docs(01-04): complete integration+gate plan summary; add CAL-08 decision template

- 01-04-SUMMARY.md: code-complete; Task 1 committed (48f90ce); Tasks 2+3 are live-gate checkpoints with exact human-action steps - CAL-08-DECISION.md: template for human to fill in after running apps/api/src/broker/spike.ts against real Fastmail credentials
2026-06-04 11:18:04 -04:00
parent 48f90ceca9
commit 22a0f05170
2 changed files with 294 additions and 0 deletions
@@ -0,0 +1,63 @@
+# CAL-08: Personal Calendar ACL Spike — Decision Record
+
+**Requirement:** CAL-08
+**Phase:** 01-foundation-broker-spike
+**Spike script:** `apps/api/src/broker/spike.ts`
+
+## Status
+
+**Decision: [PENDING — fill in after running the spike]**
+
+---
+
+## How to Run the Spike
+
+```bash
+cd apps/api
+FASTMAIL_EMAIL=<lucas@fastmail.com> \
+FASTMAIL_APP_PASSWORD=<app-password-from-fastmail-settings> \
+pnpm exec tsx src/broker/spike.ts
+```
+
+The script will print every calendar collection returned by Fastmail's CalDAV PROPFIND.
+
+---
+
+## Results
+
+> Fill in after running the spike.
+
+### Calendars Discovered
+
+| displayName | URL | ctag returned? | syncToken returned? |
+|-------------|-----|----------------|---------------------|
+| (fill in) | (fill in) | (fill in) | (fill in) |
+
+### Questions Resolved
+
+| Question | Finding |
+|----------|---------|
+| Does Lucas's app password see the shared family calendar? | (fill in) |
+| Does Lucas's app password see Lucas's personal calendar? | (fill in) |
+| Which change-detection field does Fastmail use — ctag or syncToken? | (fill in) |
+
+---
+
+## Decision
+
+**Decision: GO / NO-GO** (circle one — delete the other after filling in)
+
+**Rationale:** (fill in after seeing the spike output)
+
+**If NO-GO — Fallback:**
+Proceed with shared-family-only calendar in Phase 1. Personal calendar overlay moves to v1.x.
+Document the Fastmail restriction that prevented per-member personal calendar access.
+
+---
+
+## Notes
+
+- App password scope required: "Mail, Contacts & Calendars"
+- Fastmail Settings → Privacy & Security → App Passwords
+- The password is passed via env for this one-off read-only enumeration; it is NOT committed anywhere
+- Results here resolve RESEARCH Open Questions 1 + Assumptions A1/A2/A3