From b7d7bf059ef34eaefe3a18c219ef3dd3f4595d97 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Wed, 28 Oct 2026 07:18:23 -0500 Subject: [PATCH] docs(website): record the demo's re-check after DM27/DM28 and the play-review walk The 12:00 UTC wipe on 2026-10-28 installed Module-Rust v0.6.3 (its first run tagged v0.6.2 and failed to publish it). play-review walked 19/19, the seeded events' actions came up enabled and Server greeting ran, and both Steam unlinks answer 403 DEMO_LOCKED with the link kept. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY --- website/DEMO_MODE.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/website/DEMO_MODE.md b/website/DEMO_MODE.md index a9bdc54..09cc01d 100644 --- a/website/DEMO_MODE.md +++ b/website/DEMO_MODE.md @@ -610,12 +610,24 @@ through that proxy. - **The credential check over-flags.** `SECRET_WORDS` matches words such as `key` and `auth` inside longer names ("Allow Master Key", "TC Auth Only", a drone preset key), so on the demo those harmless fields are hidden and read-only. **Left as is (DM29).** - - **`play-review` was not walked**: its password is only in the host's `.env`. It is read on the - host and walked after the two fixes land. + - **`play-review` was not walked**: its password is only in the host's `.env`. The org lead read + it there and handed it over, and it was walked with the re-check below. - `demo-player` could remove its stand-in Steam link, and staff could remove it for them. **Locked (DM27).** - The public URL did not open in Chrome on the walker's PC, while curl and the emulator reached it; the org lead opened it through the proxy without trouble, so it is local to that PC. - Nothing seeds the moderation queues, so the moderator tour shows empty lists. + + **Re-checked after the fixes** (2026-10-28, the 12:00 UTC wipe, Module-Rust **v0.6.3**, whose run + tagged a v0.6.2 first and then failed to publish it): + - **`play-review`, 19/19.** It is not among the published logins; it signs in as admin and reads + settings, users, servers and events; its own username, password, email, two-factor, recovery + codes and sessions are refused, as are the site's admin locks. The app's path works too: mobile + sign-in, a bearer read, a refused lock and sign-out. Its web sign-in was checked through the + API, which is the call the page makes. + - **Seeded events, W1.** The three actions are on, uncapped, straight after the wipe, and + Server greeting ran to completion. + - **Steam link, W4.** `demo-player`'s unlink and staff's unlink both answer `403 DEMO_LOCKED`, and + the link stays. 6. **Play**: the sign-in details in the Play Console point at `play-review`; runicgateway.com `/beta` publishes the logins. -- 2.49.1