docs(website): record the demo's step-5 walk, its findings and the answers (DM27-DM29) #387

wtclaude · 2026-10-28T03:18:20-05:00

wtclaude commented

2026-10-28 03:18:20 -05:00

Records the §10 step-5 walk of demo.runicgateway.com in website/DEMO_MODE.md, and the org lead's answers to what it found (DM27–DM29). Docs only.

What was walked (2026-10-28) on website main, Module-Rust v0.6.1, Rust bundle 2026.10.22, rig Rust build 26139947:

Every lock through the API: 87/87 (all Tier A rows, uploads, data: URIs, module locks, bridge config, redaction, noindex).
Console deny list at save: 21/21, including the reward step and teardown commands. At run: proven on a local core (saved with DEMO_MODE off, run with it on).
Browser: demo-player, demo-moderator, demo-admin; toast, hero draft and Preview with Publish refused, config editor.
App (edge debug build) on the public HTTPS address: strip, sign-in, refusal snackbar.
One wipe cycle: a changed config, permission, NPC placement, event, hero draft and action toggle all came back (11/11).

Findings and answers

Seeded events can't run because their actions start disabled → DM28: the seed switches them on (website PR).
SECRET_WORDS over-flags harmless fields → DM29: left as is.
play-review not walked → its password is read on the host, and it gets walked after the fixes land.
The Steam link can be removed (player and staff) → DM27: locked (Module-Rust PR into edge, then a cutover).
Chrome on the walker's PC could not open the public URL → local to that PC; the org lead reached it through the proxy.
Moderation queues empty (nothing seeded). Noted only.

AI-assisted: Claude Code (Claude Opus 5.5)

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

Records the §10 step-5 walk of `demo.runicgateway.com` in `website/DEMO_MODE.md`, and the org lead's answers to what it found (DM27–DM29). Docs only. **What was walked (2026-10-28)** on website `main`, Module-Rust v0.6.1, Rust bundle 2026.10.22, rig Rust build 26139947: - Every lock through the API: **87/87** (all Tier A rows, uploads, `data:` URIs, module locks, bridge config, redaction, `noindex`). - Console deny list at save: **21/21**, including the reward step and teardown commands. At run: proven on a local core (saved with `DEMO_MODE` off, run with it on). - Browser: `demo-player`, `demo-moderator`, `demo-admin`; toast, hero draft and Preview with Publish refused, config editor. - App (`edge` debug build) on the public HTTPS address: strip, sign-in, refusal snackbar. - One wipe cycle: a changed config, permission, NPC placement, event, hero draft and action toggle all came back (**11/11**). **Findings and answers** 1. Seeded events can't run because their actions start disabled → **DM28: the seed switches them on** (website PR). 2. `SECRET_WORDS` over-flags harmless fields → **DM29: left as is**. 3. `play-review` not walked → its password is read on the host, and it gets walked after the fixes land. 4. The Steam link can be removed (player and staff) → **DM27: locked** (Module-Rust PR into `edge`, then a cutover). 5. Chrome on the walker's PC could not open the public URL → local to that PC; the org lead reached it through the proxy. 6. Moderation queues empty (nothing seeded). Noted only. - [x] AI-assisted: Claude Code (Claude Opus 5.5) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-28 03:18:23 -05:00

docs(website): record the demo's step-5 walk and its findings 2d596c51d9

Every lock through the API (87 checks), the console deny list at save on the
demo and at run on a local core, the three published logins in the browser,
the app on the public HTTPS address, and one wipe cycle restoring a changed
config, permission, NPC placement, event and hero draft. Lists what the walk
found: seeded events whose actions start disabled, the credential check
over-flagging, play-review not walked, the open Steam unlink, empty
moderation queues.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-28 04:44:39 -05:00

docs(website): the org lead's answers to the step-5 walk (DM27-DM29) 598b439ec6

DM27 locks removing a Steam link on the demo (player route by demoLocks,
staff route in its handler); DM28 has seed:demo switch on the actions the
seeded events use; DM29 leaves SECRET_WORDS as is. The Chrome problem was
local to the walker's PC, and play-review is walked once the fixes land.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude changed title from ~~docs(website): record the demo's step-5 walk and its findings~~ to docs(website): record the demo's step-5 walk, its findings and the answers (DM27-DM29)

2026-10-28 04:45:25 -05:00

whitlocktech merged commit 64583c6d1c into main

2026-10-28 04:47:14 -05:00

whitlocktech referenced this issue from a commit

2026-10-28 04:47:15 -05:00

Merge pull request 'docs(website): record the demo's step-5 walk, its findings and the answers (DM27-DM29)' (#387) from docs/demo-step5-walk into main

whitlocktech deleted branch docs/demo-step5-walk

2026-10-28 04:47:16 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/docs#387