NODEDC_MISSION_CORE/docs/audits/2026-09-07-node-home-and-local-k1-r17.md

Node home and local K1 interface — R17

Approved product surface

The owner requests the existing Mission Core home and avatar → Settings → Environment composition on the onboard application, with the same reusable components. They explicitly approve moving any missing reusable settings and background components into the Design Guideline. Only Home has configurable landing content on Node; System and Devices keep their existing workspaces. Logo navigation returns to Home. Text, uploaded/URL image/video playlist, order and image duration are editable. Remove the decorative fallback radial gradient.

Operator job: personalize the onboard home, then enter existing system/device workflows. Home owns presentation, never acquisition or physical authority. The existing ApplicationShell stage is the selected placement. A separate dashboard/root or reimplemented Node settings form would duplicate the approved job and composition, so neither is selected. Avatar UserProfileMenu already exists in DG; the reusable EnvironmentSettingsWindow, playlist, background and LandingStage are extracted there from the existing implementation. Core and Node supply product pages/actions, storage and permissions through adapters.

Initial state: Home without media. States: loading, ready, local draft, saving, uploading, saved, validation/storage conflict/error, media unavailable and unauthorized Node. Settings use FeatureSettingsWindow, SettingsCard, Field, Select, Switch, SortableList, MediaSourceField, RangeControl and canonical Button/WindowFooterActions. No new product root or device command is introduced.

Local K1 findings

Both hosts already consume SensorWorkspace and xgridsK1SensorUi. NodeSensors adapts authenticated local enrollment/inventory/operation routes; remote Fleet adapts the same broker/plugin operations. Shared K1 fields, validation, connection proof and physical command guards remain the same. Local UI reuse alone is not physical acceptance on the onboard webview.

The primary button inherited the DG theme's default pink accent on Node, whereas Core overrode primary tokens locally. Shared Button now admits a neutral primary tone, with white enabled and gray disabled states independent of accent/theme; the shared K1 start/configuration actions select it.

The local server's CSP also denied frame ancestry for its own Rerun runtime, WebAssembly compilation and blob video. These are presentation transport gaps, not a missing second K1 controller. Fixes and tests must preserve same-origin authentication/control and allow only the existing viewer/runtime capabilities.

Acceptance

Required: same settings component rendered for Core and Node, only home in Node page selector, text/media persist across reopening, playlist order/timing, invalid/stale saves rejected, logo returns home, neutral start states across themes, local/remote K1 broker parity and unchanged one-shot guards. Synthetic, browser and owner physical outcomes are recorded separately when obtained.

No physical fault injection, automatic provisioning or START/STOP is authorized by the visual refactor. The R16 Bridge laboratory checkpoint remains bounded as recorded in the previous audit.

Source and validation — 2026-09-07

Design Guideline: b10fd5d645ddfb8c373ae6105efa0850aef2509c. Node candidate: 0.8.14; K1 plugin remains 0.1.13. Builder provenance now includes ui-core source and compiled shared environment model as well as ui-react and styles.

• Shared DG packages compiled; catalog production build and registry validation passed (34 components, 48 icons). Three shared media/model/DOM tests passed.
• Core architecture: 4 tests; complete frontend: 809/809; TypeScript and production build passed. Existing operator-environment v3 API/storage is unchanged.
• Node TypeScript and UI boundary check passed; all Go packages passed. Five new Go test functions cover persistent trimmed home copy, simultaneous revision conflict, rejection without overwriting, corrupt-state preservation, validated PNG upload/hash/reopen/HTTP Range, session/Origin restrictions and scoped CSP.
• Package lifecycle/installer regressions: 14 passed. No physical BLE, network provisioning, START or STOP was dispatched during this task.
• In-app browser at the canonical 8000 confirms shared Home renders without the fallback radial gradient. Detailed settings interactions and the Ubuntu webview require acceptance after installation; do not infer them from builds.
• Core 8000 remains the original durable PID 88424; no 8765 listener and no temporary test/build/server processes. Only the Docker networking helper is present; Docker Desktop was not started.

Local and Bridge commands enter the same DeviceEnrollment.Submit and Sensors.Submit; the boolean distinguishes local vs signed remote authority. Both use the same SensorWorkspace and xgridsK1SensorUi, including project name, mount/GNSS settings, one-shot controls and shared scene. The existing SSE path refreshes its write deadline per delivery. The R17 change admits same-origin Rerun iframe/WASM/blob media in the local server CSP; it does not change K1 protocol state or the R16 laboratory acceptance boundary.

Local presentation is authenticated, CAS-versioned and atomically persisted beside Node product state. Uploaded media is content-checked, hashed, private, limited to 256 MiB/file and 8 GiB total. External images/video are browser-loaded HTTP(S) URLs. Media cleanup beyond rejected-upload temporary files is not added; recordings, identity, pairing and the installed credential are not part of this store. No marketing-image fallback is supplied.

Candidate and handoff

Source: a23c5b2005. Canonical Node builder completed after the source commit. The UI production build passed. mission-core-node_0.8.14_amd64.deb is 109863396 bytes; SHA-256 9bf4188cd51628144a9126ccfd33afce1503870c13548e31336b9484dce052aa. Archive inspection verified 71 regular files, source/DG provenance, no secret or runtime-state payload. Local release: private/releases/mission-core-node-20260907-r17. The reviewed Ubuntu installer uses the existing preinst safety guards and preserves installed K1 0.1.13 and private state. No Synology deploy is involved.

Read-only Ubuntu check confirmed installed Node 0.8.13 and K1 0.1.13, both active. The immutable candidate directory was created, but automatic approval review rejected scp before execution: destination ownership for private code egress requires explicit owner confirmation. The owner was asked to confirm the Ubuntu address. No candidate transfer/installation is claimed. Do not retry transfer until that confirmation is supplied.

Ops MISSIONCOR-76 baseline and state are preserved. Comment d16d36ed-f746-4fb9-8a63-f8d1a72f7e2d records implementation, tests, candidate, remaining UI/physical acceptance and transfer block; readback confirmed it.