From 6817df50f084968b1419025cdf64efacfb7c5c00 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 11:59:13 -0800 Subject: [PATCH 1/4] quest: nixos2 hosts Windows, Apple-only signing, keypad hotkeys, Blitz release, pin waits Co-Authored-By: Claude Opus 5.5 --- quest/m0/README.md | 5 ++-- quest/m0/app-macos.md | 17 +++++++------- quest/m0/app-windows.md | 4 ++++ quest/m0/cef-headless.md | 4 ++++ quest/m0/packaging.md | 8 +++++-- quest/m0/pin-aac-encode.md | 15 ++++++++---- quest/m0/pin-audio-filters.md | 15 ++++++++---- quest/m0/pin-audio-tap.md | 16 +++++++++---- quest/m0/pin-browser-audio.md | 15 ++++++++---- quest/m0/pin-browser-video.md | 15 ++++++++---- quest/m0/pin-portal-token.md | 13 ++++++++--- quest/m0/pin-readback.md | 16 ++++++++----- quest/m0/signing.md | 36 ++++++++++++++++++++++------ quest/m0/vcam/macos.md | 2 +- quest/m0/windows-host.md | 39 +++++++++++++++++++++++++++++++ quest/m1/README.md | 1 + quest/m1/hotkeys-keypad.md | 24 +++++++++++++++++++ quest/m2/README.md | 1 + quest/m2/overlay-blitz-release.md | 27 +++++++++++++++++++++ 19 files changed, 223 insertions(+), 50 deletions(-) create mode 100644 quest/m0/windows-host.md create mode 100644 quest/m1/hotkeys-keypad.md create mode 100644 quest/m2/overlay-blitz-release.md diff --git a/quest/m0/README.md b/quest/m0/README.md index eda72ca4..0a68b8b0 100644 --- a/quest/m0/README.md +++ b/quest/m0/README.md @@ -89,6 +89,7 @@ repository. ## Required - [Studio on macOS with capture granted](/quest/m0/app-macos.md) - camera, screen, and audio capture run on a Mac, not only Linux +- [nixos2 boots Windows for agents](/quest/m0/windows-host.md) - a Windows machine agents reach over ssh, with a camera and microphone - [Studio on Windows](/quest/m0/app-windows.md) - the studio runs on Windows, not only Linux - [Wayland display and window sources](/quest/m0/wayland-sources.md) - portal-picked sources that reopen without the picker - [Destinations](/quest/m0/destinations.md) - RTMP, RTMPS, and WHIP push with per-destination codecs and shared encoders, on a UI-free egress library a hosted service can reuse @@ -102,8 +103,8 @@ repository. - [Browser sources on the GPU under Mesa](/quest/m0/cef-headless.md) - shared-texture pages paint on Intel and AMD under Wayland, and a page that cannot paint fails loudly - [One Vulkan loader for the studio and CEF](/quest/m0/cef-vulkan-loader.md) - NixOS builds and tests find the GPU without VK_DRIVER_FILES - [Browser sources on the GPU under X11 on NVIDIA](/quest/m0/cef-x11-nvidia.md) - the X11 GPU path paints on NVIDIA, or falls back to the CPU path loudly -- [Signing identities are available](/quest/m0/signing.md) - the Apple and Windows code-signing credentials packaging and the macOS camera need -- [Packaging](/quest/m0/packaging.md) - signed installers for macOS and Windows and a Flatpak for Linux +- [The Apple signing identity is available](/quest/m0/signing.md) - the Apple credentials packaging and the macOS camera need; Windows ships unsigned +- [Packaging](/quest/m0/packaging.md) - a signed macOS app, a Windows installer, and a Flatpak for Linux - [The persistable portal restore token is pinned](/quest/m0/pin-portal-token.md) - moq-video's restore token, for Wayland sources - [Platform AAC encoders are pinned](/quest/m0/pin-aac-encode.md) - moq-audio's AAC encoders, for destinations - [moq-audio's filter chain is pinned](/quest/m0/pin-audio-filters.md) - the chain audio filters configure diff --git a/quest/m0/app-macos.md b/quest/m0/app-macos.md index bc6da84e..38a83ee5 100644 --- a/quest/m0/app-macos.md +++ b/quest/m0/app-macos.md @@ -2,20 +2,21 @@ ## Goal -Someone at a Mac grants the camera, microphone, and Screen & System Audio -Recording permissions, runs `moq-studio --features capture`, and fixes -whatever only shows up there: camera, display, window, microphone, and system -audio sources reaching preview, program, and the published broadcast, and the -Devices panel listing and adding each. +On the maintainer's Mac, an agent runs `moq-studio --features capture` and +fixes whatever only shows up there: camera, display, window, microphone, and +system audio sources reaching preview, program, and the published broadcast, +and the Devices panel listing and adding each. The build, `just ci`, the window, compositing on Metal, and publishing through -VideoToolbox already run on an Apple Silicon Mac. Capture has not: its TCC -prompts need a person to answer them, so an unattended agent cannot do this. +VideoToolbox already run on an Apple Silicon Mac. Capture has not. ## Plan - The studio is not an app bundle, so the prompts and grants belong to the app - that launched it, such as the terminal. + that launched it. Granted 2026-11-06 (maintainer, /quest-unblock): T3 Code + holds Camera, Microphone, and Screen & System Audio Recording, so an agent + it launches captures without a prompt. A run that still meets a permission + error stops and asks the maintainer rather than working around it. ## Related diff --git a/quest/m0/app-windows.md b/quest/m0/app-windows.md index 10651019..b69a551b 100644 --- a/quest/m0/app-windows.md +++ b/quest/m0/app-windows.md @@ -15,6 +15,10 @@ the studio landed. - Build with `--features capture`, since a default build has image, color, and broadcast sources only. +## Required + +- [nixos2 boots Windows for agents](/quest/m0/windows-host.md) - the Windows machine this runs on + ## Related - [Hardware validation](https://github.com/moq-dev/moq/blob/main/quest/m5/video-hardware.md) - capture paths not yet run on real machines diff --git a/quest/m0/cef-headless.md b/quest/m0/cef-headless.md index 1d7cac36..1ee891f7 100644 --- a/quest/m0/cef-headless.md +++ b/quest/m0/cef-headless.md @@ -38,6 +38,10 @@ When the capturer cannot allocate, CEF never paints and never says so. Fail the page loudly instead, from a signal CEF or Chromium gives (no first-paint timeout). +Decided 2026-11-06 (maintainer, /quest-unblock): this trial runs before +nixos2 switches to Windows ([windows-host](/quest/m0/windows-host.md)), which +then leaves no Mesa machine on NixOS. + ## Waiting - Maintainer: log into a Wayland desktop session (GNOME or KDE) on a Mesa GPU, diff --git a/quest/m0/packaging.md b/quest/m0/packaging.md index 8a95f7de..f8d6703f 100644 --- a/quest/m0/packaging.md +++ b/quest/m0/packaging.md @@ -2,7 +2,7 @@ ## Goal -Every release ships a signed and notarized macOS app, a signed Windows +Every release ships a signed and notarized macOS app, an unsigned Windows installer, and a Linux Flatpak of `moq-studio`, all built in CI. Each artifact is verified to launch and list devices on its platform. @@ -19,9 +19,13 @@ libpipewire, so it adds `pipewire` itself: inside the sandbox the camera portal is the only way to a camera, and its PipeWire DMA-BUFs are what the compositor imports without a copy. +Decided 2026-11-06 (maintainer, /quest-unblock): Windows ships unsigned +until a release needs SmartScreen reputation; see +[signing](/quest/m0/signing.md). + ## Required -- [Signing identities are available](/quest/m0/signing.md) - the credentials signing needs +- [The Apple signing identity is available](/quest/m0/signing.md) - the credentials macOS signing needs - [Studio on macOS with capture granted](/quest/m0/app-macos.md) - camera, screen, and audio capture run on a Mac - [Studio on Windows](/quest/m0/app-windows.md) - the studio running on Windows diff --git a/quest/m0/pin-aac-encode.md b/quest/m0/pin-aac-encode.md index 69535e95..849dee77 100644 --- a/quest/m0/pin-aac-encode.md +++ b/quest/m0/pin-aac-encode.md @@ -7,7 +7,14 @@ The `moq` submodule includes moq-audio's platform AAC encoders, from [Media Foundation AAC encode](https://github.com/moq-dev/moq/blob/main/quest/m5/audio-encode-mediafoundation.md) on Windows, which destinations whose ingest requires AAC use. -Check: both quests' PRs have merged on moq's `main`, deleting their files, and -moq-audio's AAC encoders are there. A quest file that moved, or went away -without its work landing, does not count. Advance it with `just upgrade-moq` -in its own PR, fixing whatever the new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: both upstream quests above land. Check: both quests' PRs have + merged on moq's `main`, deleting their files, and moq-audio's AAC encoders + are there. A quest file that moved, or went away without its work landing, + does not count. diff --git a/quest/m0/pin-audio-filters.md b/quest/m0/pin-audio-filters.md index a806ba71..0787f955 100644 --- a/quest/m0/pin-audio-filters.md +++ b/quest/m0/pin-audio-filters.md @@ -5,7 +5,14 @@ The `moq` submodule includes moq-audio's per-source filter chain and plugin host, from [moq-audio filter chain](https://github.com/moq-dev/moq/blob/main/quest/m5/audio-filters.md). -Check: that quest's PR has merged on moq's `main`, deleting its file, and -moq-audio's filter chain is there. A quest file that moved, or went away -without its work landing, does not count. Advance it with `just upgrade-moq` -in its own PR, fixing whatever the new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has + merged on moq's `main`, deleting its file, and moq-audio's filter chain is + there. A quest file that moved, or went away without its work landing, does + not count. diff --git a/quest/m0/pin-audio-tap.md b/quest/m0/pin-audio-tap.md index d7f249d4..9bd475cf 100644 --- a/quest/m0/pin-audio-tap.md +++ b/quest/m0/pin-audio-tap.md @@ -6,8 +6,14 @@ The `moq` submodule includes moq-audio's tap of a bus source's own samples, before its delay and stamped with their bus-clock positions, from [Read a bus source's own samples](https://github.com/moq-dev/moq/blob/main/quest/m3/audio-strip-tap.md). -Check: that quest's PR has merged on moq's `main`, deleting its file, and -`moq_audio::bus` there offers a tap of a source's samples with bus positions. -A quest file that moved, or went away without its work landing, does not -count. Advance it with `just upgrade-moq` in its own PR, fixing whatever the -new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has + merged on moq's `main`, deleting its file, and `moq_audio::bus` there offers + a tap of a source's samples with bus positions. A quest file that moved, or + went away without its work landing, does not count. diff --git a/quest/m0/pin-browser-audio.md b/quest/m0/pin-browser-audio.md index dbc3b5a0..64fa5b1c 100644 --- a/quest/m0/pin-browser-audio.md +++ b/quest/m0/pin-browser-audio.md @@ -6,7 +6,14 @@ The `moq` submodule includes moq-audio's browser backends (AudioWorklet capture and playback, WebCodecs Opus and AAC), from [moq-audio in the browser](https://github.com/moq-dev/moq/blob/main/quest/m5/audio-web.md). -Check: that quest's PR has merged on moq's `main`, deleting its file, and -moq-audio's browser backends are there. A quest file that moved, or went away -without its work landing, does not count. Advance it with `just upgrade-moq` -in its own PR, fixing whatever the new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has + merged on moq's `main`, deleting its file, and moq-audio's browser backends + are there. A quest file that moved, or went away without its work landing, + does not count. diff --git a/quest/m0/pin-browser-video.md b/quest/m0/pin-browser-video.md index da0ed08c..bb4bf2e5 100644 --- a/quest/m0/pin-browser-video.md +++ b/quest/m0/pin-browser-video.md @@ -7,7 +7,14 @@ getDisplayMedia capture, WebCodecs, and VideoFrame import into wgpu) and the wasm32 builds of hang and moq-mux, from [moq-video in the browser](https://github.com/moq-dev/moq/blob/main/quest/m5/video-web.md). -Check: that quest's PR has merged on moq's `main`, deleting its file, and -moq-video's browser backends are there. A quest file that moved, or went away -without its work landing, does not count. Advance it with `just upgrade-moq` -in its own PR, fixing whatever the new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has + merged on moq's `main`, deleting its file, and moq-video's browser backends + are there. A quest file that moved, or went away without its work landing, + does not count. diff --git a/quest/m0/pin-portal-token.md b/quest/m0/pin-portal-token.md index 042e3ae5..cfa9827c 100644 --- a/quest/m0/pin-portal-token.md +++ b/quest/m0/pin-portal-token.md @@ -5,6 +5,13 @@ The `moq` submodule includes moq-video's persistable xdg-desktop-portal restore token, from [Linux capture parity](https://github.com/moq-dev/moq/blob/main/quest/m3/capture-linux.md). -Check: moq-video on moq's `main` exposes the persistable restore token (the -quest no longer lists it because it landed, not because it moved). Advance it with -`just upgrade-moq` in its own PR, fixing whatever the new API breaks here. +## Plan + +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + +## Waiting + +- moq-dev/moq: Linux capture parity lands the persistable token. Check: + moq-video on moq's `main` exposes the persistable restore token (the quest + no longer lists it because it landed, not because it moved). diff --git a/quest/m0/pin-readback.md b/quest/m0/pin-readback.md index e53ede0f..dc8d4283 100644 --- a/quest/m0/pin-readback.md +++ b/quest/m0/pin-readback.md @@ -6,14 +6,18 @@ The `moq` submodule includes moq-video's public readback, which copies a wgpu texture into packed RGBA with no encoder, from [Read a texture back without an encoder](https://github.com/moq-dev/moq/blob/main/quest/m1/video-readback.md). -Check: that quest's PR has merged on moq's `main`, deleting its file, and -`moq/rs/moq-video` there has a public readback with no encoder probe. A quest -file that moved, or went away without its work landing, does not count. -Advance it with `just upgrade-moq` in its own PR, fixing whatever the new API -breaks here. - ## Plan +Once the wait clears, advance it with `just upgrade-moq` in its own PR, +fixing whatever the new API breaks here. + Decided 2026-11-02 (maintainer, on [#9](https://github.com/moq-dev/studio/pull/9)): the Linux virtual camera's readback lives in moq-video, not in a copy here. + +## Waiting + +- moq-dev/moq: the upstream quest above lands. Check: that quest's PR has + merged on moq's `main`, deleting its file, and `moq/rs/moq-video` there has + a public readback with no encoder probe. A quest file that moved, or went + away without its work landing, does not count. diff --git a/quest/m0/signing.md b/quest/m0/signing.md index 3c9e6fbc..1ad58031 100644 --- a/quest/m0/signing.md +++ b/quest/m0/signing.md @@ -1,11 +1,33 @@ -# [XS] Signing identities are available +# [S] The Apple signing identity is available ## Goal -The maintainer provisions code-signing credentials as release CI secrets: -- an Apple Developer ID that can notarize and holds the System Extension - entitlement the macOS camera extension needs -- a Windows code-signing certificate +Release CI can sign and notarize the macOS app and its camera system +extension: moq-dev/studio holds, as Actions secrets for the release +environment, a Developer ID Application certificate with its key, an App +Store Connect API key for `notarytool`, and a Developer ID provisioning +profile carrying the System Extension capability. -Ask the maintainer whether the secrets exist. Delete this quest once the -release workflow can read them. +## Plan + +Decided 2026-11-06 (maintainer, /quest-unblock): + +- ✅ **Windows ships unsigned for now.** Installers run, with a SmartScreen + warning. Rejected: Azure Artifact Signing and an OV/EV certificate, both + paid, for a build nobody downloads yet. +- The hang.live 1Password vault holds the Apple material for team + `D7D5SDDB5Z`: `apple-developer-id` (a Developer ID Application certificate, + valid until 2027-02-01), `apple-certificate` (`hang.live.p12` and its + password), and `apple-api` (an App Store Connect API key). The membership + has lapsed, so notarization fails until it is renewed. +- Once renewed, an agent with the maintainer's `op` session creates the + Developer ID profile through the App Store Connect API with that key, and + stores everything with `gh secret set` (no secret passes through chat or a + file outside `.tmp/`). Confirm the `.p12` holds the Developer ID key, not a + distribution one, before storing it. Then delete this quest. + +## Waiting + +- Maintainer: renew the Apple Developer Program membership for team + `D7D5SDDB5Z`; only the account holder can pay. Check: `xcrun notarytool + history` with the `apple-api` key succeeds. diff --git a/quest/m0/vcam/macos.md b/quest/m0/vcam/macos.md index 4a26514c..4cd89fa1 100644 --- a/quest/m0/vcam/macos.md +++ b/quest/m0/vcam/macos.md @@ -8,5 +8,5 @@ update installs the new extension without a reboot. ## Required -- [Signing identities are available](/quest/m0/signing.md) - system extensions only load when signed +- [The Apple signing identity is available](/quest/m0/signing.md) - system extensions only load when signed - [Studio on macOS with capture granted](/quest/m0/app-macos.md) - camera, screen, and audio capture run on a Mac diff --git a/quest/m0/windows-host.md b/quest/m0/windows-host.md new file mode 100644 index 00000000..e0f1d8b0 --- /dev/null +++ b/quest/m0/windows-host.md @@ -0,0 +1,39 @@ +# [S] nixos2 boots Windows for agents + +## Goal + +nixos2 boots Windows by default, and an agent on the maintainer's Mac reaches +it with `ssh nixos2`, builds `moq-studio --features capture` there, and finds +a camera and a microphone to capture, so Windows quests run on real hardware. + +## Plan + +Decided 2026-11-06 (maintainer, /quest-unblock): nixos2 becomes the Windows +host, after the Mesa trial on its Intel GPU +([cef-headless](/quest/m0/cef-headless.md)), which needs NixOS there. + +nixos2 already dual-boots: Windows sits on its own partition (`nvme0n1p3`, +600 GB, last booted 2026-09-14) with firmware entry `Boot0003` (Windows Boot +Manager); NixOS boots through systemd-boot on `nvme0n1p4`. The switch: + +1. From NixOS, an agent moves `Boot0003` to the front of the firmware boot + order (`efibootmgr -o`, with passwordless sudo) and reboots. NixOS stays + installed; boot it once with `bcdedit /set {fwbootmgr} bootsequence + {}` from Windows when a Linux run needs it. +2. The maintainer turns on OpenSSH Server (see Waiting). +3. Over ssh, an agent installs the toolchain with `winget`: rustup with the + MSVC target, Visual Studio Build Tools with the C++ workload, Git, and + `just`. It records the host key change for `nixos2` and what it installed + in this PR. + +## Waiting + +- Maintainer: at nixos2's console once it boots Windows, turn on OpenSSH + Server (Settings > System > Optional features), add the Mac's public key to + `C:\ProgramData\ssh\administrators_authorized_keys`, and plug in a USB + camera and a microphone, which nixos2 lacks. An agent cannot reach Windows + before sshd runs. Check: `ssh nixos2 ver` prints a Windows version. + +## Required + +- [Browser sources on the GPU under Mesa](/quest/m0/cef-headless.md) - the Mesa trial runs on nixos2's Intel GPU first diff --git a/quest/m1/README.md b/quest/m1/README.md index 7b0b5c1f..ac9a8e95 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -25,4 +25,5 @@ than opening an m2 for them. - [Viewer-side composition](/quest/m1/compose/README.md) - sources as their own tracks plus a layout track, composed by viewers and by a server - [Hotkeys and editor preferences](/quest/m1/hotkeys.md) - system-wide hotkeys, arrow nudge, aspect lock, and persisted editor settings +- [Keypad keys bind as hotkeys](/quest/m1/hotkeys-keypad.md) - scene and action keys on the keypad, apart from the main row - [Scene graph view](/quest/m1/scene-graph.md) - a node view of picture and audio scenes, their routing, volume, pan, and waveforms diff --git a/quest/m1/hotkeys-keypad.md b/quest/m1/hotkeys-keypad.md new file mode 100644 index 00000000..3d6bf622 --- /dev/null +++ b/quest/m1/hotkeys-keypad.md @@ -0,0 +1,24 @@ +# [S] Keypad keys bind as hotkeys + +## Goal + +The operator binds keypad keys (`Numpad0` to `Numpad9`, the keypad +operators, and keypad Enter) to studio actions, and they fire system-wide on +macOS, Windows, X11, and the Wayland portal, apart from the main-row keys +with the same symbol. Streamers often put scenes on the keypad. + +## Plan + +From [moq-dev/studio#61](https://github.com/moq-dev/studio/pull/61), which +refuses keypad keys rather than binding them; picked 2026-11-06 (maintainer, +/quest-plan) as its own quest so #61 lands as reviewed. + +- Carry winit's physical `KeyCode` (or the key's keypad location) through + `Binding`, so `Numpad1` and `Digit1` stay distinct. +- Register global-hotkey's `Numpad*` codes on macOS, Windows, and X11, and + ask the GlobalShortcuts portal for `KP_*` keysyms on Wayland. +- `README.md` drops the note that keypad keys are refused. + +## Required + +- [Hotkeys and editor preferences](/quest/m1/hotkeys.md) - the bindings and settings store this extends diff --git a/quest/m2/README.md b/quest/m2/README.md index f27c6101..88c638b3 100644 --- a/quest/m2/README.md +++ b/quest/m2/README.md @@ -14,3 +14,4 @@ consumer appears. ## Required - [Published independently](/quest/m2/publish-independently.md) - a source opts out of the program and publishes its own track for services that place it themselves +- [Overlays drop their Blitz panic guard](/quest/m2/overlay-blitz-release.md) - the next Blitz release lets overlay checks parse without `catch_unwind` diff --git a/quest/m2/overlay-blitz-release.md b/quest/m2/overlay-blitz-release.md new file mode 100644 index 00000000..3fe690d8 --- /dev/null +++ b/quest/m2/overlay-blitz-release.md @@ -0,0 +1,27 @@ +# [XS] Overlays drop their Blitz panic guard + +## Goal + +`overlay::check` (`rs/moq-scene/src/overlay.rs`) parses an overlay's HTML +without `catch_unwind`, because the Blitz it builds on reports an +unresolvable `src` or `href` instead of panicking. + +## Plan + +From [moq-dev/studio#62](https://github.com/moq-dev/studio/pull/62); picked +2026-11-06 (maintainer, /quest-plan), m2 since the guard works meanwhile. + +[DioxusLabs/blitz#1374](https://github.com/DioxusLabs/blitz/pull/1374) +(merged 2026-11-03) skips a resource whose URL cannot resolve. Bump the Blitz +crates to the release carrying it, drop `catch_unwind`, and keep the error +`check` gives for such a URL, now found by walking the document. + +## Waiting + +- DioxusLabs/blitz: a release after 0.3.0-beta.4 with #1374. Check: the + newest `blitz-dom` on crates.io is past 0.3.0-beta.4, and its + `Document::resolve_url` returns an `Option`. + +## Related + +- [DioxusLabs/blitz#1455](https://github.com/DioxusLabs/blitz/issues/1455) - root and `` background images don't reach the canvas; overlays put an image on a sized element until then From bb7c7d32b39a54b1a849d4eefbe5f44db0364d75 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 12:00:57 -0800 Subject: [PATCH 2/4] quest: the join page waits only on its certificate Co-Authored-By: Claude Opus 5.5 --- quest/m0/join-page-live.md | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/quest/m0/join-page-live.md b/quest/m0/join-page-live.md index a578ca1b..020087ab 100644 --- a/quest/m0/join-page-live.md +++ b/quest/m0/join-page-live.md @@ -2,17 +2,21 @@ ## Goal -`https://join.studio.moq.dev/` serves the join page (`js/join`), so -`--join-page` works without being passed. The maintainer: +`https://join.studio.moq.dev/` serves the join page (`js/join`) over a valid +certificate, so `--join-page` works without being passed. -- enables GitHub Pages for moq-dev/studio with GitHub Actions as its source, - and limits the `github-pages` environment's deployment branches to `main` -- protects `main` so only reviewed PRs reach it, since whatever lands there - deploys to the page every guest's token passes through -- points `join.studio.moq.dev` at Pages in DNS, sets it as the custom domain, - and enforces HTTPS -- runs the Join page workflow (`.github/workflows/join.yml`) once +## Plan -Check: `curl -sI https://join.studio.moq.dev/` answers 200 over a valid -certificate, and the page loads. Then drop the README's note that the -default is not live yet, and delete this quest. +Done 2026-11-06 (maintainer and agent, /quest-unblock): Pages builds from +GitHub Actions, the `github-pages` environment deploys only from `main`, a +ruleset on `main` takes only PRs that pass `Check` and refuses force pushes +and deletion, Cloudflare has `join.studio` as a DNS-only CNAME to +`moq-dev.github.io`, Pages has `join.studio.moq.dev` as its custom domain, and +the Join page workflow deployed. `http://join.studio.moq.dev/` answers 200. + +Left for an agent: once GitHub issues the certificate +(`gh api repos/moq-dev/studio/pages` shows `https_certificate.state` as +`approved`), enforce HTTPS (`gh api -X PUT repos/moq-dev/studio/pages -F +https_enforced=true`), check that `curl -sI https://join.studio.moq.dev/` +answers 200 and the page loads, drop the README's note that the default is +not live yet, and delete this quest. From 2afb531d237cbe8a8c79e59e283a17dda97a0c9a Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 12:10:17 -0800 Subject: [PATCH 3/4] quest: nixos2 logs into GNOME at boot, clearing the Mesa trial's wait Co-Authored-By: Claude Opus 5.5 --- quest/m0/cef-headless.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/quest/m0/cef-headless.md b/quest/m0/cef-headless.md index 1ee891f7..8087cb8a 100644 --- a/quest/m0/cef-headless.md +++ b/quest/m0/cef-headless.md @@ -42,9 +42,10 @@ Decided 2026-11-06 (maintainer, /quest-unblock): this trial runs before nixos2 switches to Windows ([windows-host](/quest/m0/windows-host.md)), which then leaves no Mesa machine on NixOS. -## Waiting - -- Maintainer: log into a Wayland desktop session (GNOME or KDE) on a Mesa GPU, - such as nixos2's Intel, so an agent can run `binary(browser)` there with that - session's `WAYLAND_DISPLAY`. An agent cannot start a logged-in session on a - greeter. Check: `loginctl list-sessions` shows a user session on `seat0`. +Since 2026-11-06 ([kixelated/nixos#31](https://github.com/kixelated/nixos/pull/31)), +GDM logs `kixelated` into GNOME at boot on nixos2. Its GNOME Shell runs on +the Intel GPU (`card1`, `renderD128`) with no monitor attached, so an agent +runs `binary(browser)` there over ssh with `WAYLAND_DISPLAY=wayland-0` and +`XDG_RUNTIME_DIR=/run/user/1000`. If a page paints only with a display +connected, say so and ask the maintainer for an HDMI dummy plug on the +motherboard's port. From ca2004882af546faa6693d597aa2c590783e3d59 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 12:45:53 -0800 Subject: [PATCH 4/4] quest: the join page is live join.studio.moq.dev serves the join page over HTTPS, so drop the README's note that the default is not live and finish its quest. Co-Authored-By: Claude Opus 5.5 --- README.md | 5 ++--- quest/m0/README.md | 1 - quest/m0/join-page-live.md | 22 ---------------------- 3 files changed, 2 insertions(+), 26 deletions(-) delete mode 100644 quest/m0/join-page-live.md diff --git a/README.md b/README.md index 8c67c082..31b03418 100644 --- a/README.md +++ b/README.md @@ -425,9 +425,8 @@ moq-studio show.toml --connect 'https://relay.example.com/show?jwt=...' \ relay. Put its public half in the directory `moq auth serve --key-dir` reads. - `--join-page` is where the join page (`js/join`, `bun run --cwd js/join build`) is hosted. Browsers open the camera only on an `https://` page or - `localhost`, so the studio refuses any other. It defaults to `https://join.studio.moq.dev/`, which this - repository deploys from `main`, but that domain is not live yet, so for now - host the page yourself and pass its URL. + `localhost`, so the studio refuses any other. It defaults to + `https://join.studio.moq.dev/`, which this repository deploys from `main`. - `--guest-expiry` (default `4h`, at least `1m`) is how long a link works, and each token the studio renews it with. While a guest is in the room, the studio signs them a fresh token every half of it, over a session of its own diff --git a/quest/m0/README.md b/quest/m0/README.md index 0a68b8b0..4aac5003 100644 --- a/quest/m0/README.md +++ b/quest/m0/README.md @@ -94,7 +94,6 @@ repository. - [Wayland display and window sources](/quest/m0/wayland-sources.md) - portal-picked sources that reopen without the picker - [Destinations](/quest/m0/destinations.md) - RTMP, RTMPS, and WHIP push with per-destination codecs and shared encoders, on a UI-free egress library a hosted service can reuse - [Composable scenes](/quest/m0/scenes/README.md) - scenes nest scenes and the program, any scene publishes at its own size, and mixes become audio scenes -- [The join page is live](/quest/m0/join-page-live.md) - `join.studio.moq.dev` serves the join page `--join-page` defaults to - [Clap-to-measure sync delay](/quest/m0/sync-clap.md) - a clap sets a microphone's delay against its camera - [Audio filters](/quest/m0/audio-filters.md) - per-source noise suppression, gate, compressor, limiter, and plugins, configured from the studio - [Browser sources on macOS and Windows](/quest/m0/browser-source.md) - the out-of-process CEF pages Linux has, with shared GPU textures on the other desktops diff --git a/quest/m0/join-page-live.md b/quest/m0/join-page-live.md deleted file mode 100644 index 020087ab..00000000 --- a/quest/m0/join-page-live.md +++ /dev/null @@ -1,22 +0,0 @@ -# [XS] The join page is live - -## Goal - -`https://join.studio.moq.dev/` serves the join page (`js/join`) over a valid -certificate, so `--join-page` works without being passed. - -## Plan - -Done 2026-11-06 (maintainer and agent, /quest-unblock): Pages builds from -GitHub Actions, the `github-pages` environment deploys only from `main`, a -ruleset on `main` takes only PRs that pass `Check` and refuses force pushes -and deletion, Cloudflare has `join.studio` as a DNS-only CNAME to -`moq-dev.github.io`, Pages has `join.studio.moq.dev` as its custom domain, and -the Join page workflow deployed. `http://join.studio.moq.dev/` answers 200. - -Left for an agent: once GitHub issues the certificate -(`gh api repos/moq-dev/studio/pages` shows `https_certificate.state` as -`approved`), enforce HTTPS (`gh api -X PUT repos/moq-dev/studio/pages -F -https_enforced=true`), check that `curl -sI https://join.studio.moq.dev/` -answers 200 and the page loads, drop the README's note that the default is -not live yet, and delete this quest.