2.6 KiB
Area: Storage CORS reliability (storage-cors)
Assignment: storage-cors-1
Bounded parallel trial: validate todo/TODO_2026-06-16_r2-followups.md CORS replace-not-merge report at current HEAD. Dispatch inspected ensureBucketCors in js/storage/s3-multipart.js: constructs PutBucketCors with requested origins only, no GetBucketCors. This is evidence for investigation, not proof every caller loses policy. Trace actual callers and required existing-origin behavior. Reproduce offline via real helper and fake S3 transport/SDK boundary: an existing origin/rule, adding a second origin, idempotent repeated call, missing config and read-failure cases. No cloud credentials/network/bucket mutation.
First report smallest demonstrated loss plus proposed preservation semantics/files to dispatch before product changes. Inspect AWS command export in s3-client read-only. You own s3-multipart.js/s3-client.js and new tests/storage-cors-preservation.test.mjs only after fix routing; no R2/S3 upload service copies, app, signer or UI edits. Existing wildcard/method/header/non-origin rule semantics must not be guessed; read failure must not silently overwrite a policy. Do not add broad SDK/dependency upgrade. If stale/already fixed, close with evidence and propose next independent TODO. No browser initially. Relevant focused storage checks, lint, full normal gate/build after approved fix; ask dispatch before expensive runs. Integrity notes docs/testing/storage-cors-integrity.md.
Coordination and limits
Send dispatch a read/next-action acknowledgement immediately, then claim your item and keep .task current. Record start/end UTC and time blocked by tools/browser/gates. Report exact SHA/commands/counts/unverified scope; mailbox on blocker, reproduced result, landing and final. Read RULE-CHANGES, PROGRAM, KNOWN_ISSUES, repo memory, and test-integrity before changes. New tests require failing mutants; no weakened expectations/retries/sleeps. Product/test fixes must be scoped from demonstrated evidence. No shared TEST_INTEGRITY.md or docs/TODO.md edits: keep uniquely prefixed integrity/evidence notes under docs/testing and ask dispatch to integrate status. Do not edit another area worktree or stop another process. Full-suite runs and product landings need dispatch resource coordination (one expensive gate at a time, unchanged normal landq). Focused offline checks can overlap. Commit named files via fleet tool; merge unstable, never rebase; normal queue/durable status+ancestry before close. No subagents initially. No deploy/push/spend/real-wallet/production-data/secrets/scheduler/kit changes. Preserve preview3000. Public network/real buckets/signers/peers forbidden in fixtures.