Slice 1 (0c6fb899eb) asked for two things to be checked on a scratch server before the page is built: signing in, and writing a decision from the page. Checked 2026-11-04, 11:59 AM to 12:01 PM Detroit time, by this session's run.

The scratch server. Fossil 2.27 serving three repositories, alpha, beta and console, from one directory (fossil server --repolist), with the ocx2 release the agents daemon runs (gate green 646 examples) as ocx2-cgi in its extension root. Logins alice and bob in each, goi24prj. In alpha and beta, bob asked alice a question with two options, using ocx2 post TICKET TEXT --for alice --options.

1. Signing in

• Each repository signs you in by itself. Signing in at /alpha/login sets cookie fossil-<code> with path /alpha. With it, /alpha/ext/ocx2-cgi/questions?json=on answers for: alice and her one question; /beta/... answers for: nobody and none.
• Signing in to each works together. After a second sign-in at /beta/login, both cookies are kept and beta answers for: alice. A page on the same host reads both, since the browser sends each project's cookie with each project's request.
• A login group makes one sign-in do. After fossil login-group join of beta and console to alpha's group, one sign-in at /alpha/login set a cookie with path /, and beta answered for: alice.

2. Writing a decision

• OCX, not Fossil, decides, and it refuses. A real (not dry-run) POST of alice's decision to /alpha/ext/ocx2-cgi/post was refused with 403 and "post changes something, so it is taken only by a POST from OCX's own page on this site, ext/ocx2-cgi or ext/ocx2-cgi-next" when the Referer was: none; the console's file, /console/doc/trunk/console/index.html; and beta's own OCX page, /beta/ext/ocx2-cgi/console. Only the same project's OCX page counts. This is OCX's decision 111 (USAGE.md, "Stage, accept or roll back a release"): never from "a file a user committed, which Fossil serves under /doc". A dry run passes with any Referer.
• A project's console page may be framed by the same host. It is sent with X-Frame-Options: SAMEORIGIN. Its buttons are forms posting to, decision, text and back to ocx2-cgi/post.

3. Serving the console from its repository

• Fossil serves the committed prototype as it is: /console/doc/trunk/console/index.html as text/html and console.js as text/javascript, with script-src 'self', so the page's script runs and may fetch every project on the same host.

What it means for slice 1

Reading the three lists across projects needs no change anywhere: the page fetches each project's console?json=on, and the maintainer signs in to each project once, or once for a login group. A press on a page served from this repository can't write a decision without changing OCX's rule. How the press is made is the maintainer's to decide; the question is in this run's thread.

Not checked here: no browser runs on this host, so the page itself was not opened; these are HTTP requests made with curl. Also not checked, and worth checking in a browser: whether a page on the same host can still pass decision 111, as the Fetch standard lets a script name any same-origin Referer (fetch(url, {referrer})), and a same-origin page may submit a form inside a framed OCX page. If so, the Referer check does not stop a committed file, and the rule rests on who may commit.