# CAL-08: Personal Calendar ACL Spike — Decision Record

**Requirement:** CAL-08
**Phase:** 01-foundation-broker-spike
**Spike script:** `apps/api/src/broker/spike.ts`

## Status

**Decision: [PENDING — fill in after running the spike]**

---

## How to Run the Spike

```bash
cd apps/api
FASTMAIL_EMAIL=<lucas@fastmail.com> \
FASTMAIL_APP_PASSWORD=<app-password-from-fastmail-settings> \
pnpm exec tsx src/broker/spike.ts
```

The script will print every calendar collection returned by Fastmail's CalDAV PROPFIND.

---

## Results

> Fill in after running the spike.

### Calendars Discovered

| displayName | URL | ctag returned? | syncToken returned? |
|-------------|-----|----------------|---------------------|
| (fill in) | (fill in) | (fill in) | (fill in) |

### Questions Resolved

| Question | Finding |
|----------|---------|
| Does Lucas's app password see the shared family calendar? | (fill in) |
| Does Lucas's app password see Lucas's personal calendar? | (fill in) |
| Which change-detection field does Fastmail use — ctag or syncToken? | (fill in) |

---

## Decision

**Decision: GO / NO-GO** (circle one — delete the other after filling in)

**Rationale:** (fill in after seeing the spike output)

**If NO-GO — Fallback:**
Proceed with shared-family-only calendar in Phase 1. Personal calendar overlay moves to v1.x.
Document the Fastmail restriction that prevented per-member personal calendar access.

---

## Notes

- App password scope required: "Mail, Contacts & Calendars"
- Fastmail Settings → Privacy & Security → App Passwords
- The password is passed via env for this one-off read-only enumeration; it is NOT committed anywhere
- Results here resolve RESEARCH Open Questions 1 + Assumptions A1/A2/A3