From 2d596c51d9a33f5630c4183d91503e0989edc127 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Wed, 28 Oct 2026 03:18:06 -0500 Subject: [PATCH] docs(website): record the demo's step-5 walk and its findings Every lock through the API (87 checks), the console deny list at save on the demo and at run on a local core, the three published logins in the browser, the app on the public HTTPS address, and one wipe cycle restoring a changed config, permission, NPC placement, event and hero draft. Lists what the walk found: seeded events whose actions start disabled, the credential check over-flagging, play-review not walked, the open Steam unlink, empty moderation queues. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY --- website/DEMO_MODE.md | 46 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/website/DEMO_MODE.md b/website/DEMO_MODE.md index 9a50a45..e1e6adf 100644 --- a/website/DEMO_MODE.md +++ b/website/DEMO_MODE.md @@ -560,5 +560,51 @@ through that proxy. chat titles (DM26). **Public URL:** `demo.runicgateway.com` is served through Pangolin. Cloudflare's proxy in front of it made the app log Cloudflare's addresses as the visitors' IPs, under the default `TRUST_PROXY=1`. Cloudflare was set to DNS only, and the app now logs the real visitor. + DM26 then seeded the NPC profiles and chat titles, and restored wipes 378 and 381 brought the + whole default set back. + + **The walk (2026-10-28)**, on `website` `main`, `Module-Rust` v0.6.1 and Rust bundle 2026.10.22, + with the rig on Rust build 26139947 (the public branch that day): + - **Every lock, through the API:** all 87 checks passed. They cover each Tier A row for all three + published logins, the case and trailing-slash forms, the four upload routes, multipart sent to + an unlisted core route and to a module route, the `data:` URI forms (plain, `data:`, split + by a newline, in the hero draft, in a module write), both server-link locks, the bridge's config + under four spellings for reading and writing, the file list and write history without the + bridge, the Servers view without the sidecar URL, a redacted field, the raw-JSON save, a form + edit of a flagged field, and `noindex`. Prose containing `Data:` still saves. + - **The deny list at save:** 21 checks. Every ยง3.4 command was refused in a run step, under + each spelling (`global.`, `o.`, upper case, padding), in a teardown command, in a reward step + and in an edit of an existing event. The open commands (`say`, `server.writecfg`, `env.*`, + `weather.*`, `oxide.grant`, `kick`) all saved. + - **The deny list at run:** this half cannot be reached on the live demo, because every save path + asks first. It was run on a local core instead, on the v0.6.1 release tarball: an event holding + `quit` was saved and published with `DEMO_MODE` off, the core was restarted with it on, and the + run's step failed with the deny sentence before any command was sent. + - **In the browser**, as `demo-player`, `demo-moderator` and `demo-admin`: the strip, the logins + and **Use** buttons, the toast and the inline line on a refused username change, the moderator's + queues, and the hero editor saving and previewing its draft while Publish is refused. The config + editor left the bridge out and showed a redacted field read-only. A config change to AutoDoors + saved, reloaded the plugin on the rig and appeared in the history. The browser half ran + against the host's LAN address, because Chrome on the walking machine would not open the + public name, although `curl` and the emulator did. + - **In the app** (`Android-app` `edge`, debug build, public HTTPS address): the Home strip, sign-in + as `demo-admin`, and the maintenance switch refused with the inline line and the snackbar. + - **One wipe cycle:** before the 08:00 UTC wipe the walk changed AutoDoors' config, took a + permission out of `vip` and retitled it, deleted the `guard-1` placement, edited the greeting + event, added to the hero draft and enabled an event action. After the wipe all of them were + back as the default set has them, with all four NPCs alive. The site reseeded at 08:07 and the + rig was fully back at 08:17. + + **Found by the walk, open:** + - **The seeded events cannot run.** A fresh database has every event action switched off, so + Server greeting, Treasure drop and Payday show as ready but fail when started ("not enabled on + this deployment"). An admin can switch the action on, and the wipe switches it off again. + - **The credential check over-flags.** `SECRET_WORDS` matches words such as `key` and `auth` + inside longer names ("Allow Master Key", "TC Auth Only", a drone preset key), so on the demo + those harmless fields are hidden and read-only. + - **`play-review` was not walked**: its password is only in the host's `.env`. + - `demo-player` can unlink its stand-in Steam link (the player's Rust page). It is not locked, + and the wipe puts it back. + - Nothing seeds the moderation queues, so the moderator tour shows empty lists. 6. **Play**: the sign-in details in the Play Console point at `play-review`; runicgateway.com `/beta` publishes the logins.