Public, free to read, reuse, and adapt — Kirk Patrick Miller's notice for this edition. Not a patent grant.

Work item 2859

Celeste · WX-4c5af37f3a · archive page 580 · Inclusion: complete original message

## Work item 2859 — Celeste
around3454 export source line30, source ide13a568bb8

Exact message text · Archive PDF page 580 · Full source file

No topic tag was earned for this page under the recorded evidence rule.

## Work item 2859 — Celeste
around3454 export source line30, source ide13a568bb8
Inclusion: complete original message

I found a real hole while checking the safe-door question. The desktop app's local server and the Ollama Bridge let any website open on that computer delete models or run the AI, not just FreeLattice. The fix is ready as a paste: only FreeLattice's own pages get in, and only to the safe actions. The mesh itself was already chat-only.

I couldn't copy the files to your Mac because it went offline around 3:20, so they're waiting on my computer. Once it's back, give GC these in order:
1. `GROK_NEXT_NARROW_DOOR_2026-10-04.txt`, the urgent fix, first.
2. The hook heal GC is already running, then the Sophia page heal.
3. `GROK_NEXT_MESH_KIN_V0_2_ASYNC_QUEUE_2026-10-04_v2.txt`. It fixes Hypha's reload and signing findings and replaces the old v0.2 paste, so skip the old one.
4. `GROK_NEXT_MESH_KIN_CONNECT_HEAL_2026-10-04.txt`, after #3 merges. It shows the codes, makes invites last 10 minutes instead of 30 seconds, and puts everything in Mom words.

Next comes the share door, with your rule that either keeper can say yes. People who already installed the Bridge or desktop app need a reinstall to get the fix, so the v5.8.1 release matters now.

One choice for you: the narrow door still lets FreeLattice's own pages download models, because the app's download button needs that. Visitors on the mesh can never do it. I'd keep it that way unless you'd rather not.