Campfire pin: what breaks after Page < Array when moving to basecamp/main (CSRF :header_only, RichText#embeds, Lexxy's input) #514

Moving CAMPFIRE_SHA from 90b3300 to current basecamp/once-campfire main stops first at Spinel rejecting class Page < Array (app/models/message/pagination.rb:8). That one is already tracked in matz/spinel#7449, matz/spinel#7584 and #472. To see what comes after it, we built Campfire main with the Spinel from matz/spinel#7584 and ran three of the Campfire gates from ci.yml locally. One gate fails for two reasons (the second shows once the first is patched around), and one test file goes red. We couldn't find an issue or PR for any of them (we searched issues and PRs for Sec-Fetch-Site, header_only, CSRF, authenticity, embeds, lexxy, editor_adapter).

Is anyone already on these, for example as part of the Campfire preview work in #462? If not, we'd be glad to send one PR per item.

Setup

• roundhouse f860e932 (main on 2026-10-06; the one commit since then only touches the CRuby gzip cache)
• once-campfire 32b4144 (basecamp/main, 2026-10-06, the merge of once-campfire#314: Rails main at e3d5c569, config.load_defaults 8.2)
• Spinel 59cf56a8 (the head of A subclass of Array is an Array, with its own methods dispatched on it matz/spinel#7584)
• A Linux x86_64 Docker container with Ruby, Rust, clang, Redis and ffmpeg

scripts/build-campfire-archive --out out /path/to/campfire   # spinel from matz/spinel#7584 on PATH
scripts/campfire-oracle prepare --app /path/to/campfire
scripts/campfire-compare --spinel /path/to/campfire
scripts/campfire-db-differential --spinel /path/to/campfire
scripts/campfire-suite /path/to/campfire

The archive builds: spin pack ok, the C compiles with no errors, and the 13 MB binary starts (/first_run 200, /up 200). campfire-db-differential --spinel is green: 0 tables differ, rollback 17/17.

1. campfire-compare --spinel: the Rails oracle accepts the forged posts

The Rails walk fails before the emit is compared:

==> a forged post, which must be refused
  FAIL a POST without the token is refused: got "200", want "422"
  ok   the right token from a foreign Origin is refused
  FAIL neither reaches a socket: got true, want false
  FAIL a planted session cookie's token is refused: got "200", want "422"

Cause. With load_defaults 8.2, today's Rails defaults to forgery_protection_verification_strategy = :header_only (rails/rails#56350). In action_controller/metal/request_forgery_protection.rb at e3d5c569, verified_via_header_only? returns true for same-origin and same-site, origin_trusted? for cross-site, and, when the header is absent, true unless the request is SSL or the app forces a secure protocol. The probes in scripts/campfire-cable-drive.rb (around lines 410-437) send no Sec-Fetch-Site over plain http, so Rails lets them through. The Rails at the current pin checked the token.

Check. We sent Sec-Fetch-Site: cross-site on the two forged posts and same-site on the planted one:

-             accept: "text/vnd.turbo-stream.html, text/html", csrf: false)
+             accept: "text/vnd.turbo-stream.html, text/html", csrf: false, headers: { "Sec-Fetch-Site" => "cross-site" })
 ...
-              accept: "text/vnd.turbo-stream.html, text/html", origin: "https://attacker.example")
+              accept: "text/vnd.turbo-stream.html, text/html", origin: "https://attacker.example", headers: { "Sec-Fetch-Site" => "cross-site" })
 ...
-              accept: "text/vnd.turbo-stream.html, text/html", token: PLANTED)
+              accept: "text/vnd.turbo-stream.html, text/html", token: PLANTED, headers: { "Sec-Fetch-Site" => "same-site" })

Rails then returns 422 and 422, and nothing reaches a socket. The planted-cookie post still gets 200, which matches the code above: :header_only accepts same-site without looking at the token.

Open question. The runtime checks the masked token: verified_request? in runtime/ruby/action_controller/base.rb:603, and the Spinel reopening in runtime/spinel/request_forgery_protection.rb:10-34, which adds the Origin check. Should the probes only gain the header, or should the runtime follow verified_via_header_only? so the two lanes keep agreeing? We haven't measured how the emit answers the planted same-site post: the Rails walk stops first, and for item 2 we removed that probe.

2. With the probes patched, room.html differs by one attribute

With the header patch above and the planted probe removed, both walks are green. frame_text.html and frame_html.html are equivalent. room.html differs only in the composer: the emit's <lexxy-editor> carries input="message_body_trix_input_message", and Rails' doesn't. All the other attributes match.

Cause. Lexxy is 0.9.24 both at the pin and today. At boot it picks a path with Lexxy.supports_editor_adapter? (lib/lexxy.rb:6), which is true when ActionText::Editor#editor_tag takes a block (rails/rails#56926):

• the pin's Rails doesn't have that, so lib/lexxy/engine.rb loads the fallback helpers, and lib/lexxy/action_text_tag.rb:13 sets options["input"];
• today's Rails has it, so Lexxy registers ActionText::Editor::LexxyEditor and doesn't load the fallback.

The emitter reproduces the fallback: src/lower/view_to_library/form_builder.rs:1790-1799 says "the path Rails without ActionText::Editor takes, campfire's".

3. campfire-suite: RichText#embeds is missing

FAIL test/models/message_test  6/8
     FAIL MessageTest#test_presentation_associations_load_together: undefined method 'embeds' for an instance of ActionText::RichText
==> 416 of 418 tests pass (69 of 70 files green), 2 skipped

That is still above the floor in ci.yml (392 tests, 66 files), so the conformance job would stay green. The test comes from once-campfire#292 (659f957, 2026-10-04). It calls message.body.embeds.each(&:filename) inside assert_no_queries, after with_presentation → with_attachment_details → with_rich_text_body_and_embeds. Roundhouse already types that scope (src/analyze/mod.rs:560-569), but the ActionText::RichText model it synthesizes (src/lower/rich_text.rs) has no embeds attachments. We haven't measured whether the preload would then satisfy assert_no_queries.

Not run

• campfire-compare and campfire-db-differential on the ruby target
• campfire-compare --spinel with --minor-gc and --verify-gen
• the Spinel suite lane, the smoke jobs and the benches

Written by Claude Code (AI assistant) on behalf of @namespaceMarcello, who directs this work.