@1agh/maude 0.53.0 → 0.53.2

package/apps/studio/http.ts

@@ -5,7 +5,7 @@
 // top-level fall-through for paths Bun's `routes` field doesn't cover.
 
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync, watch } from 'node:fs';
+import { existsSync, readFileSync, unlinkSync, watch } from 'node:fs';
 import { dirname, join, posix, relative, resolve, sep } from 'node:path';
 
 import {
@@ -22,6 +22,7 @@ import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { ImportAssetError, importSvg, SVG_MAX_BYTES } from './bin/_import-asset.mjs';
 import { ImportBrandError, importBrand } from './bin/_import-brand.mjs';
 import { buildCanvasModule } from './canvas-build.ts';
+import { buildCanvasSandboxed } from './canvas-build-sandbox.ts';
 import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
 import { createCloudEndpoints } from './cloud/endpoints.ts';
@@ -82,7 +83,7 @@ import { gitShowFile } from './git/service.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
-import { DEV_SERVER_ROOT, MEDIA_DIR, STICKERS_DIR } from './paths.ts';
+import { BIN_DIR, DEV_SERVER_ROOT, MEDIA_DIR, STICKERS_DIR } from './paths.ts';
 import { createPhotoStore, PHOTO_EDIT_MAX_BYTES } from './photo-store.ts';
 import { probeReadiness } from './readiness.ts';
 import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
@@ -91,6 +92,7 @@ import { isHubReadOnly } from './sync/hubs-config.ts';
 import { signInToWorkspace, workspaceDisclosure } from './sync/workspace-signin.ts';
 import { readUiPrefs, type UiPrefs, writeUiPrefs } from './ui-prefs.ts';
 import { loadWhatsNew, resolveMaudeVersion } from './whats-new.ts';
+import { isWorkspaceMode } from './workspace-mode.ts';
 import { isLoopbackHost } from './ws.ts';
 
 // Real disk install root — never the virtual `/$bunfs/root` of compiled bins.
@@ -317,6 +319,14 @@ export const READ_ONLY_ALLOWED_WRITES = new Set([
   '/_api/export-jobs/download',
   '/_api/report', // bug reports are about Maude, not the project
   '/_api/report-fallback',
+  // Cloud Phase 27 — COMMENT IS THE ONE WRITE A VIEWER HOLDS. The role matrix
+  // has said so since Phase 25 C4 (`viewer.comment === true`), the People page
+  // promises it in those words, and the cell's proxy allows it — but this list
+  // did not, so a viewer's comment was accepted by the authority and then
+  // refused by the defence-in-depth layer behind it. Found by commenting as a
+  // viewer against a real cell. A second gate that is STRICTER than the first is
+  // still a gate that is wrong.
+  '/_comments',
   '/_api/hub/link', // link/unlink ≈ session management (cell allows /auth/logout)
   '/_api/workspace/sign-in', // signing in is how the role is (re)learned
   '/_api/workspace/disclosure',
@@ -328,6 +338,18 @@ export const READ_ONLY_ALLOWED_WRITES = new Set([
   '/_api/git/checkout', // viewing another branch, not changing one
 ]);
 
+/**
+ * Write paths a read-only session may use whose members are GENERATED rather
+ * than declared, so an exact-match set cannot name them.
+ *
+ * Deliberately one entry. Every regex here is a hole nobody can see by reading
+ * the list above, so the bar for adding one is that an exact path genuinely
+ * cannot express it.
+ */
+export const READ_ONLY_ALLOWED_WRITE_PATTERNS: RegExp[] = [
+  /^\/_api\/comments\/[A-Za-z0-9_-]+\/reply$/,
+];
+
 /** The refusal a read-only session gets for a project-mutating write. */
 export function readOnlyRefusalResponse(): Response {
   return Response.json(
@@ -502,6 +524,40 @@ async function serveCanvasTsx(
     const source = await file.text();
     const deps = localDepsFromSource(source, absPath, ctx.paths.designRoot);
     let result: Awaited<ReturnType<typeof buildCanvasModule>>;
+    // DDR-209 A′2 — SAME ENGINE, DIFFERENT HOST. On a desktop the process that
+    // parses your canvas is the process you own, so an in-process build costs
+    // nothing. In a cell it holds HUB_SECRET and the tenant's storage
+    // credentials, and the source is written by somebody who is not us — so the
+    // build goes out of process, with an empty environment, an import allowlist
+    // and wall-clock + RSS ceilings (Cloud Phase 25 A1's contract, unchanged).
+    // This branch is also what `sandboxArmed` in the containment boot-assert
+    // attests: the cell may serve the canvas surfaces BECAUSE this exists.
+    if (isWorkspaceMode()) {
+      const built = await buildCanvasSandboxed({
+        designRoot: ctx.paths.designRoot,
+        canvasAbs: absPath,
+      });
+      if (!built.ok) {
+        return new Response(`Canvas build error: ${built.error}`, {
+          status: built.kind === 'build' ? 422 : 500,
+          headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+        });
+      }
+      result = {
+        js: built.js,
+        locator: built.locator,
+        etag: built.etag,
+      } as Awaited<ReturnType<typeof buildCanvasModule>>;
+      cached = {
+        sig: canvasFreshnessSig(absPath, deps),
+        etag: `${result.etag}-${RUNTIME_BOOT_ID}-${CHROME_EPOCH}`,
+        js: result.js,
+        deps,
+      };
+      canvasCache.set(absPath, cached);
+      await writeLocator(locatorAbsPath, canvasSlug(absPath, ctx.paths.designRoot), result.locator);
+      return respondWithCanvasModule(req, cached);
+    }
     try {
       result = await buildCanvasModule(absPath, source, {
         designRoot: ctx.paths.designRoot,
@@ -538,6 +594,13 @@ async function serveCanvasTsx(
     await writeLocator(locatorAbsPath, canvasSlug(absPath, ctx.paths.designRoot), result.locator);
   }
 
+  return respondWithCanvasModule(req, cached);
+}
+
+/** The conditional-GET half of serving a built canvas module. Shared by the
+ *  in-process (desktop) and sandboxed (cell) build paths so the two cannot
+ *  disagree about caching semantics. */
+function respondWithCanvasModule(req: Request, cached: { js: string; etag: string }): Response {
   const ifNoneMatch = req.headers.get('if-none-match');
   if (ifNoneMatch === cached.etag) {
     return new Response(null, {
@@ -650,14 +713,50 @@ async function serveHistoricalCanvas(
   });
 }
 
+/**
+ * How long a served file may be reused — Cloud Phase 27 B2.
+ *
+ * `no-store` on everything is correct on a laptop, where the round trip is a
+ * memcpy and the designer is editing the file you just served. Over the
+ * internet it means a teammate re-downloads every photograph on every pan, on
+ * a project whose media is 266 MB. So:
+ *
+ *   content-addressed name  →  immutable, a year. The name IS the content
+ *                              (sha8), so a changed file is a changed URL and
+ *                              a stale answer is impossible by construction.
+ *   everything else         →  revalidate (`no-cache` + ETag). A designer
+ *                              editing `hero.png` in place still sees their
+ *                              edit; the wire cost of not having changed it is
+ *                              a 304, not the file.
+ *
+ * Universal, not cloud-only: the rule is true on all three shells, and a
+ * caching policy that differs per shell is a bug report nobody can reproduce.
+ */
+export function cacheControlFor(absPath: string): { cacheControl: string; addEtag: boolean } {
+  const name = absPath.slice(absPath.lastIndexOf('/') + 1);
+  // The shape every writer emits — timeline insert/replace/assemble, the asset
+  // upload route, `maude design fetch-asset`: <sha8>.<ext>, lowercase hex.
+  if (/^[0-9a-f]{8,64}\.[A-Za-z0-9]+$/.test(name)) {
+    return { cacheControl: 'public, max-age=31536000, immutable', addEtag: false };
+  }
+  return { cacheControl: 'no-cache', addEtag: true };
+}
+
+/** A weak validator from the file's own metadata — no read, no hash. */
+function etagFor(file: { size: number; lastModified: number }): string {
+  return `W/"${file.size.toString(16)}-${Math.trunc(file.lastModified).toString(16)}"`;
+}
+
 async function serveFile(absPath: string, headers: Record<string, string> = {}): Promise<Response> {
   const file = Bun.file(absPath);
   if (!(await file.exists())) return new Response('Not found', { status: 404 });
   const e = ext(absPath);
+  const policy = cacheControlFor(absPath);
   return new Response(file, {
     headers: {
       'Content-Type': MIME[e] || 'application/octet-stream',
-      'Cache-Control': 'no-store',
+      'Cache-Control': policy.cacheControl,
+      ...(policy.addEtag ? { ETag: etagFor(file) } : {}),
       ...headers,
     },
   });
@@ -685,7 +784,9 @@ async function serveMediaFile(
   const size = file.size;
   const base = {
     'Content-Type': MIME[ext(absPath)] || 'application/octet-stream',
-    'Cache-Control': 'no-store',
+    // B2 — same policy as serveFile. Media is the heaviest thing a member
+    // fetches, so the content-addressed case matters most here.
+    'Cache-Control': cacheControlFor(absPath).cacheControl,
     'Accept-Ranges': 'bytes',
     ...headers,
   };
@@ -1218,11 +1319,32 @@ export function createHttp(
     // knows before it draws anything. It decides what the UI OFFERS and is
     // never what stops a write — the cell enforces that (Phase 25 C1),
     // whatever a patched client believes.
-    '/_config': () =>
+    '/_config': (req: Request) =>
       Response.json({
         ...ctx.cfg,
         canvasOrigin: ctx.canvasOrigin,
-        readOnly: projectReadOnly(),
+        readOnly: projectReadOnly(req),
+        // Cloud Phase 27 (DDR-209) — the capability that opens the cookieless
+        // canvas origin, minted per session by the proxy. Absent on a desktop,
+        // where the canvas origin is loopback and needs none. `canvasUrl()`
+        // appends it exactly the way it already appends `readOnly`, which is
+        // what keeps this a FLAG on the shared client rather than a fork of it.
+        ...(req.headers.get('x-maude-canvas-token')
+          ? { canvasToken: req.headers.get('x-maude-canvas-token') }
+          : {}),
+        // Cloud Phase 27 C2/C4 — the ONE cloud-only input the shared client
+        // takes. Its presence says "you are in a browser tab, on somebody
+        // else's machine", which is what lets the client state the agent's
+        // absence and offer a way back to the dashboard. A flag, not a fork:
+        // every other difference between the three shells stays zero.
+        ...(isWorkspaceMode()
+          ? {
+              cloud: {
+                dashboardUrl: process.env.HUB_DASHBOARD_URL ?? 'https://cloud.maude.sh',
+                projectName: process.env.MAUDE_PROJECT_NAME ?? ctx.cfg.name ?? null,
+              },
+            }
+          : {}),
       }),
 
     // What's New feed (DDR-A) — read-only product-update list surfaced in the
@@ -1251,6 +1373,88 @@ export function createHttp(
       );
     },
 
+    // feature-bug-report-button — capture the STUDIO SHELL (menubar, sidebar,
+    // status bar, toasts) as a PNG. `/_api/export` can only ever render a canvas
+    // headlessly, so Maude's own chrome — where most reported UI bugs actually
+    // live — has never been capturable from inside the app. This shells out to
+    // the same `screenshot.sh` spine every `/design:*` capture uses, in its
+    // `--shell` mode, so it inherits engine resolution (the desktop bundle's
+    // agent-browser via MAUDE_AGENT_BROWSER, DDR-144), one-time browser
+    // provisioning, and the playwright fallback.
+    //
+    // The capture is a SEPARATE headless session, not a mirror of the user's
+    // window: it reproduces the app's chrome and the active canvas, but not
+    // transient state (an open dropdown, a stuck spinner). That's why the
+    // dialog keeps the manual attach/paste lane alongside this.
+    //
+    // PRIVILEGED: main-origin only + double gate — it spawns a process and
+    // renders the project, so the untrusted canvas origin must never reach it
+    // (absent from CANVAS_SAFE_API + startCanvasServer routes, per DDR-088).
+    '/_api/shell-shot': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      // Target the very server handling this request — no _server.json read, so
+      // a stale/absent state file can't point the capture at another instance.
+      const port = new URL(req.url).port;
+      if (!/^\d+$/.test(port)) {
+        return Response.json({ error: 'no port on the request URL' }, { status: 500 });
+      }
+      // Which canvas to open is the CLIENT's call, always sent explicitly —
+      // `null` means "open nothing". The server's `_active.json` is global and
+      // sticky (it outlives every closed tab and any session may write it), so
+      // resolving it here would photograph a canvas the reporter never had open.
+      const body = await readJson<{ canvas?: unknown }>(req);
+      const canvas = typeof body?.canvas === 'string' ? body.canvas : '';
+      const out = join(ctx.paths.designRoot, '_reports', `shell-${Date.now()}.png`);
+      try {
+        const proc = Bun.spawn(
+          [
+            'bash',
+            join(BIN_DIR, 'screenshot.sh'),
+            '--shell',
+            '--port',
+            port,
+            '--out',
+            out,
+            '--root',
+            ctx.paths.repoRoot,
+            '--canvas',
+            canvas,
+          ],
+          { stdout: 'ignore', stderr: 'pipe' }
+        );
+        // Booting a browser, loading the studio, opening the active canvas and
+        // painting it runs well past a default fetch timeout on a cold cache;
+        // the dialog shows a pending row meanwhile. Kill rather than hang.
+        const timer = setTimeout(() => proc.kill(), 60_000);
+        const code = await proc.exited;
+        clearTimeout(timer);
+        if (code !== 0 || !existsSync(out)) {
+          const why = (await new Response(proc.stderr).text())
+            .trim()
+            .split('\n')
+            .slice(-3)
+            .join(' ');
+          return Response.json({ error: `shell capture failed: ${why}` }, { status: 502 });
+        }
+        const png = await Bun.file(out).arrayBuffer();
+        // The PNG is handed to the client and never needed again — leaving it on
+        // disk would quietly grow `_reports/` on every dialog open.
+        try {
+          unlinkSync(out);
+        } catch {
+          /* already gone — nothing to clean up */
+        }
+        return new Response(png, {
+          headers: { 'content-type': 'image/png', 'Cache-Control': 'no-store' },
+        });
+      } catch (e) {
+        return Response.json({ error: `shell capture failed: ${String(e)}` }, { status: 502 });
+      }
+    },
+
     // feature-bug-report-button — submit proxy. The client never talks to
     // cloud.maude.sh directly (no CORS surface to open, and the endpoint can be
     // overridden for self-hosters/tests via MAUDE_REPORT_URL). Forwards the
@@ -1263,7 +1467,13 @@ export function createHttp(
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
       try {
-        const upstream = await fetch(endpoint, {
+        // `globalThis.fetch` — NOT bare `fetch`: this module declares its own
+        // `async function fetch(req: Request)` (the server fall-through handler)
+        // in the same scope, which shadows the global. A bare call re-entered the
+        // fall-through with a URL string, so `new URL(req.url)` threw
+        // `"undefined" cannot be parsed as a URL` and every report died with a
+        // plain-text HTTP 500 without ever leaving the machine.
+        const upstream = await globalThis.fetch(endpoint, {
           method: 'POST',
           body: await req.formData(),
           signal: AbortSignal.timeout(30_000),
@@ -1365,7 +1575,7 @@ export function createHttp(
         // the api layer — DDR-115). The layout lane mutates the versioned
         // `.meta.json`, so a read-only session is refused here, in-handler,
         // where the two lanes are distinguishable.
-        if (projectReadOnly() && 'layout' in body.patch) {
+        if (projectReadOnly(req) && 'layout' in body.patch) {
           return readOnlyRefusalResponse();
         }
         const next = await api.patchCanvasMeta(body.file, body.patch);
@@ -3948,7 +4158,11 @@ export function createHttp(
     '/index.html': () => serveFile(join(CLIENT_DIR, 'index.html')),
   } satisfies Record<string, (req: Request) => Response | Promise<Response>>;
 
-  async function fetch(req: Request): Promise<Response> {
+  // Named `handleFallthrough`, not `fetch` — a same-named local function shadows
+  // the global `fetch` for every call site in this module's scope, which is how
+  // the `/_api/report` route ended up calling itself instead of the network (see
+  // the `globalThis.fetch` comment on that route; RCA issue-report-a-bug-http-500).
+  async function handleFallthrough(req: Request): Promise<Response> {
     try {
       const url = new URL(req.url);
       const pathname = url.pathname;
@@ -4062,17 +4276,13 @@ export function createHttp(
           if (RANGE_MEDIA_EXTS.has(ext(name))) {
             return serveMediaFile(abs, req, { 'X-Content-Type-Options': 'nosniff' });
           }
-          const f = Bun.file(abs);
-          if (await f.exists()) {
-            return new Response(f, {
-              headers: {
-                'Content-Type': MIME[ext(name)] || 'application/octet-stream',
-                'Cache-Control': 'no-store',
-                'X-Content-Type-Options': 'nosniff',
-              },
-            });
-          }
-          return new Response('Not found', { status: 404 });
+          // B2 — the SAME caching policy as every other static lane. This
+          // route is the one a canvas's photographs actually come down, so
+          // `no-store` here is the difference between a teammate re-fetching
+          // 266 MB of media on every pan and re-fetching none of it. Content-
+          // addressed names (`<sha8>.<ext>`, which is what every writer emits)
+          // are immutable by construction; anything else revalidates.
+          return serveFile(abs, { 'X-Content-Type-Options': 'nosniff' });
         }
       }
 
@@ -4317,13 +4527,28 @@ export function createHttp(
   // covers all three doors at once: the main-origin `routes` table, the
   // canvas-origin `routes` allowlist in server.ts (it references these same
   // handlers), and the dynamic-path `fetch` fall-through (comment replies).
-  function projectReadOnly(): boolean {
+  function projectReadOnly(req?: Request): boolean {
+    // ---- Cloud Phase 27 A3/A4 (DDR-209): the role is PER SESSION ----------
+    //
+    // In a cell this process serves an owner and a viewer at the same time, so
+    // the on-disk answer below — one role per hub URL — is not merely stale, it
+    // is the wrong SHAPE. The proxy in front vouches a role per request and
+    // injects the capability it derived from the one role table.
+    //
+    // AND IT DEFAULTS CLOSED. The local path fails OPEN by design: `catch`
+    // returns false, an unset `linkedHub` returns false, and a fully writable
+    // studio is the correct answer for a tool running on your own laptop. On
+    // the internet it is the whole ballgame — so in a cloud build read-only is
+    // the default and an edit role requires positive proof.
+    if (isWorkspaceMode()) {
+      return req?.headers.get('x-maude-readonly') !== '0';
+    }
     return ctx.cfg.linkedHub ? isHubReadOnly(ctx.cfg.linkedHub.url) : false;
   }
 
   function readOnlyRefusal(req: Request): Response | null {
     if (READ_ONLY_SAFE_METHODS.has(req.method)) return null;
-    if (!projectReadOnly()) return null;
+    if (!projectReadOnly(req)) return null;
     let pathname: string;
     try {
       pathname = new URL(req.url).pathname;
@@ -4331,6 +4556,10 @@ export function createHttp(
       return readOnlyRefusalResponse();
     }
     if (READ_ONLY_ALLOWED_WRITES.has(pathname)) return null;
+    // The dynamic half of the comment lane. An exact-match set cannot express
+    // it, and leaving it out would mean a viewer may leave a comment but not
+    // reply to one — a distinction nobody promised and nobody wants.
+    if (READ_ONLY_ALLOWED_WRITE_PATTERNS.some((re) => re.test(pathname))) return null;
     return readOnlyRefusalResponse();
   }
 
@@ -4342,7 +4571,7 @@ export function createHttp(
   ) as typeof routes;
 
   async function guardedFetch(req: Request): Promise<Response> {
-    return readOnlyRefusal(req) ?? fetch(req);
+    return readOnlyRefusal(req) ?? handleFallthrough(req);
   }
 
   return { routes: guardedRoutes, fetch: guardedFetch, serveCanvasShell, isCanvasSafeRoute };

package/apps/studio/paths.ts

@@ -48,6 +48,14 @@ export const CLIENT_DIR: string = join(DEV_SERVER_ROOT, 'client');
 /** `<DEV_SERVER_ROOT>/dist/runtime/` — pre-built /_canvas-runtime/*.js bundles. */
 export const RUNTIME_BUNDLES_DIR: string = join(DIST_DIR, 'runtime');
 
+/**
+ * `<DEV_SERVER_ROOT>/bin/` — the shell helpers behind `maude design <verb>`.
+ * Resolved here rather than locally per DDR-045: inside a `bun --compile`
+ * binary a local `dirname(fileURLToPath(import.meta.url))` yields the virtual
+ * `/$bunfs/root`, and every `existsSync` against it silently returns false.
+ */
+export const BIN_DIR: string = join(DEV_SERVER_ROOT, 'bin');
+
 /**
  * `<DEV_SERVER_ROOT>/stickers/` — bundled whiteboard sticker packs
  * (feature-whiteboard-annotation-improvements, Phase 4). Ships with the

package/apps/studio/server.ts

@@ -14,13 +14,12 @@
 // else binds to a port. The orchestrator (slash commands) reads _server.json
 // to detect a live instance and avoid duplicate boots.
 
-import { spawn } from 'node:child_process';
-
 import { createAcp } from './acp/index.ts';
 import { cancelInstall, cancelSignin } from './acp/login-state.ts';
 import { createActivity } from './activity.ts';
 import { ASSET_MAX_VIDEO_BYTES, createApi } from './api.ts';
 import { bootSelfHeal } from './boot-self-heal.ts';
+import { isSandboxArmed } from './canvas-build-sandbox.ts';
 import { createCanvasListWatch } from './canvas-list-watch.ts';
 import { type AiActivityEntry, createAiActivity } from './collab/ai-activity.ts';
 import { createGitLifecycle } from './collab/git-lifecycle.ts';
@@ -177,8 +176,22 @@ const MAX_REQUEST_BODY = ASSET_MAX_VIDEO_BYTES + 8 * 1024 * 1024;
 // Checked against the ACTUAL route table (`http.routes` keys plus the paths the
 // `fetch` fall-through owns), not a hand-maintained list, so a future route can
 // only escape it by being invisible to both.
-const WORKSPACE_FETCH_ROUTES = ['/_ws/acp', '/_canvas-shell.html', '/_canvas-runtime/'];
+//
+// Split by verdict (DDR-209 A′1), because the two halves are asserted
+// differently. `/_ws/acp` is FORBIDDEN and the fall-through 404s it in a cell,
+// so it is only asserted outside workspace mode (where it is genuinely
+// reachable). The canvas surfaces are SANDBOXED — a cell serves them — so they
+// are asserted ALWAYS, which is what makes the sandbox attestation load-bearing
+// rather than decorative.
+const FETCH_ROUTES_FORBIDDEN_IN_WORKSPACE = ['/_ws/acp'];
+const FETCH_ROUTES_SANDBOXED = ['/_canvas-shell.html', '/_canvas-runtime/'];
 const WORKSPACE = isWorkspaceMode();
+// DDR-209 A′1 — the contract that lets a cell serve `/_canvas-shell` +
+// `/_canvas-runtime` at all: the canvas build runs out of process, with an empty
+// environment, an import allowlist and ceilings. Computed here rather than
+// inside workspace-mode.ts, which has no business importing the build host —
+// and passed in, so an unstated contract reads as an unmet one.
+const SANDBOX_ARMED = isSandboxArmed();
 // PRUNE first, then assert over what survived — so the assert is a
 // post-condition on the pruning rather than a second, driftable opinion. A
 // prefix added to the vocabulary then both prunes and is verified, together.
@@ -191,24 +204,32 @@ if (WORKSPACE && pruned.removed.length > 0) {
   );
 }
 try {
-  assertContainment([...Object.keys(SERVER_ROUTES), ...(WORKSPACE ? [] : WORKSPACE_FETCH_ROUTES)], {
-    // Presence of the dependency is the signal: a cell image that ships
-    // Playwright is one import() away from rendering tenant content. Skippable
-    // in a dev checkout, where Playwright is a legitimate devDependency of the
-    // E2E harness and would otherwise make workspace mode untestable locally.
-    // A BUILT cell image has no such escape — scripts/check-containment.sh
-    // enforces the runtime-dependency half at build time.
-    resolveModule:
-      process.env.MAUDE_WORKSPACE_ALLOW_DEV_MODULES === '1'
-        ? undefined
-        : (specifier) => {
-            try {
-              return !!import.meta.resolveSync?.(specifier);
-            } catch {
-              return false;
-            }
-          },
-  });
+  assertContainment(
+    [
+      ...Object.keys(SERVER_ROUTES),
+      ...FETCH_ROUTES_SANDBOXED,
+      ...(WORKSPACE ? [] : FETCH_ROUTES_FORBIDDEN_IN_WORKSPACE),
+    ],
+    {
+      sandboxArmed: SANDBOX_ARMED,
+      // Presence of the dependency is the signal: a cell image that ships
+      // Playwright is one import() away from rendering tenant content. Skippable
+      // in a dev checkout, where Playwright is a legitimate devDependency of the
+      // E2E harness and would otherwise make workspace mode untestable locally.
+      // A BUILT cell image has no such escape — scripts/check-containment.sh
+      // enforces the runtime-dependency half at build time.
+      resolveModule:
+        process.env.MAUDE_WORKSPACE_ALLOW_DEV_MODULES === '1'
+          ? undefined
+          : (specifier) => {
+              try {
+                return !!import.meta.resolveSync?.(specifier);
+              } catch {
+                return false;
+              }
+            },
+    }
+  );
 } catch (err) {
   console.error(`\n${(err as Error).message}\n`);
   process.exit(1);
@@ -228,10 +249,15 @@ function startServer(port: number): BunServer {
       const pathname = new URL(req.url).pathname;
 
       // Containment (DDR-193 §2) — the `fetch` fall-through owns paths that are
-      // not in the route table (`/_ws/acp`, `/_canvas-shell.html`,
-      // `/_canvas-runtime/*`), so pruning the table alone would leave them
-      // reachable. 404, not 403: a cell should look like it never had the
-      // feature, rather than like it is refusing one.
+      // not in the route table (`/_ws/acp`), so pruning the table alone would
+      // leave them reachable. 404, not 403: a cell should look like it never had
+      // the feature, rather than like it is refusing one.
+      //
+      // `/_canvas-shell.html` and `/_canvas-runtime/*` used to be caught here
+      // too. DDR-209 A′1 reclassified them: a cell SERVES them (the browser is
+      // what evaluates), attested by the build sandbox at boot. They are not in
+      // `isForbiddenRoute` any more, so they fall through to `http.fetch` — on
+      // purpose, and the boot-assert is what keeps that honest.
       if (WORKSPACE && isForbiddenRoute(pathname)) {
         return new Response('not found', { status: 404 });
       }
@@ -293,6 +319,12 @@ function startServer(port: number): BunServer {
             id: crypto.randomUUID(),
             remote: req.headers.get('x-forwarded-for') ?? '127.0.0.1',
             kind: 'inspector',
+            // Cloud Phase 27 — stamp the role onto the socket at the handshake,
+            // the one moment the session is unambiguous. Fails CLOSED in a cell
+            // for the same reason the HTTP gate does: an absent header is an
+            // unproven session, and this channel can delete other people's
+            // comments.
+            readOnly: WORKSPACE ? req.headers.get('x-maude-readonly') !== '0' : false,
           },
         });
         if (ok) return undefined as unknown as Response;
@@ -468,12 +500,25 @@ ctx.mainOrigin = `http://localhost:${server.port} http://127.0.0.1:${server.port
 const CANVAS_ORIGIN_SPLIT = !/^(0|false|off|no)$/i.test(
   process.env.MAUDE_CANVAS_ORIGIN_SPLIT ?? ''
 );
-// The canvas origin exists to SERVE AND RENDER canvases (DDR-063). A workspace
-// cell has no business starting it — that second origin is the surface the
-// containment invariant is about. Not started here rather than started-and-
-// pruned: there would be nothing left to serve.
-const canvasServer = CANVAS_ORIGIN_SPLIT && !WORKSPACE ? startCanvasServer(0) : null;
-const canvasOrigin = canvasServer ? `http://localhost:${canvasServer.port}` : undefined;
+// The canvas origin exists to SERVE canvases into a segregated origin (DDR-063
+// / DDR-054). A workspace cell used to skip it, back when a cell was forbidden
+// to serve them at all. DDR-209 A′1 reverses that, and in a cell the split is
+// not merely protective — it is the boundary between one tenant's executing
+// canvas and everything else on that host, which is the strongest reason any
+// deployment has ever had to keep it on.
+const canvasServer = CANVAS_ORIGIN_SPLIT ? startCanvasServer(0) : null;
+// D4 — PUBLIC IDENTITY COMES FROM CONFIGURATION, NEVER FROM THE REQUEST.
+//
+// The loopback origin is what this process BINDS; behind a reverse proxy it is
+// not the address the member's browser can reach, and deriving it from the Host
+// header is exactly the bug Cloud Phase 25 shipped into production twice (a
+// member signing in was sent to an address that was not their project). So a
+// cell states its canvas origin explicitly and we use it verbatim.
+const canvasOrigin = process.env.MAUDE_PUBLIC_CANVAS_ORIGIN?.replace(/\/+$/, '')
+  ? process.env.MAUDE_PUBLIC_CANVAS_ORIGIN.replace(/\/+$/, '')
+  : canvasServer
+    ? `http://localhost:${canvasServer.port}`
+    : undefined;
 if (canvasOrigin) ctx.canvasOrigin = canvasOrigin;
 
 await Bun.write(
@@ -484,6 +529,10 @@ await Bun.write(
       port: server.port,
       url: `http://localhost:${server.port}`,
       ...(canvasOrigin ? { canvasOrigin } : {}),
+      // The port the canvas listener actually BOUND, as distinct from the
+      // public `canvasOrigin` name above. A co-located reverse proxy (the cell's
+      // hub) forwards canvas-origin traffic here; nothing else needs it.
+      ...(canvasServer ? { canvasPort: canvasServer.port } : {}),
       started: new Date().toISOString(),
       project: ctx.cfg.name,
       config_source: ctx.cfg._source,
@@ -553,11 +602,28 @@ console.log(`  Design:    ${ctx.paths.designRoot}`);
 console.log(`  Active:    ${ctx.paths.activeFile}`);
 console.log('  Press Ctrl+C to stop.\n');
 
-if (!process.env.NO_OPEN) {
-  if (process.platform === 'darwin')
-    spawn('open', [url], { stdio: 'ignore', detached: true }).unref();
-  else if (process.platform === 'linux')
-    spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+// A workspace cell has nobody at the keyboard, and no browser to open — the
+// member is already looking at this project through the proxy in front of it.
+// Attempting it there was not merely pointless: the spawn threw ENOENT on a
+// headless image and took the whole server down with it, which the supervisor
+// then dutifully restarted into the same crash. Two fixes, because they are two
+// separate mistakes: do not TRY in a cell, and do not DIE when it fails.
+if (!process.env.NO_OPEN && !WORKSPACE) {
+  const opener =
+    process.platform === 'darwin' ? 'open' : process.platform === 'linux' ? 'xdg-open' : null;
+  if (opener) {
+    // `Bun.spawn`, not `node:child_process.spawn` — it reports a missing
+    // executable SYNCHRONOUSLY, so one try/catch genuinely covers it. The node
+    // shim signals ENOENT through an async 'error' event, which a try/catch
+    // does not catch and an unhandled listener turns into a process-level
+    // throw. That is precisely how a headless image with no `xdg-open` took the
+    // whole server down. (DDR-009 also prefers Bun.* here.)
+    try {
+      Bun.spawn([opener, url], { stdin: 'ignore', stdout: 'ignore', stderr: 'ignore' }).unref();
+    } catch {
+      console.log(`  (could not open a browser automatically — visit ${url})`);
+    }
+  }
 }
 
 async function shutdown() {