commercial canary: reconcile the landing page, seat vocabulary and signed update eligibility #35

Activity

1. turinglambdaai commented on Oct 23, 2026

   

   turinglambdaai

   on Oct 23, 2026

   OwnerAuthor

   More actions

   Claiming the in-repo slice of this issue (one claimable slice at a time, per the issue's protocol).

   Starting SHA: a3e887e (main, post-#38; tree clean, fast-forwarded against origin).
   Owned files this slice: support/updates.rkt, app/gate.rkt, app/backend.rkt, support/updater.rkt (message only if needed), tests/gate-test.rkt, tests/update-test.rkt, tests/backend-wire-test.rkt, docs/update-contract.md, docs/index.html, PRICING.md, PRICING.zh-CN.md, CHANGELOG + version single source.
   Commands: raco test tests/*.rkt (local, minus the known Linux-only wire assertion), PR CI (Linux test + acceptance) as referee, release gate at the tag.
   Rollback: short-lived branch commercial-canary, revert merge or git revert per commit; no data migrations involved (exports are plain pcap/JSON/Markdown files).

   Slice contents (from the issue's 完成标准, against auth decision 2026-10-auth-1):

   1. Raw-data export leaves the legacy Pro gate: pcap-export and Wireshark retained-replay become free (PRICING free scope: "Moving raw capture export out of its legacy Pro gate still requires implementation"). The engineering report becomes the gated paid surface (report action) per the paid scope's evidence-backed reports — the old UI copy already claimed this but no gate existed.
   2. Update eligibility moves to the decision's rule — release time vs updates_through, never the current date ("the current date must not suddenly invalidate an acquired version"): the signed feed's published_at is compared against the entitlement cutoff (day-granular cutoffs extend to that day's end). Fixed UTC boundary tests: cutoff−1s ✓, exactly at cutoff ✓, cutoff+1s ✗, plus an expired-window install keeps its tier and still launches.
   3. Static-review items already green on main (landing page stack wording, seat vocabulary) get re-verified and the remaining doc drift (update-contract.md window paragraph, AppImage install shapes note, landing page asset list) is reconciled.

   Explicitly out of this slice, staying on the issue: real reference-hardware/privilege/runtime gates (need the Linux hardware leg; simulator evidence is never presented as hardware qualification) and the Commerce purchase→credential→eligibility loop (commerce repo).
2. turinglambdaai

   added a commit that references this issue on Oct 23, 2026

   Merge pull request #39 from turinglambdaai/commercial-canary

   ...

   4516599
3. turinglambdaai commented on Oct 23, 2026

   

   turinglambdaai

   on Oct 23, 2026

   OwnerAuthor

   More actions

   Slice delivered: in-repo authorization implementation (PR #39, released as v0.4.0)

   Claimed slice complete. Correction to the claim comment: actual starting base was f0d825c (main had advanced past the quoted a3e887e between writes); ending at merge commit 4516599, release run 39898528464 (success).

   完成标准逐项状态（Completion criteria):

   Item	Status	Evidence
   旧 GTK/WebView 安装命令清除，对照实际发布资产	✅	Stack wording fixed on main (dda27d2); this slice added the AppImage install card matching the shipped stable alias; landing page asset list = deb/rpm/AppImage/tar.gz/zip (v0.4.0 ships all)
   updates_through 之前/等于/之后的固定 UTC 边界测试	✅	tests/gate-test.rkt: cutoff−1s ✓ / exactly at cutoff ✓ / cutoff+1s ✗ (full instant); date-only cutoff extends to day's end; missing authenticated instant fails closed; fixed-UTC determinism asserted
   过窗仍可启动合法旧版	✅	A credential whose window is entirely past still grants the pro tier, keeps engine rights, and stages exactly the pre-cutoff releases (unit); the gate never touches startup
   不依赖下载/检查日期	✅	Eligibility is now a pure function of the signed feed's published_at vs updates_through — the decision reads no clock (updates-window-open? has no today/date parameter); previously the day after expiry even the last in-window release was refused
   团队离线席位如属约定制须明确	✅	PRICING (both languages, on main since fde07e0): "Offline seat limits are contractual, not real-time concurrency enforcement"; five named assignments, one one-seat entitlement per assignee, no floating/concurrent promise
   硬件时钟/模拟器证据分开	✅ (docs)	Landing page, README and ACCEPTANCE keep simulator evidence explicitly separate from NIC/PHC capability; no hardware claim derives from simulator passes
   历史门禁移除与数据兼容	✅	Raw capture export (pcap-export, Wireshark retained replay) left the Pro gate — wire-verified over real RVT1 with no entitlement (651 tests, 0 failures locally; Linux CI green); exports are plain pcap/JSON/Markdown files, no data migration. The engineering report is now the gated paid evidence surface per the paid scope

   静态审查 P0 复核： landing page stack wording and seat vocabulary were already fixed on main by fde07e0/dda27d2; re-verified at merge — no WebKitGTK/GTK3 references remain in docs/index.html; "5席" reads as five named users in both PRICING languages.

   未执行/排队（kept open on this issue, per the evidence protocol):

   • Real reference-hardware, privilege and runtime-control gates — require the Linux hardware leg with a real NIC/PHC; simulator evidence is never presented as hardware qualification (docs/ux-acceptance.md / docs/hardware-qualification.md).
   • Commerce purchase → duplicate delivery → credential recovery → update-eligibility closed loop (commerce repo Improve timing diagnostics and packet analysis workflow #1/Harden linuxptp runtime and reference clock lifecycle #2).

   Free-scope implementation status in PRICING (both languages) now states the 0.4.0 fact instead of the pending-move caveat.