Claus Lohmar
04c2394c34
REVIEW-001 triage updated (H1, H2, M1c, M1s, L3s, L1c/L2s, L8c, M2s, M3s, M2c, L1s, L5s, L4s, L7c marked FIXED; L3c, L4c, L5c, L6c stay open with the reason), and each fix is tied to its code and test. - SPEC-003: the door pipeline (XFF right→left, the per-request setup gate, the isolated hardening headers, the pinned setup module), §6 the `__Host-` cookie and the startup-generated signing keys, §7 loopback enforcement per request, new AC-10…AC-12, D-2 amended (session_key removed), and a new §11 that maps every REVIEW-001 finding to its fix. - SPEC-005 / SPEC-006 / SPEC-007: the same three points where they belong (the wizard's loopback + module pin, the nudge's configured-origin signal, the async /access notification ruled in). - PROJECT_PLAN §10 register: A13 re-stated as enforced (per request + pin); A2/A5/A8 re-stated as enforced where the review verified them; A3/A6/A9/A15 now enforced by this pass; A11 left open (L4c). §14 change log entries. - README: the status said "planning / pre-alpha · nothing is built" — it is stale. State M0+M0.1, note that /setup PERSISTS config.yaml and a restart adopts the generated secrets, and state the per-request loopback rule. |
||
|---|---|---|
| .. | ||
| README.md | ||
| spec-001-git-bootstrap.md | ||
| spec-002-routing-model.md | ||
| spec-003-core-door.md | ||
| spec-004-identity-sessions.md | ||
| spec-005-setup-wizard.md | ||
| spec-006-enroll-login.md | ||
| spec-007-roles-chain-recovery.md | ||
| spec-008-module-registry.md | ||
| spec-009-web-pwa.md | ||
Specs — MyDay
Implementation specs, in build order. A spec precedes its code.
The design of record is ../../PROJECT_PLAN.md; decisions are D-nnn.
Convention: spec-NNN-<slug>.md · Status: Draft → Ready for implementation → Implemented
· one spec per coherent slice; each ends with acceptance criteria.
Index
| # | Spec | Milestone | Status | Depends on |
|---|---|---|---|---|
| 001 | Git connection bootstrap | Prep | Implemented | — |
| 002 | Routing model (internal/core/routing) |
M0 | Implemented | — |
| 003 | The core door (server + httpx) |
M0 | Implemented | 002, 004 |
| 004 | Identity & sessions (core/auth, core/users) |
M0 | Implemented | 002 |
| 005 | /setup wizard + bootstrap |
M0 | Implemented | 003, 004 |
| 006 | Enroll & login (Passkey + TOTP) | M0 | Implemented | 004 |
| 007 | Roles, the chain & recovery | M0 | Implemented | 004, 006 |
| 008 | Module registry & the Modules page | M0 | Implemented | 003 |
| 009 | Web layer & PWA (screens · WebAuthn JS · service worker) | M0.1 | Implemented | 005, 006, 007 |
The M0 slice order
002 routing ─► 004 identity/sessions ─► 003 door ─┬─► 005 setup wizard
├─► 006 enroll/login
├─► 007 roles/chain/recovery
└─► 008 registry/modules page
│
└─► 009 web layer & PWA
002 is the Stage-0 gate (ROUTING.md §11): the pure model is approved and unit-tested before any server code. 002 ✅ · 004 ✅ · 003 ✅ · 006 ✅ · 005 ✅ · 007 ✅ · 008 ✅ · 009 ✅ implemented. M0 + M0.1 are complete; next is M1 — org structure.