A14 — Human Alpha control surface

[jaydumisuni]

Frozen A14 Human Alpha candidate

• Base / accepted A13: 264612c426d01e1c246f0beea451e735a259dccb
• Frozen A14 candidate: c5bb5b5dbd49bdee7b849b47e6dc1b42b9208f50
• Frozen tree: d2a8d66dc0d80a768efcdae519fa1e9e7e63050a
• Exactly one commit over A13.
• Supersedes all earlier failed/rejected A14 candidates.

Review corrections incorporated

Recovery and PR review identified and corrected all outstanding A14 closeout defects without milestone expansion:

• exact Host/Origin fencing prevents DNS-rebinding/cross-origin protected control access;
• exported authorize_control now rejects absent and whitespace-only explicit approvals;
• a visibly selected workspace without a loaded authority projection disables protected controls and is also rejected at submit time;
• successful authorization status is written after canonical refresh so request identity and the not completion distinction remain visible;
• each accepted socket receives bounded read/write timeouts so one idle local connection cannot block the synchronous control server indefinitely;
• proof-harness browser-provider/node_modules residue is removed before the final clean-tree assertion.

All five PR review threads are resolved against the final frozen head.

Delivers

• human Ptah home and Workspace selector
• Activity Centre, Object/Artifact explorer, multi-terminal, transfer and Browser projections
• Node/Provider health and evidence/limitation views
• diagnostic facts separated structurally from non-authorizing suggestions
• worker completion separated from caller/reviewer acceptance
• explicit dismiss/defer/alternative/upgrade and result-acceptance controls
• checkpoint/reconnect controls
• desktop/tablet/mobile preservation of critical controls
• client reopen reconciliation against fresh canonical truth
• full Workspace/Session/Node/Fence/Provider-generation fencing
• exact terminal/browser target-to-Provider binding
• blank-approval, replay and malformed-framing rejection
• loopback-only binding plus exact Host/Origin authority fencing
• physical TCP-level Host/Origin/missing-Host rejection tests
• bounded accepted-connection request I/O
• selected-workspace/authority mismatch fencing
• authorization result preserved across canonical refresh
• dispatch authorization explicitly separated from operation completion

Exact-head proof

GitHub Actions run 32608257902 / A14 run #18 passed on the exact frozen candidate.

Retained artifact: a14-human-alpha-c5bb5b5dbd49bdee7b849b47e6dc1b42b9208f50

Artifact digest: sha256:37b95445451f47fe57f076fee0e4cf753483eebb0f8423c4d312c89dfa22fee1

Proof record confirms:

• exact-head match: true
• exactly one commit over A13: true
• A14 tests: 20
• full workspace tests: 265
• strict format + pedantic Clippy: passed
• loopback control boundary: passed
• physical viewports: desktop, tablet, mobile
• explicitly authorized submissions: 6
• final repository working tree: clean (git-status.txt = 0 bytes)
• status: exact_head_human_alpha_proof_passed

A14 has completed Build → Review → Freeze → Prove. Keep this PR unmerged until final owner acceptance/sign-off; Ship is the only remaining A14 gate.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e46584c-75b2-4adc-8d67-b5b4c17046cd

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9779670920

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jaydumisuni]

@codex address that feedback

Please address the P1 inline review finding about DNS rebinding / untrusted Host and Origin on the A14 loopback control server. Requirements:

• reject untrusted Host values before serving /api/state or /api/control;
• reject cross-origin Origin values when Origin is present;
• preserve valid loopback use for 127.0.0.1 / ::1 / localhost on the actual bound port;
• reject duplicate/blank Host and duplicate/blank Origin framing;
• add unit tests;
• extend .github/workflows/a14-human-alpha-control-proof.yml with physical curl proof that trusted loopback returns 200 while attacker Host and attacker Origin return 403;
• do not weaken any existing authority, replay, approval, provider-generation, or exact-head gates.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.