lfg2025/archy
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

Record bounded HTTPS iframe and tab acceptance evidence

Browse Source
This commit is contained in:
archipelago
2026-10-07 19:12:05 -04:00
parent 60bd728a04
commit 516941192d
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/https-app-gate-followup-20261006.md
+30
View File
@@ -156,3 +156,33 @@ CGNAT-address port-443 listener, observed through read-only socket inspection.
Nodes without that competing tailnet bind retain their existing wildcard and
IPv6 HTTPS service. A configured Tailscale interface alone is not sufficient.
The added socket-profile cases are pending the same backend qualification run.
### Read-only Yaya iframe/tab follow-up (7 October)
Disposable Chromium contexts used the existing diagnostic session and mapped
`archipelago.local` to Yaya only within the test browser. Authenticated File
Browser (:8083) iframe, frame reload and separate-tab requests returned 200 on
HTTP and HTTPS at 390/1440 widths. Removing cookies in those disposable contexts
made iframe/tab reloads return 401; invalid sessions were also denied. All
non-GET/HEAD/OPTIONS requests were blocked. No signing, payment, shared-session
logout, service mutation or trust-store change was performed.
The full matrix passed 22/24 checks; two mobile invalid-session iframe navigations
timed out waiting for DOMContentLoaded. A bounded mobile follow-up passed 12/12
checks after those invalid-session checks waited only for response commit. That
proves the 401 response boundary, not successful page completion or a diagnosed
cause for the earlier timeouts. An initial frame-selection harness failure is
also retained separately.
Normal Chromium trust still rejects Yaya's leaf as an untrusted authority. Public
certificate inspection confirms `archipelago.local` matches its SAN, while
`192.168.63.169` does not. The matrix therefore used an explicit certificate
exception only in its isolated contexts; it is not trusted-TLS acceptance. The
test name is not claimed to be the operator's exact hostname.
Cookie removal is not actual logout, and an invalid token is not a naturally
expired session. Shared-session revocation, expiry/renewal, remember-me, interactive
gate exchange, physical companion and the exact reported hostname/app remain
open. No new source correction is justified by these checks. Evidence and scripts
are preserved in
`~/.local/state/archipelago/release-qualification/https-task17-20261007/`.