luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
892 Commits 2 Branches 2 Tags
4b461cbaab97653ad5d038db0a6ab238d5b2c9bd
Commit Graph
430 Commits
Author SHA1 Message Date
Lucas Berger 4b461cbaab docs(19): add validation strategy 2026-06-17 15:19:08 -04:00
Lucas BergerandClaude Sonnet 4.6 29f4a2e623 docs(19): research phase 19 local auth domain 
Covers password hashing (node:crypto scrypt), JWT session cookies
(hono/utils/jwt), middleware ordering, local_credentials schema,
OIDC-link flow, dev-bypass rework (option C), and break-glass CLI.
Resolves all five open questions from CONTEXT.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-17 15:17:46 -04:00
Lucas BergerandClaude Opus 4.8 9ef7eaada8 docs(state): record phase 19 UI-SPEC approval; ignore local claude settings 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 21:21:25 -04:00
Lucas BergerandClaude Sonnet 4.6 4dd6068dcc docs(19): mark UI-SPEC approved after checker verification 
All 6 design dimensions PASS plus Phase 17 brand-slot readiness contract.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 21:19:45 -04:00
Lucas BergerandClaude Sonnet 4.6 71bf21634c docs(19): UI design contract for local auth login screen and admin additions 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 21:18:04 -04:00
Lucas Berger 45fca0ed6b docs(state): record phase 19 context session 2026-06-16 21:04:57 -04:00
Lucas Berger 64fa4653da docs(19): capture phase context 2026-06-16 21:04:52 -04:00
Lucas BergerandClaude Opus 4.8 f485b38324 docs(12): ship phase 12 — PR #22 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:24:41 -04:00
Lucas BergerandClaude Opus 4.8 e821515d25 docs(12): resolve VERIFICATION human-needed — wizard e2e satisfied via UAT re-verify
CI / changes (pull_request) Successful in 4s
Details
CI / fast-checks (pull_request) Failing after 1m4s
Details
CI / api (pull_request) Failing after 1m30s
Details
CI / harness (pull_request) Failing after 1h2m7s
Details
CI / security (pull_request) Failing after 13s
Details
CI / gate (pull_request) Failing after 1s
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:23:15 -04:00
Lucas BergerandClaude Opus 4.8 932fcb6e3f chore(12): mark Phase 12 complete — UAT re-verified, all 6 gaps closed 
- ROADMAP/STATE advanced to Phase 13 (real-lint-gate-eslint)
- Archived diagnosed UAT marked superseded (historical only)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:17:18 -04:00
Lucas BergerandClaude Opus 4.8 5eef074a57 test(12): re-verify UAT after gap-closure — 6 passed, 1 env-blocked, all 6 gaps confirmed closed 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:04:22 -04:00
Lucas Berger eed76de37f docs(12-05): complete Instance-step gap-closure plan (gaps 1, 3, 4) 2026-06-15 21:32:53 -04:00
Lucas Berger 7c94558de4 docs(12-07): append self-check result to SUMMARY 2026-06-15 21:25:03 -04:00
Lucas Berger 96c49138cb docs(12-07): complete UAT gap-closure plan (gaps 5 & 6 — /setup reverse-gate + ['me'] freshness) 2026-06-15 21:24:42 -04:00
Lucas Berger 2b3569ff20 fix(12-07): make ['me'] fresh on shell entry so post-wizard banner clears (gap 6) 
- Root cause confirmed = mechanism (ii): ['me'] staleness, NOT a backend linking gap
  (upsertUser claim preserves users.id → credential stays linked → DB needsProviderSetup=false)
- SetupBanner ['me'] query staleTime 5min → 0 so a pre-claim stale cache entry is
  refetched on mount; banner hides once needsProviderSetup resolves false
- App.tsx boot ['me'] staleTime also set to 0 (committed with Task 1) for the same reason
- Add SetupBanner.test.tsx regression: absent when false, present (no dismiss) when true,
  stale-cache refetch hides banner; success-only dismissal contract preserved (no X button)
- Log pre-existing PWA lint errors (SetupPage.test.tsx, setupClient.contract.test.ts) to deferred-items.md
 2026-06-15 21:23:46 -04:00
Lucas Berger 67c17a58eb docs(12-06): complete setup-route gap-closure plan (VAPID equality + DB name) 2026-06-15 21:15:18 -04:00
Lucas Berger f0fb31348d docs(12): gap-closure plans 05-07 for 6 UAT gaps 2026-06-15 21:05:45 -04:00
Lucas Berger dc7f8d2aa9 test(12): complete UAT - 0 passed, 6 issues across 3 tests 2026-06-15 21:00:31 -04:00
Lucas BergerandClaude Opus 4.8 df93f4fe95 docs(12): code review clean after --fix --auto (10 findings fixed across 3 iterations) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 16:50:36 -04:00
Lucas Berger ef3e9810a9 docs(12): add code review report 2026-06-15 16:11:50 -04:00
Lucas Berger 836cb38934 docs(phase-12): add security threat verification — 15/15 closed, 0 open 2026-06-15 16:05:14 -04:00
Lucas BergerandClaude Opus 4.8 a07bb5bc67 fix(12): keep phase checkbox open — verification is human_needed, completion via verify-work 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:22:46 -04:00
Lucas BergerandClaude Opus 4.8 8db5b236c4 test(12): persist human verification items as UAT 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:22:18 -04:00
Lucas BergerandClaude Opus 4.8 4f81ccdbfd docs(12): verification passed (9/9) after VAPID gap closure — one human Fastmail UAT remains 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:22:00 -04:00
Lucas Berger 49b82d2ef4 docs(12-04): update SUMMARY + STATE + ROADMAP for CR-01 VAPID gap closure 2026-06-15 15:16:41 -04:00
Lucas BergerandClaude Opus 4.8 523742c489 fix(12): revert premature phase-complete checkbox — verification pending 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:03:25 -04:00
Lucas BergerandClaude Opus 4.8 d8b4c98592 docs(12): code review — 1 critical, 5 warnings, 4 info 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:02:27 -04:00
Lucas BergerandClaude Opus 4.8 d96dfae17b chore(12-04): drop committed verification screenshot from planning dir 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 14:54:19 -04:00
Lucas Berger 7a1801f47d docs(12-04): complete setup-wizard PWA plan — BUG 1+2 fixed, playwright verified 
Update SUMMARY.md with bug fix details, TDD gate compliance, and playwright-cli
verification confirming /api/setup/config returns 200 with camelCase payload.
Update STATE.md session info. Phase 12 all 4 plans complete.
 2026-06-15 14:52:17 -04:00
Lucas Berger 1d8eed309b docs(12-04): complete setup-wizard PWA plan — paused at human-verify checkpoint 2026-06-15 14:36:20 -04:00
Lucas BergerandClaude Opus 4.8 ee21611607 docs(12-03): record Self-Check PASSED in summary 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 14:17:41 -04:00
Lucas Berger a36f9ddb78 docs(12-03): complete first-login-claims plan summary 2026-06-15 14:16:59 -04:00
Lucas Berger 9d0aa6296a docs(12-02): complete setup-routes plan — guard + router + OIDC fallback 2026-06-15 14:06:29 -04:00
Lucas Berger c6d0db0119 docs(12-01): complete Phase 12 Plan 01 plan 2026-06-15 13:47:04 -04:00
Lucas BergerandClaude Opus 4.8 743e83c2f2 docs(phase-12): reconcile roadmap/state after merging origin/main; begin phase 12 execution 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 13:31:15 -04:00
Lucas Berger f5bb71cd99 Merge remote-tracking branch 'origin/main' into gsd/phase-12-initial-setup-wizard 
# Conflicts:
#	.planning/ROADMAP.md
#	.planning/STATE.md
 2026-06-15 13:30:32 -04:00
Lucas Berger 2bf5a42ac2 docs(roadmap): add Phase 19 Local Auth (No-OIDC Mode) 2026-06-15 13:11:34 -04:00
Lucas BergerandClaude Sonnet 4.6 0f3c3784e6 docs(12): revise UI-SPEC for collect-and-write wizard model 
Drop Step 2 "Generate Secrets" (secrets move to pre-boot helper script per D-05),
rework Step 2 to collect non-secret config via form fields (app URL, OIDC issuer,
client_id, VAPID public key) written to app_config per D-02, and reduce wizard
from 5 steps to 4. All design tokens, surfaces, and a11y contracts unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-15 13:09:25 -04:00
Lucas BergerandClaude Opus 4.8 513fc887e4 docs(12): finalize plan — validation map, research resolution, roadmap waves 
Resolve plan-checker warning (mark RESEARCH Open Questions RESOLVED),
fill VALIDATION.md Nyquist map (nyquist_compliant), record planning
complete in STATE, annotate ROADMAP wave dependencies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:49:53 -04:00
Lucas Berger fe40de83db docs(12): create initial-setup-wizard phase plan (4 plans, 3 waves) 2026-06-15 11:46:30 -04:00
Lucas BergerandClaude Opus 4.8 ea40176920 docs(12): map patterns to existing analogs 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:37:37 -04:00
Lucas BergerandClaude Opus 4.8 48acf3ac95 docs(12): add research and validation strategy 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:34:00 -04:00
Lucas BergerandClaude Sonnet 4.6 f5542dce10 docs(12): research phase 12 initial setup wizard 
Covers pre-auth /api/setup/* route surface, minimal-env-kernel + DB-backed
config model, pre-OIDC local user + first-login-claims schema migration,
defense-in-depth 423 guard, generate-secrets helper script, and explicit
reconciliation of the SETUP-03 and D-09 deviations from the roadmap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-15 11:32:55 -04:00
Lucas BergerandClaude Opus 4.8 3ed9a42845 docs(12): capture phase context 
Restored onto phase-12 branch — discuss-phase originally committed the
context (dc41073) on the phase-18 branch by mistake.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:24:43 -04:00
Lucas BergerandClaude Opus 4.8 e7c55787e0 docs(18): ship phase 18 — PR #21
CI / changes (pull_request) Successful in 2s
Details
CI / fast-checks (pull_request) Successful in 1m28s
Details
CI / api (pull_request) Successful in 1m5s
Details
CI / harness (pull_request) Failing after 6m41s
Details
CI / security (pull_request) Successful in 40s
Details
CI / gate (pull_request) Failing after 1s
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 09:15:22 -04:00
Lucas BergerandClaude Opus 4.8 745e806d89 docs(phase-18): add security threat verification (SECURED, 0 open) 
gsd-security-auditor verified all 13 plan-time STRIDE threats against the
implementation: 8 mitigate confirmed in code (file:line evidence), 5 accept
documented, 4 supply-chain checks (zero new deps). threats_open: 0. ASVS L1,
block_on high — no high-severity gaps. Post-review fixes (WR-01 blank-TZ guard,
WR-02 INSERT IGNORE) verified in code; D-07 boundary confirmed via git diff.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 07:58:53 -04:00
Lucas BergerandClaude Opus 4.8 60621468be docs(18): code review clean + fix report (--fix --auto --all) 
Re-review after fixes: status clean (0 Critical/Warning). All 5 findings
from the prior pass resolved across 4 atomic fix commits:
- WR-01: treat empty/blank TZ as unset in the D-06 fallback chain
- WR-02: derive seed `seeded` flag from INSERT IGNORE affectedRows (accurate
  under concurrent race; D-03 no-overwrite preserved)
- IN-01/02: reuse fetched row on GET unset path; centralize D-06 fallback
- IN-03: memoize household timezone per outbox drain cycle

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 07:47:40 -04:00
Lucas BergerandClaude Opus 4.8 ea93089b74 docs(18): verification passed + mark phase complete 
Phase-goal verification: 7/7 decision-contract truths confirmed (D-01..D-07).
Browser round-trip re-confirmed via Playwright e2e against the live stack.
Mark phase 18 complete in STATE.md and ROADMAP.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-14 23:08:56 -04:00
Lucas Berger 79ea94f4b9 docs(18): mark WR-01/WR-02 resolved in review 
- WR-01: resolved (first-run save enabled — AdminPage.tsx + unit tests)
- WR-02: resolved (seed endpoint idempotent — admin.ts + integration tests)
- WR-03: accepted/not-fixing (redundant GET SELECT, low priority)
- Info items remain as-is (no action required)
 2026-06-14 22:57:05 -04:00
Lucas Berger 9481544a58 docs(18-04): complete admin timezone UI plan 2026-06-14 22:46:21 -04:00