oficina / meet Public

Two more notes for spec revision 9, from the slice 2 reviews. (1) The hub's session key is a keyed hash of the session cookie, hex(sha256(per-boot salt | cookie value)), not subject plus creation instant as first recorded here: rastrillo stores created_at at second granularity, so two sign-ins of one person inside a second would have shared a participation, and the cookie carries the session token itself, so the hub must never hold it raw. Two tabs of one browser still share the key (the takeover case); two browsers of one person do not. (2) The attaching GET /m/{sqid}/stream requires an Accept header containing text/event-stream and answers 404 otherwise, so a cross-site top-level navigation (GET is CSRF-exempt, the cookie is SameSite=Lax) cannot occupy the session's peer slot; the ?probe=1 forms attach nothing and are exempt. Also from review: the 410 resume answer is scoped to the tombstone's own room and session, so a past room-mate cannot learn why a peer left.

Slice 2 checkpoint at c4e55d9: Tasks 1 to 7 reviewed clean; room.js (Task 8) in its fix round; the Playwright gate (Task 9) is in and green, nine scenarios in a real Chromium: devices, two-member call with frames both ways, stream renewal across five TTLs, guest knock and admit through the emailed link, removal through the confirm page, app restart with unattended re-pair, takeover from a second tab, cross-site GET ending nothing (the 406 seen in a browser), and both pages scriptless. Note for whoever runs it: UDP is blocked inside the Claude Code bash sandbox, so make browser must run with the sandbox off or it reports zero frames falsely. Remaining: Task 10 gates, Task 11 copy catalogue, whole-branch review, Codex review, canary, CI, merge, deploy.

Revision 9 note from the Task 10 review: the §2.5 room-page row must read standing (member or guest) or a live participation for this session in this room whose kind is not member: a member who has lost standing is refused the page by the next request and ended by the next tick (§2.4), while an admitted guest whose grant lapsed continues (ruling 14). The code does this; the table as written would let a re-implementer reopen the hole.

Slice 2 at 3eec748: whole-branch review (merge after W-1 and W-2, both fixed), Codex round 1 (nine findings, all fixed: member standing re-derived on relay, reset, resume and the probe per §2.5's paragraph, now §15.12; a lapsed participation no longer blocks a fresh stream; a non-blocking terminate; the client probes its own participation on a signal 404, retries resets, enforces the thirty-second send deadline, and implements isSettingRemoteAnswerPending). Browser gate 22 scenarios in about four minutes. CI passed. Canary live at https://slice2-meet.bds.oncarlos.com bound to the slice2 bundle. Codex round 2 is running; merge and deploy follow it. Platform note: carlos canary builds the host as name.app.domain, which the platform rejects as two labels; the canary was made with instances create plus deploy --channel.

Slice 2 closed: merged at 2215f26 and deployed. Full record in docs/superpowers/reviews/2026-09-10-slice-2-record.md; Codex rounds 1 to 5 and the whole-branch findings are summarised there with dispositions and the carried items for slices 3 and 4.