feat: humanish MVP — two-tier credential broker (broker + box + google.whoami)

[thedotmack]

Summary

humanish MVP — two-tier credential broker. Code complete and live in production. All 8 phases of plans/2026-05-17-humanish-server.md + post-MVP hardening (tests, CI, dashboard polish, security review, deploy adjustments).

Deployed

• Broker (Cloudflare Worker): https://humanish-broker.black-pond-afbb.workers.dev
• Box (Fly machine): https://humanish-box.fly.dev:8443 (action runner, TLS, bearer-gated) + https://humanish-box.fly.dev/ (neko UI, port 443)
• Account state: Cloudflare info@copterlabs.com, Fly thedotmack@gmail.com

Both originally provisioned during this branch:

• KV namespace humanish-broker.KV (id 1d108315895e4a4896a6bbe040cbdc84)
• Fly app humanish-box, 3 GB volume humanish_data, shared IPv4 + dedicated IPv6, sjc region
• Secrets set: HUMANISH_MASTER_KEY + BOX_SHARED_SECRET identical on both Worker and Fly; RESEND_API_KEY is a re_PLACEHOLDER_ value — broker logs magic links to wrangler tail until operator wires a real Resend key

End-to-end verified live

Check	Result
GET / landing	200, 2,979 bytes
POST /api/auth/request allowlisted email	200 + magic link logged to wrangler tail
POST /api/auth/request non-allowlisted	403 not_allowed
GET /api/auth/verify?token=…	302 → /dashboard, humanish_session cookie set HttpOnly+Secure+SameSite=Lax
GET /api/me (with session)	200 {email:thedotmack@gmail.com}
GET /api/profiles (proxied to box)	200 {profiles:[]}
POST /api/mint	200 {slug,url}
GET /:slug (first visit)	200 with skill markdown, all placeholders substituted, single unique bearer
GET /:slug (second visit)	410 dead-slug page
POST /api/actions/google-personal/google.whoami (no profile saved yet)	404 profile_not_found (box correctly rejects)
Replay same bearer	401 expired
Bearer for shape {} called with {"extra":"field"}	400 payload_shape_mismatch
Box /healthz no auth	200 {ok:true,ts:…}
Box /profiles no auth	401 unauthorized
Box /profiles with BOX_SHARED_SECRET	200 {profiles:[]}

Test + verification gates passed

• pnpm -r typecheck — broker + box clean
• pnpm check:allowlist — broker ACTION_ALLOWLIST and box ACTION_REGISTRY in sync
• pnpm -r test — 35 vitest tests passing (9 crypto AES-GCM round-trip / AAD tampering / IV uniqueness, 17 bearer scope + payload_shape_hash, 9 SlugBox single-use)
• pnpm audit --prod — no known vulnerabilities
• wrangler deploy --dry-run — bundle 162.51 KiB / 43.72 KiB gzip
• docker build -f packages/box/Dockerfile . — builds clean
• OWASP top-10 review (A01–A10) — PASS on every category, zero findings
• All 8 anti-pattern grep guards from plan §7 — zero violations (slug-box atomicity, no secrets in pages/templates, no payload logging, no allow-top-navigation, slug page has no fetch(), AAD on both encrypt + decrypt, no child_process.exec, action runner bind validated)
• GitHub Actions CI workflow added (typecheck + test + broker dry-run + box docker build, concurrency cancels in-flight)

What's left for live use by the operator

1. Sign up for Resend, verify a sending domain, run wrangler secret put RESEND_API_KEY with a real key. Until then, magic links are logged to wrangler tail instead of emailed.
2. Open the dashboard, walk through the Add profile flow to drop a real Google storageState into /data/profiles/google-personal.bin.
3. Mint a slug, paste into a Claude chat, ask "which Google account am I signed in as?" — the full §7 8-step E2E. The previous live test got everything to the box, so once a profile exists the action should return {email, checked_at} in ~10s.

Known caveats (documented in README)

• Neko v2 legacy mode is active. The upstream ghcr.io/m1k1o/neko/chromium image bakes NEKO_MEMBER_MULTIUSER_USER_PASS (v2) at build time, which silently disables our chat/filetransfer plugin-disable config. For single-user MVP this is not a security defect (dashboard sandboxed iframe contains the threat) — needs an image fork to fully fix.
• Action runner exposed publicly (not Flycast-only as the plan originally said). Workers can't reach *.flycast; the real defense is BOX_SHARED_SECRET (constant-time compare) + TLS termination at fly-proxy. Bearer + TLS = same threat model as the plan's intent.
• RESEND_API_KEY placeholder triggers a magic-link bypass that logs via wrangler tail. Replace before sharing the broker URL.

Commits

11 commits, each phase atomically reviewable:

• 5937eb8 scaffold
• e4e84a0 broker security core (auth/SlugBox/bearer/routes)
• 54a5169 box (Dockerfile/Fly/crypto/runner)
• c5f1469 broker templates wired via wrangler Text bundles
• c1d00b9 dashboard SPA
• f329710 google.whoami action
• ed185e3 Phase 8 hardening (mint rate limit / audit rotation / allowlist guard / README)
• 0fd16b2 plan docs
• 0ee87bb tests + CI
• 9a6c3af production deploy + dashboard polish + skill template replaceAll bug
• 8899da1 neko v3 env fallback + README updated for actual deployed state

🤖 Generated with Claude Code