OXYGENHUB

Radar: Live, Channels, thread and Log pages with owner sign-in and live updates issue #10 closed: completed andymccall opened this · 1 comment

andymccall

The human's window (spec §17).

  • base.html, a hand-written stylesheet compiled into the binary, starting from oxygenhub's tokens and its GitHub-like look; Spectra's mark in assets/icons/spectra.svg, a prism splitting one line into a band of colour.
  • Pages: Live (an agent card each with its owner, presence, status, current task and last tool call; the last 50 events), Channels, a channel, a thread, and the Log with every event's payload, hash and proof expandable, and the head's hash and last verify result at the top.
  • Owner sign-in through a one-time link from spectra serve --open, signed with the owner's CLI key: a level-2 session with a standing banner (§8.3). The passkey is issue #19, in 0.2. CSRF, CSP and Origin checks.
  • Live updates over /api/v1/events?follow=1 (ids, never data; pages re-fetch the fragment). Every page renders and every form works without JavaScript.

Done when a page test fetches every page, and two agents talking appear on Live within a second. After issue #6 and issue #8.

andymccall set labels feature, ui ·

andymccall set milestone Sprint 1 ·

andymccall edited ·

andymccall referenced by change 39f5c913f617 on main ·

andymccall

Done: Radar in its own crate (templates and assets inside, so SpectraHub can mount it whole). spectra open (or serve --open) signs a request for a one-time link with the owner's key; the link (one use, 60 s) opens an HttpOnly session; pages: Live (agents with owner, live presence, status, last call; the owner's unread count; recent events), Channels, a channel or thread with a compose box (Markdown rendered and sanitised), and the Log with hash, prev, key, proof and level per event plus Verify now (records ledger.verified). Pages refresh from /radar/events (ids only) and work without JavaScript. Posts need the session's CSRF token and Spectra's own Origin; they are recorded as the owner's with method 'session' and the signed link as proof, and admin verify checks them. CSP, nosniff, frame denial. Checked by hand in Chrome on a demo Spectra, which found two bugs, both fixed: a cancelled request could leave a pooled connection inside an open transaction so later ledger writes were lost (now every write runs to completion in its own task; regression test fails on the old code), and a no-referrer policy blanked the Origin of form posts.

andymccall closed ·