# Phase 1: Foundation + Broker Spike - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md — this log preserves the alternatives considered.

**Date:** 2026-06-04
**Phase:** 1-Foundation + Broker Spike
**Areas discussed:** Personal-cal spike & fallback, Member color assignment, Infra validation scope

---

## Area Selection

| Option                        | Selected                        |
| ----------------------------- | ------------------------------- |
| Personal-cal spike & fallback | ✓                               |
| Member color assignment       | ✓                               |
| Phase 1 landing scope         | (skipped → Claude's discretion) |
| Infra validation scope        | ✓                               |

---

## Personal-cal spike & fallback

### Where the wife's personal calendar lives

| Option                  | Description                                     | Selected |
| ----------------------- | ----------------------------------------------- | -------- |
| Fastmail                | Fastmail-hosted collection; broker can reach it | ✓        |
| iCloud / Apple Calendar | Broker cannot read; CAL-08 degrades             |          |
| Not sure yet            | Confirm before spike                            |          |
| Both / mixed            | Define overlay target                           |          |

**User's choice:** Fastmail
**Notes:** Removes the iCloud "unreachable" risk; CAL-08 is technically achievable.

### Broker access model

| Option                                    | Description                                          | Selected |
| ----------------------------------------- | ---------------------------------------------------- | -------- |
| Single broker token + share               | One token; share+accept per member                   |          |
| Per-member app passwords                  | Each member's own app password; broker holds N creds | ✓        |
| Prove single-token, keep per-member ready | Hybrid                                               |          |

**User's choice:** Per-member app passwords
**Notes:** Eliminates the unconfirmed cross-account CalDAV ACL discovery risk (the project's original highest risk). Spike simplifies to confirming an app password reads its own account.

### Spike credential sequencing

| Option                   | Description                                                  | Selected |
| ------------------------ | ------------------------------------------------------------ | -------- |
| Just mine now            | Prove broker with Lucas's app password; wife's added Phase 2 | ✓        |
| Both before Phase 1 done | Get wife's password too; fully close CAL-08 now              |          |

**User's choice:** Just mine now
**Notes:** Phase 1 not blocked on coordinating with wife. CAL-08 structurally proven via N-credential broker.

### Credential storage

| Option                      | Description                                                | Selected |
| --------------------------- | ---------------------------------------------------------- | -------- |
| DB table, encrypted at rest | Keyed by oidc_sub, key from env; supports later onboarding | ✓        |
| Env vars / secrets file     | Simple, but redeploy to add/rotate                         |          |

**User's choice:** DB table, encrypted at rest
**Notes:** Supports adding wife later with no redeploy; backend-only, never exposed to frontend.

---

## Member color assignment

| Option                    | Description                                | Selected |
| ------------------------- | ------------------------------------------ | -------- |
| Auto-assign from palette  | Assign on first login, persist on user row | ✓        |
| User-pickable in settings | Default + settings color-picker            |          |
| Hardcoded per account     | Fixed color in config per oidc_sub         |          |

**User's choice:** Auto-assign from palette
**Notes:** No settings UI in Phase 1; stable across sessions; works for future members. Pickable color deferred.

---

## Infra validation scope

### Deployment scope

| Option                    | Description                                            | Selected |
| ------------------------- | ------------------------------------------------------ | -------- |
| Deploy through Pangolin   | Real tunnel + Authelia; validate OIDC topology day one | ✓        |
| Local docker-compose only | Localhost; defer tunnel validation                     |          |

**User's choice:** Deploy through Pangolin
**Notes:** Avoids "worked locally, broke in prod" OIDC failure; same-parent-domain cookies (Pitfall 17).

### Pangolin SSE smoke test

| Option           | Description                                           | Selected |
| ---------------- | ----------------------------------------------------- | -------- |
| Fold it in now   | Trivial SSE endpoint over public URL; de-risk Phase 4 | ✓        |
| Defer to Phase 4 | Keep Phase 1 strict to its 5 criteria                 |          |

**User's choice:** Fold it in now
**Notes:** Cheap while stack+tunnel are up; a failure changes Phase 4 transport but does not block Phase 1.

---

## Claude's Discretion

- Phase 1 landing page: thin authenticated shell that also displays the one cached event as broker proof.
- Color palette: small set of visually-distinct, accessible hues, round-robin by join order.
- Broker internals (sync-token vs ctag, poll interval), Drizzle schema, OIDC middleware wiring, encryption helper.
- Stack libraries/versions per locked research stack.

## Deferred Ideas

- User-pickable member color (settings color-picker) — future settings/profile phase.
- Single-token broker via share+accept — not chosen; alternative on record only.
- Wife's app-password onboarding UX/endpoint — Phase 2 (the encrypted credential table is built in Phase 1 to support it).
