akif/arclet-boards

Arclet Boards — private Kanban workspaces with AppID, DataK3, shared web and MCP actions.

• dodil-challenge
• dodil-challenge-boards

A remix template · 1 remixes · Remix akif/arclet-boards

evidence/live.json

{
  "checked_at": "2026-10-31T16:04:11.864765+00:00",
  "base_url": "https://arclet-boards-akif-8080.ignite.dodil.cloud",
  "authentication": "four real AppID password-grant sessions through the Ignite gateway",
  "passed": [
    "real AppID owner identity accepted by deployed gateway",
    "real AppID member identity accepted by deployed gateway",
    "real AppID viewer identity accepted by deployed gateway",
    "real AppID outsider identity accepted by deployed gateway",
    "four independent user subjects",
    "real platform principal cannot read end-user API",
    "real platform principal cannot invoke application MCP",
    "anonymous board API denied",
    "anonymous MCP challenge advertises OAuth discovery",
    "OAuth metadata is public and points to this MCP resource",
    "OAuth authorization server is the application's AppID pool",
    "gateway strips forged anonymous identity headers",
    "forged owner header cannot replace a real viewer session",
    "MCP creates a persistent real board",
    "owner grants board-specific member and viewer access",
    "member and viewer read their accessible board",
    "outsider cannot discover private board",
    "outsider board listing excludes private board",
    "only owner manages members and viewer cannot edit",
    "member MCP mutation persists through HTTP",
    "MCP viewer mutation and outsider reads/writes are denied",
    "MCP user-identity arguments cannot elevate permissions",
    "description labels assignment and date persist",
    "my-tasks and overdue are scoped to the real member",
    "MCP cross-list move persists",
    "history contains creation field changes labels and move with real actors",
    "durable HTTP replay returns original response",
    "invalid assignee invalid date and stale edit are refused",
    "manual checklist persists and viewer cannot toggle it",
    "cross-board foreign list cannot receive a card",
    "role changes take effect without replacing the user's token",
    "revoked user loses visibility immediately",
    "record survives new HTTP session and backend connection"
  ],
  "workspace_id": "54bd620dfdc14fe985c7f7ca6470fdf0",
  "board_id": "782d17901a544ebda3ba9bfa889a2388",
  "card_id": "3b0e8ed05f4a4123a67b1069c1f822d3",
  "oauth_discovery_verified": true,
  "external_assistant_interactive_consent_verified": false
}