Add human login, cross-device answers, and reachable preview links

[korya]

Problem

You could build a site with Creo, but only from the machine it runs on. Closing the laptop mid-build and picking up a phone — the thing the product promises non-coders — did not work: nobody had a name, there was no way to answer the agent or stop it from a second device, and preview links pointed at 127.0.0.1.

Two deferrals were also overdue. Human users (D1) had slipped from M1 to "M3/M4"; the per-tenant storage quota (D2) was deferred at M1, re-owed to M2, and shipped past — the miss that motivated docs/deferrals.md in the first place.

Solution

Add a human-login surface, let runs pause for a question that any device can answer, and make preview links follow the host that asked. Identity is a seam, not a hardcoding: an Authenticator driver answers only which human just proved themselves, and a fixed service turns that claim into a Creo-native session — so swapping in OIDC later touches no code outside the driver.

Browser ─▶ /login ─▶ Authenticator (pluggable)  ─▶ IdentityService (fixed)
                     ├── static  → account picker   identity → local user row
                     └── oidc    → redirect (M5)    → mint session → Principal
                                                                        │
             every route, every handler ◀───── one Principal type ──────┘

The static driver is a passwordless picker over precreated accounts — the permanent answer for a household, not a stopgap. It reports Assurance: attributed, and that property (never the driver's name) is what the honesty banner, the audit trail, and policy branch on. What it cannot prove is enforced structurally rather than documented: the server refuses to start when passwordless accounts exist and the bind address is reachable beyond a private network, naming --allow-unsecured as the one deliberate, logged way past. Tailscale's CGNAT range counts as private, so the tailnet path needs no override.

Runs gained two states. ask_user parks a run — releasing its worker, so a question costs nothing and survives any number of restarts — and RC-2 extends to waiting, because a paused conversation still owns its project. Cancel bumps the lease generation rather than only flipping status, which is what actually stops the holder: its next append is rejected in storage, the same fencing that makes crash takeover safe. Sessions now name their state (session.state.changed + GET /v1/sessions/{id}); clients render it instead of inferring "working" from run.started, which is how N clients drift into N notions of what the agent is doing.

Screenshots

Sign in by picking a name	Family-mode honesty banner

The banner shows whenever identity is attributed rather than proven. Its dismissal lives in page memory and nowhere else, so it returns on every reload and in every new tab — a warning you can permanently silence isn't one.

The agent asking a question; answerable here, on a phone, or from the CLI:

Typing a reply and tapping a choice take the same path — to the user they are the same act. This is load-bearing, not cosmetic: RequestRun always creates a run, so a typed reply would otherwise register a second run that RC-2 could never claim, and the user would watch their words vanish.

Defects found on the way

Four, three of them pre-existing:

• Cancel didn't fence. The first implementation flipped status but left the lease generation, so a cancelled worker kept appending for up to a renewal interval — observed as a question emitted twice after a stop.
• A test that passed vacuously. The language test's HTTP helper only decoded response bodies on success, so every error string it "checked" was empty. Caught by reverting a message and watching the test not fail; both the helper and the assertion are fixed, and the detector was re-verified by regression.
• The client's 401 check never matched (String(err) is prefixed "Error: "), so an unauthenticated visitor saw an empty "Your sites" instead of sign-in. Invisible in M3; fatal for a picker.
• creo account new failed on a fresh install with a SQLite out-of-memory error — the admin CLI never created its data directory, and this is now plausibly the first command an operator runs.

Deliberately not in scope

The oidc driver is deferred to M5 (ledger D6): it needs two dependencies under a stdlib-first rule and an IdP to test against, and T1 does not use it. The startup fence is what prevents that gap being shipped past silently. Asset upload (R-WEB-4) is now tracked as D7 — it was owned by no milestone, and a bakery site with no photo of the bakery is a real limit on the north-star claim.

Honest gaps

AC-14 is proven against a scripted server, not a GPU. The e2e drives the real binary through the real OpenAI protocol — including the quirk that local servers report finish_reason: "stop" while emitting tool calls, which is why the adapter trusts the presence of tool calls over the label. Whether a given local model is good at the task needs scripts/demo-local-model.sh and hardware that CI does not have.

AC-12 was audited against the escalation ladder, not against real users. Non-coder transcripts did not exist when the pass ran; the pass was sequenced last precisely so it could be transcript-driven, and it wasn't. Worth re-running once they exist.

Other Changes

• Error language (R-AGT-2/3), now enforced by tests. 22 handlers returned err.Error() verbatim — Go error strings, file paths, driver noise — to the client; they now go through serverError, which logs the cause and returns a sentence. internal/e2e/language_test.go reads what a user would see on every reachable failure path and rejects jargon.
• openai-compat adapter, written against the wire protocol rather than a vendor SDK, so one adapter covers Ollama, LM Studio, vLLM, OpenRouter, and OpenAI. Zero new Go dependencies.
• Storage quota is CAS-aware: an unchanged logo across ten versions is counted once, and content the tenant already holds is free — otherwise a tenant near their limit could never save any change at all. The check runs before any bytes are written, so a refused commit leaves nothing behind and retrying doesn't dig the hole deeper.
• R-NFR-2 measured at ~2 ms for a returning client against a 3-second target, as a regression alarm rather than a benchmark.
• docs/deploy/lan-and-tailscale.md — operator guide for both networking paths, including what the platform refuses and why the check catches mistakes rather than attackers.

Related:

• docs/plans/m4-blueprint.md — the validated plan this implements
• docs/deferrals.md — D1/D2 closed, D6/D7 opened

🤖 Generated with Claude Code