luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
957 Commits 2 Branches 2 Tags
5f74ae965d90ed733ecfe91403dbaa8669e80bbb
Commit Graph
314 Commits
Author SHA1 Message Date
Lucas Berger 5f74ae965d docs(19): add code review fix report 2026-06-17 20:42:51 -04:00
Lucas Berger 4b635784e4 docs(19): add code review report 2026-06-17 20:08:26 -04:00
Lucas Berger 0aca22f743 docs(19): verification passed (21/21) after blocker fix; UAT for live/CI items 2026-06-17 20:00:00 -04:00
Lucas Berger 11977fddf4 chore: merge executor worktree (worktree-agent-ad5628ea37541e256) 2026-06-17 17:28:49 -04:00
Lucas Berger 63beb74650 docs(19-04): complete PWA login UI + account management surfaces plan 2026-06-17 17:26:07 -04:00
Lucas Berger eba0bb095d docs(19-05): complete dev-bypass rework + harness + CI plan (checkpoint) 2026-06-17 17:22:39 -04:00
Lucas Berger e0d471a5d5 docs(19-03): complete local-auth middleware wiring plan 2026-06-17 17:00:42 -04:00
Lucas Berger f167031292 docs(19-02): complete admin+me account management plan summary 2026-06-17 16:40:50 -04:00
Lucas Berger d22da015cb docs(19-01): complete local-auth foundation plan (checkpoint reached at Task 4) 2026-06-17 16:19:25 -04:00
Lucas Berger f96282a767 docs(19): add PATTERNS.md (codebase analog map for planning) 2026-06-17 16:08:36 -04:00
Lucas Berger dc40ba9fb8 docs(19): create local-auth phase plan (5 plans, 4 waves) 2026-06-17 15:35:43 -04:00
Lucas Berger 4b461cbaab docs(19): add validation strategy 2026-06-17 15:19:08 -04:00
Lucas BergerandClaude Sonnet 4.6 29f4a2e623 docs(19): research phase 19 local auth domain 
Covers password hashing (node:crypto scrypt), JWT session cookies
(hono/utils/jwt), middleware ordering, local_credentials schema,
OIDC-link flow, dev-bypass rework (option C), and break-glass CLI.
Resolves all five open questions from CONTEXT.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-17 15:17:46 -04:00
Lucas BergerandClaude Sonnet 4.6 4dd6068dcc docs(19): mark UI-SPEC approved after checker verification 
All 6 design dimensions PASS plus Phase 17 brand-slot readiness contract.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 21:19:45 -04:00
Lucas BergerandClaude Sonnet 4.6 71bf21634c docs(19): UI design contract for local auth login screen and admin additions 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 21:18:04 -04:00
Lucas Berger 64fa4653da docs(19): capture phase context 2026-06-16 21:04:52 -04:00
Lucas BergerandClaude Opus 4.8 e821515d25 docs(12): resolve VERIFICATION human-needed — wizard e2e satisfied via UAT re-verify
CI / changes (pull_request) Successful in 4s
Details
CI / fast-checks (pull_request) Failing after 1m4s
Details
CI / api (pull_request) Failing after 1m30s
Details
CI / harness (pull_request) Failing after 1h2m7s
Details
CI / security (pull_request) Failing after 13s
Details
CI / gate (pull_request) Failing after 1s
Details 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:23:15 -04:00
Lucas BergerandClaude Opus 4.8 932fcb6e3f chore(12): mark Phase 12 complete — UAT re-verified, all 6 gaps closed 
- ROADMAP/STATE advanced to Phase 13 (real-lint-gate-eslint)
- Archived diagnosed UAT marked superseded (historical only)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:17:18 -04:00
Lucas BergerandClaude Opus 4.8 5eef074a57 test(12): re-verify UAT after gap-closure — 6 passed, 1 env-blocked, all 6 gaps confirmed closed 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-16 16:04:22 -04:00
Lucas Berger eed76de37f docs(12-05): complete Instance-step gap-closure plan (gaps 1, 3, 4) 2026-06-15 21:32:53 -04:00
Lucas Berger 7c94558de4 docs(12-07): append self-check result to SUMMARY 2026-06-15 21:25:03 -04:00
Lucas Berger 96c49138cb docs(12-07): complete UAT gap-closure plan (gaps 5 & 6 — /setup reverse-gate + ['me'] freshness) 2026-06-15 21:24:42 -04:00
Lucas Berger 2b3569ff20 fix(12-07): make ['me'] fresh on shell entry so post-wizard banner clears (gap 6) 
- Root cause confirmed = mechanism (ii): ['me'] staleness, NOT a backend linking gap
  (upsertUser claim preserves users.id → credential stays linked → DB needsProviderSetup=false)
- SetupBanner ['me'] query staleTime 5min → 0 so a pre-claim stale cache entry is
  refetched on mount; banner hides once needsProviderSetup resolves false
- App.tsx boot ['me'] staleTime also set to 0 (committed with Task 1) for the same reason
- Add SetupBanner.test.tsx regression: absent when false, present (no dismiss) when true,
  stale-cache refetch hides banner; success-only dismissal contract preserved (no X button)
- Log pre-existing PWA lint errors (SetupPage.test.tsx, setupClient.contract.test.ts) to deferred-items.md
 2026-06-15 21:23:46 -04:00
Lucas Berger 67c17a58eb docs(12-06): complete setup-route gap-closure plan (VAPID equality + DB name) 2026-06-15 21:15:18 -04:00
Lucas Berger f0fb31348d docs(12): gap-closure plans 05-07 for 6 UAT gaps 2026-06-15 21:05:45 -04:00
Lucas Berger dc7f8d2aa9 test(12): complete UAT - 0 passed, 6 issues across 3 tests 2026-06-15 21:00:31 -04:00
Lucas BergerandClaude Opus 4.8 df93f4fe95 docs(12): code review clean after --fix --auto (10 findings fixed across 3 iterations) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 16:50:36 -04:00
Lucas Berger ef3e9810a9 docs(12): add code review report 2026-06-15 16:11:50 -04:00
Lucas Berger 836cb38934 docs(phase-12): add security threat verification — 15/15 closed, 0 open 2026-06-15 16:05:14 -04:00
Lucas BergerandClaude Opus 4.8 8db5b236c4 test(12): persist human verification items as UAT 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:22:18 -04:00
Lucas BergerandClaude Opus 4.8 4f81ccdbfd docs(12): verification passed (9/9) after VAPID gap closure — one human Fastmail UAT remains 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:22:00 -04:00
Lucas Berger 49b82d2ef4 docs(12-04): update SUMMARY + STATE + ROADMAP for CR-01 VAPID gap closure 2026-06-15 15:16:41 -04:00
Lucas BergerandClaude Opus 4.8 d8b4c98592 docs(12): code review — 1 critical, 5 warnings, 4 info 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 15:02:27 -04:00
Lucas BergerandClaude Opus 4.8 d96dfae17b chore(12-04): drop committed verification screenshot from planning dir 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 14:54:19 -04:00
Lucas Berger 7a1801f47d docs(12-04): complete setup-wizard PWA plan — BUG 1+2 fixed, playwright verified 
Update SUMMARY.md with bug fix details, TDD gate compliance, and playwright-cli
verification confirming /api/setup/config returns 200 with camelCase payload.
Update STATE.md session info. Phase 12 all 4 plans complete.
 2026-06-15 14:52:17 -04:00
Lucas Berger 1d8eed309b docs(12-04): complete setup-wizard PWA plan — paused at human-verify checkpoint 2026-06-15 14:36:20 -04:00
Lucas BergerandClaude Opus 4.8 ee21611607 docs(12-03): record Self-Check PASSED in summary 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 14:17:41 -04:00
Lucas Berger a36f9ddb78 docs(12-03): complete first-login-claims plan summary 2026-06-15 14:16:59 -04:00
Lucas Berger 9d0aa6296a docs(12-02): complete setup-routes plan — guard + router + OIDC fallback 2026-06-15 14:06:29 -04:00
Lucas Berger c6d0db0119 docs(12-01): complete Phase 12 Plan 01 plan 2026-06-15 13:47:04 -04:00
Lucas Berger f5bb71cd99 Merge remote-tracking branch 'origin/main' into gsd/phase-12-initial-setup-wizard 
# Conflicts:
#	.planning/ROADMAP.md
#	.planning/STATE.md
 2026-06-15 13:30:32 -04:00
Lucas Berger 2bf5a42ac2 docs(roadmap): add Phase 19 Local Auth (No-OIDC Mode) 2026-06-15 13:11:34 -04:00
Lucas BergerandClaude Sonnet 4.6 0f3c3784e6 docs(12): revise UI-SPEC for collect-and-write wizard model 
Drop Step 2 "Generate Secrets" (secrets move to pre-boot helper script per D-05),
rework Step 2 to collect non-secret config via form fields (app URL, OIDC issuer,
client_id, VAPID public key) written to app_config per D-02, and reduce wizard
from 5 steps to 4. All design tokens, surfaces, and a11y contracts unchanged.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-15 13:09:25 -04:00
Lucas BergerandClaude Opus 4.8 513fc887e4 docs(12): finalize plan — validation map, research resolution, roadmap waves 
Resolve plan-checker warning (mark RESEARCH Open Questions RESOLVED),
fill VALIDATION.md Nyquist map (nyquist_compliant), record planning
complete in STATE, annotate ROADMAP wave dependencies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:49:53 -04:00
Lucas Berger fe40de83db docs(12): create initial-setup-wizard phase plan (4 plans, 3 waves) 2026-06-15 11:46:30 -04:00
Lucas BergerandClaude Opus 4.8 ea40176920 docs(12): map patterns to existing analogs 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:37:37 -04:00
Lucas BergerandClaude Opus 4.8 48acf3ac95 docs(12): add research and validation strategy 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:34:00 -04:00
Lucas BergerandClaude Sonnet 4.6 f5542dce10 docs(12): research phase 12 initial setup wizard 
Covers pre-auth /api/setup/* route surface, minimal-env-kernel + DB-backed
config model, pre-OIDC local user + first-login-claims schema migration,
defense-in-depth 423 guard, generate-secrets helper script, and explicit
reconciliation of the SETUP-03 and D-09 deviations from the roadmap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-15 11:32:55 -04:00
Lucas BergerandClaude Opus 4.8 3ed9a42845 docs(12): capture phase context 
Restored onto phase-12 branch — discuss-phase originally committed the
context (dc41073) on the phase-18 branch by mistake.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 11:24:43 -04:00
Lucas BergerandClaude Opus 4.8 745e806d89 docs(phase-18): add security threat verification (SECURED, 0 open) 
gsd-security-auditor verified all 13 plan-time STRIDE threats against the
implementation: 8 mitigate confirmed in code (file:line evidence), 5 accept
documented, 4 supply-chain checks (zero new deps). threats_open: 0. ASVS L1,
block_on high — no high-severity gaps. Post-review fixes (WR-01 blank-TZ guard,
WR-02 INSERT IGNORE) verified in code; D-07 boundary confirmed via git diff.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-15 07:58:53 -04:00