[allsmog]

Stacked on #4, which is stacked on #3. These are the fixes from Sean's PR #3 review (request-changes, 23:44Z), made in Sean's session at his request, plus the agent connection for local workspaces he asked for. The mini was asked to hold off the same items.

1. Local-merge items (9b56a56)

• 14, CSRF: every custom write needs JSON from this Host and Origin. A text/plain form from another localhost port gets 415.
• 15, cross-tab: a custom /api/state names its workspace (Northstar's view is unchanged). A tab drops any state that isn't its own workspace and role, so it never renders another workspace's data.
• 16: test-tenancy refuses the main checkout and a busy port before it deletes ./data/state.json.
• 17: a failed /api/session shows "Couldn't reach Align" with Try again, not "Loading Align..." forever.
• 18: the passcode card needs "I've saved all three passcodes" before the open link, which opens a new tab.
• 19, Lows:
  • a primitive JSON sign-in body is 400 again;
  • the size check runs before the audit archive append;
  • readAuth gives 500 for EMFILE or a malformed file, never "Session ended";
  • a failed event append no longer loses the passcodes;
  • workspace login says "gone" vs "couldn't reach, try again", fits a phone, and notes a demo session;
  • /setup refuses a workspace session up front;
  • /new keeps the code field when its config fetch fails.

2. Hosted items (a16c3aa)

• 1, Northstar is off when hosted:
  • / and /setup redirect to /new;
  • Northstar sign-in is 404 and Northstar tokens are ignored;
  • the Northstar store refuses every read and write;
  • ALIGN_NORTHSTAR_PUBLIC is refused at startup.
• 2: .dockerignore is an allowlist of the app's own source, and no AI key is used when hosted.
• 3, a refused start exits. On the image, next start logged the register() error and kept serving 500s, so instrumentation.ts now exits 1. proxy.ts answers 503 if a refused process is ever kept up.
• 4: passcode hashing runs at most 2 at a time, with 8 waiting (429 beyond), so a burst can't stall other workspaces.
• 5: backoff is per workspace, role and client (Fly-Client-IP), counted before the hash, and only for workspaces that exist.
• 6, creation:
  • single-use invite codes (ALIGN_SIGNUP_CODES), spent under the creation lock after the cap check and stored as hashes;
  • wrong codes limited per client;
  • the shared code and ALIGN_CREATE_PER_HOUR are refused when hosted.
• 7: proxy.ts is an allowlist of tester routes, so every other path is 404 when hosted. H6 checks every route in app/.
• 8: scripts/ws-admin.mjs lists and deletes (one, or all with --yes) the way the app does, and is safe while serving. Volume snapshots are documented.
• 9: /new shows the notice: a test server, nothing confidential, the deletion date (ALIGN_DELETE_BY). The passcode card repeats the date. Shruti owns the wording.
• 10: a two-stage image with production dependencies and the build output only. The server is PID 1, running as node.
• 11: test-tenancy builds once and runs every phase on next start.
• 12:
  • pid file on the volume, 0600;
  • files 0600 and folders 0700;
  • a Fly health check with the edge headers;
  • Fly-Client-IP required;
  • hosted logs carry only error names;
  • --ha=false documented.
• 13: docs/HOSTING.md rewritten to match, including the go-C smoke test.

3. Agent connection for local workspaces (0af316d, 2331da3)

• Tokens. A workspace's leadership mints an agent token per repo (POST /api/workspaces/agent-token). Minting is that repo's capture consent and leaves an audit row. The token is HMAC-signed, tied to the passcode epoch (a bump revokes it), and can't be read as a session.
• What it opens. With the token, capture, MCP and wake-ups (poll, ack, stream) read and write that workspace only. Workspace approvals are tagged, and never reach the default store's wire view.
• The launcher. scripts/agent-session.sh has a workspace mode: ALIGN_WORKSPACE plus its leadership passcode.
• Hosted. None of this exists when hosted.

Gates

• scripts/test-all.sh: 15 of 15. Tenancy is 122/122 on production servers. It adds:
  • all 19 startup refusals;
  • the allowlist against every route;
  • Northstar off, including a forged token;
  • invites and per-client limits;
  • the sign-in burst, the notice and the delete tool;
  • W1 to W6 for workspace agents;
  • R12 to R19, with a two-tab browser check;
  • spec tests 9, 18 and 20, stricter A2, A6 and A7, and browser cases U1 (no pre-login poll) and U2 (session ended) (d1d0fc7).
• scripts/test-image.sh: 13 of 13 on the real image. It needs Docker, so it isn't in test-all. It checks:
  • nothing beyond the app in the image;
  • a misconfigured container exits 1;
  • wrong Host 421, http 403, no edge header 403;
  • / redirects, and Northstar and agent routes are 404;
  • PID 1 is the server as uid 1000;
  • the pid file is 0600.
• Northstar UI text: 72 of 72 files identical to 850971e, now a test-all step (ui-northstar, on a production build).

Live runs (Claude Sonnet in tmux, in physical-ai, planning-only by the launcher's deny list and prompt)

• CPSec as a real workspace (11:04 PM):
  • the agent read "not agreed" through its agent token;
  • the agreement went through with the workspace's own passcodes, with five conditions (278 characters);
  • Align woke it at 11:05:13 PM, and it replanned inside all five.
• Align's record: delivered at 06:05:13Z and acted on at 06:05:16Z, in the workspace's own state. No Northstar state was written, and no repo file changed.

Still open

• The clinical-screening-window fixture ("label it fictional; it keeps confirm") comes from Shruti's interview, so its wording is hers.
• Before the first tester: the live smoke test on Fly and the snapshot retention setting. Both need Sean's deploy go.

[liminalshruti]

Landed via #9: merge commit 95c43be on main (Oct 23 03:03Z), whose second parent is Sean-approved 3cd7f8a. This PR's head is an ancestor of 3cd7f8a, so all its commits are on main. Closed rather than merged separately, per the founder ruling on LIM-2424.