §5. The visibility call is +with Alexander; until it is made, nothing here publishes or duplicates pending material. + +**Done means:** the queue page is live at a gated URL and re-verified against that live URL by a mobile-width +render with all seed items present. **Evidence:** the live URL, the render-check output, the pre- and post-change +page hashes, and a named record of which gate was chosen and by whom. +Entered by Timmy 2026-09-26, satisfying the Q7 obligation for this cycle.