# Consumer Infrastructure Audit — Beast Computer

**Date:** 2026-07-12
**Commit:** eca86a8
**Consultants:** Codex (gpt-5.5), 2 rounds — consumer audit (114K tokens) + architecture consultation (69K tokens)
**Requested by:** Manager — "run the audit with codex to find out what is the consumer computer core was not solid yet"

## Context

Beast Computer ships 5.0–5.7 phases (agent OS). Manager tested the consumer flow and found chat messages sent but responses never arrived. Root cause: missing Stop hook in settings.json (fixed in eca86a8). This triggered a full consumer-facing audit.

## Round 1: Consumer Experience Audit

### BROKEN (3)

1. **Sessions in-memory only** (`web_auth.go:22`) — `sync.Map` with random process-local secret. Server restart logs out all users. `Config.Web.SessionSecret` is ignored.
2. **Mobile Files tab wrong target** (`web_dashboard.go:1166`) — scrolls to `.side-section:nth-child(2)` (Tasks), not Files.
3. **"Message queued" lie** (`web_api.go:404`) — says "queued" when `Send()` fails, but no queue exists. Message saved to chat history but never delivered.

### FRAGILE (5)

4. **Hook URL template** (`template.go:244`) — `http://localhost{{web_addr}}` breaks when addr is `127.0.0.1:9100`.
5. **Stale hook scripts** (`template.go:312`) — merges settings.json hooks but never rewrites beast-hook.sh. Config changes leave old URLs.
6. **XSS via goldmark unsafe** (`web_api.go:22`) — Claude's markdown rendered with `WithUnsafe()`, raw HTML executes in consumer's browser.
7. **Supervisor blocks all** (`supervisor.go:165`) — `time.Sleep()` in single-threaded loop. One flapping computer delays all others.
8. **CDN dependency** (`web_dashboard.go:208`) — HTMX + xterm from unpkg/jsdelivr. CDN down = entire UI broken.

### MISSING (2)

9. **No chat delivery state** (`chat_store.go:12`) — only `user`/`assistant` roles, no sent/failed/queued.
10. **No OAuth diagnostics** (`web_auth_flow.go:84`) — errors discarded, can't distinguish CLI missing vs permission failure vs timeout.

## Round 2: Architecture Consultation

**Core thesis:** Keep one Go control plane. Promote sessions, chat, supervisor state, audit, and OAuth into **durable control-plane data** (SQLite WAL). JSON files remain workspace artifacts; product state should not.

### Per-Issue Architecture

| # | Current | Proposed | Scale |
|---|---------|----------|-------|
| 1 | sync.Map sessions | SQLite `web_sessions` table, sha256(sid), Secure/HttpOnly/SameSite | restart-safe at 100, shareable at 1000 |
| 2 | Scroll to nth-child | App-shell router with `?view=chat\|files\|terminal`, explicit panel roots | Deep links, back button, E2E testable |
| 3 | Fire-and-forget tmux send | Durable outbox: `chat_messages` + `chat_deliveries` tables, 202 Accepted | UI truth from state, not optimism |
| 4 | `http://localhost{{web_addr}}` | `beast computer hook claude-stop --stdin` CLI or Unix socket | No URL templating, local IPC |
| 5 | Generated scripts | Versioned managed hooks, `hook_version` in state, reconcile on start | No per-user drift, rollback = migration |
| 6 | goldmark WithUnsafe | Remove unsafe + CSP headers | Model output = untrusted |
| 7 | time.Sleep in loop | Per-computer actors, `next_check_at` scheduler | One stuck = one slot, leaseable |
| 8 | CDN scripts | go:embed vendored assets | Self-contained binary |
| 9 | id/role/content only | State machine: accepted→queued→delivered→responded→failed | Explicit delivery feedback |
| 10 | Discarded errors | `oauth_attempts` + `oauth_events` tables | Phase-specific remediation |

### Additional Gaps (not in original audit)

| Gap | Fix |
|-----|-----|
| JSON store limits | SQLite WAL for product state, markdown stays as workspace |
| No event bus | Append-only events table, SSE tails event IDs |
| Multi-process locking | DB transactions + advisory locks per computer |
| Tenant isolation | Per-request authz, path checks, MIME policy, body limits |
| Secret management | Encrypted-at-rest (age/KMS), per-computer data keys |
| Resource scheduling | Idle suspend, quota, queue depth limits, concurrency caps |
| Observability | Structured logs + traces on chat/delivery/hook/recovery |
| Schema migrations | `schema_migrations` table, version gates |
| Terminal security | Session recording, idle timeout, CSRF on WebSocket |

## Decision: Phase 6 — Consumer Infrastructure

Implement as Phase 6 of beast computer. Priority order:

1. **SQLite control-plane DB** — sessions, chat messages, events (foundation for everything else)
2. **XSS fix** — remove goldmark unsafe + add CSP
3. **Embed assets** — go:embed vendor HTMX/xterm
4. **Chat delivery model** — outbox + state machine
5. **Supervisor actors** — per-computer workers, no sleep in loop
6. **Hook IPC** — CLI command replaces HTTP URL templating
7. **Mobile panel router** — explicit view state
8. **OAuth diagnostics** — attempt records + phase display

Items 1-3 are zero-risk infrastructure. Items 4-6 change the chat pipeline. Items 7-8 are UX polish.