preflight-02: fixture and persona access

Metadata	Value
Status	failed
Wave	preflight
PR refs	#6545
Personas	Avery Admin, Rowan Owner, Vivian Viewer, Nolan Outsider
Boards	qa-grid-24, qa-permissions-public
Profiles	main-writable, main-readonly
Chromium viewports	desktop-1440
Zoom	100%
Input	mouse, keyboard
Widget kinds	None
Artifact directory	/home/habs/.codex/worktrees/8ba8/homarr/.screenshots/release-v2/preflight-02
Candidate SHA	`f57a660088`
URL / actual ports	http://127.0.0.1:34401 / 34401; http://127.0.0.1:41589 / 41589
Runtime profiles / flags	main-writable and main-readonly; DEMO_MODE=true, DEMO_READ_ONLY=false, UNSAFE_ENABLE_MOCK_INTEGRATION=true
Executed personas	Avery Admin, Rowan Owner, Vivian Viewer, Nolan Outsider
Browser session IDs	p02-rerun-main-avery-r2, p02-rerun-main-rowan, p02-rerun-main-vivian, p02-rerun-main-nolan, p02-rerun-ro-avery, p02-rerun-ro-rowan, p02-rerun-ro-vivian, p02-rerun-ro-nolan
Timestamp	2026-08-31T22:58:30+02:00
Executed viewport / input / zoom	desktop-1440 / mouse, keyboard / 100%

Dogfood evidence

Case ID	Status	Evidence	Observed	Expected
PF-002-ENVIRONMENT	failed	runtime artifacts	Both local profiles rendered the app and assigned boards. The readonly Rowan baseline captured a missing static chunk (404) and both sampled profiles emitted a duplicate PostHog initialization warning; page-error buffers were empty.	Verify candidate identity, Chromium session, runtime health, fixture reachability, and clean console/network baselines.
PF-002-ACCESS	failed	access matrix, readonly steps	Authentication and direct board access worked for all personas. Shared-board role boundaries held, but privileged users in main-readonly could enter edit mode and reach enabled item-save UI.	Verify assigned profiles, personas, boards, permissions, and readonly boundaries before mutations.
PF-002-EVIDENCE	passed	artifacts	Fresh named Chromium sessions covered both profiles, all four personas, both boards, reload persistence, and a retry of the readonly interactive path. No secret values were recorded.	Capture timestamped viewport/input/zoom evidence and confirm artifacts contain no secrets.

Access matrix

Observed UI on the private shared board (qa-grid-24) and public board (qa-permissions-public):

Profile	Persona	Private shared board	Public board
main-writable	Avery Admin	Edit board and Board settings; 24 items	Edit board and Board settings; 2 items
main-writable	Rowan Owner	Edit board and Board settings; 24 items	Edit board and Board settings; 2 items
main-writable	Vivian Viewer	View only; 24 items	View only; 2 items
main-writable	Nolan Outsider	Denied with Board not found	View only; 2 items
main-readonly	Avery Admin	Edit board and item mutation UI; 24 items	Edit board; 2 items
main-readonly	Rowan Owner	Edit board and edit mode; 24 items	Edit board; 2 items
main-readonly	Vivian Viewer	View only; 24 items	View only; 2 items
main-readonly	Nolan Outsider	Denied with Board not found	View only; 2 items

Public-board behavior is recorded from the browser, not inferred from the fixture manifest. The main-readonly profile did not show Board settings in the privileged public-board views, but it still showed Edit board.

Runtime baseline

Authentication completed for all eight persona/profile combinations. Avery and Nolan required a hydration retry in their respective sessions; only the non-secret username was re-filled.
No page errors were captured in the fresh reload baselines for Rowan readonly or Vivian main-writable.
Rowan readonly captured GET /_next/static/chunks/_1wsmiab._.js [Script] 404 after reload. The matching main-writable Vivian filter captured no request.
Rowan readonly and Vivian main-writable both emitted the duplicate PostHog initialization warning. React DevTools and HMR messages were also present as development-runtime messages.

Findings

RV2-P1-001 — P1: main-readonly privileged sessions expose mutation UI

Preconditions: candidate f57a660088d6777c86aca22977354fa8b810e2be, main-readonly at http://127.0.0.1:41589, desktop-1440, 100% zoom, fresh named sessions.

Authenticate as Avery Admin in p02-rerun-ro-avery and open /boards/qa-grid-24.
Observe Edit board, enter edit mode, open an item settings menu, and observe Edit item, Move / resize item, Duplicate item, and Remove item.
Open Edit item and observe the enabled Save changes control.
Submit Save changes without changing a value, leave edit mode, reload, and verify the private board still has 24 items.
Repeat the board/edit-mode path as Rowan Owner in p02-rerun-ro-rowan.

Expected: main-readonly prevents board and item mutation affordances and save submission. Actual: Avery and Rowan can enter edit mode; Avery can reach the item mutation menu and enabled save control. The unchanged save did not alter fixture content, so this rerun does not claim a changed-value write. Reproducibility: reproduced across Avery and Rowan readonly sessions.

Evidence: step 1, step 2, step 3, step 4, Avery menu, Avery dialog, Rowan edit mode.

RV2-P2-002 — P2: authenticated readonly page requests a missing static chunk

Preconditions: candidate f57a660088d6777c86aca22977354fa8b810e2be, authenticated Rowan readonly session, fresh reload.

After clearing the request log and reloading qa-grid-24, the browser reported GET /_next/static/chunks/_1wsmiab._.js [Script] 404 while the board rendered. Request bodies, headers, cookies, tokens, and query strings were not inspected. The sanitized status capture is rerun-rowan-readonly-network-status.txt.

RV2-P2-003 — P2: authenticated pages emit duplicate PostHog initialization warning

Fresh reload console baselines for Rowan readonly and Vivian main-writable both emitted [warning] [PostHog.js] You have already initialized PostHog! Re-initializing is a no-op. No page errors were captured in either paired errors baseline. See Rowan console, Vivian console, and the corresponding Rowan errors and Vivian errors captures.

Persistence and mutation

Avery main-writable entered edit mode, performed an unchanged Save board action, reloaded, and retained the private-board title and 24 items.
Avery main-readonly opened the item edit dialog and submitted Save changes without changing a value; reload retained 24 items. This confirms no changed fixture value was introduced while demonstrating that the readonly save path is enabled.
Rowan main-readonly entered and exited edit mode without a mutation.
No other mutation was attempted because the packet’s purpose was permission and readonly-guard coverage.

Limitations and hygiene

This was a focused black-box browser rerun. No source files, network bodies, response bodies, headers, cookies, tokens, or password values were inspected or recorded.
The interactive recorder stop hung and left rerun-readonly-edit-affordance.webm at zero bytes; the annotated step screenshots are the relied-upon retry evidence.
Main-writable Vivian's matching chunk filter had no request after reload; the 404 finding is based on the direct Rowan readonly observation.
No widget or performance measurements were in scope.
The shared report aggregator and ledger were not run.

Artifacts

Cleanup

All rerun sessions were targeted for closure after evidence capture. The zero-byte recorder artifact was retained as produced; no browser secrets or product fixture values were written to the workspace.

23 KiB Raw Blame History Unescape Escape