{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[6b6eb0c3] Auth form: poem JS morphs form innerHTML on response; no redirect\n\n- post_choose_username returns HTML fragments instead of redirects:\n  success → auth_signed_in_fragment (\"you're signed in — return to your agent\")\n  error   → choose_username_error_fragment (form re-rendered with error inline)\n- Poem JS now reads response body; if non-empty, morphs form innerHTML with it\n  (existing ingest forms return empty body, so they're unaffected)\n- auth.rs: keep full layout() with poem JS — revert to single layout\n- auth-success CSS class added to both themes\n\nCo-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>\n\nSide A — unified diff (full patch):\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex c1194f79fd89fb47fe6b425b494a0ffa667abb2d..cb0faa29b834931e2c2b2f5c174c875e2e2e9346 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -16,7 +16,7 @@ use crate::{\n         canonicalize_username, validate_agent_format, validate_username,\n         Event, TokenIssued, UserRegistered,\n     },\n-    html::{auth_complete_page, choose_username_page},\n+    html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n     state::{AppState, PendingSession},\n };\n \n@@ -274,8 +274,6 @@ pub async fn post_choose_username(\n         return api_error(StatusCode::BAD_REQUEST, \"invalid agent format\", Some(msg)).into_response();\n     }\n \n-    let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n-\n     let reduced_arc = state.reduced.clone();\n     let reduced = reduced_arc.read().await;\n     let provider_key = (provider.to_lowercase(), provider_id.clone());\n@@ -284,11 +282,7 @@ pub async fn post_choose_username(\n     }\n     if reduced.users_by_provider.values().any(|u| u == &canonicalize_username(&form.username)) {\n         drop(reduced);\n-        return Redirect::to(&format!(\n-            \"{public_url}/auth/choose-username?session={}&error={}\",\n-            urlencoding::encode(&form.session),\n-            urlencoding::encode(\"that username is taken — try another\"),\n-        )).into_response();\n+        return choose_username_error_fragment(&form.session, \"that username is taken — try another\").into_response();\n     }\n     drop(reduced);\n \n@@ -324,7 +318,7 @@ pub async fn post_choose_username(\n         s.complete = Some((canon_user.clone(), bearer.clone()));\n     }\n \n-    Redirect::to(&format!(\"{public_url}/auth/complete\")).into_response()\n+    auth_signed_in_fragment().into_response()\n }\n \n pub async fn post_pending_session(\ndiff --git a/server/src/html/auth.rs b/server/src/html/auth.rs\nindex 40b1ef30a6c1d4063aa2d8e9c93df8972df4b27c..0a14bdbfb66c65d1bd09993ffd4a7bb6f2fe041e 100644\n--- a/server/src/html/auth.rs\n+++ b/server/src/html/auth.rs\n@@ -1,20 +1,25 @@\n-use maud::{html, Markup, DOCTYPE};\n+use maud::{html, Markup};\n \n-/// Minimal layout for auth pages — no JS interceptor, real form navigation works.\n-fn auth_layout(title: &str, body: Markup) -> Markup {\n+fn form_inner(session: &str, error: Option<&str>) -> Markup {\n     html! {\n-        (DOCTYPE)\n-        html {\n-            head {\n-                meta charset=\"utf-8\";\n-                meta name=\"viewport\" content=\"width=device-width, initial-scale=1\";\n-                title { (title) }\n-                link rel=\"stylesheet\" href=\"/static/theme_default.css\";\n-            }\n-            body class=\"view-auth\" {\n-                (body)\n-            }\n+        input type=\"hidden\" name=\"session\" value=(session);\n+        label for=\"username\" { \"username\" }\n+        input\n+            type=\"text\"\n+            id=\"username\"\n+            name=\"username\"\n+            placeholder=\"e.g. alice\"\n+            pattern=\"[a-z0-9_\\\\-]{1,32}\"\n+            maxlength=\"32\"\n+            autocomplete=\"off\"\n+            autofocus;\n+        p.auth-hint {\n+            \"lowercase · alphanumeric · hyphens · underscores · max 32\"\n         }\n+        @if let Some(msg) = error {\n+            p.auth-error { (msg) }\n+        }\n+        button type=\"submit\" { \"continue\" }\n     }\n }\n \n@@ -28,27 +33,23 @@ pub fn choose_username_page(session: &str, error: Option<&str>) -> Markup {\n         h1 { \"choose a username\" }\n         p { \"pick a handle for slug.social.\" }\n         form.auth-form method=\"POST\" action=\"/auth/choose-username\" {\n-            input type=\"hidden\" name=\"session\" value=(session);\n-            label for=\"username\" { \"username\" }\n-            input\n-                type=\"text\"\n-                id=\"username\"\n-                name=\"username\"\n-                placeholder=\"e.g. alice\"\n-                pattern=\"[a-z0-9_\\\\-]{1,32}\"\n-                maxlength=\"32\"\n-                autocomplete=\"off\"\n-                autofocus;\n-            p.auth-hint {\n-                \"lowercase · alphanumeric · hyphens · underscores · max 32\"\n-            }\n-            @if let Some(msg) = error {\n-                p.auth-error { (msg) }\n-            }\n-            button type=\"submit\" { \"continue\" }\n+            (form_inner(session, error))\n         }\n     };\n-    auth_layout(\"join — slug.social\", body)\n+    super::layout(\"join — slug.social\", \"view-auth\", body, None)\n+}\n+\n+/// Fragment returned to the poem JS on error — replaces the form's innerHTML.\n+pub fn choose_username_error_fragment(session: &str, error: &str) -> Markup {\n+    form_inner(session, Some(error))\n+}\n+\n+/// Fragment returned to the poem JS on success — replaces the form's innerHTML.\n+pub fn auth_signed_in_fragment() -> Markup {\n+    html! {\n+        p.auth-success { \"you're signed in — return to your agent.\" }\n+        p.auth-hint { \"you can close this tab.\" }\n+    }\n }\n \n pub fn auth_complete_page() -> Markup {\n@@ -62,5 +63,5 @@ pub fn auth_complete_page() -> Markup {\n         p { \"Return to your terminal — your agent is polling and will collect your token automatically.\" }\n         p.auth-hint { \"You can close this tab.\" }\n     };\n-    auth_layout(\"signed in — slug.social\", body)\n+    super::layout(\"signed in — slug.social\", \"view-auth\", body, None)\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 2f16d701962d703db0c859bb586dfc08ec385690..8b48a25cce79f0eefc7e29849e1a667cae4c7986 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -15,7 +15,7 @@ mod search;\n mod tree;\n use breadcrumb_path::OntologyPath;\n \n-pub use auth::{auth_complete_page, choose_username_page};\n+pub use auth::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page};\n pub use editor::{editor_check, editor_page};\n pub use forum::{index, thread_feed_html, thread_post_expand, thread_post_view, thread_view};\n pub use garden::{garden_index, ontology_path};\n@@ -114,6 +114,8 @@ script { (maud::PreEscaped(r#\"\n                         });\n \n                         // Poem: intercept POST forms, send via fetch, await SSE for DOM update.\n+                        // If the response body is non-empty HTML, morph the form's innerHTML with it\n+                        // (used for inline feedback without a page reload, e.g. auth forms).\n                         document.addEventListener('submit', async (e) => {\n                             const f = e.target;\n                             if (!f || f.tagName !== 'FORM') return;\n@@ -121,14 +123,19 @@ script { (maud::PreEscaped(r#\"\n                             e.preventDefault();\n                             const btn = f.querySelector('button[type=\"submit\"], input[type=\"submit\"]');\n                             if (btn) { btn.disabled = true; btn.textContent = '…'; }\n-                            await fetch(f.action, {\n+                            const resp = await fetch(f.action, {\n                                 method: 'POST',\n                                 body: new URLSearchParams(new FormData(f)),\n                                 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n                                 credentials: 'same-origin',\n                             });\n-                            if (btn) { btn.disabled = false; btn.textContent = 'submit'; }\n-                            f.reset();\n+                            const html = await resp.text();\n+                            if (html && html.trim()) {\n+                                Idiomorph.morph(f, html, {morphStyle: 'innerHTML'});\n+                            } else {\n+                                if (btn) { btn.disabled = false; btn.textContent = 'submit'; }\n+                                f.reset();\n+                            }\n                         });\n \n                         // Search: debounced fetch + idiomorph.\ndiff --git a/server/static/theme_default.css b/server/static/theme_default.css\nindex 9e71574da4bed3a0116c347610636780678bd1af..a1d8d1765a7812191edc579125facf1694554c2c 100644\n--- a/server/static/theme_default.css\n+++ b/server/static/theme_default.css\n@@ -250,6 +250,11 @@ p.auth-error {\n   font-size: 12px;\n   margin: 4px 0 0;\n }\n+p.auth-success {\n+  color: var(--signal);\n+  font-size: 13px;\n+  margin: 4px 0 0;\n+}\n \n /* ----------------------------------------------------------------\n    BUTTONS — raised, press on :active\ndiff --git a/server/static/theme_retro.css b/server/static/theme_retro.css\nindex dc9fa4654f529eb1843557fb580cf3982da46901..8ed8fd88efab32b36bd66cf200aa182219b0a8b5 100644\n--- a/server/static/theme_retro.css\n+++ b/server/static/theme_retro.css\n@@ -32,6 +32,7 @@ input[type=\"text\"] {\n input[type=\"text\"]:focus { border-color: #00ff41; }\n p.auth-hint { color: #555; font-family: monospace; font-size: 0.75rem; margin: 0; }\n p.auth-error { color: #ff4444; font-family: monospace; font-size: 0.8rem; margin: 0; }\n+p.auth-success { color: #00ff41; font-family: monospace; font-size: 0.8rem; margin: 0; }\n \n /* Ingest form (poem pattern) */\n .ingest-form-wrap { margin-top: 1.5rem; }\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[075d4d37] Fix OAuth test mocks so Clojure E2E auth flows work again.\n\nHttpServer handlers were crashing on query parsing and token POSTs, which broke Playwright login; also read alias/history via real CSS selectors.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>\n\nSide B — unified diff (full patch):\ndiff --git a/test/auth_login.clj b/test/auth_login.clj\nindex 6f2f00d7aa7340e63d1ac465b0a2234cec7a983f..aa63b66ccb2471b710ba3d168d0461252b39fc10 100644\n--- a/test/auth_login.clj\n+++ b/test/auth_login.clj\n@@ -14,27 +14,27 @@\n (defn- type-alias! [pg text]\n   (page/evaluate pg\n                  (.replace\n-                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return;\n+                  \"(() => { const i = document.getElementById('alias-input'); const f = document.getElementById('alias-check-form'); if (!i || !f) return Promise.resolve('missing-form');\n                     i.value = __TEXT__;\n                     const cf = document.getElementById('alias-claim-field'); if (cf) cf.value = i.value;\n                     return fetch(f.action, { method: 'POST', credentials: 'same-origin',\n                       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n                       body: new URLSearchParams(new FormData(f)).toString() })\n                       .then(function (r) { return r.text(); })\n-                      .then(function (t) { eval(t); }); })()\"\n+                      .then(function (t) { eval(t); return document.getElementById('alias-status')?.textContent || ''; }); })()\"\n                   \"__TEXT__\"\n-                  (pr-str text)))\n-  (Thread/sleep 400))\n+                  (pr-str text))))\n \n-(defn- element-text [pg test-id]\n+(defn- element-text [pg selector]\n   (let [raw (page/evaluate pg\n-                           (str \"document.querySelector('[data-testid=\\\"\" test-id \"\\\"]')?.textContent || ''\"))]\n+                           (str \"document.querySelector(\" (pr-str selector) \")?.textContent || ''\"))]\n     (when (string? raw) (str/trim raw))))\n \n (defn- wait-for-text [pg test-id text timeout-ms]\n-  (let [deadline (+ (System/currentTimeMillis) timeout-ms)]\n+  (let [deadline (+ (System/currentTimeMillis) timeout-ms)\n+        selector (str \"[data-testid=\\\"\" test-id \"\\\"]\")]\n     (loop []\n-      (let [got (or (element-text pg test-id) \"\")]\n+      (let [got (or (element-text pg selector) \"\")]\n         (cond\n           (= got text) got\n           (< (System/currentTimeMillis) deadline) (do (Thread/sleep 200) (recur))\ndiff --git a/test/support/mock_oauth.clj b/test/support/mock_oauth.clj\nindex 5ba7e9be3cf6d2226648e9609a09ed45f306930f..333fe08d56cb06bac2a338cad1c73894d54c4495 100644\n--- a/test/support/mock_oauth.clj\n+++ b/test/support/mock_oauth.clj\n@@ -7,7 +7,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -31,11 +31,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -45,7 +45,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn- authorize-redirect [exchange query]\n@@ -55,7 +55,7 @@\n         user (parse-mock-user mock-user)\n         code (str \"mock:\" (:id user) \":\" (:login user))\n         loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                 \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                 \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n     (send-redirect exchange loc)))\n \n (defn start-mock-oauth\n@@ -65,49 +65,56 @@\n         handler\n         (proxy [HttpHandler] []\n           (handle [^HttpExchange exchange]\n-            (let [uri (.getRequestURI exchange)\n-                  path (.getPath uri)\n-                  query (.getQuery uri)\n-                  method (.getRequestMethod exchange)]\n-              (cond\n-                ;; GitHub authorize\n-                (str/ends-with? path \"/login/oauth/authorize\")\n-                (authorize-redirect exchange query)\n+            (try\n+              (let [uri (.getRequestURI exchange)\n+                    path (.getPath uri)\n+                    query (.getQuery uri)\n+                    method (.getRequestMethod exchange)]\n+                (cond\n+                  ;; GitHub authorize\n+                  (str/ends-with? path \"/login/oauth/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; Reddit authorize\n-                (str/ends-with? path \"/api/v1/authorize\")\n-                (authorize-redirect exchange query)\n+                  ;; Reddit authorize\n+                  (str/ends-with? path \"/api/v1/authorize\")\n+                  (authorize-redirect exchange query)\n \n-                ;; GitHub token\n-                (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n-                (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n-                  (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n+                  ;; GitHub token\n+                  (and (= method \"POST\") (str/ends-with? path \"/login/oauth/access_token\"))\n+                  (let [code (or (:code (read-form exchange)) \"mock:1002:newbie\")]\n+                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\"}\")))\n \n-                ;; Reddit token (client_credentials for import + authorization_code for login)\n-                (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n-                (let [form (read-form exchange)\n-                      grant (or (:grant form) \"\")\n-                      code (or (:code form) \"mock:t2_test:redditor\")]\n-                  (if (= grant \"client_credentials\")\n-                    (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n-                    (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n+                  ;; Reddit token (client_credentials for import + authorization_code for login)\n+                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n+                  (let [form (read-form exchange)\n+                        grant (or (:grant form) \"\")\n+                        code (or (:code form) \"mock:t2_test:redditor\")]\n+                    (if (= grant \"client_credentials\")\n+                      (send-json exchange 200 \"{\\\"access_token\\\":\\\"app-token\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\")\n+                      (send-json exchange 200 (str \"{\\\"access_token\\\":\\\"\" code \"\\\",\\\"token_type\\\":\\\"bearer\\\",\\\"expires_in\\\":3600}\"))))\n \n-                ;; GitHub user\n-                (= path \"/user\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; GitHub user\n+                  (= path \"/user\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"1002\" :login \"newbie\" :numeric? true})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\" (:id user) \",\\\"login\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                ;; Reddit /api/v1/me\n-                (str/ends-with? path \"/api/v1/me\")\n-                (let [token (bearer-token exchange)\n-                      user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n-                  (send-json exchange 200\n-                             (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n+                  ;; Reddit /api/v1/me\n+                  (str/ends-with? path \"/api/v1/me\")\n+                  (let [token (bearer-token exchange)\n+                        user (or (parse-token-user token) {:id \"t2_test\" :login \"redditor\"})]\n+                    (send-json exchange 200\n+                               (str \"{\\\"id\\\":\\\"\" (:id user) \"\\\",\\\"name\\\":\\\"\" (:login user) \"\\\"}\")))\n \n-                :else\n-                (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))))]\n+                  :else\n+                  (send-json exchange 404 \"{\\\"error\\\":\\\"not found\\\"}\")))\n+              (catch Throwable t\n+                (binding [*out* *err*]\n+                  (println \"mock-oauth handler error:\" t))\n+                (try\n+                  (send-json exchange 500 \"{\\\"error\\\":\\\"mock-oauth internal\\\"}\")\n+                  (catch Throwable _))))))]\n     (.createContext server \"/\" handler)\n     (.setExecutor server nil)\n     (.start server)\ndiff --git a/test/support/mock_reddit.clj b/test/support/mock_reddit.clj\nindex a630cf0938722193e9af88382d60e777ff371be4..faa27945b6394363914c853627a0bad1e819a5f9 100644\n--- a/test/support/mock_reddit.clj\n+++ b/test/support/mock_reddit.clj\n@@ -12,7 +12,7 @@\n (defn- query-param [query key]\n   (when query\n     (some (fn [pair]\n-            (let [[k v] (str/split pair \"=\" 2)]\n+            (let [[k v] (str/split pair #\"=\" 2)]\n               (when (= k key)\n                 (URLDecoder/decode (or v \"\") \"UTF-8\"))))\n           (str/split query #\"&\"))))\n@@ -34,11 +34,11 @@\n \n (defn- send-redirect [^HttpExchange ex location]\n   (.set (.getResponseHeaders ex) \"Location\" location)\n-  (.sendResponseHeaders ex 302 -1)\n+  (.sendResponseHeaders ex 302 0)\n   (.close (.getResponseBody ex)))\n \n (defn- read-form [^HttpExchange ex]\n-  (let [body (slurp (.getInputStream ex))]\n+  (let [body (slurp (.getRequestBody ex))]\n     {:code (query-param body \"code\")\n      :grant (query-param body \"grant_type\")}))\n \n@@ -48,7 +48,7 @@\n           (str/replace #\"^[Bb]earer \" \"\")))\n \n (defn- parse-token-user [token]\n-  (when (str/starts-with? token \"mock:\")\n+  (when (and token (str/starts-with? token \"mock:\"))\n     (parse-mock-user (subs token 5))))\n \n (defn start-mock-reddit\n@@ -72,7 +72,7 @@\n                        user (parse-mock-user (query-param query \"mock_user\"))\n                        code (str \"mock:\" (:id user) \":\" (:login user))\n                        loc (str redirect-uri \"?code=\" (java.net.URLEncoder/encode code \"UTF-8\")\n-                                \"&state=\" (java.net.URLEncoder/encode state \"UTF-8\"))]\n+                                \"&state=\" (java.net.URLEncoder/encode (or state \"\") \"UTF-8\"))]\n                    (send-redirect exchange loc))\n \n                  (and (= method \"POST\") (str/ends-with? path \"/api/v1/access_token\"))\n","role":"user"}],"model":"openai/gpt-chat-latest"}