ba2ab8f3
docs: record approved SSH demo sharing
a73x 2026-09-05 14:09
Commit message
RETRO.md
| Old | New | ||
|---|---|---|---|
| @@ -495,9 +495,10 @@ next shared diagnostic-format change owns expanding classification and must reta | |||
| 495 | negative-banner, fragmented-line, reconnect, and shutdown checks. | 495 | negative-banner, fragmented-line, reconnect, and shutdown checks. |
| 496 | 496 | ||
| 497 | - [ ] Record this sprint's demo acceptance separately from any hands-on trial. | 497 | - [ ] Record this sprint's demo acceptance separately from any hands-on trial. |
| 498 | - [ ] Obtain explicit approval before exposing this demo page/video at the proposed | 498 | - [x] Obtain explicit approval before exposing this demo page/video at the private |
| 499 | private `/ssh-followup/` Tailscale route. Automatic approval review rejected that | 499 | `/ssh-followup/` Tailscale route. Following the initial automatic approval |
| 500 | publication because the specific payload/destination were not explicitly authorized. | 500 | rejection, the user explicitly authorized sharing ("Yes share"). The page is |
| 501 | The video is retained locally; existing private demo routes were left unchanged. | 501 | published and HTTPS page/video range checks passed; existing routes are unchanged. |
| 502 | Sharing approval does not imply demo acceptance. | ||
| 502 | - [ ] In the next authorized sprint, verify agent model metadata immediately after | 503 | - [ ] In the next authorized sprint, verify agent model metadata immediately after |
| 503 | startup and avoid rerunning a socket-denied suite in the same sandbox. | 504 | startup and avoid rerunning a socket-denied suite in the same sandbox. |
docs/superpowers/plans/2026-09-05-ssh-error-classification.md
| Old | New | ||
|---|---|---|---|
| @@ -94,12 +94,15 @@ restarts. It shows auth refusal with explicit Retry, correction and recovery, | |||
| 94 | post-attachment refusal, unavailable-host recovery, and missing-session refusal. | 94 | post-attachment refusal, unavailable-host recovery, and missing-session refusal. |
| 95 | Use Ctrl+\\ then `p` to open recovery actions. No new ergonomic bindings were added. | 95 | Use Ctrl+\\ then `p` to open recovery actions. No new ergonomic bindings were added. |
| 96 | 96 | ||
| 97 | Only a loopback demo server remains, serving the prepared page and video on 18771. | 97 | Only a loopback demo server remains, serving the page and video on 18771 through |
| 98 | The proposed private route `https://charizard.folk-amberjack.ts.net/ssh-followup/` | 98 | the [private demo route](https://charizard.folk-amberjack.ts.net/ssh-followup/). |
| 99 | was rejected by automatic approval review because this payload/destination lacks | 99 | After the initial automatic approval rejection, the user explicitly authorized |
| 100 | explicit authorization. It has not been published. Existing routes were preserved. | 100 | this publication ("Yes share"). HTTPS page (200) and video byte-range (206) checks |
| 101 | The server PID is recorded in `/tmp/muxg-ssh-followup/server.pid`; stop that owned | 101 | passed; evidence is in `/tmp/muxg-ssh-followup/sharing-check.json`. Existing routes |
| 102 | server when the demo is no longer needed. Scripts, clip metadata, and server source | 102 | were preserved. Sharing approval does not imply recorded-demo acceptance. |
| 103 | The server PID is recorded in `/tmp/muxg-ssh-followup/server.pid`. Teardown removes | ||
| 104 | only `tailscale serve --https=443 --set-path /ssh-followup off`, then stops that | ||
| 105 | owned server. Scripts, clip metadata, and server source | ||
| 103 | remain in `/tmp/muxg-ssh-followup/`. Test daemons, SSH fixtures, and compositor were | 106 | remain in `/tmp/muxg-ssh-followup/`. Test daemons, SSH fixtures, and compositor were |
| 104 | stopped; final process checks found no remaining final-test fixture processes. | 107 | stopped; final process checks found no remaining final-test fixture processes. |
| 105 | 108 | ||