kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

Research: canvas as a data-plane client on any node (browser and passkey feasibility) #167

New issue
Closed
opened 2026-10-11 14:45:43 +00:00 by kayg · 21 comments
kayg commented 2026-10-11 14:45:43 +00:00
Owner
Copy link

Owner idea 2026-10-11: split the server into a control plane (identity, policy, CA, audit, canvas layouts) and a data plane where any node can serve the canvas and carry session traffic directly over the mesh (end-to-end), with every permission enforced at the target host. Research first: browser behaviours and blockers (page on the server origin talking to a local infraternal agent; a canvas served from localhost; passkeys across those origins) in Chromium, Firefox and WebKit/Safari, desktop and iOS. Owner decides after the numbers (foundational: touches D8-D10).

Owner idea 2026-10-11: split the server into a control plane (identity, policy, CA, audit, canvas layouts) and a data plane where any node can serve the canvas and carry session traffic directly over the mesh (end-to-end), with every permission enforced at the target host. Research first: browser behaviours and blockers (page on the server origin talking to a local infraternal agent; a canvas served from localhost; passkeys across those origins) in Chromium, Firefox and WebKit/Safari, desktop and iOS. Owner decides after the numbers (foundational: touches D8-D10).
kayg commented 2026-10-11 14:53:36 +00:00
Author
Owner
Copy link

Started research on branch research-canvas-node, based on origin/dev at ded3abd609e5290a7027b6888ecd9864a2d30374. Issue #167 has 0 comments; fj issue view exposes its body and comments but no parent relation, so no parent issue was identifiable through the approved CLI.

Started research on branch `research-canvas-node`, based on `origin/dev` at `ded3abd609e5290a7027b6888ecd9864a2d30374`. Issue #167 has 0 comments; `fj issue view` exposes its body and comments but no parent relation, so no parent issue was identifiable through the approved CLI.
kayg commented 2026-10-11 15:17:18 +00:00
Author
Owner
Copy link

Orchestrator, owner idea 2026-10-11 (add to the research): canvas nodes served on a real HTTPS name by the reverse-proxy plugin in the infraternal agent, e.g. https://. (ACME DNS-01 cert), resolving to a LAN address at home. Evaluate: sign-in redirect to the server origin and back with a short-lived per-origin session (works in Chromium/Firefox/WebKit?), passkey RP-ID implications (passkeys stay on the server origin; Related Origin Requests not needed?), iOS Safari/PWA reaching a LAN-resolving public name, mixed private-IP DNS answers (DNS rebinding protections in routers/resolvers that drop private answers), and serving a signed UI bundle that must match the control-plane version. Compare with the localhost variants.

Orchestrator, owner idea 2026-10-11 (add to the research): canvas nodes served on a real HTTPS name by the reverse-proxy plugin in the infraternal agent, e.g. https://<node>.<owner-domain> (ACME DNS-01 cert), resolving to a LAN address at home. Evaluate: sign-in redirect to the server origin and back with a short-lived per-origin session (works in Chromium/Firefox/WebKit?), passkey RP-ID implications (passkeys stay on the server origin; Related Origin Requests not needed?), iOS Safari/PWA reaching a LAN-resolving public name, mixed private-IP DNS answers (DNS rebinding protections in routers/resolvers that drop private answers), and serving a signed UI bundle that must match the control-plane version. Compare with the localhost variants.
kayg commented 2026-10-11 15:26:49 +00:00
Author
Owner
Copy link

Chrome finding (Linux Debian 13; Google Chrome Stable 155.0.8059.39 via Playwright 1.64.0, headless): from the secure test origin https://8.8.8.8:4844, local-network and loopback-network query as prompt. Fetches to http://127.0.0.1:4841 and http://localhost:4841 fail before reaching the fixture; console reports loopback permission denied. ws://127.0.0.1:4842, ws://localhost:4842, and wss://localhost:4843 fail with ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS; the fixture records no requests or PNA OPTIONS. Headless mode showed no visible prompt; Chrome’s documented prompt text is “Look for and connect to any device on your local network.” Raw evidence: research/canvas-node/results/browser-probes.json. This differs from Chrome’s Chrome-138 rollout note, which said WebSockets were not yet gated.

Chrome finding (Linux Debian 13; Google Chrome Stable 155.0.8059.39 via Playwright 1.64.0, headless): from the secure test origin `https://8.8.8.8:4844`, `local-network` and `loopback-network` query as `prompt`. Fetches to `http://127.0.0.1:4841` and `http://localhost:4841` fail before reaching the fixture; console reports loopback permission denied. `ws://127.0.0.1:4842`, `ws://localhost:4842`, and `wss://localhost:4843` fail with `ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS`; the fixture records no requests or PNA OPTIONS. Headless mode showed no visible prompt; Chrome’s documented prompt text is “Look for and connect to any device on your local network.” Raw evidence: `research/canvas-node/results/browser-probes.json`. This differs from Chrome’s Chrome-138 rollout note, which said WebSockets were not yet gated.
kayg commented 2026-10-11 15:48:51 +00:00
Author
Owner
Copy link

Firefox/WebKit finding (Linux, headless Playwright): Firefox 157.0 reports local-network and loopback-network as prompt; fetches stayed pending until the harness aborted at 1.8 s, WebSockets timed out, and the local fixture saw no requests. WebKit 27.2 reports the same permission states but sends no local HTTP or ws:// request; console says “Not allowed to request resource.” Its wss://localhost:4843 probe did reach the fixture and echoed one byte without a visible prompt. Headless runs cannot show browser-chrome permission UI, so these are permission states and observed outcomes, not visual confirmation of a dialog. Evidence: research/canvas-node/results/browser-probes.json.

Firefox/WebKit finding (Linux, headless Playwright): Firefox 157.0 reports `local-network` and `loopback-network` as `prompt`; fetches stayed pending until the harness aborted at 1.8 s, WebSockets timed out, and the local fixture saw no requests. WebKit 27.2 reports the same permission states but sends no local HTTP or `ws://` request; console says “Not allowed to request resource.” Its `wss://localhost:4843` probe did reach the fixture and echoed one byte without a visible prompt. Headless runs cannot show browser-chrome permission UI, so these are permission states and observed outcomes, not visual confirmation of a dialog. Evidence: `research/canvas-node/results/browser-probes.json`.
kayg commented 2026-10-11 15:48:53 +00:00
Author
Owner
Copy link

Passkey finding (Google Chrome Stable 155.0.8059.39, CDP virtual authenticator): registration and assertion on the server RP ID example.com succeeded; a localhost page could register its own localhost RP ID but could not assert for example.com, even when the RP well-known JSON listed the localhost origins; a separate HTTPS origin at node.other.net succeeded for example.com when listed by the RP. This supports HTTPS per-node names as a browser-compatible Related Origin Request path, while localhost is not a valid related origin in this test. Evidence: research/canvas-node/results/browser-probes.json (webAuthn).

Passkey finding (Google Chrome Stable 155.0.8059.39, CDP virtual authenticator): registration and assertion on the server RP ID `example.com` succeeded; a `localhost` page could register its own `localhost` RP ID but could not assert for `example.com`, even when the RP well-known JSON listed the localhost origins; a separate HTTPS origin at `node.other.net` succeeded for `example.com` when listed by the RP. This supports HTTPS per-node names as a browser-compatible Related Origin Request path, while localhost is not a valid related origin in this test. Evidence: `research/canvas-node/results/browser-probes.json` (`webAuthn`).
kayg commented 2026-10-11 15:59:13 +00:00
Author
Owner
Copy link

Linux multi-user finding (Debian 13, kernel 6.12.111+deb13-amd64): a browser-style TCP connection from OS user nobody (UID 65534) to a test listener owned by kayg (UID 1001) produced a live client-side /proc/net/tcp row with UID 65534 and an accepted server-side row with UID 1001. The client tuple plus row UID identifies the connecting local user; the accepted socket alone does not. The harness output is research/canvas-node/results/local-user-uid.json.

Linux multi-user finding (Debian 13, kernel 6.12.111+deb13-amd64): a browser-style TCP connection from OS user `nobody` (UID 65534) to a test listener owned by `kayg` (UID 1001) produced a live client-side `/proc/net/tcp` row with UID 65534 and an accepted server-side row with UID 1001. The client tuple plus row UID identifies the connecting local user; the accepted socket alone does not. The harness output is `research/canvas-node/results/local-user-uid.json`.
kayg commented 2026-10-11 16:05:55 +00:00
Author
Owner
Copy link

Chrome CORS/PNA finding (Google Chrome Stable 155.0.8059.39): after CDP granted the loopback/local permissions, the simple GETs and ws/wss echoes succeeded. A custom-header fetch did ordinary CORS OPTIONS preflight (Access-Control-Request-Headers: x-canvas-probe), but the server saw no Access-Control-Request-Private-Network; the request returned 200 both when the preflight response omitted Access-Control-Allow-Private-Network and when it included it. Exact Access-Control-Allow-Origin and ordinary CORS method/header responses were present. Evidence: research/canvas-node/results/browser-probes.json (corsPreflight, serverRequests).

Chrome CORS/PNA finding (Google Chrome Stable 155.0.8059.39): after CDP granted the loopback/local permissions, the simple GETs and `ws`/`wss` echoes succeeded. A custom-header fetch did ordinary CORS OPTIONS preflight (`Access-Control-Request-Headers: x-canvas-probe`), but the server saw no `Access-Control-Request-Private-Network`; the request returned 200 both when the preflight response omitted `Access-Control-Allow-Private-Network` and when it included it. Exact `Access-Control-Allow-Origin` and ordinary CORS method/header responses were present. Evidence: `research/canvas-node/results/browser-probes.json` (`corsPreflight`, `serverRequests`).
kayg commented 2026-10-11 16:07:01 +00:00
Author
Owner
Copy link

Latency finding (infraternal-dev, Debian 13, kernel 6.12.111+deb13-amd64): 60 browser round trips of a 1-byte WebSocket echo measured localhost WS p50 0.8 ms / p95 1.8 ms / p99 5.5 ms. Across a veth pair in two temporary network namespaces with netem delay 75ms on each egress direction, WSS p50 was 151.1 ms / p95 151.4 ms / p99 157.4 ms. The benchmark ran inside systemd-run --user --scope -p CPUWeight=10000; load average was 12.88 / 21.79 / 26.21 at start and 11.67 / 21.24 / 25.99 at end. Evidence: research/canvas-node/results/latency.json; namespaces and veths were removed at exit.

Latency finding (infraternal-dev, Debian 13, kernel 6.12.111+deb13-amd64): 60 browser round trips of a 1-byte WebSocket echo measured localhost WS p50 0.8 ms / p95 1.8 ms / p99 5.5 ms. Across a veth pair in two temporary network namespaces with `netem delay 75ms` on each egress direction, WSS p50 was 151.1 ms / p95 151.4 ms / p99 157.4 ms. The benchmark ran inside `systemd-run --user --scope -p CPUWeight=10000`; load average was 12.88 / 21.79 / 26.21 at start and 11.67 / 21.24 / 25.99 at end. Evidence: `research/canvas-node/results/latency.json`; namespaces and veths were removed at exit.
kayg commented 2026-10-11 16:11:48 +00:00
Author
Owner
Copy link

Mobile finding (documentation only; no iPhone/iPad device or real Safari automation): Apple TN3179 states that local-network operations from Safari do not require the OS Local Network privilege, so the native-app Local Network prompt is not evidence for or against Safari page access. Apple supports adding a site to the iPhone Home Screen as a web app, while the W3C secure-context rules do not treat an ordinary LAN IP over HTTP like localhost. Direct Safari/PWA access to a same-LAN node and its mesh address remain unverified; the established server-origin path is still the only measured mobile path. Evidence and links: research/canvas-node/README.md §5.

Mobile finding (documentation only; no iPhone/iPad device or real Safari automation): Apple TN3179 states that local-network operations from Safari do not require the OS Local Network privilege, so the native-app Local Network prompt is not evidence for or against Safari page access. Apple supports adding a site to the iPhone Home Screen as a web app, while the W3C secure-context rules do not treat an ordinary LAN IP over HTTP like localhost. Direct Safari/PWA access to a same-LAN node and its mesh address remain unverified; the established server-origin path is still the only measured mobile path. Evidence and links: `research/canvas-node/README.md` §5.
kayg commented 2026-10-11 16:15:25 +00:00
Author
Owner
Copy link

Dependency step complete: pinned Playwright 1.64.0 in an AGPL-3.0-only research package. Commit 35576215ea9d36c36f4807cd390128c0f9e05064. Gate: bun install --frozen-lockfile — Checked 2 installs across 3 packages (no changes) [539.00ms].

Dependency step complete: pinned Playwright 1.64.0 in an AGPL-3.0-only research package. Commit `35576215ea9d36c36f4807cd390128c0f9e05064`. Gate: `bun install --frozen-lockfile` — `Checked 2 installs across 3 packages (no changes) [539.00ms]`.
kayg commented 2026-10-11 16:18:32 +00:00
Author
Owner
Copy link

Browser-probe step complete: recorded Chrome 155.0.8059.39, Firefox 157.0, and Playwright WebKit 27.2 across both localhost names; Chrome’s custom-header preflight succeeded without Access-Control-Allow-Private-Network. Evidence is in results/browser-probes.json. Commit 3c17fa9ce27754f6f1cbb6c78e0d25d0a3a566bb; git diff --cached --check passed with no output.

Browser-probe step complete: recorded Chrome 155.0.8059.39, Firefox 157.0, and Playwright WebKit 27.2 across both localhost names; Chrome’s custom-header preflight succeeded without `Access-Control-Allow-Private-Network`. Evidence is in `results/browser-probes.json`. Commit `3c17fa9ce27754f6f1cbb6c78e0d25d0a3a566bb`; `git diff --cached --check` passed with no output.
kayg commented 2026-10-11 16:19:48 +00:00
Author
Owner
Copy link

Linux local-user step complete: UID 65534 (nobody) connected to a UID 1001 (kayg) listener. The client /proc/net/tcp row showed UID 65534; the accepted row showed UID 1001. Commit 60468d7ac60125574fc1b3afa4c5df858e60fa8c; evidence: results/local-user-uid.json.

Linux local-user step complete: UID 65534 (`nobody`) connected to a UID 1001 (`kayg`) listener. The client `/proc/net/tcp` row showed UID 65534; the accepted row showed UID 1001. Commit `60468d7ac60125574fc1b3afa4c5df858e60fa8c`; evidence: `results/local-user-uid.json`.
kayg commented 2026-10-11 16:21:45 +00:00
Author
Owner
Copy link

Latency step complete: 60 one-byte round trips per path under the requested systemd CPU weight and two temporary network namespaces. Local WS p50/p95/p99: 0.8/1.8/5.5 ms; WSS over 75 ms netem per direction: 151.1/151.4/157.4 ms. Load average start/end: 12.88/21.79/26.21 and 11.67/21.24/25.99. Commit eb7303c01aed0c9b18fc8327317d1462680a5d1b; evidence: results/latency.json.

Latency step complete: 60 one-byte round trips per path under the requested systemd CPU weight and two temporary network namespaces. Local WS p50/p95/p99: 0.8/1.8/5.5 ms; WSS over 75 ms netem per direction: 151.1/151.4/157.4 ms. Load average start/end: 12.88/21.79/26.21 and 11.67/21.24/25.99. Commit `eb7303c01aed0c9b18fc8327317d1462680a5d1b`; evidence: `results/latency.json`.
kayg commented 2026-10-11 16:58:05 +00:00
Author
Owner
Copy link

Continuing after the host resize on research-canvas-node, based on origin/dev at ded3abd609e5290a7027b6888ecd9864a2d30374; checkpoint head before restore was 019a4a6c. Ran the requested soft reset; restored checkpoint changes are staged on current head f4cef80c. Reviewing the owner’s per-node HTTPS extension and will split/push the restored work atomically.

Continuing after the host resize on `research-canvas-node`, based on `origin/dev` at `ded3abd609e5290a7027b6888ecd9864a2d30374`; checkpoint head before restore was `019a4a6c`. Ran the requested soft reset; restored checkpoint changes are staged on current head `f4cef80c`. Reviewing the owner’s per-node HTTPS extension and will split/push the restored work atomically.
kayg commented 2026-10-11 17:14:03 +00:00
Author
Owner
Copy link

Handoff finding (Debian 13, Linux 6.12.111+deb13-amd64; Playwright 1.64.0; Chrome 155.0.8059.39, Firefox 157.0, WebKit 27.2; headless): popup postMessage with exact origin/source/state checks and top-level redirect back to the node both completed on http://localhost:4840 and http://127.0.0.1:4840 in all three engines. The fixture redeemed once (204), rejected replay (409), and a same-origin HttpOnly; Secure; SameSite=Strict cookie authenticated in Chrome and Firefox. WebKit did not store/send that Secure cookie on either HTTP loopback origin; an HttpOnly SameSite=Strict cookie without Secure worked there, and the Secure cookie worked over HTTPS localhost in all three. Redirect-code URLs were redacted from captured request paths. This is browser-mechanics evidence only; the code issuer and authorization were fixtures. Evidence: research/canvas-node/results/browser-probes.json (handoff, 21 probes), harness: research/canvas-node/browser-probes.mjs.

Handoff finding (Debian 13, Linux 6.12.111+deb13-amd64; Playwright 1.64.0; Chrome 155.0.8059.39, Firefox 157.0, WebKit 27.2; headless): popup `postMessage` with exact origin/source/state checks and top-level redirect back to the node both completed on `http://localhost:4840` and `http://127.0.0.1:4840` in all three engines. The fixture redeemed once (204), rejected replay (409), and a same-origin `HttpOnly; Secure; SameSite=Strict` cookie authenticated in Chrome and Firefox. WebKit did not store/send that Secure cookie on either HTTP loopback origin; an HttpOnly SameSite=Strict cookie without Secure worked there, and the Secure cookie worked over HTTPS localhost in all three. Redirect-code URLs were redacted from captured request paths. This is browser-mechanics evidence only; the code issuer and authorization were fixtures. Evidence: `research/canvas-node/results/browser-probes.json` (`handoff`, 21 probes), harness: `research/canvas-node/browser-probes.mjs`.
kayg commented 2026-10-11 17:17:29 +00:00
Author
Owner
Copy link

Per-node HTTPS extension finding: Chromium 155’s CDP virtual authenticator asserted for RP ID example.com from https://node.other.net:4844 when that exact origin was listed by the RP’s /.well-known/webauthn; http://localhost:4840 failed even when listed. The fixture mapped node.other.net to the namespace test address and used a throwaway CA certificate with a browser pin, so this proves origin/ROR mechanics only, not production DNS, certificate trust, mesh reachability, or iOS behavior. Evidence: research/canvas-node/results/browser-probes.json (webAuthn). Resolver behavior is still environment-dependent; for example, OpenWrt documents dnsmasq rebind protection and its possible-rebind rejection log: https://openwrt.org/docs/guide-user/base-system/dhcp.dnsmasq. I’ll record the unmeasured resolver and signed-bundle compatibility costs in the report.

Per-node HTTPS extension finding: Chromium 155’s CDP virtual authenticator asserted for RP ID `example.com` from `https://node.other.net:4844` when that exact origin was listed by the RP’s `/.well-known/webauthn`; `http://localhost:4840` failed even when listed. The fixture mapped `node.other.net` to the namespace test address and used a throwaway CA certificate with a browser pin, so this proves origin/ROR mechanics only, not production DNS, certificate trust, mesh reachability, or iOS behavior. Evidence: `research/canvas-node/results/browser-probes.json` (`webAuthn`). Resolver behavior is still environment-dependent; for example, OpenWrt documents dnsmasq rebind protection and its possible-rebind rejection log: https://openwrt.org/docs/guide-user/base-system/dhcp.dnsmasq. I’ll record the unmeasured resolver and signed-bundle compatibility costs in the report.
kayg commented 2026-10-11 17:17:35 +00:00
Author
Owner
Copy link

Latency harness finding: two post-resize attempts failed only on remote WSS. CDP showed local-network and loopback grants; the local WS leg passed. Diagnostic output showed Chrome net::ERR_INTERNET_DISCONNECTED and client veth-client LOWERLAYERDOWN; the script started the far-side namespace server asynchronously without waiting for its listener. Added a bounded listener-ready wait in run-latency-netns.sh. Rerun succeeded: 60 one-byte RTTs, local p50/p95/p99 1.2/3.1/10.0 ms; netem WSS 151.6/170.6/191.1 ms. Load average start/end 37.93/42.57/30.52 and 35.94/41.91/30.50 on the 12-vCPU host. Evidence: research/canvas-node/results/latency.json.

Latency harness finding: two post-resize attempts failed only on remote WSS. CDP showed local-network and loopback grants; the local WS leg passed. Diagnostic output showed Chrome `net::ERR_INTERNET_DISCONNECTED` and client `veth-client` `LOWERLAYERDOWN`; the script started the far-side namespace server asynchronously without waiting for its listener. Added a bounded listener-ready wait in `run-latency-netns.sh`. Rerun succeeded: 60 one-byte RTTs, local p50/p95/p99 1.2/3.1/10.0 ms; netem WSS 151.6/170.6/191.1 ms. Load average start/end 37.93/42.57/30.52 and 35.94/41.91/30.50 on the 12-vCPU host. Evidence: `research/canvas-node/results/latency.json`.
kayg commented 2026-10-11 17:21:57 +00:00
Author
Owner
Copy link

Browser handoff step committed and pushed: 95540f6c. The harness records 21 popup, redirect, and cookie probes across Chrome 155.0.8059.39, Firefox 157.0, and WebKit 27.2 on localhost, 127.0.0.1, and HTTPS localhost. Popup and redirect code redemption passed in all three; Secure cookies on HTTP loopback failed only in WebKit. node --check and git diff --check passed; browser run exited 0. Evidence: research/canvas-node/results/browser-probes.json.

Browser handoff step committed and pushed: `95540f6c`. The harness records 21 popup, redirect, and cookie probes across Chrome 155.0.8059.39, Firefox 157.0, and WebKit 27.2 on localhost, 127.0.0.1, and HTTPS localhost. Popup and redirect code redemption passed in all three; Secure cookies on HTTP loopback failed only in WebKit. `node --check` and `git diff --check` passed; browser run exited 0. Evidence: `research/canvas-node/results/browser-probes.json`.
kayg commented 2026-10-11 17:22:25 +00:00
Author
Owner
Copy link

Latency step committed and pushed: 45723a8e. The two-namespace harness now waits for the remote WSS listener; a 60-sample rerun passed at local p50/p95/p99 1.2/3.1/10.0 ms and netem WSS 151.6/170.6/191.1 ms. Load averages were 37.93/42.57/30.52 at start and 35.94/41.91/30.50 at end. bash -n, node --check, and git diff --check passed. Evidence: research/canvas-node/results/latency.json; initial run retained in latency-first-run.json.

Latency step committed and pushed: `45723a8e`. The two-namespace harness now waits for the remote WSS listener; a 60-sample rerun passed at local p50/p95/p99 1.2/3.1/10.0 ms and netem WSS 151.6/170.6/191.1 ms. Load averages were 37.93/42.57/30.52 at start and 35.94/41.91/30.50 at end. `bash -n`, `node --check`, and `git diff --check` passed. Evidence: `research/canvas-node/results/latency.json`; initial run retained in `latency-first-run.json`.
kayg commented 2026-10-11 17:23:51 +00:00
Author
Owner
Copy link

Finished and pushed research-canvas-node at 2202eaf996f32c167a7c243572bfc0392ea7c447; local and remote heads match and the worktree is clean. Browser handoff, latency, and report changes are split into commits 95540f6c, 45723a8e, and 2202eaf9.

Final gate output:

git diff --check
(no output; exit 0)

git diff --check origin/dev...HEAD also produced no output and exited 0. The research brief does not require scripts/verify fast. Report and evidence: research/canvas-node/README.md and research/canvas-node/results/.

Finished and pushed `research-canvas-node` at `2202eaf996f32c167a7c243572bfc0392ea7c447`; local and remote heads match and the worktree is clean. Browser handoff, latency, and report changes are split into commits `95540f6c`, `45723a8e`, and `2202eaf9`. Final gate output: ``` git diff --check (no output; exit 0) ``` `git diff --check origin/dev...HEAD` also produced no output and exited 0. The research brief does not require `scripts/verify fast`. Report and evidence: `research/canvas-node/README.md` and `research/canvas-node/results/`.
kayg commented 2026-10-28 17:52:59 +00:00
Author
Owner
Copy link

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Research delivered (research/canvas-node, 2202eaf9) and owner decisions recorded as D248. Reopen if anything is still missing.

Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Research delivered (research/canvas-node, 2202eaf9) and owner decisions recorded as D248. Reopen if anything is still missing.
kayg closed this issue 2026-10-28 17:52:59 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#167
No description provided.