amadan
Record staged deploy notifications, copy waiver and sign-in fix
1 file changed,
+8
−0
implementation/overnight-2026-09-07.md+8 −0
No CI script — run details
CI log
amadan: no CI script — add an executable .amadan/ci or a `ci` target to the Makefile
diff --git a/implementation/overnight-2026-09-07.md b/implementation/overnight-2026-09-07.md| index e0e6333..ab0e903 100644 |
| --- a/implementation/overnight-2026-09-07.md |
| +++ b/implementation/overnight-2026-09-07.md |
| @@ -676,3 +676,11 @@ Full review is retained there and posted to suite discussion 5. |
| - Calendar observer66ca525 is implemented, independently root-reviewed and ARM64-built. Receipt /tmp/oficina-calendar-observer-release/build-receipt.json; no live probe or database writer. Observer and revised Docse6 destination design are now in a separate running Fable follow-up queue under oficina-fable-followup-20260908-0655.service. |
| - Additional root Sheets dependency proof: a72003-byte synthetic XLSX spills68157934 bytes of plaintext worksheet XML including an actual cell value under the app's exact Excelizev2.11.0 limits. Close removes the file. This contradicts draftB's no-plaintext-staging promise; requires explicit no-spill/resource contract and regression. Probe /tmp/oficina-sheets-design-audit, recorded in Sheets23. No production input or live call. |
| - Home9 records root ownership of the markup correction and current quota state. Existing owner branches remain preserved. Pending copy, authenticated canary, restore and platform gates remain unchanged. |
| + |
| +## User steering and live sign-in report, 8 September morning |
| + |
| +- User explicitly waived copy review for this entire round, including pending strings. Do not keep the six old copy servers as release gates or ask again. Other actual review, CI, custody and deployment requirements remain. |
| +- Add open-source attribution across the suite, with Help → Open-source acknowledgements or About on apps without Help. Build a reusable Estilo presentation from the first real app adoption; inventory exact shipped dependencies, fonts and assets, project URLs, copyright and license/notice texts. Include required notices in distributed artifacts as well as the UI. Do not treat a generated dependency name list as complete attribution. |
| +- User requests continuously deployed stages and a notification after EVERY verified deployment, including what changed, exact URL, what to inspect, and whether preview or production. Do not announce a queued promotion as live. |
| +- User Safari screenshot exposed form-action self blocking Home's POST redemption → credential root → configured directory redirect. Screenshot token is not copied or used. Root paused the UI-only deployment and implemented fix/signin-form-redirect9b77ec85ad23c87fa234bd7130b616179d96cd37 atop markup eb6e739. |
| +- The fix adds only the validated configured directory origin via framework Options.CSP. Exact framework baseline comparison and full route sweep retain other restrictions; binary wiring guard permits only the reviewed setter. Chromium and WebKit synthetic TLS tests both reproduce old refusal, corrected success and unrelated permission refusal. Full local gate/race and actual CI passed. Fable design/code review running; ARM64 release artifact built at /tmp/oficina-home-form-redirect-release. No deployment yet. |