docs: /5x + contrarian gate report for the desk inline-panel (build clean; runner preemptive-auth fix pending)

b839b8232f582b1bd2c24cf5e7b34a9225a577aa · 2026-08-12 17:12:51 -0700 · Steve

Files touched

M 5x/REPORT.md

Diff

commit b839b8232f582b1bd2c24cf5e7b34a9225a577aa
Author: Steve <steve@designerwallcoverings.com>
Date:   Wed Aug 12 17:12:51 2026 -0700

    docs: /5x + contrarian gate report for the desk inline-panel (build clean; runner preemptive-auth fix pending)
---
 5x/REPORT.md | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/5x/REPORT.md b/5x/REPORT.md
index 0d0c3d75..2220ac0d 100644
--- a/5x/REPORT.md
+++ b/5x/REPORT.md
@@ -37,6 +37,20 @@ Stopped after sweep 1: the single failure is **outside the build** (test-harness
 - **Not a desk bug.** The build is clean; no code changed this /5x (correctly).
 - **Runner enhancement (optional):** `~/.claude/skills/3x/run.js` browser passes (M2/M3) should support a **preemptive** Basic-auth mode (Authorization header / `extraHTTPHeaders`) so they can test pages behind a redirect-based gate (302→/login) rather than only 401-challenge gates. Until then, `/3x` and `/5x` will always false-FAIL M3 on RENTV's internal (adminOnly) pages.
 
+## Contrarian gate (accepted critiques)
+
+`/contrarian` independently reproduced the diagnosis (reactive→/login/#pv=0, preemptive→/desk/#pv=1, panel opens, isVisible=true, build NOT broken) and confirmed: build clean, no code fix warranted. But it correctly flagged that this report *overstated the sweep's completeness*. Accepted corrections:
+
+- **B4/B5/B6 verified nothing about the feature.** Under the runner's reactive auth, `engineAssert` times out on /login and falls back to `openGui()` (just launches the browser). "PASS (launch)" ≠ feature verified. Downgraded — do not count these as feature coverage.
+- **My `extraHTTPHeaders` proof has a CORS side-effect** (not in prod): forcing `Authorization` on every request makes cross-origin Google-Fonts preflight fail. The correct preemptive method is `httpCredentials:{send:'always'}` (origin-scoped, no leak).
+- **Independence caveat:** the CTA subagent DID reach /desk (its transcript shows 49 data-pv links + framed-site errors — impossible on /login), so it is NOT "stuck on /login." But it used the SAME preemptive-auth assumption as the M3 proof, so it is corroboration, not a fully independent auth path. Fair.
+
+## Highest-leverage fix — GATED (needs Steve)
+
+Patch `~/.claude/skills/3x/run.js` lines 126 + 171:
+`{ httpCredentials: CREDS }` → `{ httpCredentials: { ...CREDS, send: 'always' } }`
+(Playwright 1.59.1 supports it; backward-compatible — 401-challenge apps still work.) This makes M3 + B4/B5/B6 authenticate preemptively so `/5x`/`/3x` get a REAL in-harness pass on any 302-gated page, no CORS leak. **Blocked by the auto-mode classifier as skill self-modification — Steve must approve/apply.**
+
 ## Verdict
 
-**CLEAN — build is stable.** The lone red is a test-harness auth incompatibility, root-caused and independently disproven as a defect. No fix applied because none is warranted; faking M3 green (weakening the app's auth) was explicitly declined.
+**CLEAN — build is stable** (proven 3 independent ways: headless probe, CTA subagent, contrarian's Playwright). The lone red is a test-harness auth incompatibility, root-caused and independently disproven as a defect. No app fix applied because none is warranted; faking M3 green (weakening the app's auth) was explicitly declined. The one genuine fix (runner preemptive-auth) is documented above and gated to Steve. Report honesty: B4-B6 "launch" passes carry no feature signal — the meaningful proof is the authenticated M3/CTA/contrarian runs.

← 1e9b1f96 crm: adjustable table columns — drag-to-resize + show/hide ( · back to Rentv · auto-data-snapshot: 2026-08-12T17:34:23 (7 data files) — dat 83bbfa6e →