T104, the console token travels in the opened URL, not /capabilities (plan 034) - #84

Merged

brettheap merged 138 commits into

mainfrom

build/034-p3t-t104-token-in-url

Oct 5, 2026

Commits on Sep 28, 2026

T071: 13.2 and 13.3 — load_settings refuses a non-PostgreSQL DSN and a collapsed DSN pair (plan 034)

brettheap
and
claude
committed
e406a00
Fix round: _refuse_non_postgresql_dsn never raises a bare ValueError (Copilot review of this PR)

brettheap
and
claude
committed
91f7973
Rework #60 to Brett's ruling: OPENDOX_MIGRATION_DATABASE_URL required only for migrate

brettheap
and
claude
committed
b5296f9
Fix round: load_migration_settings gets the same dialect gate load_settings has

brettheap
and
claude
committed
f097fd8

Commits on Sep 30, 2026

T070: 13.4, 13.5 and 13.6 — OPENDOX_INSTALL_MODE and generate-and-open --local (plan 034)

brettheap
and
claude
committed
b50e3b1
T072: 13.1 — the bundled PostgreSQL server, the local install's own child (plan 034)

brettheap
and
claude
committed
2c96dfb
T072: extend the dependency lock for the `local` extra and the test extra's setuptools

brettheap
and
claude
committed
c3a70a2
Fix round: the install-mode fixture's repository ignores the user's git config (Copilot review)

brettheap
and
claude
committed
32683e8
Merge T070's fix round (32683e8) into T072

brettheap
and
claude
committed
95fe16f
Fix round: runtime migrate and reset refuse what a local install cannot be (Copilot review)

brettheap
and
claude
committed
525f61c
Merge T070's second fix round (525f61c) into T072

brettheap
and
claude
committed
32db5d8
Fix round: status reports a local install's broker on its early return too (Copilot review)

brettheap
and
claude
committed
02dadc5
Merge T070's third fix round (02dadc5) into T072

brettheap
and
claude
committed
ac61596
Fix round: a healthy local status is proven to exit 0, and RuntimeSettings' broker invariants are scoped (Copilot review)

brettheap
and
claude
committed
859b37b
Fix round: the local install's migrations, pid, initdb, start and interrupts hardened (Copilot review)

brettheap
and
claude
committed
5e52872
Merge T070's fourth fix round (859b37b6) into T072

brettheap
and
claude
committed
28bdccd
Fix round: an unprovable pid is not believed, and the state dir refuses by name (Copilot review)

brettheap
and
claude
committed
96b2699
Fix round: the install-mode module says which of its cases is DB-backed (Copilot review)

brettheap
and
claude
committed
026f00e
Merge T070's fifth fix round (026f00ea) into T072

brettheap
and
claude
committed
4aed627
Fix round: pyproject's packaging note names the resolver that exists (Copilot review)

brettheap
and
claude
committed
a0fb7c8
Fix round: libpq's environment, the socket's path and a relative HOME (Copilot and SonarCloud review)

brettheap
and
claude
committed
0f77d5c
Fix round: the socket's path trusts no group and no link it cannot vouch for (Copilot review)

brettheap
and
claude
committed
379fbb1
T072: pixeltable-pgserver carries the server, and it authenticates by peer (RULED 5916000030 items 2, 3)

brettheap
and
claude
committed
84a6c04
Fix round: the data path, fresh directories and readiness belong to this install (Copilot review)

brettheap
and
claude
committed
f8e6e9e

Commits on Oct 2, 2026

Merge main (047bb4fa) into T071: phase 2 has landed

brettheap
and
claude
committed
adeb6fe
Merge T071's merge-from-main head (adeb6fed) into T070

brettheap
and
claude
committed
3185e7d
T070, owed at the merge round: the standalone generate-and-open runs say --local

brettheap
and
claude
committed
c8fac05
T084: the rejection report prints every broken rule once, with its count

brettheap
and
claude
committed
2210739
Merge T070's merge round (c8fac05e) into T072: phase 2 is on the base

brettheap
and
claude
committed
fe232fe
T072, owed at the merge round: the real entry point, and every --local child keeps its own state

brettheap
and
claude
committed
19e32f0
T084: gate and refresh are true only where a contributed route answers them

brettheap
and
claude
committed
e7324d4
Fix round: a PostgreSQL scheme libpq would not read as a URI is refused (Copilot review)

brettheap
and
claude
committed
c39d960
Merge T071's fix round (c39d960e) into T070

brettheap
and
claude
committed
9ae5e72
T073: 13.4a, /capabilities gains an install block, from the serving process's own settings

brettheap
and
claude
committed
379ff1f
Fix round: the --local callers inherit none of the runner's runtime settings (Copilot review)

brettheap
and
claude
committed
cdf7382
Merge T073 (openDox-code#72, 379ff1f4) into T084: serve.py's single-writer order T055 -> T073 -> T084

brettheap
and
claude
committed
c664775
Merge #67's fix rounds (cdf7382b) into T072

brettheap
and
claude
committed
94254b1
T072: the env probe expects the child's own state directory, never the runner's

brettheap
and
claude
committed
6eb0bbd
Fix round: the healthy-local status case sets its schema with make_conninfo (Copilot review)

brettheap
and
claude
committed
d1de1fd
T084: the consumer columns' seams, with openDox's defaults registered by the entry points

brettheap
and
claude
committed
7714751
Merge T072's merge-round fixes (openDox-code#69, 6eb0bbdb) into T073

brettheap
and
claude
committed
47a6574
Fix round: nothing is made through a path the tree check would refuse (Copilot review)

brettheap
and
claude
committed
0488f5b
T073: the hosted case hands its child a hosted install's settings on purpose

brettheap
and
claude
committed
20032d0
Merge T073 (openDox-code#72, 20032d02) into T084

brettheap
and
claude
committed
a39e020
Merge #67's fix round d1de1fd9 into T072

brettheap
and
claude
committed
fedfa75
Fix round: no runtime setting the runner exports reaches a tests_runtime case (Copilot review)

brettheap
and
claude
committed
105f2f1
Merge T072's fix rounds (openDox-code#69, fedfa75d) into T073

brettheap
and
claude
committed
1b0c3a6
Fix round 12: the auth files are exactly 0600, and the cluster runs on its own files (Copilot review)

brettheap
and
claude
committed
3426c75
Merge #67's fix round 105f2f12 into T072

brettheap
and
claude
committed
f66e5f8
T084: route the last deferred reaches through the column seams (4.3, batch L)

brettheap
and
claude
committed
5d4e433
Merge T073 (openDox-code#72, 1b0c3a63) into T084

brettheap
and
claude
committed
a5ace91
T084: a tile's own documents are editable in openDox's default scope

brettheap
and
claude
committed
65551e6
T084: pin the static bundle's content types ahead of the platform's table

brettheap
and
claude
committed
1fab55f
T072: the in-process local cases give themselves a short state directory

brettheap
and
claude
committed
a985407
T084: retire consumer_reach; the gate and projection columns are a host's (F4.1 whole)

brettheap
and
claude
committed
55f6e8a
T084: the rail's thread read and a standalone own-document turn, held

brettheap
and
claude
committed
0b0c37d
Merge T072's fix rounds (openDox-code#69, f66e5f82) into T073

brettheap
and
claude
committed
bb05e3d
Adversarial review M1: a comma in the state directory is refused

brettheap
and
claude
committed
e214477
Merge T073 (openDox-code#72, bb05e3d7) into T084

brettheap
and
claude
committed
897029d
Adversarial review L1: the carrier is pinned below 0.7, and another major is refused by name

brettheap
and
claude
committed
c4f5df3
Adversarial review L3: the directory creation starts from is judged by its descriptor

brettheap
and
claude
committed
b2d80e9
Adversarial review L2: the local verbs judge their socket before connecting to it

brettheap
and
claude
committed
9e2f303
Adversarial review note: no replication connection, logical or physical

brettheap
and
claude
committed
21bde1a
T084 fix round 1: a seam registration with the names but not their shape is refused (Copilot review)

brettheap
and
claude
committed
b1db196
Merge T072's adversarial-review rounds (openDox-code#69, 21bde1af) into T073

brettheap
and
claude
committed
bb71ee2
Fix round 13: the server is found as the installed distribution's own files, never by import precedence (Copilot review)

brettheap
and
claude
committed
28e195b
Merge T073 (openDox-code#72, bb71ee25) into T084

brettheap
and
claude
committed
94dc15e
T084: `opendox --help` names the installed command and openDox only

brettheap
and
claude
committed
dd015d1
Merge T072's fix round 13 (openDox-code#69, 28e195b9) into T073

brettheap
and
claude
committed
539a358

Commits on Oct 3, 2026

Merge main (8a98e317) into T073

brettheap
and
claude
committed
3da9353
Fix round 14: a named platform gate, resolution failures as reasons, no pid behind a refused tree (Copilot review)

brettheap
and
claude
committed
bf9bcb0
Merge main 66ff7257 into T072: #67 (T070) and #61 (T078) landed

brettheap
and
claude
committed
57b7ed8
Merge T073 (openDox-code#72, 3da93530) into T084, and main through it

brettheap
and
claude
committed
3387293
Fix round 15: on Linux the parent-death signal is armed, or the server is not started (Copilot review)

brettheap
and
claude
committed
058d96e
Merge main 2fc714d2 into T072: #62 (T079) landed

brettheap
and
claude
committed
085ba0b
T084 fix round 2: a gate verb on the default gate is refused, not a traceback (Copilot review)

brettheap
and
claude
committed
ff70ac1
Merge T072 (openDox-code#69, 058d96ef) into T073: stack A carries main 66ff7257

brettheap
and
claude
committed
b4e5485
Fix round 16: a local install's served role and database are the bundle's own (Copilot review)

brettheap
and
claude
committed
3ebccb3
Merge T073 (openDox-code#72, b4e54857) into T084: stack A's main 66ff7257

brettheap
and
claude
committed
7cd2370
Merge main 9a490405 into T072: #74 (T081) landed

brettheap
and
claude
committed
52a2b8d
Merge T072 (openDox-code#69, 085ba0b0) into T073: stack A carries main 2fc714d2

brettheap
and
claude
committed
00ff3e8
T103: every loopback route checks the Host (DNS rebinding) (plan 034)

brettheap
and
claude
committed
56aae21
Merge T073 (openDox-code#72, 00ff3e83) into T084: stack A's main 2fc714d2

brettheap
and
claude
committed
1d6a4f1
T084: openDox's own settings documents are never a tile's editable material (adversarial review 2, M1)

brettheap
and
claude
committed
5a3b51e
T104: the console token travels in the opened URL, not /capabilities (plan 034)

brettheap
and
claude
committed
3e2d5ac
T084: an unknown tile kind is a malformed request, never a dropped connection (adversarial review 2, L1)

brettheap
and
claude
committed
278855d
Merge T084 (openDox-code#77, 1d6a4f19) into T103

brettheap
and
claude
committed
badf247
T084: generate-and-open removes the run directory it minted, named opendox- (adversarial review 2, G7)

brettheap
and
claude
committed
5a9cb0d
T084: `python -m opendox.serve --help` names openDox only, as `opendox --help` does

brettheap
and
claude
committed
6519660
Merge T103 (openDox-code#80, 56aae213) into T104

brettheap
and
claude
committed
efdc18b
Fix round 17: the /proc falsifier is gated, and a backslash in the map is pinned literal (Copilot review)

brettheap
and
claude
committed
4a9dbe9
T104: T103's real local serve reads its token from the private copy

brettheap
and
claude
committed
ff321f3
Merge T072 (openDox-code#69, 52a2b8dc) into T073: stack A carries main 9a490405

brettheap
and
claude
committed
620bee2
T103 fix round 1: an IPv6 loopback bind binds, and its URL is bracketed (Copilot review)

brettheap
and
claude
committed
978f264
Merge T073 (openDox-code#72, 620bee27) into T084: T081 arrives through stack A's main

brettheap
and
claude
committed
b333bf1
Fix round 18a: both bundle DSNs name their schema, public (Copilot review)

brettheap
and
claude
committed
8986158
Fix round 18b: a live pid /proc will not describe fails closed (Copilot review)

brettheap
and
claude
committed
c04690f
Merge T084 (openDox-code#77, b333bf16) into T103

brettheap
and
claude
committed
fb0393d
T104: the private copy refuses a state directory in a served root

brettheap
and
claude
committed
7d69dc3
T084 fix round 3: a group's edges name documents by id, and the scope projects them by path (Copilot review)

brettheap
and
claude
committed
ebe0a35
T103 fix round 2: an IPv6 wildcard bind is announced at ::1 (Copilot review)

brettheap
and
claude
committed
7702004
Merge T084 (openDox-code#77, ebe0a35f) into T103

brettheap
and
claude
committed
d0f1efc
Merge T072 (openDox-code#69, c04690f8) into T073: stack A's final pre-squash head

brettheap
and
claude
committed
bc85f21
Merge main (5e7ab003) into T073: T072 (#69) landed as a squash

brettheap
and
claude
committed
6894268
T073: the install report reads the bundled server's process once; the /proc guard and a docstring's noun (Copilot review of openDox-code#72)

brettheap
and
claude
committed
93f77dc
Merge T103 (openDox-code#80, d0f1efcb) into T104

brettheap
and
claude
committed
6db50b0
Merge T073 (openDox-code#72, 93f77dc1) into T084: #72's head with its Copilot fix round

brettheap
and
claude
committed
7536bfe
Merge main (90ac7033) into T084: T073 (#72) landed as a squash

brettheap
and
claude
committed
d556c3f
T104 fix round 1: every served root, an exact removal, and a plain kill (Copilot review)

brettheap
and
claude
committed
cb89954
T084 fix round 4: a selection's files are paths and a group's edges are ids, looked up apart; the server's help names loopback as the default (Copilot review)

brettheap
and
claude
committed
1fb81cb
T084 fix round 5: an in-root alias of a settings document is the settings document; the typeless package marker is set aside by its reason (Copilot review)

brettheap
and
claude
committed
213344a
T104 fix round 2: the copy is judged by its own path, and no static link serves it (Copilot review)

brettheap
and
claude
committed
c979747
Merge T084 (openDox-code#77, 213344ad) into T103: #77's final pre-squash head

brettheap
and
claude
committed
514d9ad
Merge main (e49b17c3) into T103: T084 (#77) landed as a squash

brettheap
and
claude
committed
b9025b6
T104: the state directory and every served root overlap in neither direction

brettheap
and
claude
committed
36ff610
Merge T103 (openDox-code#80, b9025b6c) into T104: #80's final pre-squash head

brettheap
and
claude
committed
c1e7d8d
Merge main (390e2c28) into T104: T103 (#80) landed as a squash

brettheap
and
claude
committed
60bace0
T104 fix round 3: a directory's index page is judged, and a FIFO never blocks a read (Copilot review)

brettheap
and
claude
committed
219d7cf
Merge main (0116293a) into T104: T102 (#81) landed as a squash

brettheap
and
claude
committed
d4b9943
T104: every clause of #1144 12.4a as batch N amends it, and the opener file's lifecycle self-pass

brettheap
and
claude
committed
a13857a
Merge main (c4b55cc4) into T104: the T102 follow-on (#85) landed as a squash

brettheap
and
claude
committed
182cac7
T104: the state directory is walked once, every link and directory on the way judged, and the write anchored to that walk (Copilot review)

brettheap
and
claude
committed
14285fb

Commits on Oct 4, 2026

Commits on Oct 5, 2026

T104 fix round 13: the console page's URL is judged as a browser reads it (Copilot review)

brettheap
and
claude
committed
c5fcdfa