oficina / meet Public

Codex code review of slice 1, three rounds, record in docs/superpowers/reviews/2026-09-09-codex-code-r1.md on fix/codex-code-r1:

• Round 1 (against cae60ed): 8 findings, 3 P1. C1-5 (own flag parser refusing the platform's -socket/-db) was the deploy blocker, fixed on main before the first release. C1-6 (CARLOS_SMTP_* fallback) likewise. C1-1 (plaintext persons.email and session subject) deferred as the suite-wide shape, filed on suite #5 for Paul.
• Fix wave 5fdddcf: mail errors redacted before rastrillo logs them, gorm logging parameterised, grant minted in the same transaction that re-checks the link, /continue re-selects its pending row in-transaction, expired records swept at boot and hourly, eleven tests added or corrected.
• Internal Opus review found the redaction's case-folding slice could leak an address fragment on runes whose lowercase changes byte length; Codex round 2 found the same, plus that hibernation needs a platform wake for cleanup. Fixed in 9e067e4: no message text is logged at all, the wrapper is applied in resolve, Options.NextDue schedules the wake, the sweeper has a lifecycle and a 1000-row bound.
• Re-review and Codex round 3 both found the wake calculation ignored rastrillo's auth_links (a plain member sign-in with no meeting link would never be swept while hibernating); fixed in c5981ca, and sessions added in 19ccf42 with a retry deadline on error and three test-fixture corrections.

Declined and recorded as uncovered: transaction-interleaving and concurrent-budget tests (the invariants rest on the single-connection writer pool and are asserted sequentially). auth.Sweep is context-free inside rastrillo; noted for a rastrillo issue.

19ccf42 is in CI; it deploys to https://meet.oficina.works when green.

Deployed: meet 19ccf42 to https://meet.oficina.works (production; also https://meet.bds.oncarlos.com). Verified by the build probe (/api/version = 19ccf42 on both hosts); the probe is now set, so deploys verify the process rather than the edge header.

What changed: the Codex code-review fix waves. Mail delivery errors reach no log with an address in them; database logging is parameterised; a grant is minted only in the transaction that re-checks its link; /continue re-selects its pending row inside its transaction; expired pending rows, unclicked magic links and stale sessions are swept at boot, hourly, and by a platform wake scheduled from the earliest expiry; fifteen tests added or corrected. No page or copy changed.

What to inspect:

• Sign in and use the app as before; nothing visible should differ.
• Ask for a magic link and do not click it; after about fifteen minutes the row is gone (operators can confirm with the sweep counts in the app log).
• The deploy log shows instance woke ... (version 19ccf42).

Rollback: carlos deploy --app meet --account oficina --version fd626d6 releases/meet-linux-arm64 (the previous release is still shipped on the platform).

Deployed 39f7de7 to meet.oficina.works, promoted 23:42 UTC, instance awake and answering at 00:03 UTC after a ten-minute wake-lease stall on the platform (wake failed: instance lease held by another box; retried until it cleared). Changes: the site is now styled (theme.css vendored from rastrillo's day theme, topbar shell layout with the Meet brand), and the welcome page always carries a Start a call button that creates a meeting titled Call, <day month time> and lands on the link page. CI passed; main fast-forwarded 19ccf42..39f7de7.

Deployed 2215f26 to meet.oficina.works (edge), live at 07:5x UTC 2026-09-10: slice 2, the holding screen and the room with direct WebRTC. What is new: the holding screen enumerates devices, previews the camera and remembers choices in the browser; the room is a peer-to-peer mesh of up to four with perfect negotiation, an SSE stream with resume and replay, a server-side hub with participations, a waiting queue for guests (knock, admit), removal and takeover through their own confirm pages, and a scriptless floor on both pages. No schema change. Gates: make ci, go test -race, a Playwright gate of 23 scenarios in a real Chromium (about five minutes; run with the Claude Code sandbox off), a whole-branch review, and five Codex rounds ending in accept. Spec is revision 9 (§15 records every departure). Record: docs/superpowers/reviews/2026-09-10-slice-2-record.md. Deploy note for the future: the hub is in-process, so every deploy drops every live call; deploy outside meeting hours. The canary at slice2-meet.bds.oncarlos.com stays up on its seven-day lease for trying the room without touching the main host.

Deployed 3420396 to meet.oficina.works (edge), live 2026-09-10 15:39 UTC: slice 3, the platform relay. Meet now reads CARLOS_RELAY at boot (a malformed value refuses to start outside development), mints a TURN credential per call at GET /m/{sqid}/ice for an admitted participation (three-hour expiry, renewal advised at two and a half), and the room renews each connection before the deadline with an ICE restart proven by a new username fragment on the selected candidate pair; a failed fetch shows a warning, an expired or stuck connection says so on its tile with a Retry. The relay is enabled on the app (carlos relay enable, eu-west-1, incarnation c35c3231d5e9a9aa); the instance restarted onto the new config and logged relay configured regions=1. The holding page's no-relay sentence is gone. No schema change. Gates: make ci, go test -race, the browser gate at 27 scenarios (about seven minutes, sandbox off), a whole-branch review and four Codex rounds ending in accept. Spec revision 9 §15.13 and §15.14; record docs/superpowers/reviews/2026-09-10-slice-3-record.md. Deploy note: enabling or rotating the relay re-renders the config and restarts the instance, dropping live calls, like any deploy.

Deployed 1c66309 to meet.oficina.works (edge), live 2026-09-11: slice 4, chat and screen share. Chat: a panel in the room (estilo's first chat: one partial and one script another app can adopt), messages up to 2 KB fanned out by the hub to every other admitted participant with the sender's name, never stored, never replayed, never seen by a waiting guest. Screen share: one Share button; the screen travels as its own sendonly track on every connection and arrives as a second tile captioned with the sharer's name; stopping ends the receiver's track and removes the tile while the camera continues. Under the hood: the polite side of a negotiation now yields briefly before offering (a Chromium rollback was leaving both cameras dead after a simultaneous share), and the room watches its own media and repairs a camera that stopped encoding or a tile that stopped painting. No schema change. Gates: make ci, go test -race, 232 node tests, the browser gate at 31 scenarios (about nine minutes, sandbox off), a whole-branch review and four Codex rounds ending in accept. Spec revision 9 §15.15 and §15.16; record docs/superpowers/reviews/2026-09-10-slice-4-record.md, with the Chromium reproduction preserved in its §8 for an upstream report. Every deploy still drops live calls.

Slice 5 (the drive surface) is live at https://meet.oficina.works, main a283c53 (fast-forward of slice/5-drive). Ships: the agents table (migration 0002agents, applied at boot: log 'migrate applied=[meet/0002agents]'); Settings mints a token (mt_ + 32 random bytes, stored SHA-256, shown once, no-store) and revokes through a confirm page, 20 live agents per operator; GET/POST /api/v1/meetings, POST …/{sqid}/links, POST …/{sqid}/end, GET …/{sqid} behind a bearer, reach re-derived on every request from the operator's current member standing (removal or revocation bites on the next request), 60/min per agent, 401 only for a missing or malformed header and the same 404 for unknown, revoked and reach-less tokens; the robot badge and the principal name~email on agent-made meetings on the list. The API mounts outside csrf.Protect because rastrillo's SameOrigin refuses a request with no Origin/Sec-Fetch-Site/Referer; safe because it honours no cookie. Reviews: per-task Opus reviews, whole-branch review (merge with named fixes, applied), four Codex rounds (5, 2, 2, 0 findings; two P2 fixed: the EOF rule and body cap on every write, the 409 decided inside the write transaction). Gates on the shipping head: make ci, make race, make browser 31/31, remote CI. Record: docs/superpowers/reviews/2026-09-11-slice-5-record.md; spec §15.17. Every deploy drops live calls (hub in-process). Carried: unauthenticated flood control on /api/v1 is an edge concern (no client-address limiter in the app: behind the platform socket every request shares one address). Next: slice 6, deploy docs.

Slice 6 (deploy docs) is merged: main fast-forwarded to e4f5d9e from slice/6-deploy (docs only, off 9225ec2). Not deployed: the change is documentation, edge is being promoted by hand (651cff2 as observed on 2026-09-14) and a redeploy would drop live calls for nothing; when main is next promoted, README's Deploying section is the recipe. Ships: README.md (the scriptless-floor sentence in the first paragraph, the relay paragraph second, sign-in, the room, agents, native apps, gates, deploying with every required setting and the canary recipe citing platform #124); PRODUCT.md (impeccable product schema, 'What is deliberately not here' with the scriptless exception); AGENTS.md's Deploying section and its scriptless exception widened to match §9 (browser media participation, and in the room the chat panel and live admission controls); the Consumed suite rulings commit fa875c7 (spec §0.2 against doctrine 1ac4323 revision 8, rulings named never restated, the 4/12 row consuming Home assertions through §7.1.1, ruling 16 as amended by the 2026-09-12 sharing update and disclosed as off doctrine main); spec §8.4 amended for the shipped native milestone, §11 no longer lists a native client, §9 counts five confirm pages and names chat and admission as script-gated, §15.11 states no drain exists, §2.1 lists token_sealed; §15.18 records the dispositions: the acknowledgements page is discussion 10's branch feat-open-source-credits and was not duplicated; the Estilo theme has no tagged release and is already adopted on main at a pseudo-version; no deploy from this slice. Reviews: whole-branch (Opus, merge with named fixes W6-1..15, applied) and three Codex rounds (13, 4, 0 findings). Record: docs/superpowers/reviews/2026-09-14-slice-6-record.md. That closes the programme docs/superpowers/plans/2026-09-09-meet-slices-2-6-programme.md: slices 2 to 6 delivered.