mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
J3vbandClaude Fable 5
75d64dd412
* docs(b3-1): record PR #1449 =71d867cbin the status line, step table and evidence block Pre-squash SHAs completed with the coverage commita0356ee1and the three Codex rounds (head8614603b). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * refactor(b3-2): auth_deps.go — the consumer-owned AuthService interface Eight methods beside the handlers that need them: Register, Login, VerifyTOTP, Logout, DeleteAccount, EnableTOTP, ConfirmTOTP, DisableTOTP — fewer than the ten *db.DB methods the two handlers call today. The input and result types they name (Principal, RegisterInput, LoginInput, AuthResult, TOTPChangeResult) and the AuthBroadcaster the delete path needs live in service/auth.go. Nothing implements or calls the interface yet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * refactor(b3-2): service.AuthService — the auth orchestration, moved verbatim Register, Login, VerifyTOTP, Logout, DeleteAccount, EnableTOTP, ConfirmTOTP, DisableTOTP and the RegistrationPolicy gate two characterization rows pin ahead of the body read. The enumeration guard, the F3 reserve-before-compare, the audit writes, the best-effort custom-status clear and the 200+warning partial-success contract move line for line; persistence stays in db behind Store. Each refusal is a named service.Err* whose Error() is the exact public message the handler wrote and whose category (ErrUnauthorized and ErrInvalidInput join the message.go set) the transport maps to a status. The auth rate multiplier moves to auth/ratescale.go so the route mounts and the login failure accounting read one value; api keeps its wrappers. Nothing calls the service yet — the handlers still own their copies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * refactor(b3-2): thin auth handlers — decode, call AuthService, encode *db.DB leaves every handler signature in auth_handler.go and totp_handler.go; MountAuthRoutes takes the interface and the AuthMiddleware the caller builds, and router.go constructs the service after the hub. Each refusal is encoded by one writeAuthError switch on the service's error categories. The principal helper in middleware.go hands the handlers the caller as service.Principal, and userResponse moves next to the profile handler, so neither auth file names db any more: their two DBImportAllow rows go in this commit (TestDBImportAllowIsLive proves the rows could not outlive the import) and the boundary fixture points at middleware.go instead. The auth-slice limits leave api/constants.go with the code that reads them; profile_handler.go reads the shared pw_confirm budget from the service. Test files change only where they mount the routes (four helper lines + two direct mounts); no assertion or row moves. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * docs(b3-2): after-state boundary inventory — api db importers 12 → 10 Regenerated table (49 files; move 28 → 26), the auth slice's after-state dependency rows, and the honest reading of the plan's "neither db nor service" target: met for db, not for service — the handlers import service for the interface's types and Err* categories. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * docs(b3-2): evidence block — pre-squash SHAs, graph deltas, gates, coverage Characterization green at each SHA in a detached worktree with the frozen files byte-identical to 71d867cb; nine-method interface vs ten db methods; api db importers 12 → 10; slice coverage 392/433 = 90.5% → 392/427 = 91.8%; the five behaviour notes (decode-before-gate corner cases, shared AuthMiddleware, folded confirmation block, moved limits, moved converter). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * docs(hp-3): scorecard draft and the D4 vertical-slice pattern in server.md Five questions answered with commands and outputs at fe1d11b8/3f0d24ec; owner sign-off line left blank. server.md gains D4 — the eight-step interface/service/handler rule for B3-8 with the awkward step (gate-before-decode) named — and its D3 deviation note drops the auth routes. Plans README indexes the scorecard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo * docs(b3-2): record PR #1450 in the evidence block and the HP-3 fetch line Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A17Uq3d2C36rN82Jitf3wo --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Plan index
Closes G-04. Historical plans are kept at their existing paths — links from audits and commit messages must keep resolving — so status is recorded here rather than by moving or rewriting them.
A plan's own header can drift out of date after its table is updated in place. Where that has happened it is called out below, and this index is the authority.
Active — these drive current work
| Plan | State |
|---|---|
| beta-product-requirements-2026-08-23 | Approved beta scope, frozen. 57 BPR-* requirements. |
| repo-health-roadmap-2026-08-23 | Phase order and gates, B0–B10. B0, B1 and B2 complete (HP-0, HP-1 and HP-2 all accepted); B3 is next — opens with the layout-refactor first slice. B3–B10 not started. Amended 2026-08-28: dated lines in B3–B10, a "Phase execution pattern" section, and a truthful status header. Amended 2026-08-29: B3/B7/B9 lines binding the layout-refactor supplement below; current slice updated for B2-2. |
| repo-health-issue-register-2026-08-23 | 88 planning rows. Public-safe; not a replacement for the ledger. |
| beta-requirements-traceability-2026-08-23 | Requirement → phase → evidence map. No row is release-qualified. |
| b0-baseline-2026-08-25 | Supersedes the roadmap's "current evidence snapshot." B0 measurements and dispositions. |
| b1-repository-foundation-2026-08-25 | B1-0 through B1-8 all done. B1 execution plan. Re-verifies every RL-* claim against HEAD; several are refuted. |
| hp-0-scorecard-2026-08-25 | HP-0 accepted 2026-08-25. The single baseline-acceptance artifact. Part-closes R-08. |
| hp-1-scorecard-2026-08-27 | HP-1 accepted 2026-08-27. Structural-diff proofs for the flatten and module rename, plus the B1 exit gate. |
| b2-protocol-trust-compat-2026-08-28 | B2 complete — HP-2 accepted 2026-08-29. B2-0, B2-1, B2-8 done 2026-08-28; B2-2 (B2-3/B2-4 folded in), B2-5, B2-6, B2-7, B2-9 done 2026-08-29. Scorecard below. |
| hp-2-scorecard-2026-08-29 | HP-2 accepted 2026-08-29. Seven questions answered with commands; B2 exit gate, nine conditions met (1 at the slim epoch scope, 4 with one E2EE gap disclaimed). Owner follow-ups that do not gate B3: BPR-051 reader line, SEC-01/SEC-04 advisory IDs. |
| b3-server-architecture-guardrails-2026-08-29 | B3 in progress from 2026-08-29. Execution plan: B3-0 inventory → B3-1/B3-2 auth slice → HP-3 → lifecycle, hub options, ws split, families; guardrails and the alpha dataset beside the slice. B3-0 (inventory + db-import-boundary rule) and B3-1 (auth characterization) merged 2026-08-29; B3-2 (auth vertical slice) in review 2026-08-30. |
| hp-3-scorecard-2026-08-29 | HP-3 draft 2026-08-30, awaiting the owner's signature. Five questions on the auth vertical slice answered with commands: frozen set green at every pre-squash SHA, api db importers 12 → 10, B2 contracts unchanged, the pattern written as D4 in server.md, guardrails as they exist. |
| audit-2026-08-19-remediation | Phases 1–6 done 2026-08-20; phase 7 pending. Its header still reads "in progress 2026-08-19" — stale; the phase table is correct. |
Partially implemented
| Plan | State |
|---|---|
| bug-detection-improvements | Tier 1a (make fuzz) and Tier 2 (five ESLint rules) shipped 2026-08-08. Remaining tiers open. |
Design only — not implemented
| Plan | State |
|---|---|
| developer-experience-layout-refactor-2026-08-29 | Draft, not started. Implementation supplement bound into the roadmap 2026-08-29: B3 workstream 17 (Phases 1–3, auth slice → HP-3), B7 workstream 16 (Phases 4–6), B9 workstream 11 (CSS split). Nothing starts before HP-2. |
| slash-commands | Design only. No implementation; not in beta scope. |
Shipped — kept for history, do not use as current status
| Plan | Shipped |
|---|---|
| audit-2026-07-19-decisions | Decisions recorded; greenlit items implemented through 2026-07-23. |
| channel-visibility-unification | 2026-07-20 (D9), re-verified 2026-08-04. |
| v2-dispatch-migration | 2026-07-20 (D10), re-verified 2026-08-04. |
| tauri-capability-narrowing | 2026-07-20, re-verified 2026-08-04. |
| http-tofu-proxy | 2026-07-19, re-verified 2026-08-04. |
| permission-middleware-consolidation | 2026-07-23 (D13), re-verified 2026-08-04. |
| security-hardening-remediation | 2026-07-23, re-confirmed 2026-08-04. |
| security-scan-2026-07-22-remediation | All 8 findings F1–F8 closed, verified 2026-08-04. |
| sqlc-adoption | Shipped, verified 2026-08-04. |
| discord-parity | Phases 1–6 complete, verified 2026-08-04. Phase 1's table reads as a gap list but every row shipped. |
| infrastructure-roadmap | 2026-08-15, with two recorded leftovers (TOTP persister seam; published capacity numbers). |
Where status actually lives
Planning documents are not trackers. Do not read a defect count out of one.
| Concern | Source of truth |
|---|---|
| Defect status | .superpowers/findings-ledger.json (FINDINGS.md is rendered from it) |
| Security-sensitive defects | Private GitHub Security Advisories |
| Product scope | beta-product-requirements-2026-08-23 |
| Phase order and gates | repo-health-roadmap-2026-08-23 |
| Current measured baseline | b0-baseline-2026-08-25 |
Ledger at 2026-08-29: 315 fixed / 59 open / 3 declined / 1 duplicate = 378.
All 38 open records still resolved to a live file:line at
5cc0888964e26276d1aca145e83270a2c1b9febd when that sweep was run — it was a
manual pass, not something a command reproduces. What the tooling does check:
node .superpowers/render-ledger.mjs --check # the ledger's schema is valid
node scripts/check-doc-counts.mjs # documents agree with it, and
# FINDINGS.md is not stale
Adding a plan
- Give it a
**Status:**line with a date, and update that line — not only the phase table — when it changes. - Add a row here. A plan absent from this index has no recorded status.
- Mark a superseded plan here; leave it at its path so existing links resolve.