Claus Lohmar
57610cdbae
- PROJECT_PLAN.md: the decision log of record through D-042 and the M0.1 slice - docs/specs: SPEC-002…009 — routing · door · identity/sessions · /setup · enroll/login · roles/chain/recovery · module registry · the web layer & PWA (plus docs/specs/README.md, the index) - AGENT.md: the working rules — commit AND push at every submilestone (gate green), Conventional Commits, never commit secrets - README.md: the quickstart, the first-run/SSH-tunnel steps and the localhost/loopback caveat (SPEC-009 §13 Q-3): with an https base URL the CSRF/session cookies are Secure, so reach the app at localhost/127.0.0.1 - config.example.yaml: the settings template (D-035)
79 lines
3.5 KiB
Markdown
79 lines
3.5 KiB
Markdown
# AGENT.md — MyDay
|
|
|
|
> Operating instructions for AI agents working in this repository.
|
|
> **Status:** M0 + M0.1 implemented (SPEC-002…009); next milestone **M1 — org structure**.
|
|
|
|
---
|
|
|
|
## 1. What MyDay is
|
|
|
|
**MyDay** is Sechpoint's **self-hosted, single-tenant** employee app (a **PWA** for mobile and
|
|
desktop): **time & absence**, **reporting**, and the **company org structure** those depend on.
|
|
|
|
It is **one Go binary** — a small **core** (`MyDay.auth`) plus drop-in **modules**.
|
|
|
|
---
|
|
|
|
## 2. The source of truth
|
|
|
|
| Artefact | Role |
|
|
|---|---|
|
|
| **`PROJECT_PLAN.md`** | the **decision log of record** — read it first. If a decision changes, update it **in the same change**. |
|
|
| **`docs/specs/`** | implementation specs. **Specs precede code.** |
|
|
| **`README.md`** | the human quickstart. |
|
|
| **`.opencode/git.env`** | the agent **git-workflow contract** (gitignored; see `.opencode/git.env.example`). |
|
|
|
|
---
|
|
|
|
## 3. Doctrine — the rules that must not be broken
|
|
|
|
1. **The path is the request.** Identity lives in the path; the query carries only transient state.
|
|
2. **The rule of the door.** The door *resolves*; the handler *authenticates*. A module **never
|
|
parses a raw path**.
|
|
3. **Identification ≠ authorisation.** The GUID is a *username*; the **session cookie is the
|
|
credential**. A bookmark is never a login.
|
|
4. **Two doors, one destination.** ROUTER (path) and HANDLER (`do`/`action`) both resolve to
|
|
`(module, function, params)` (D-039).
|
|
5. **Modules are independent.** A module depends only on **core interfaces** and **owns its own
|
|
tables** — never reach into another module's data.
|
|
6. **Delete, don't redirect.** Reserved names come from one source.
|
|
7. **Every page renders inside the shell.** The core layout owns the document, the header and the
|
|
nav (`Registry.Nav()`); a module supplies **content** only. The CSP is `script-src 'self'`:
|
|
**no inline `<script>`, no `on*=`, no `javascript:`** — the WebAuthn ceremonies are driven from
|
|
`data-*` attributes by `static/webauthn.js`. Static assets are served by the reserved `static`
|
|
workflow (`internal/core/server/static.go`).
|
|
|
|
---
|
|
|
|
## 4. Stack & layout
|
|
|
|
- **Go** (single binary) · **SQLite** (WAL · foreign keys ON · CGO-free driver) · `sqlc` · `slog`
|
|
- `internal/core/` — the door · registry · identity · sessions · roles · chain · DB
|
|
- `internal/modules/<name>/` — `app.go` · `routing.go` · `handlers.go` (+ `queries.go` ·
|
|
`migrations/` · `web/`)
|
|
|
|
See `PROJECT_PLAN.md` §12.1.
|
|
|
|
---
|
|
|
|
## 5. Working rules
|
|
|
|
- **Read `PROJECT_PLAN.md` before changing anything structural.** Decisions live there.
|
|
- **Spec before code.** New work starts as `docs/specs/spec-NNN-*.md`.
|
|
- **Commit AND push at every submilestone** (each spec slice or revision) once the gate —
|
|
`go build` · `go vet` · `go test -race` — is **green**. `main` is the source of truth.
|
|
Group into **Conventional Commits** (`feat:` · `fix:` · `docs:` · `chore:` …), one per area/submilestone.
|
|
- **Never commit secrets** — `config.yaml`, `.opencode/git.env`, `*.db` are gitignored (D-010).
|
|
- **Never set git identity globally** — repo-local only.
|
|
- **Do not force-push.**
|
|
- When a decision changes, **update `PROJECT_PLAN.md` in the same commit**.
|
|
|
|
---
|
|
|
|
## 6. Current phase
|
|
|
|
**M0 (auth + routing foundation) and M0.1 (the web layer / PWA) are complete** — SPEC-002 … SPEC-009
|
|
are implemented: routing · identity/sessions · the door · `/setup` · enroll/login (+ the passkey
|
|
nudge) · roles/chain/recovery · the module registry · the web shell & PWA.
|
|
|
|
**Next:** **M1 — org structure** (`PROJECT_PLAN.md` §11).
|