65 lines
5.6 KiB
Markdown
65 lines
5.6 KiB
Markdown
# Workspace Chat — Current Progress
|
||
|
||
Updated: 2026-10-29 (homelab go-live + acceptance).
|
||
|
||
## Status
|
||
|
||
Chat runtime is live on CT 116; operator reports **14/14 acceptance checks passed**. Operator-confirmed CT 102 `echodo` ledger: **24 entries through `0023`**, with required columns/table verified and all `chat_*` tables owned by `echodo`. An earlier copy of this document said `0022–0024`; no `0024` migration exists in this checkout, so that statement is not treated as verified.
|
||
|
||
The deployment evidence below was supplied by the operator and is present in this workspace copy. It was not independently rerun in this reconciliation session; read-only access through PVE stopped at unknown SSH host-key verification.
|
||
|
||
## Deployed
|
||
|
||
- `CHAT_TICKET_SECRET` generated on CT 116 (≥32), shared by web + collab (sha256 match). Not logged.
|
||
- `CHAT_PORT=1235`; collab dual listeners 1234 (Hocuspocus) + 1235 (Chat).
|
||
- Traefik `echodo-chat` → `192.168.68.116:1235` for `chat.echodo.stillwell.cloud` and `chat.stillwell.cloud`.
|
||
- Public WSS URL baked into web: `wss://chat.stillwell.cloud` (nested `*.echodo.stillwell.cloud` Universal SSL fails publicly).
|
||
- Compose validated; web/collab/worker rebuilt/recreated; opencode-v2 preserved.
|
||
|
||
## Runtime fixes applied during go-live
|
||
|
||
1. Ticket Origin check used `request.url` origin (`https://0.0.0.0:3000`) behind Docker — now prefers `x-forwarded-host` / `host` + `x-forwarded-proto`.
|
||
2. `channel-drizzle-adapter` `row()` spread full DB columns into strict lifecycle receipt schema — project ChannelRecord fields only.
|
||
3. `redactCreatedOutbox` `jsonb_build_object(...)` params caused `could not determine data type of parameter $1` — set plain JSON payload instead.
|
||
4. Empty `AUTH_DEV_PASSWORD` blocked credentials acceptance — set on CT 116 (not logged).
|
||
|
||
Source under `/opt/submatter` (+ opencode workspace copy) updated for (1–3). Image chunks patched in place for immediate runtime; rebuild web on next deploy to bake permanently.
|
||
|
||
## Source reconciliation (2026-10-29)
|
||
|
||
- Channel projection and plain-JSON redaction fixes were already present locally; preserved and covered with adapter regression tests.
|
||
- Local ticket handling now pins the expected origin to configured `AUTH_URL` (or `NEXTAUTH_URL`), not caller-supplied forwarded headers. Production fails closed without a valid configured URL. This is a hardened replacement for the deployed forwarded-header hot patch, not a byte-for-byte copy. Deploy and retest ticket issuance before considering this replacement live.
|
||
- Canonical browser endpoint is `wss://chat.stillwell.cloud` (socket path `/chat`). The Traefik example retains both hostname routes.
|
||
- Next deploy must rebuild web from reconciled source; image hot patches are not durable. Re-run ticket issuance, cross-origin rejection and the acceptance suite afterward. No production changes, rebuild, commit or push were performed during this reconciliation.
|
||
- **Security follow-up:** `AUTH_DEV_PASSWORD` is a shared credentials password for existing user emails, not a per-user password. Remove it after acceptance unless the operator explicitly intends this login mechanism; verify SSO access first and recreate web when removing the environment value. Awaiting operator decision; not changed remotely.
|
||
- Remaining release gates: full local checks, disposable-Postgres coverage, final review and convoy lifecycle reconciliation. The reported live suite does not prove multi-instance fan-out or Redis outage behavior.
|
||
|
||
## Main deployment preparation
|
||
|
||
The operator approved sending the reconciled branch to `main` for real-build testing. The branch includes the earlier foundation commit and its AI-shell/backlog changes. The main push triggers `.forgejo/workflows/deploy-homelab.yml` when the runner and deployment secrets are configured; a push alone does not prove deployment success. The deploy script no longer removes orphan containers, preserving separately managed services such as `opencode-v2`. Six static deployment checks cover the configuration and this safety guard.
|
||
|
||
## Local validation after reconciliation
|
||
|
||
- `pnpm lint`: passed with existing warnings.
|
||
- `pnpm type-check --concurrency=1`: passed.
|
||
- `pnpm test`: ticket-origin regressions (11), channel adapter tests (10) and outbox adapter test (1) passed. Full suite remains blocked by the worker remote-AG-UI pending-response polling test timing out after 5000 ms. PostgreSQL-gated tests remain skipped without a disposable test database.
|
||
- `pnpm build --concurrency=1`: passed with a longer command allowance after the first attempt timed out during build tracing. This is a local build, not a Docker image rebuild or deployment.
|
||
- `git diff --check`: passed.
|
||
- Security review of this slice: ticket origin is pinned to server configuration; forwarded-header spoofing, missing/malformed origins and workspace denial are covered. Redaction remains workspace/channel/message/create-event scoped. Production shared-password sign-in remains an operational security concern until explicitly resolved. No secrets were read or printed.
|
||
|
||
## Acceptance evidence (2026-10-29)
|
||
|
||
Two signed-in members (`me@randallstillwell.com` + `chat-acceptance-b@stillwell.local`) against workspace `randall-stillwell`:
|
||
|
||
| Gate | Result |
|
||
|------|--------|
|
||
| Secret shared web/collab | Pass |
|
||
| Compose validate + ports | Pass |
|
||
| Public WSS reject without ticket | Pass (connection fails) |
|
||
| Dual WS subscribe via `wss://chat.stillwell.cloud/chat` | Pass |
|
||
| Send + Redis invalidate hint | Pass |
|
||
| Reply | Pass |
|
||
| Reconnect catch-up | Pass |
|
||
| Unread mark + summary | Pass |
|
||
| Edit / delete + mutation catch-up | Pass (after redact fix) |
|
||
| Membership revocation (hint + history denied) | Pass |
|