tracker

3.5 KB

1. # STATUS — tracker.worldapi.org
3. ## 2026-09-27 — ticket #1: the empty shell, ident login
5. Built the app from scratch: vendored `bin/hybriel` + `plugins/` + `shared/tokens.hl` from
6. `ident.worldapi.org` (newest local build, hybriel master 837fe120, no local patch — see
7. README "Vendored Hybriel"). `project.hl` (routes `/login`, `/callback`, `/logout`, `/`),
8. `components/home.hl` (the empty homepage), `components/main.hl` (shell), `styles.hl`
9. (accent green `#4ec9b0`, per `antcolony/README.md` "look and style" / `CONCEPT.md`).
10. `docker-compose.yml` / `Dockerfile` / `deploy.sh` following ident's own house pattern
11. (port 45008, container `tracker.worldapi.org`).
13. **Login**: the ident login BUTTON flow (ident.worldapi.org README "How apps use ident"),
14. server-side exchange (`POST <ident>/api/exchange`), this app's own framework session
15. (`session.user = { identity }`, cookie `trackersid`). ident hands over only the identity's
16. public **short id** — no display name yet (ident#11, properties handover, is on hold) — so
17. "your name" on the homepage is `Signed in as <shortid>`, the same identifier every other
18. worldapi app would show; see `decided` in the report.
20. **Lesson (Hybriel)**: a face that mutates `session.user` (e.g. `signOut`) does NOT
21. automatically re-render the page — a component's reactive members (`signedIn`, `identity`,
22. …) are computed once at mount from the framework's read-only session snapshot; a client
23. handler that calls `emit server X()` must ALSO flip the affected members itself afterwards
24. (ident's own `components/home.hl` `on doSignOut(e)` does exactly this: `emit server
25. signOut()` then `signedIn = false` …). Missing that made the sign-out button silently do
26. nothing client-side (the ack came back `ok:true`, the server-side session really was
27. cleared — proven by a reload — but the DOM never updated) until copied.
29. **Gate** (`tests/browser.mjs`, 13 checks): a fresh copy of `ident.worldapi.org`'s code (no
30. `.env`, no `storage/`, no `.sessions/` — verified empty of secrets/data before first use)
31. runs as this gate's own ident, on its own storage and its own mail sink (no live ident, no
32. real mail). The gate registers this app in that dev ident once over the `/__hl/emit` API
33. (the same one-time step a person does by hand in ident's `/apps` page), then drives the
34. REAL login-button flow in a real headless Chrome: signed out → click "Sign in with ident" →
35. ident's email form → the mail-sink code → the first-login optional-names form (Skip) → the
36. one-identity choice (one click) → back on tracker, "Signed in as `<shortid>`" → "Sign out" →
37. signed out again → a reload stays signed out. No console errors. Ran twice for stability, 0
38. failures; no leftover Chrome/hybriel processes after either run.
40. ```
41. node tests/browser.mjs
42. 13 passed, 0 failed
43. ```
45. `./deploy.sh --dry-run --target .scratch/deploy-preview --url http://127.0.0.1:0/` (a local
46. directory, per ident's own convention for testing deploy.sh without touching Byrodin): gate
47. passed, rsync preview held none of `storage/`, `.sessions/`, `.env`, `.scratch/`, `server.*`,
48. logs — confirmed by the same grep the script refuses on.
50. **Open**: the app is not registered with the LIVE ident yet — `TRACKER_KEY`/`TRACKER_SECRET`
51. are unset until the architect's first deploy does that (README "Deploy"); until then
52. `/login` on the live site answers a plain error page instead of redirecting (`/` itself
53. still renders). This is normal for a brand-new app, the same as ident's own SMTP `.env`
54. before its first deploy — not something this ticket's worker can set (no `.env` access,
55. and it is a LIVE ident registration).