HAC-341: the root URL served a blank page, and prepare the cold-read kit - #33
Merged
Conversation
## `/` and `/cockpit` rendered nothing
`vercel.json` rewrites `/` and `/cockpit` onto `media/hac-341/cockpit.html`. A
rewrite serves those bytes without changing the request URL, and a
document-relative specifier resolves against the *request* URL — so
import { armView } from './lib/arm-view.mjs'
resolved to `/lib/arm-view.mjs` and aborted. Same for `./lib/guide.mjs` and the
`./evidence/view-model.json` fetch. Both entry points returned HTTP 200 and
rendered a blank page with the body text "Skip to the run". Confirmed against
the live deployment: `/media/hac-341/cockpit.html` renders 1628 characters,
`/` and `/cockpit` render 15.
These are the two URLs a judge visits. #27 made `/` stop 404ing; it did not
make it work.
Nothing caught it because every gate loads the file path directly, which is the
one path where the relative form happens to resolve. The three references are
now anchored at `/media/hac-341/`, and the cockpit gate refuses a
document-relative import or fetch statically — no server, no deployment, and it
fails on the specifier rather than on the blank page. One negative proof.
## Cold-read kit
`media/hac-341/cold-read/` — moderator script and per-reader response sheet.
Status is READY_FOR_HUMAN_TEST: prepared, not run, nothing claimed.
It names the public custom domain, because every `*.vercel.app` URL for this
project is behind Vercel SSO (`ssoProtection: all_except_custom_domains`) and
would send a cold reader to a login page. All six tester URLs verified 200
logged out.
The sheet records verbatim answers rather than scores, and lists the automatic
failures — inferring Agent Runtime or Agent Gateway, collapsing the two proof
classes into one experiment, reading ALLOW as authorized or EXECUTED as
OBSERVED — as overriding any score.
pnpm run check exit 0, 645 tests, typecheck clean.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/and/cockpitrendered nothingvercel.jsonrewrites/and/cockpitontomedia/hac-341/cockpit.html. Arewrite serves those bytes without changing the request URL, and a
document-relative specifier resolves against the request URL — so
resolved to
/lib/arm-view.mjsand aborted. Same for./lib/guide.mjsand the./evidence/view-model.jsonfetch.Measured against the live deployment:
/media/hac-341/cockpit.html?…/cockpit?…/?…Those are the two URLs a judge visits. #27 made
/stop 404ing; it did not makeit work.
Nothing caught it because every gate loads the file path directly — the one
path where the relative form happens to resolve.
Fix
The three references are anchored at
/media/hac-341/, and the cockpit gate nowrefuses a document-relative
import/fetchstatically: no server, nodeployment, and it fails on the specifier rather than on the blank page. One
negative proof asserts the mutation lands.
Cold-read kit
media/hac-341/cold-read/— a moderator script to read verbatim and aper-reader response sheet.
Status: READY_FOR_HUMAN_TEST. Prepared, not run, nothing claimed. HAC-341
stays open until three real readers complete it.
It names the public custom domain deliberately: every
*.vercel.appURL forthis project is behind Vercel SSO (
ssoProtection: all_except_custom_domains),so a deployment URL would send a cold reader to a login page. All six tester
URLs verified HTTP 200 logged out on
interlock.marcellelabs.io.The sheet records verbatim answers rather than scores, and treats inferring
Agent Runtime / Agent Gateway, collapsing the two proof classes, or reading
ALLOWas authorized /EXECUTEDasOBSERVEDas automatic failures thatoverride any score.
Verification
pnpm run checkexit 0