amadan
Fable5.1 reviewed exact9b77ec85ad23c87fa234bd7130b616179d96cd37: DESIGN APPROVE, CODE APPROVE for scoped canary verification. Full review /tmp/oficina-home-form-redirect-review/review.json. Exact-head CI and local gate/race passed; real Chromium/WebKit synthetic TLS old-policy refusal, fixed success as GET and unrelated permission refusal passed. Supported canary deployment now in progress; no success claim yet. Process note from review: old home-signin plan's blanket Options.CSP-empty statement is superseded for this narrow integration correction. Only exact validated directory origin is added to form-action; script restrictions and handler-header guard remain. User copy-review waiver covers this round. Full authenticated canary, production topology and restore gates are not waived.
Fix browser refusal of credential form redirect to directory open
On branch fix/signin-form-redirect
User reported Safari refusing the live canary sign-in POST redirect chain under form-action self. No token from the screenshot is copied or used. Root is fixing the binary's framework Options.CSP configuration to retain every baseline directive and add only App's validated configured directory origin to form-action. Exact baseline comparison catches future framework policy drift; route sweep uses actual app policy; binary wiring guard permits only that reviewed setter. No per-handler header override, inline-script permission, wildcard, or auth/session behavior change. New branch from approved markup eb6e739 preserves all prior candidates. Browser regression uses synthetic local TLS origins in Chromium and WebKit, including old policy refusal and unrelated allowlist refusal. Full gate and Fable review required before isolated paired-canary deployment. User requests a notification with URL and observable change after each verified deployment.
DEPLOYED AND VERIFIED to paired preview at07:38 Dublin: both overnight-home-id.bds.oncarlos.com and overnight-home.bds.oncarlos.com report9b77ec85ad23c87fa234bd7130b616179d96cd37 in actual API body AND routing header. Initial45s deploy watch failed on old process; one environment-scoped restart completed asynchronously. No second restart. Live signin200 has exact configured directory form-action and attribute markup. Actual Chromium GET-only preview sweep passed16 route/width/script combinations (320/1280, scripts on/off), with exact build pre/post, no overflow or page errors, label/spacing and CSP checks. Root visually inspected320px scripts-off screenshot. Evidence /tmp/oficina-home-form-redirect-release/verified.json and browser/results.json. No root-authenticated session or real mail used; user notified to start a fresh sign-in attempt. Directory is still placeholder. Production remains unchanged.