conductor/SLICE10.md

SLICE10 — Browser titles and application icons

Status: Complete — implementation and local verification; release/customer VM acceptance pending

Purpose

Implement the approved temporary Conductor favicon and browser-title convention in the application itself. Support optional icons for installed applications and applications published from Conductor projects.

Working instructions

Read CODEX.md and applicable AGENTS.md instructions before work. Current source and tests are authoritative. Preserve unrelated working-tree changes. Use this file as both the slice specification and its continuing log.

The user authorized implementation of this slice on 2026-09-13. Update the checklist and append dated log entries as work proceeds. Record decisions, changed files, checks and results, failures, unresolved issues and the next action. Do not erase earlier log entries or claim VM/release acceptance from local tests alone.

Scope

• Install the approved vector and fallback favicon assets as Conductor defaults.
• Use app-first titles: Conductor at home; Projects · Conductor and Publishing · Conductor for core views; Social Scheduler · Conductor and each published app's display name for app routes.
• Use a shared identity mechanism that handles navigation, direct links, loading, sign-in/sign-out and unavailable applications without leaving stale titles or icons.
• Allow installed-app manifests to specify an optional local icon; existing manifests keep working.
• Provide optional custom icons for published applications, stored on the customer's VM with a default-icon reset.
• Use the relevant icon on application cards as well as in the browser tab.
• Keep default fallback behavior when an icon is omitted, missing or unusable.
• Update administrator, user and installer-contract documentation.

Acceptance checks

Action	Purpose / expected behavior
Open the home page and core screens	Correct title and Conductor icon; no stale identity after navigation.
Open an installed app directly and from its card	Registered application name and optional icon apply, with no Social Scheduler hardcoding in base Conductor.
Publish an app with and without a custom icon	Both published routes and catalog cards use the selected icon or default.
Change and reset an app icon, then reload	Selection persists, and reset restores the default.
Try a missing or invalid icon and sign out	Fallback and authorization remain correct; private app metadata is not disclosed before authentication.
Run focused tests, regressions and production builds	Verify actual behavior and compatibility; inspect light/dark browser-size screenshots.

Boundaries and dependencies

The temporary icon artwork is approved in design/icon. Plugin-package architecture, image publication, setup-script changes and upgrades belong to SLICE11–SLICE13. No customer deployment is part of this slice.

The customer control panel and other SaaS backlog items remain outside these four slices. The user reports only one live Conductor instance, which has Social Scheduler installed. A clean Conductor reset is an available fallback if a safe retrofit is impractical; first record the exact scope and backup/recovery plan. This does not authorize wiping the entire VM or deleting Node-RED's saved connections or PostgreSQL's schedules.

Progress log

2026-09-13 — Plan recorded

• Renamed the proposed four phases to SLICE10, SLICE11, SLICE12 and SLICE13, respectively.
• Implementation started: inspecting existing publication metadata, authentication and installed-app registration.

Initial handoff (superseded by the completion log below)

Implement and verify browser identity and optional app icons; append the actual results here.

2026-09-13 — Implementation progress

• Added shared browser identity, approved default assets, optional local iconPath in installed-app manifests, and application-card icons.
• Added PNG upload/selection/reset in Publishing. Images are constrained to square 16–512 pixel PNGs up to 256 KiB, decoded and re-encoded, and stored as deduplicated public decorative assets in Conductor SQLite.
• Existing publication metadata gets a nullable icon_path column automatically; old manifests and apps retain the default. No canonical project-schema change is needed.
• The existing 29 backend tests and 528 frontend tests pass after initial implementation. Adding focused API and browser coverage before marking implementation verified.
• Dependency: pinned pngjs 7.0.0 and its type declarations; consulted the project's primary documentation at https://github.com/pngjs/pngjs. No native image library or new VM service is required.

2026-09-13 — Implementation and local verification complete

• Installed the approved SVG, ICO, 32-pixel PNG and touch-icon assets in frontend/public. The SVG and ICO match their approved design masters byte-for-byte.
• Connected shared identity to core navigation, signed-in application catalogs, published app runtime and the installed-app registry. Titles use the agreed app-first convention. Default fallback also applies after an image error, a five-second load timeout, navigation or sign-out.
• Published apps support optional PNG upload on creation, later icon changes and default-icon reset. App cards display the same image. Icon changes are metadata changes, independent of the immutable project snapshot.
• Added backward-compatible optional iconPath metadata to schemaVersion 1 installed-app manifests. Base Conductor has no Social Scheduler-specific title or icon.
• Added authenticated administrative upload and public decorative asset routes. PNG parsing checks file size, chunk structure, dimensions, CRC and bounded decompression; images are re-encoded and deduplicated in SQLite. Old publications receive a nullable icon choice through repeatable initialization.
• Fixed a concrete publication boundary found during this work: metadata changes now validate the existing published snapshot rather than the current draft. A private credential-bearing snapshot cannot become public just because its draft was edited, and a safe public app can change its icon even if its unpublished draft now needs authentication.
• Updated administrator, user, installer-contract, installation, operations, test and icon-asset documentation.
• Preserved the pre-existing Projects/registry work and unrelated documentation/schema/runtime changes. The pre-slice source backup is retained at /home/vwiebe/projects/.local/conductor-slice10-start-20260913T144004Z.

Verification performed by Codex in local Ubuntu/Chromium using disposable databases and Node 24.18.1:

Check	Result / evidence
Backend build and tests	PASS — 29 tests, including real HTTP/SQLite icon validation, permissions, restart persistence and published-snapshot regressions.
Frontend tests	PASS — 29 suites / 531 tests, including delayed icon-load, sign-out and timeout regressions.
Frontend TypeScript and production build	PASS.
Browser identity acceptance	PASS — 26 identity assertions plus upload/reset/republish, missing-asset fallback and default asset checks. Results: test-results/slice10/browser-identity.json.
Existing management browser acceptance	PASS — Projects, publishing, registry updates/removal, role filtering and failure recovery.
Current Social Scheduler integration	PASS — compiled the actual source overlay with the final Conductor changes; registered its real manifest twice; opened Configure and Compose through the authenticated bridge; confirmed Social Scheduler · Conductor and the default icon; return home restores Conductor.
Visual inspection	PASS — Publishing at 1440 and 1000 pixels, plus default icons at 16/32/48 pixels on light and dark backgrounds. No overlaps observed.
Documentation, governance and whitespace	PASS — documentation links, MVP governance and git diff --check.

Browser artifacts are under test-results/slice10, test-results/management and test-results/slice10-social-integration. The compatibility build is /home/vwiebe/projects/.local/conductor-slice10-social-kit/.local/conductor-build. Its scheduler API is a read-only local fixture; no Bluesky post or customer credential was used.

Resolved verification issues:

• The first browser selector expected the Access label without its option text. Corrected the test selector; the real publishing workflow then passed.
• The first compatibility-copy location was inside its source directory, which Node correctly refused to copy recursively. Prepared the kit as a sibling under projects/.local and rebuilt successfully.
• The first race test used a test helper that this repository does not install. Reused its existing React act/createRoot approach; no testing dependency was added.
• The documentation scan included an incomplete temporary source backup. Moved that backup outside Conductor rather than changing the documentation checker; the scan then passed.

Delivery boundaries

Local implementation and verification are complete. Customer VM acceptance and release publication have not occurred in SLICE10. setup-conductor.sh, customer data, social credentials, the Social Scheduler release archive and version numbers were not changed. No source commit, push or image publication was made.

User-uploaded icons support PNG in this slice; trusted installed-app assets can use the documented local image formats. Uploaded images are public decorative assets and are retained when a selection is reset. Unused-asset cleanup and per-app touch icons are not implemented.

Next action

Proceed with SLICE11 when requested: independently release Conductor and replace source-overlay app packaging with the generic installed-app package interface. SLICE12 then updates fresh installation; SLICE13 supplies the repeatable upgrade path. Preserve the completed title/icon behavior and its tests during that work.