Changes touching this path
- the browser opens what the forge cannot: own-private read ships an owner read tier, a once-per-device unlock, and a grant mailbox that never acks (#1043)
c8dd4da1 · dbf3dbe6… - the private tier counts ACTIONS at the one seam every handler enters through, and the account reference it carries is the notice second identifier rather than a footnote
loot#1758, the third of loot#1619 three collection points. Every api.private.*
request enters through withPrivateSession, so the row is queued there on the
way OUT with the status actually sent - one instrumentation point rather than
one per route, which means a new endpoint is counted by construction and a test
pins that every api.private.* file uses the seam.
Deliberately narrow: the beacon owns views, the log owns volume, this owns
actions. Counting anywhere wider would either double-count with the beacon or
undercount behind the 60-second cache.
The path is the ROUTE SHAPE, which on this tier is not a formality: owner,
repo and file path all travel in the QUERY STRING, and routeShape drops the
query before any rule runs. The pin asserts the repo name is absent from the
serialised row, not merely that the path looks right.
account_ref is a keyed SHA-256 digest of the Clerk id, 32 hex, stable ON
PURPOSE - the opposite choice from the visitor key, because its entire job is
to let an erasure request find every row of one account. A read of the metrics
database yields nothing a third party issued; an erasure can still compute the
value to delete by. A 401 row carries NULL rather than a reference to nobody,
so the one-subject-tier CHECK reads it as no subject.
The notice moved with it, in nine sentences. The page said in so many words that
the records carry NO account reference and that there is ONE identifier; both
are now false and both are now pinned in the other direction. What the page
does NOT claim is as deliberate: loot#1622 says the reference lives with the
account and is deleted on request, and only the second half is built - no
account-deletion hook removes these rows - so the page says on request and
says the automatic link is not built, and a test refuses the flattering version.
Rendering found two more sentences that had become misleading rather than
false: Erasure said deleting the account deletes it, which now read as covering
the counted rows, and the retention section said keyed rows lose their meaning
when the salt dies, which is true of visitor keys and the opposite of true for
account codes. Both now say which rows they mean.
547 site tests pass; budget green with 263 B of slack left on /privacy, so the
next notice edit will need a recorded raise.
3bb326ce · dbf3dbe6…diff - the private shell stops dying a minute after /account: it authenticated with Clerk 60-second __session cookie while no Clerk JS ran on /private to refresh it, so every private call 401d and a reload wiped the vault. per the operator grill (ADR 0096, reversing #930 dec. 4), Clerk JS now runs on the private routes, loaded on demand behind PrivateGate so public pages carry none, under the strict nonce CSP widened only for Clerk (its frontend API host read out of the publishable key, img.clerk.com, the Turnstile and protect hosts, and worker-src blob: for its session timers) with the request nonce passed to ClerkProvider; every private call goes through one privateFetch that sends a Bearer from getToken and retries once with a fresh token, and /api/private/* no longer accepts the cookie; the vault is wiped only when Clerk reports signed out or a different user, or on Lock, and an HTTP status never wipes it; signed-out /private renders SignIn in place and returns to the requested URL, and the private bar gains Sign out beside Lock. the vault, private shell and CSP comments and CONTEXT.md now say what is true: the wrap key can decrypt, so any script on this origin can recover the seed, and the wrap protects it at rest; the boundary is this origin script set, loot code plus Clerk. tests for the CSP, bearer lane, retry and wipe triggers and the built server, each red under a named mutation and restored; site gate 804 passed, every surface lighter; a CSP-enforcing signed-out load renders SignIn with no violation and /why loads no Clerk; workspace suite 4549 passed. the operator live check closes the ticket (#2396)
25ab3fa8 · dbf3dbe6…diff
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.