docs: correct the role-behaviour claim, flag the fail-open webhook, changelog today's work #7

Merged

mohlec merged 2 commits from docs/correct-role-behaviour into main

2026-08-06 20:33:15 +00:00

mohlec commented

2026-08-05 21:15:43 +00:00

Owner

Docs only - closes out the work deployed today.

README.md

The "field techs see only their own column" claim was wrong and is now actively misleading: the web board has never filtered, and as of PR #6 the viewer's column is simply ordered first on both boards with everything else still visible. Someone reading the old line could reasonably "fix" the ordering back into a filter.
Documents that leaving Webhook Secret empty skips the signature check entirely rather than rejecting. That reads as "not configured yet" when it actually means the webhook accepts unauthenticated writes. It is empty in production right now.

CHANGELOG.md - an [Unreleased] entry covering the own-column-first change, the mobile auto-refresh, the websocket-reconnect refetch, the case-mismatch bug, and the duplicate-column fix.

The entry records that the deployed build is 618be8e while still reporting version 0.2.0, since that ambiguity is what hid Phase 6 for a month and is worth writing down rather than rediscovering.

Confirmed working in production: Dan Stout's column is first for him, with the other columns still present.

Docs only - closes out the work deployed today. **`README.md`** - The *"field techs see only their own column"* claim was wrong and is now actively misleading: the web board has never filtered, and as of PR #6 the viewer's column is simply ordered **first** on both boards with everything else still visible. Someone reading the old line could reasonably "fix" the ordering back into a filter. - Documents that leaving **Webhook Secret** empty **skips the signature check entirely** rather than rejecting. That reads as "not configured yet" when it actually means the webhook accepts unauthenticated writes. It is empty in production right now. **`CHANGELOG.md`** - an `[Unreleased]` entry covering the own-column-first change, the mobile auto-refresh, the websocket-reconnect refetch, the case-mismatch bug, and the duplicate-column fix. The entry records that the deployed build is `618be8e` while still reporting version `0.2.0`, since that ambiguity is what hid Phase 6 for a month and is worth writing down rather than rediscovering. Confirmed working in production: Dan Stout's column is first for him, with the other columns still present.

mohlec added 2 commits

2026-08-05 21:15:43 +00:00

docs: correct the role-aware claim, and warn that an empty webhook secret disables auth a4a1b3669e

The README said field techs see only their own column. The web board has
never filtered, and as of the own-column-first change neither board does -
the viewer's column is ordered first and every other column stays visible.

Also documents that leaving Webhook Secret empty skips the signature check
rather than rejecting, which reads as 'not configured yet' when it actually
means 'open to unauthenticated writes'.

docs: changelog entry for the own-column-first and staleness work ee298675d8

mohlec merged commit c2cf82e7c6 into main

2026-08-06 20:33:15 +00:00

mohlec deleted branch docs/correct-role-behaviour

2026-08-06 20:33:15 +00:00

mohlec referenced this pull request from a commit

2026-08-06 20:33:17 +00:00

Merge pull request 'docs: correct the role-behaviour claim, flag the fail-open webhook, changelog today's work' (#7) from docs/correct-role-behaviour into main