132 lines
7.7 KiB
Markdown
132 lines
7.7 KiB
Markdown
# UX packages 0–3 — implementation evidence
|
||
|
||
2026-10-07, blunix, Sol High. Packages 0–3 are implemented in separate
|
||
reviewable commits; the operator also authorized release to chat.0ff.space.
|
||
Existing audit findings remain historical evidence in UX-AUDIT-REPORT.md.
|
||
No protocol namespace, cryptographic format, dependency, room privacy,
|
||
LLDAP configuration or personal account was changed.
|
||
|
||
## Changes
|
||
|
||
- Package 0 (`40f8d3b`): configurable origins and candidate expectations,
|
||
private reusable profiles, revision/build identification and failure exit
|
||
codes. Candidate mode excludes the old manual cache deletion. Follow-up
|
||
`6e4f6be` retires deliberately added devices and fixes the scroll setup.
|
||
- Package 1 (`0977c0e`): validated legacy PEP device events, account-scoped
|
||
caches, five-minute freshness and reconnect invalidation. Non-roster peers
|
||
refresh at conversation/send-burst start (ten seconds idle); concurrent
|
||
refreshes coalesce. Explicit empty lists are distinct from malformed or
|
||
unavailable responses. Known OMEMO peers cannot silently become plaintext
|
||
recipients. Existing identities and ratchets remain.
|
||
- Package 2 (`e17a02d`): visible readable incoming messages determine outgoing
|
||
cumulative displayed markers. Local badge clearing is independent. Later
|
||
readable messages advance past unreadable gaps without changing stored
|
||
decrypt errors. Remote markers advance cumulatively and monotonically.
|
||
Ticks expose accessible “Displayed” labels; errors offer explanatory help.
|
||
- Package 3 (`bf93174`): Session owns conversation media capability. File
|
||
selection, paste, drop, recording and programmatic sending fail before
|
||
upload/microphone access when unsupported or uncertain. Capability is
|
||
rechecked at upload boundaries. Joined group uploads and cancellation work.
|
||
|
||
Marker policy was recorded in README.md before package 2 code was changed.
|
||
It uses XEP-0333 cumulative reports rather than asserting human reading or
|
||
successful decryption of every earlier message. The existing database `read`
|
||
status stays compatible; its user-facing label changes.
|
||
|
||
## Candidate verification
|
||
|
||
Ran `npm run check` (zero errors/warnings), `npm test`, `npm test --
|
||
--test-isolation=none` (57 passing tests), `npm run build`, runner syntax
|
||
checks and `git diff --check`. Added tests cover PEP validation, account
|
||
isolation, freshness/request counts, non-roster bursts, reconnect, concurrent
|
||
refreshes, a newer event racing an older fetch, failure/empty lists, changed
|
||
peer/own encryption targets and real ratchet decryption. Status tests cover
|
||
visible candidates, unreadable gaps, local badges, own-device cumulative
|
||
sync, out-of-order external markers and retained errors. Upload tests cover
|
||
zero slots/PUTs on rejection, revocation after a slot, supported upload and
|
||
cancellation before network activity.
|
||
|
||
Sequential one-worker Chromium 152 / Linux WebKit 26.5 runs used
|
||
http://127.0.0.1:4173 and the production-built candidate, 402 × 874 CSS
|
||
pixels, existing dedicated A/B accounts and the existing audit room. No
|
||
concurrent build/browser runs. Build: assets/index-B41Jitwn.js, SHA-256
|
||
13e5c4265d1a006c1d3b028f227ef64d31ef7d9673a4e01b724d4d6601ec9fd6.
|
||
|
||
Private evidence (credentials, profiles and captures never enter Git):
|
||
|
||
- Original candidate reproducer:
|
||
/tmp/chat-ux-runner/results/direct-pwa-chromium-1791389739800/report.json.
|
||
New B could not decrypt, but A showed “read”. Later healthy checks failed
|
||
without the historical intervention, as expected.
|
||
- Package 1 additions passed independently in Chromium and WebKit:
|
||
direct-pwa-chromium-1791389950620 and direct-pwa-webkit-1791390150675.
|
||
- Package 2 failed-message/later-readable-message policy passed in both:
|
||
direct-pwa-chromium-1791390512931 and direct-pwa-webkit-1791390546658.
|
||
- Combined candidate runs passed: direct-pwa-chromium-1791390917997,
|
||
direct-pwa-webkit-1791391115192 and
|
||
direct-pwa-chromium-1791391707447 (fresh B device plus removal/cleanup).
|
||
All are under /tmp/chat-ux-runner/results/.
|
||
- Unsupported direct selection, paste and drop: zero slot requests, zero
|
||
PUTs. Chromium voice entry: disabled, zero microphone requests. WebKit's
|
||
Linux runtime has no recording control; native recording is not certified.
|
||
- Group file/image upload works. Chromium additionally verified cancellation
|
||
during a held PUT; both verified cancellation while awaiting a slot causes
|
||
zero PUTs. WebKit's first HTTP-route cancellation probe failed to intercept
|
||
a worker-handled request; using the WebSocket slot boundary made the
|
||
cancellation deterministic. That failed harness report remains historical.
|
||
- WebKit scroll setup is now conclusive: 500 px from bottom before navigation,
|
||
0 afterward (direct-pwa-webkit-1791391654086). Position preservation remains
|
||
package 4, outside this implementation scope.
|
||
- Temporary B devices 363053480, 1653794215, 1682378312 and 365948477 were
|
||
removed through Settings. A/B stable profiles remain for ordinary retests.
|
||
|
||
## Remaining validation boundaries
|
||
|
||
Current physical Monal interoperability was not rerun: no actual Monal
|
||
client is controlled by this host. Legacy wire/ratchet compatibility tests
|
||
pass, and the earlier deployed Monal acceptance remains historical evidence,
|
||
not a fresh package-1 interop result. Actual iPhone safe areas/keyboard,
|
||
background/lock, trusted OS push/open, large text and VoiceOver also remain
|
||
native-device checks. Linux WebKit emulation is not iOS certification.
|
||
No packages 4–9 were implemented; the old pre-device encrypted backlog
|
||
continues to be intentionally unreadable on a newly added device.
|
||
|
||
## Rollout
|
||
|
||
Client source pushed through 6e4f6be. The isolated blunix lock update is
|
||
0de30ba on the existing capability-layout branch, preserving all pending
|
||
handoff edits. Deployment and post-release evidence are recorded below once
|
||
verified.
|
||
|
||
Verified release: generation 548, active system
|
||
/nix/store/9r48rc31k0fimd2yznvdycfzrrlhxqyw-nixos-system-blunix-26.11.20260910.8ce4ef6.
|
||
The active nginx root is
|
||
/nix/store/znp4ysxgmaz8hrbqinpl2mjbmcld5nwl-0ff-chat-0.1.0. Live HTTPS returns
|
||
200 with the expected CSP and the same JS asset/hash as the candidate.
|
||
nginx, Prosody, Traefik, LLDAP, Dex, Headscale, Forgejo, GoToSocial, sshd and
|
||
Tailscale were active, with zero failed units. Only nginx restarted in the
|
||
switch. Previous generation 547 retains the pre-release system
|
||
(dmw37zhy01457x6sl134gmc8klbp2gds); rollback remains available.
|
||
|
||
Full deployed Chromium/WebKit regression reports:
|
||
/tmp/chat-ux-runner/results/direct-pwa-chromium-1791391946961/report.json and
|
||
/tmp/chat-ux-runner/results/direct-pwa-webkit-1791392088226/report.json.
|
||
Both verified the actually executing asset, current strict CSP, fresh B
|
||
device readability without cache manipulation, correct delivered/displayed
|
||
transitions, the unreadable-gap policy, zero unsupported-media slots/PUTs,
|
||
group file/image decoding, cancellation before PUT and the real HTTPS
|
||
service worker. Chromium also verified zero microphone requests; WebKit
|
||
recording remains unavailable in this Linux runtime. Fresh B devices were
|
||
removed afterward and the sender cache reflected each removal. Live
|
||
Chromium/WebKit runs sampled at least 1526/1318 MiB available RAM. Stable
|
||
profiles retain separate identities per origin; ordinary retests reuse them.
|
||
|
||
Later commits only add audit documentation and runner instrumentation; they
|
||
do not change the deployed application bundle or require another input bump.
|
||
|
||
Post-release push-handler simulation also passed within its limits:
|
||
/tmp/chat-ux-runner/results/direct-pwa-chromium-1791392245466/report.json.
|
||
CDP delivered a synthetic push to the real HTTPS worker, which created the
|
||
notification; a synthetic click routed to the right conversation. The
|
||
browser rejected focus for the untrusted click (expected test limitation).
|
||
No actual push relay, OS delivery or trusted phone click is certified.
|