[liminalshruti]

DRAFT. Do not merge, and do not deploy. Stacked on PR #1 (build-a/integration). Sean reviews the diffs, and Shruti approves any merge. No hosting, DNS or accounts until Sean approves on LIM-2424.

L0, multi-workspace, built from Sean's multi-workspace tech spec rev 2: Mode L (loopback) per the §12 "In the cut" column, plus a draft of hosted mode (founder ruling "go C", LIM-2424 e6ac73ed). Each independent tester gets their own isolated workspace.

Deviation from the spec: additive in the cut

The spec says POST /api/workspaces replaces /api/scenario and /new replaces /setup. Here, both are kept: every PR #1 gate and founder ruling runs on /setup. /new and /setup share one form (components/ScenarioForm.tsx), and /setup's DOM stays byte-identical. Retiring /setup is Sean's and Shruti's call.

Commits (on PR #1 head e0d291c)

• core: lib/config.ts, workspace.ts, locks.ts, errors.ts, startup.ts; instrumentation.ts (pid guard); scripts/serve.sh. The store gets workspace-scoped state, and auth gets a custom token {actor,sid,ws,ep,exp}. The Northstar token and cookie are unchanged: a token without ws takes the old path exactly.
• routes: a capped body reader and a rate limit. session, state, reset, timer and proposals now use requireWsSession. New routes: /api/workspaces (create), /config and /[id]/login-info. emitAuthority fires only for the Northstar workspace and non-custom scenarios. (This commit's message still mentions proxy.ts and S12; those parts were absorbed by PR LIM-2424: Build A minimum slice #1's proxy.ts during the rebase.)
• UI: app/page.tsx → components/Home.tsx; /w/[slug]; a Session-ended flow; per-workspace "Restart this scenario". Includes PR LIM-2424: Build A minimum slice #1's width and landing fixes.
• tenancy: scripts/test-tenancy.mjs, run by test-all.
• HOSTED=1 hardening (draft):
  • Startup refuses: weak or missing ALIGN_HOSTS/secret/data dir/signup code, default passcodes, an AI key present, capture on.
  • The ALIGN_HOSTS allowlist replaces loopback in proxy.ts and requireJson. It's written once, in lib/config.ts hostAllowed().
  • https only. Capture and the Northstar no-session routes return 404.
  • The cookie is __Host-, Secure, HttpOnly, SameSite=Strict.
  • With HOSTED unset, the localhost behaviour is byte-identical.
• Fly deploy draft, not applied: Dockerfile, .dockerignore, fly.toml (one machine, volume /data), docs/HOSTING.md. Docker build not verified, because the daemon wasn't running. Retention (Q4) is open for Shruti.
• fixture: scripts/fixtures/clinical-screening-window.json. Fictional "Halverson Bio" (Clinical Development / Clinical Operations), for the first async tester.
• /new: create a workspace from the shared form, with a passcodes-shown-once card.

Gates (on 7d2e853)

• test-all passes every step: Northstar snapshot identical, test-flow identical, test-scenario 42/42, mcp, capture, mapper, test-tenancy 73/73. Tenancy includes the hosted phase H1–H7 and H2: an allowlisted Host gets 200, any other host gets 421.
• Northstar UI 72/72 identical.
• Gate C with the landing step: 34/34. Width: 140/140.
• /new end to end: 27/27 with open create, 28/28 with a signup code. A full instance shows the "full" message.

For Sean's review

• The lib/auth.ts changes stay within spec §5.
• ALIGN_CREATE_PER_HOUR (default 5) is new, for tests only. Don't raise it in hosted mode without Sean.
• Outside the cut: DELETE workspace, rotate and export. A8 simulates delete on disk.

Linear: LIM-2424, LIM-2437

---

Update: main merged, interview-based fixtures, record changes (Wed 10-21 evening)

• 4ac86a1: merge of main (B1, e9ef581). No force-push. 4 conflicts were resolved; Sean: please review the lib/store.ts resolution (both sections kept; resetState's consent filter is B1's, verbatim). Consent stays Northstar / machine-level only.
• 69e871e: fixtures (founder ruling, from the PG interviews):
  • clinical-screening-window.json (Halverson Bio) is a negative control: an operational change to the screening window, 4 → 5 weeks, raised by sites through site partners and approved by Global Development / a VP of Clinical Research. No protocol amendment, ethics step or safety approval. Rollout by investigator letter. One sentence is labelled "Fictional assumption". Role titles only, no person names.
  • New partner-program.json (MercuryCX): Partnerships asks Revenue Operations. Legal's and Product's limits are written into the plan as requirements that aren't settled yet. The scenario is built so the natural move is a conditional counter.
• 8d63d8a: test-all runs test-scenario against the default fixture and every scripts/fixtures/*.json.
• 1d30dc7: record changes, custom only. ⚠️ DATA FORMAT CHANGE, needs Sean's approval:
  • The decision record says: "This records what the two teams agreed. It is not approval to launch."
  • A Conditions section shows the last counter's conditions, or its rationale when there are none.
  • The countered banner trims leading punctuation and also shows the conditions.
  • New optional CounterVersion.conditions?: string (≤1000 characters, appended last, custom only). Over the cap or non-text → 400. In Northstar the field is ignored, so the counter shape stays byte-identical, which the snapshot confirms. The owner's form has a "Conditions (optional)" field.
  • Not yet exposed in the MCP decision record.

Gates on 1d30dc7:

• test-all passes every step: test-scenario 45/45 on each of the 3 fixtures, snapshot identical, test-flow identical, mcp, capture, mapper, tenancy 74/74.
• test-b1 113/113. Northstar UI 72/72. Gate C 34/34. Width 140/140.
• MercuryCX conditional run: both records show the not-launch line and the Conditions.

[allsmog]

Sean: in-depth review of PR #3 (L0 multi-workspace + hosted draft) @ 7d2e853

Read-only against e0d291c, nothing run. Four parallel reviews (tenancy core and auth, routes, hosted and deploy, UI and tests), with the main findings re-checked by me against the code. "Verified" means traced through the code path. "Suspected" depends on runtime behaviour nobody executed.

Verdict. The multi-workspace core is sound, with no cross-tenant path found. It can't deploy hosted yet, and it needs a short list of fixes before it merges even for local mode.

Checks that passed

• Isolation. A workspace token can't read or write another workspace or Northstar on any traced path. requireWsSession binds every read and write to the token's ws, and no workspace-aware route imports mutate or readState or takes a workspace from the body.
• Rev-1 review H1 to H3 are closed in the code. The CustomWsId split holds, parseCustomWs rejects northstar, and delete does a strict-child check under the lock. Creation access comes from config, not headers. Custom reads never fall back to the Northstar fixture or create directories. Create is atomic.
• Tokens. The HMAC covers {actor,sid,ws,ep,exp} and is checked in constant time. exp and ep are enforced. An ended session gets 401 Session ended and never Northstar.
• Passcodes. 80 bits, async scrypt (N=16384), timingSafeEqual, shown once, no-store, never logged. All login failures give one uniform 401.
• Create. requireJson runs first, the 64 KB cap is enforced on the stream, reserved keys are rejected, and the zod schema is strict. The cap is checked under the creation lock (two racing creates at N-1 give exactly one 201). The signup-code compare is timing-safe.
• Northstar (Mode L). State path, .secret, env passcodes, token, cookie string and error strings are unchanged, with one edge case below. The Home.tsx and ScenarioForm.tsx moves are pure extractions plus additive code. /setup's DOM is unchanged.
• XSS. No raw HTML. The only hrefs are built from server ids.
• Hosted pieces. The exact-match Host allowlist (trailing dot, empty and loopback all get 421) is shared with requireJson. Only an exact X-Forwarded-Proto: https passes. The __Host- Secure cookie is right. fly.toml has no secrets, one machine, auto-stop off, /data mounted.

Blocks any hosted deploy

1. High: Northstar is still live when HOSTED=1. Verified. / renders the Northstar app, and login() has no hosted check. With a Northstar session, /api/scenario, /api/reset, /api/state (which runs evidence ingest and the mapper refresh) and the rest all work. Test H2 asserts that Northstar sign-in returns 200. This is go-C condition 1. Fix:

   • when hosted, Northstar login and readState("northstar") return 404;
   • the proxy 404s Northstar-only routes and redirects / and /setup to /new;
   • delete northstarPublic;
   • refuse ALIGN_NORTHSTAR_PUBLIC at startup;
   • flip H2.

2. High: the AI key can ship in the image. Verified. .dockerignore's .env patterns match only the repo root. lib/mapper.ts:31 on this branch reads sparta/walkthrough-lab/projects/team-inbox/.env, and fly deploy uploads the local tree, gitignored files included. That gets around the env-only startup check. Fix:

   • an allowlist .dockerignore (*, then !app !components !lib !public ...) plus **/.env*;
   • apiKey() returns null when hosted (the B1 rebase drops the .env read as well).

3. High: the startup refusal is the only enforcement. Whether next start exits when register() throws is UNKNOWN. H1 runs under next dev, counts "no 200 in 90 s" as a refusal, and covers 3 of the 10 refusals. Fix:

   • memoize hostedProblems() in the proxy and return 503 while it is non-empty;
   • test every refusal against the real image (docker run).

4. Medium: a login burst stalls every tenant. Two reviewers verified it independently. checkLoginBackoff runs before the about 50 ms scrypt, and a failure is recorded only afterwards, so N parallel logins all pass. 16 MB scrypt jobs fill the 4-thread libuv pool that fs.promises shares, so state reads for all workspaces queue for seconds. Anyone with a /w/<id> link can do this. Fix:

   • a global semaphore on verifyPasscode (1 to 2 in flight, 429 beyond a short queue);
   • count the attempt before awaiting.

5. Medium: the backoff works as a lockout and can be reset. Verified (lib/ratelimit.ts, app/api/session/route.ts:28). It's keyed on the raw workspace string only. One wrong try about every 10 s keeps all three roles at 429, correct passcode included. 10,000 junk ids evict the real entry. Fix:

   • record failures only for an id that parses and exists;
   • key on ws plus role, and in hosted mode also Fly-Client-IP (wire up ALIGN_TRUST_PROXY);
   • delay instead of refusing.

6. Medium: creation can be exhausted.

   • A shared signup code plus a global, in-memory 5-per-hour bucket (reset by a restart), a cap of 25 and no delete path lets one code holder fill the server in about 5 hours.
   • Signup-code guesses are unlimited.
   • The bucket token is spent before the cap check.
   • ALIGN_CREATE_PER_HOUR isn't refused when hosted.

   Fix: single-use invite codes (or one per interview), a failed-code bucket, the token taken inside the lock after the cap check, and that variable refused when hosted.

7. Medium: the proxy denylist is the only gate for capture and Northstar's no-session routes. Route handlers never check hosted mode, so a future route is open by default. H6 skips /api/evidence/*, /api/mcp, /api/directives/stream, /api/directives/ack and /api/mappings/*/confirm. Fix: a hosted guard in handle() or per route, plus a refuseCustom guard on the Northstar no-session routes, and H6 for every path.

8. Medium: no delete command (condition 4). deleteWorkspace has no caller, and the manual fly ssh steps skip the lock and the event row. Fly volume snapshots (default retention a few days, suspected) mean rm doesn't purge. Fix: scripts/ws-admin.mjs list | delete <id> | delete --all, and set or state the snapshot retention to match the Nov 6 date.

9. Medium: no notice on /new (condition 3).

10. Medium: the image runs as root and ships the whole repo. That includes dev deps, sparta/**, agent/**, scripts/**, data/fixture.json and the test fixtures. Fix: output: "standalone" or npm ci --omit=dev, copy only the build output, and USER node with /data chowned. With item 1, Northstar data doesn't ship at all.

11. Medium: every gate runs on next dev. Fly ships a production build. Fix: run the hosted phase against next build && next start (ideally the image).

12. Low:

    • the pid file sits in cwd/data on the ephemeral layer, not the volume;
    • npx runs as PID 1;
    • there's no health check (a default one would get 421 or 403; send Host and X-Forwarded-Proto);
    • the first deploy needs --ha=false;
    • files should be 0600 and directories 0700 (state.json holds private constraints at 0644);
    • when hosted, log only route, status and error name, not console.error(e);
    • suspected: peers on the Fly private network can reach 0.0.0.0:8080 with forged headers, so require Fly-Client-IP.

13. Condition 6 (live smoke test) is not done, as expected. HOSTING.md also needs fixes:

    • line 25 says Northstar sign-in needs non-default passcodes, which contradicts item 1;
    • line 64 says /new is "being built by S1", but it's in this PR;
    • line 75 says the manual delete is "the same procedure the app uses", but it skips the lock and event row;
    • line 9 says the pid file protects against a second server, but it isn't on the volume;
    • lines 51 and 52 describe safeguards the code doesn't enforce;
    • line 58 leaves out volume snapshots.

Fix before merge (also affects local mode)
14. Medium: CSRF on custom write routes. Verified (lib/http.ts:107-111). bodyFor for a custom workspace parses any content type with no Origin check, and SameSite=Strict doesn't separate localhost ports. A text/plain form from another localhost port can restart a workspace or create a proposal for a signed-in browser. Fix: requireJson(req) inside bodyFor when ws !== "northstar".
15. Medium: one browser can show workspace data at /. Verified (components/useAlign.ts:56-68). The cookie is per origin, so signing in to /w/A in tab 2 makes tab 1's next poll at / render A's names, and tab 1's buttons then act on A. Fix: /api/state returns workspace and actor; on mismatch, call loadMe() and drop the state.
16. Medium: test-tenancy can wipe the live demo. Verified (scripts/test-tenancy.mjs:4, startServer). The header says it refuses a busy port, but it only refuses 3100. Run from the main checkout, it deletes ./data/state.json and data/.secret before any guard. Fix: test-all's worktree and lsof guards.
17. Medium: "Loading Align…" forever. Verified (useAlign.ts:75, :96). loadMe rethrows non-ended errors uncaught, for example a corrupt workspace state or the server being down. Fix: catch them, and show a plain error with retry.
18. Medium (suspected): passcodes can be lost. After "Open the workspace", Back may or may not show the card again (cacheComponents Activity behaviour). Rotation is outside the cut, so a tester who clicked before copying is stuck. Fix: an "I've saved these" step, and open the workspace in a new tab.
19. Low:
- Northstar byte-identity: "workspace" in b throws on a primitive JSON body (app/api/session/route.ts:25). That gives 500 where the base gave 400. Guard with b && typeof b === "object".
- Audit trim before the size check: the archive is appended before the 1 MB check (lib/store.ts:113-119), so rejected writes duplicate rows without limit.
- readAuth: it swallows every error (an EMFILE becomes a false "Session ended"), and a malformed auth.json gives 500.
- Event append: if it fails after the rename, the workspace exists, its passcodes are lost, and it counts toward the cap.
- Northstar tokens: no expiry or mode binding, so a Mode L token minted with a shared secret is valid on hosted. Refuse a shared or default secret.
- UI:
- every login-info failure reads "no longer exists";
- the 560px login form overflows on phones;
- /setup for workspace leadership fails only after the whole form is filled;
- if the /new config fetch fails, the code field disappears;
- a Northstar cookie at /w/A renders nothing helpful.
- Fixture: clinical-screening-window.json isn't labelled fictional on screen, and keeps confirm, so POST /api/workspaces returns 400 for it.

Test gaps to close

• Spec tests 9, 18 and 20 are missing.
• A2 (status unchecked), A6 (reverse direction can pass vacuously) and A7 (statuses and counts unchecked) can pass when they shouldn't.
• H1 covers 3 of 10 refusals. H6 skips routes.
• There are no UI cases for the pre-login poll, mismatch, session ended or /new.
• The 72/72 UI snapshot isn't in test-all.
• The hosted phase should run on a production build.

Spec deviations. Accepted: /setup kept alongside /new, and the ALIGN_HOSTS name. Not accepted for hosted: no per-client limiter key, the pid file off the volume, and no delete path.

Sign-off terms.

• Local-mode merge (stacked after PR #2): items 14 to 17 and 19's Northstar byte-identity fix are fixed, test-all plus tenancy are green on a production build, and I re-review those diffs.
• Hosted deploy: additionally items 1 to 11, go-C conditions 1 to 5 met, and the live smoke test (condition 6) posted. The account creation and the deploy still need my separate go.
• Timing: this is a full night of work. If it isn't in and re-reviewed by Thu 10:00 AM, use the Neo/Meet fallback for testers.

[liminalshruti]

@allsmog: this PR now includes main with B1 (e9ef581), through merge commit 4ac86a1. It was pushed normally, with no force.

Please review the lib/store.ts resolution. Both sections are kept: L0's custom-workspace storage (readCustom, writeCustom, mutateWs, replaceWorkspaceState) and B1's consent helpers. resetState's consent filter is B1's, verbatim.

Consent design: consent is Northstar / machine-level only. Every consent and session route needs a Northstar session, so a custom-workspace token gets 403 (tenancy A5). Hosted mode returns 404 for all of /api/sessions/*, and custom workspaces never hold sessions or consents (A11).

Custom workspaces also get B1-6's per-role viewFor allowlist.

Gates on 4ac86a1:

• test-all: every step passes, including tenancy 74/74 (HOSTED=1 phase 17/17)
• test-b1: 113/113
• Northstar UI: 72/72
• Gate C: 34/34

[allsmog]

Sean: merge resolution reviewed, at 1d30dc7.

4ac86a1 (main with B1 merged into L0) is correct. All six hand-resolved files keep both sides:

• lib/store.ts: the workspace store and B1's consent helpers are both there. The reset consent filter is B1's, verbatim. The only lines dropped from main's copy moved to errors.ts or into the workspace-aware readState.
• /api/state: workspace sessions get B1-6's per-role viewFor and skip ingest. Northstar still runs ingest and the registry refresh.
• Home.tsx and useAlign.ts carry B1's two sign-in changes and the AnonStateView typing.
• lib/mapper.ts keeps both guards: custom scenarios never map, and unconsented sessions never map.
• The machine-level consent design (workspace tokens get 403 on every consent and session route; hosted returns 404) matches what I approved on B1.

Effect on my review: B1 removed the nested Sparta .env read, so item 2 drops to Medium. The .dockerignore allowlist is still needed, so a stray .env can't reach the image.

New bug (1d30dc7), Low: the UI and flow.ts allow 1,000 characters of conditions, but capFields in lib/http.ts caps every workspace string at 300 except text and plan_text. So conditions over 300 characters return 400 in a workspace but work on /setup. Fix: add conditions to the 1,000 exception, and add a test for it.

Still open: every other item in my changes-requested review (hosted blockers 1 and 3 to 11; pre-merge 14 to 17 and the 19 byte-identity fix). I'll re-review as soon as fixes land.

[allsmog]

Sean: I'm taking the PR #3 review items myself, starting now. My session is fixing items 1 to 19 from my review, hosted blockers included, in a PR stacked on #4 (which is stacked on this one).

Please hold the mini off those items so the two don't collide. If it already has fixes in progress, push them now and I'll build on top. I'll post the new PR link here, with gates, when the first batch is up.

[allsmog]

Sean: the review fixes are up in #5 (stacked on #4, then on this PR). All of items 1 to 19 are covered except the clinical-screening-window fixture wording, which is Shruti's. It also adds agent connection for local workspaces. test-all is 14/14 (tenancy 115/115 on production servers), scripts/test-image.sh is 13/13 on the real image, and Northstar UI text is 72/72 identical to 850971e. Merge order: #3, then #4, then #5. Deploying still needs my separate go.

[liminalshruti]

Landed via #9: merge commit 95c43be on main (Oct 23 03:03Z), whose second parent is Sean-approved 3cd7f8a. This PR's head (1d30dc7) is an ancestor of 3cd7f8a, so all its commits are on main. It was already closed (not merged) when checked at 03:05Z; per the founder ruling on LIM-2424 it was not merged separately.