[congvc-bot-x99]

Current Preview And Human Gate — 20 October 2026

Draft: independent code review/OCR PASS and exact-head HTTPS preview ready. Actual Brave acceptance remains open. Only Cheese merges.

• Published head 7e2dd73d023b2f1861b97c8049721505d7c511fc, REST base 6fd14f030655e6db6b9fd6e8df1b3f285ab53998, OPEN/draft and MERGEABLE/CLEAN. Exact-head checks: 19 SUCCESS, 3 SKIPPED, zero failed or pending. Live main advanced to 17a8fae0d5dd25380eb39bd7d7bffc7e4e361ce0. The captured one-commit delta is design documentation/assets. No resync occurred; this is not a latest-main integration claim.
• Independent signing reviewer x99-claude-opus, Anthropic model claude-opus-5-5[1m], returned code-review PASS with no P0/P1 in CHE-1593 comment 01a158ad-c72c-7829-a8af-38fd8483453d. Authors Sol and historical Luna contributions are OpenAI. Sol checked the trusted validator blob, exact-pair receipt/non-staleness and full 20 selected + 11 excluded path coverage. This is not Brave acceptance, PR-ready or full-issue PASS.
• Luna's exact-head preview return is comment 01a1593e-9dd1-74f1-8553-3fa00085e659, evidence attachment 01a1593e-9c6b-76c9-a84c-bdf32f07250c. Sol independently matched source/artifact/build identities and loopback/HTTPS cookie-only auth, fixture suggestions, logged-out privacy, public XML origin and manifest bytes. Native approval switched only route 19695 to loopback 13362. Other routes and all old stacks/rollback assets remain preserved. No source/branch/C00/production change or merge occurred.
• Preview: https://congvc-x99.taila6fa8a.ts.net:19695/ . Scope che1593-preview-7e2dd73-r1; build DU6ZAIoozzn9VvyTl2yqR. API SHA-256 c92600169cb2a825e4b871562bd509900b5e0916e65eaa30cad7d53e6c6de67d; web SHA-256 18f4757c140f88babcaf1b161188cb8fcc9672d10edcf3720166175f4a5900c4. Lifecycle is supervised, not helper PASS. Sol owns reconciliation and the new scope's 17:20:52 ICT on 23 October 2026 retirement deadline. Registry TTL alone does not stop the services.
• Human acceptance stays NOT-RUN, not waived: Cheese's actual Brave live-suggestion screenshot, Brave version/date and opened-issue result. CHE-1593's current state card and callback reply carry the correct synthetic fixture/workspace and detailed walkthrough. Cheese's comment 01a15746-fac5-7050-a9ef-b01c08f7040f waives only historical initial-probe Test-First ordering. Historical evidence remains NOT-RUN, not retroactive PASS. Nits remain deferred. No provider retry occurred.

The sections below preserve earlier states as history. Their pending checks/reviews and old preview identities are not the current disposition. Evidence remains bound to each exact candidate named.

STE advisory: Retain 11 true semicolon and 16 true passive-voice warnings in this source/history. Treat 2 passive-voice state descriptions and 4 synonym-rotation warnings as false positives. The meaning check passes.

Historical Branch Repair — 20 October 2026

Status: Draft. The merge conflict is resolved and published. Independent review/OCR and final CI for this new pair remain pending. Only Cheese merges the PR.

• Head: 7e2dd73d023b2f1861b97c8049721505d7c511fc.
• Captured main/base: 6fd14f030655e6db6b9fd6e8df1b3f285ab53998.
• Ordered parents: 2256409ad56097749db01e576df9dc38b18b4cda, then 6fd14f030655e6db6b9fd6e8df1b3f285ab53998.
• The only manual conflict was .env.example. The resolution retains the three suggestions settings and main's two commented vote-gate settings. No rebase or force-push occurred. The PR diff against the captured main contains 31 paths.
• Local PASS: exact environment-setting/marker assertions, PR-range git diff --check, nginx privacy/router fixtures and cutover control-flow fixtures. Full web and DB-backed search suites are NOT-RUN in this maintenance turn. Their earlier results do not transfer to this new pair.
• At 16:12 ICT, GitHub reported MERGEABLE/BLOCKED with 11 SUCCESS, 3 SKIPPED and 4 IN_PROGRESS. The remaining block was not a merge conflict. CI was not watched or re-run.
• The preserved preview at https://congvc-x99.taila6fa8a.ts.net:19695/ still serves 2256409ad56097749db01e576df9dc38b18b4cda, build 0mSxLjv5h55oozzZMs4F5. This turn changed no serving checkout, preview service, route, database, artifact, C00 or production resource. A preview of the new head is NOT-RUN.
• Cheese's historical initial-probe Test-First ordering waiver remains recorded in 01a15746-fac5-7050-a9ef-b01c08f7040f. The historical evidence remains NOT-RUN, not retroactively PASS. Actual Brave screenshot/version/date/issue selection remains NOT-RUN, not waived. Nits remain deferred.

The earlier status sections below are historical. Their review/check receipts apply only to the exact pairs they name.

Historical Gate State — 20 October 2026

Cheese wrote the following in native issue comment 01a15746-fac5-7050-a9ef-b01c08f7040f at 10:07 ICT on 20 October 2026:

waive initial-probe Test-First for CHE-1593

Only the historical initial-probe Test-First ordering is WAIVED by Cheese. Historical test evidence remains NOT-RUN, not retroactively PASS. This does not waive Brave acceptance, API/privacy checks, independent review/OCR or merge permission. Keep this PR draft. Only Cheese merges.

Published head: 2256409ad56097749db01e576df9dc38b18b4cda. REST base: 6b89a1764afb6418af873336c720bbc36bcb447e. Exact-head CI: 17 SUCCESS, 3 SKIPPED, zero failed or pending. Opus's independent PASS/OCR in issue comment 01a14d04-5107-7883-89a6-74d2ef730a44 covers only this pair. Live main is now 860e4e1210bb2879e4658d282d0076aeb727bef3; this is not a current-main integration claim.

Cheese's actual Brave screenshot, Brave version/date and selected-issue result remain NOT-RUN, not waived. The existing queued Sol run handles the reported preview OTP problem. This status update does not assert that sign-in works.

Historical Implementation And Verification Notes

The original candidate labels and unwaived-state notes below remain historical evidence. The current gate disposition is the section above.

Status
Draft implementation for CHE-1593. Candidate fc127686e9414faf03625dbc25164eb0c6d68a81, based on main.
The successful cookie probe opens the live-build gate. The signed Opus PASS and OCR receipt for b3158dfa218185cdc00e6fc9e8fd14830bc9c934 remain exact-head evidence only. They are not PR-ready or full-issue PASS. Fresh independent review and exact-head OCR for this candidate remain pending. Cheese's Brave screenshot/selection remains NOT-RUN, not waived.

Conditions

• Agents never merge. Production/C00 changes ship only through the normal release after Cheese's merge. This correction makes no C00 changes. Post-merge C00 acceptance is tracked separately on root CHE-1590.
• No tokens in URLs and no changes to cookie attributes. Only Cheese activates the Brave shortcut.
• Brave requires Improve search suggestions on. Delete old entries and re-discover the workspace engine to obtain the new stable URL.
• The initial probe commit 706bfe02b613fd6f6ec0e6629e4975875c475844 mixed tests and production. The initial-probe Test-First Gate is NOT-RUN, not waived. The live phase has the tests-only RED commit below. This does not retroactively repair probe history. The leader must reconcile this historical gate before ready.

Change

• /api/search/suggestions?workspace_slug=<slug>&q=<typed-text> reuses the existing issue/project query builders and bounded runner. Human session cookies/JWTs/PATs are accepted. Task tokens and non-members are denied.
• Admission runs before authentication/database work. Per-user sliding limits, a process cap and a 1500 ms request/database timeout bound load. Palette searches retain 8 seconds. Searches are sequential. The slot survives cancellation until database work ends.
• Up to five issue identifier/title rows and three project title rows appear. Description/comment-only matches do not. Closed issues remain findable. Raw query echo, four-element JSON, no-store/nosniff/Vary headers and query-free outcomes preserve the browser contract.
• The search route opens a matching workspace identifier directly. Other queries retain the palette. The C00 router template logs paths only, without referrers. Search failure logs use query length. Next.js dev logging suppresses address-bar URLs.
• Nginx suppresses error logging for the sensitive suggestions and search locations. Next.js suggestions proxy failures log only the diagnostic code; they do not expose query or referrer markers. Unrelated health proxy diagnostics remain available.
• All probe routes, runners and probe documentation are removed from the final files. Self-hosting settings, Compose wiring, upgrade instructions and troubleshooting are documented.

flowchart TD
  XML[Workspace OpenSearch document] --> Brave[Brave keyword mode with human session]
  Brave --> Proxy[Same-origin API rewrite]
  Proxy --> Admission[Input switch and process cap]
  Admission --> Auth[Session membership human guard and user limit]
  Auth --> Issues[Existing issue search with bounded runner]
  Issues --> Projects[Existing project search with bounded runner]
  Projects --> Rows[Private suggestion rows and query-free outcome]
  Rows --> Search[Chosen issue text enters workspace search route]
  Search --> Issue[Matching workspace issue page]

Loading

Spec deviations

1. The measured probe used /<workspace>/suggestions-probe, a Next.js route and a bundled isolated C00 service. It did not use the stable backend URL or an X99 app preview. Cheese's approval comment 01a13530-228e-7b9f-bc88-2a20186864ca accepts isolated C00 side-hosting. The live endpoint now uses the specified backend URL. The engine must be re-discovered once because the probe URL differed.
2. Probe diagnostics contained only session-cookie presence and control/error counters. Hint-cookie and fetch-metadata fields were not collected. No cookie value or typed text was logged.
3. Probe destination-URL following was not tested. The approved identifier-selection fallback is implemented. Description and destination arrays remain empty. A title beginning with this workspace's identifier opens that issue, as the approved tradeoff states.
4. The outer recorder buffers the small response before setting final privacy/outcome headers. It does not stream inner errors. This preserves the specified status/body behavior and includes middleware rejections.
5. Capacity/cancellation tests use an actual PostgreSQL table lock instead of adding a production search-hold test hook. No new global hook is introduced.
6. The attached preview screenshots show the real endpoint response and a real issue-selection round trip in isolated headless Chromium, not Brave's omnibox. Cheese's Brave screenshot remains NOT-RUN and is not replaced by these screenshots.

Evidence

• Valid probe: fetch with cookie, Brave 1.97.56, 14 Oct 2026 about 16:45 ICT, Improve search suggestions on. withCookie=22, withoutCookie=0, errors=0, control PASS. Destination URL followed: not tested. Source: comment 01a13a83-33cc-7bb4-8bfc-0df398df220b.
• Main synchronization: merge 44fe6af9a, then tests-only commit 8f79d178563c7b68ad116246a6805e37385e0017, then implementation 8c585438aad2c3951886f33266113f3acf539f27, then scoped lint correction b3158dfa218185cdc00e6fc9e8fd14830bc9c934. Commits were pushed in small steps without rewriting history.
• RED ran with the database connected. This is a behavioral failure, not a compile or collection failure. The same HTTP contract tests now pass. Extra edge-case tests added during implementation are retrospective.

Integration suite: database connected; running tests
--- FAIL: TestSearchSuggestionsAuthAndScoping
search_suggestions_test.go:107: status = 404, want 401; body 404 page not found
--- FAIL: TestSearchSuggestionsResults
--- FAIL: TestSearchSuggestionsIdentifierPrefix
--- FAIL: TestSearchSuggestionsRateLimitAndLogPrivacy
--- FAIL: TestSearchSuggestionsTimeoutReleasesCapacity
FAIL github.com/multica-ai/multica/server/cmd/server

Web RED: 4 failed | 35 passed (39)
Router RED: router must use a path-only log format without query text or referrer

• GREEN: 10 named backend suggestions tests, plus subcases, against the managed isolated database. Auth, session-user/workspace isolation, task/PAT paths, limits, timeout/cancellation capacity release, closed/hidden matches, metrics, CORS and error fallback pass.
• Search regressions: 34 tests PASS. Metrics package PASS. Web: 343 tests across 41 files PASS. Web typecheck, targeted ESLint, router fixtures and git diff --check PASS.
• HTTPS preview: https://congvc-x99.taila6fa8a.ts.net:19694/che1593-preview/issues . Real cookie attributes are Secure, HttpOnly and SameSite=Strict. Session-cookie suggestions return C9-1 Address-bar suggestions preview and a project row. The emitted issue text opens /che1593-preview/issues/C9-1 with its title visible.
• Screenshots, full RED/GREEN output, marker-log check and service/cleanup receipt are attached on CHE-1593. The preview uses task-owned user services. Production listeners are unchanged. Hermes retired the old C00 probe in comment 01a13a89-b3db-746a-ae89-2a24711d5ef5.
• The signed Opus (x99-claude-opus, Anthropic) code-review PASS and OCR receipt cover only b3158dfa218185cdc00e6fc9e8fd14830bc9c934. The previous PR author was x99-codex-sol (OpenAI). This new head requires fresh independent review and exact-head OCR before PR-ready. CI readback and exact-head review remain separate evidence.
• CI on 8c585438aad2c3951886f33266113f3acf539f27 found two unchecked response writes, field alignment and a missing Changelog line. The scoped correction explicitly discards irrecoverable response-write errors and applies gofmt. This PR description supplies the Changelog line. Fresh CI is separate from the local validation.
• Exact-head CI recovery, observed 15 Oct 2026 at 03:50 ICT: run 38584015823, attempt 2, is SUCCESS on b3158dfa218185cdc00e6fc9e8fd14830bc9c934.
  Backend-tests and the backend aggregate PASS. All 10 suggestions tests/subcases and TestCreateComment_GovernanceOn_NativeMentionRoutingUnaffected PASS.
  Latest Changelog line PASS (38586749862). No production or test change was needed. Only failed CI jobs were rerun.
  The prior missing-receipt assertion is intermittent, but its root cause is not established. Main baseline reproduction remains NOT-RUN.
• Correction commit order: tests-only d2a5b1671e37ed4abc746ef42713517089be0593, implementation d50db3a964387781d3ef952700dcd14562293f5e, tests-only d370fc32b0186876936e614bf250d7166d3debe7, tests-only aa708c0b5ace012a332fdd3dd958fd2f6452b01c, then implementation 667b8c208e26d7c709c40b98c8927d4ee6632e08.
• RED at tests-only head d2a5b1671e37ed4abc746ef42713517089be0593: frontend-test observed the synthetic query marker in Next.js output. The sqlc-check failure on that run was a dependency-download error before drift validation (issue comment 01a13c9e-326e-73cb-a570-210463d9e55e). The later tests-only cutover checks reproduced duplicate Nginx upstream mappings before the deduplication fix.
• GREEN on 15 Oct 2026 at 07:09 ICT: pnpm --dir apps/web exec vitest run proxy-failure-privacy.test.ts passed (1 test). bash deploy/cd/test-router.sh passed the nginx error-log privacy and router fixtures. bash deploy/cd/test-cutover.sh passed the cutover fixtures.
• Exact-head CI on 667b8c208e26d7c709c40b98c8927d4ee6632e08: run 38654950498 passed all applicable checks; the Changelog line check 38654950571 passed. frontend-quality, image-budget and daemon-artifact were skipped.
• X99 candidate artifact SHA-256: bd5a2ebfee04b2cdbd72e7a6886fd6c2e986622d889cff76ed139c34a2bc87c2. Build ID: KMtF5DJkPHkWy0werifXB. The tailnet preview at https://congvc-x99.taila6fa8a.ts.net:19695/ served the matching build ID in HTML; its build manifest returned HTTP 200.
• The attached production-proxy-failure.log retains ECONNREFUSED for suggestions without query or referrer markers. The unrelated /health failure retains its diagnostic query marker.
• Local tests removed their temporary nginx container and work directories. The preview remains available for review at port 19695; do not stop it before review. Tailnet route cleanup is tailscale serve --https=19695 off. The recorded web-service cleanup command is systemctl --user stop che1593-correction-preview-web.service. Service-stop readback is NOT-RUN because the systemd user bus is unavailable in this shell.
• The initial-probe Test-First Gate remains NOT-RUN, not waived. No tdd-proof CI check exists on this PR. Green GitHub checks do not resolve the historical gate, signed review, OCR receipt or Brave preview evidence.
• STE advisory warnings and Mermaid syntax/render evidence are retained in the delivery receipt. Actual GitHub Mermaid rendering is NOT-RUN.
• STE advisory: 21 warnings. The 14 passive-voice and 4 semicolon warnings are true positives retained from the source. The synonym-rotation warnings for removed, fetch and fix are false positives.

Residual privacy correction — current head fc127686e9414faf03625dbc25164eb0c6d68a81

• The correction starts with tests-only commit 7aa326660d33891e6ee0840b122e52b3c19a34a6 at 12:15:21 ICT. Nginx RED at 12:16:07 ICT reported nginx error log includes sensitive markers: NGINX_BACKEND_ISSUES_QUERY_MARKER_1593 NGINX_BACKEND_PROJECTS_QUERY_MARKER_1593 NGINX_WEB_ISSUES_QUERY_MARKER_1593 NGINX_WEB_PROJECTS_QUERY_MARKER_1593 NGINX_PALETTE_REFERRER_MARKER_1593.
• Next.js behavioral RED ran at tests-only head e880154de34d480e223fe250493daa4d24041e93. web-red-behavioral-final.log records the missing Referrer-Policy: origin and both palette query markers in Next.js output. RED was behavioral, not a compile or collection failure.
• Tests-only commits befd7027b02a71002dec48a409a5200bd41509f7 and e880154de34d480e223fe250493daa4d24041e93 precede implementations d1b7c26a816b42cb90572a2eb88a2528a68c8c89 and 3438f2bf2d84996d29688e676c4a6258aa6609a2. The final tests-only commit fc127686e9414faf03625dbc25164eb0c6d68a81 adds supplemental tests retrospectively and does not replace the RED evidence.
• GREEN on 15 Oct 2026 at 14:37 ICT: pnpm --dir apps/web exec vitest run proxy-failure-privacy.test.ts proxy.test.ts passed 39 tests across two files. bash deploy/cd/test-router.sh, bash deploy/cd/test-cutover.sh and web typecheck passed in the retained X99 receipts. git diff --check passed.
• X99 artifact SHA-256 is d99318b892ae69e03f03982f7abf1fe1fedba0ff545edeaef143764487469628. Its source is fc127686e9414faf03625dbc25164eb0c6d68a81; build ID is ObHRMekhaIyYf2Umu3YvR.
• The durable X99 preview is https://congvc-x99.taila6fa8a.ts.net:19695/ . The HTML contains the matching build ID. Its build manifest returns HTTP 200. The workspace search response sets Referrer-Policy: origin.
• Preview failure probes returned HTTP 502 for suggestions, issue search and project search. The unrelated /health control returned HTTP 500. The Next.js log retained ECONNREFUSED and PREVIEW_UNRELATED_QUERY_MARKER_1593; it contained none of the synthetic query/referrer markers for the sensitive search paths.
• Preview unit che1593-preview-fc127686e.service is active with MainPID 3873050. Tailscale port 19695 routes to 127.0.0.1:13277. Keep the preview available for review. Cleanup handles are systemctl --user stop che1593-preview-fc127686e.service and tailscale serve --https=19695 off.
• Exact-head CI run 38700122607 was pending at 14:38 ICT. Changelog line run 38700122736 and changes passed. frontend-quality, image-budget and daemon-artifact were skipped.
• Commit author and committer match the configured Git identity congvc-bot[bot] <3634010+congvc-bot[bot]@users.noreply.github.com>.
• Historical initial-probe Test-First remains NOT-RUN, not waived. Cheese's Brave screenshot/selection remains NOT-RUN, not waived. No C00 change or merge occurred. Finding 1 is FIX; fresh independent review and OCR are required for this head. Nits remain deferred.

Search proxy cancellation correction — current head 5d044c2a9b363aadbf11464035c4a555ba225005

• Correction commit order: tests-only 3ea669f3729c409046dc1d4a829d4691beb2441d, then implementation 5d044c2a9b363aadbf11464035c4a555ba225005. The tests-only commit follows 6e5c89fac5769eee4128f5191a24b0805e41ffa3.
• Behavioral RED on 3ea669f3729c409046dc1d4a829d4691beb2441d: pnpm --filter @multica/web exec vitest run proxy-failure-privacy.test.ts lib/search-proxy.test.ts exited 1. Output: Test Files 2 failed (2) and Tests 4 failed | 2 passed (6). The three real HTTP abort tests observed open upstream requests for suggestions, issue search and project search. The cancellation disposition test received 502 instead of 499. Collection succeeded. The failures were behavioral.
• GREEN on 5d044c2a9b363aadbf11464035c4a555ba225005: the same command exited 0 with Test Files 2 passed (2) and Tests 6 passed (6).
• Relevant web regressions on 5d044c2a9b363aadbf11464035c4a555ba225005 exited 0 with 84 tests passing across five files. pnpm --filter @multica/web typecheck also exited 0.
• The correction forwards request.signal to the upstream fetch. An expected client abort returns 499/no-store without logging Search proxy failed. Genuine upstream failures retain sanitized diagnostics and 502/no-store behavior.
• STE advisory: 26 warnings. The 16 passive-voice and 7 semicolon warnings are true positives from retained text. The removed, fetch and fix synonym warnings are false positives.

Changelog: Workspace search engines now offer authenticated issue and project suggestions in the browser address bar.

Closes CHE-1593