<!-- release-v2-qa-report
{
  "packetId": "board-07",
  "status": "blocked",
  "caseStatuses": {
    "BD-007-THRESHOLDS": "blocked",
    "BD-007-MUTATION": "blocked",
    "BD-007-PERSISTENCE": "blocked",
    "BD-007-ACCESS-RECOVERY": "blocked"
  },
  "execution": {
    "candidateSha": "f57a660088d6777c86aca22977354fa8b810e2be",
    "url": "http://127.0.0.1:46641",
    "actualPort": 46641,
    "runtimeProfile": "main-readonly",
    "runtimeFlags": [
      "DEMO_MODE=true",
      "DEMO_READ_ONLY=true",
      "UNSAFE_ENABLE_MOCK_INTEGRATION=true"
    ],
    "persona": "Vivian Viewer",
    "sessionId": "qa-v2-board-07",
    "timestamp": "2026-08-31T15:45:54.133Z",
    "viewport": "desktop-1440",
    "input": "mouse",
    "zoom": 100
  },
  "findings": [
    {
      "id": "RV2-P1-001",
      "fingerprint": "release-v2-auth-locale-redirect-loop",
      "severity": "P1",
      "area": "routing/authentication",
      "title": "Locale rewrite causes an infinite browser redirect before the application renders",
      "summary": "A fresh Chromium session repeatedly requests the same entry route and ends on ERR_TOO_MANY_REDIRECTS, preventing the assigned browser flow.",
      "caseIds": [
        "BD-007-THRESHOLDS",
        "BD-007-MUTATION",
        "BD-007-PERSISTENCE",
        "BD-007-ACCESS-RECOVERY"
      ],
      "evidence": [
        "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/network/redirect-initial-network.txt",
        "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-fresh-retry.png",
        "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-initial.png"
      ]
    }
  ],
  "artifacts": [
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-fresh-retry-console.txt",
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-initial-console.txt",
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-initial-url.txt",
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/network/redirect-initial-network.txt",
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-fresh-retry.png",
    "/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-initial.png"
  ],
  "widgetChecks": [],
  "performance": {
    "measurements": [],
    "limitations": [
      "The application never rendered, so assigned feature, mutation, persistence, permission, viewport, and performance checks were blocked.",
      "No credentials were submitted and no product state was mutated.",
      "The finding was retried in a fresh Chromium context; console output was empty while document requests repeated until Chromium stopped the loop."
    ]
  },
  "independentReproductions": [
    {
      "findingFingerprint": "release-v2-auth-locale-redirect-loop",
      "agentId": "qa-v2-preflight-01",
      "outcome": "reproduced",
      "evidence": [],
      "notes": "See preflight-01 for an independent Luna Max reproduction."
    }
  ],
  "notes": "Report-only black-box run. No defect was fixed and no secret was recorded."
}
-->

# board-07: Permission-aware editing

| Metadata | Value |
| --- | --- |
| Status | blocked |
| Wave | board |
| PR refs | #6503, #6545 |
| Personas | Rowan Owner, Eden Editor, Vivian Viewer, Nolan Outsider |
| Boards | qa-permissions-public |
| Profiles | main-writable, main-readonly |
| Chromium viewports | desktop-1440 |
| Zoom | 100% |
| Input | mouse, keyboard |
| Widget kinds | None |
| Artifact directory | [/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07) |
| Candidate SHA | f57a660088d6777c86aca22977354fa8b810e2be |
| URL / actual port | http://127.0.0.1:46641 / 46641 |
| Runtime profile / flags | main-readonly; DEMO_MODE=true, DEMO_READ_ONLY=true, UNSAFE_ENABLE_MOCK_INTEGRATION=true |
| Executed persona | Vivian Viewer |
| Browser session ID | qa-v2-board-07 |
| Timestamp | 2026-08-31T15:45:54.133Z |
| Executed viewport / input / zoom | desktop-1440 / mouse / 100% |

## Dogfood evidence

| Case ID | Status | Evidence | Observed | Expected |
| --- | --- | --- | --- | --- |
| BD-007-THRESHOLDS | blocked | [browser artifacts](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07) | The application entry repeated redirects until Chromium stopped navigation; the assigned flow was not reachable. | Exercise every assigned viewport, zoom, and input, including breakpoint and dense-layout stress. |
| BD-007-MUTATION | blocked | [browser artifacts](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07) | The application entry repeated redirects until Chromium stopped navigation; the assigned flow was not reachable. | Exercise create, move, resize, reorder, collapse, and delete paths that apply to this packet. |
| BD-007-PERSISTENCE | blocked | [browser artifacts](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07) | The application entry repeated redirects until Chromium stopped navigation; the assigned flow was not reachable. | Reload, switch layouts or sessions, and verify saved and reset state remains correct. |
| BD-007-ACCESS-RECOVERY | blocked | [browser artifacts](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07) | The application entry repeated redirects until Chromium stopped navigation; the assigned flow was not reachable. | Verify Owner, Editor, Viewer, outsider, read-only, keyboard, cancellation, error, and recovery behavior that applies. |

## Performance measurements and limitations

No valid feature timing could be recorded because no application document rendered. Cold/warm, polling, rendering, memory, and recovery measurements remain blocked.

## Independent reproductions

The common routing failure was independently reproduced by qa-v2-preflight-01; the corresponding tracked packet contains its own browser evidence.

## Findings

### RV2-P1-001 — P1: locale rewrite causes an infinite browser redirect

Preconditions: candidate f57a660088d6777c86aca22977354fa8b810e2be, main-readonly, desktop-1440, 100% zoom, mouse, fresh named Chromium session qa-v2-board-07.

1. Launch a fresh Chromium context with the Chromium argument --no-sandbox.
2. Set the assigned viewport and open http://127.0.0.1:46641 or its authentication entry.
3. Observe repeated document requests to the same route.
4. Wait until Chromium displays ERR_TOO_MANY_REDIRECTS or chrome-error://chromewebdata/.
5. Close the context, retry in a fresh context, and observe the same result.

Expected: the application renders the assigned entry, permitting authentication and the packet flow. Actual: the redirect loop prevents the application from rendering. Reproducibility: reproduced on retry and independently by another Luna Max preflight agent. Console output was empty; network and visual evidence are linked below.

## Artifacts

- [redirect-fresh-retry-console.txt](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-fresh-retry-console.txt)
- [redirect-initial-console.txt](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-initial-console.txt)
- [redirect-initial-url.txt](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/console/redirect-initial-url.txt)
- [redirect-initial-network.txt](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/network/redirect-initial-network.txt)
- [redirect-fresh-retry.png](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-fresh-retry.png)
- [redirect-initial.png](/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/board-07/screenshots/redirect-initial.png)

## Mutations and persistence

No credentials were submitted and no product mutation occurred. Reload and fresh-session retries reproduced the routing failure, so application persistence was not reachable.

## Blockers and gaps

Every non-evidence case listed as blocked remains untested beyond the routing entry. No blocked cell is treated as passed.

## Cleanup

The named browser session was closed by the browser agent. Artifacts remain under the untracked packet directory; no secret values were captured.