88 lines
3.7 KiB
JSON
88 lines
3.7 KiB
JSON
{
|
|
"task_id": "DEV-000033",
|
|
"task_revision": 2,
|
|
"architecture_revision": "ADR-0003 and ADR-0004",
|
|
"base_repo_revision": "111ad75deaf20a6822f5440ad232d782479ce79c",
|
|
"risk_tier": "E",
|
|
"intent": "Add a typed username/password Creator authentication flow for the single Domovoy Creator account while preserving bounded sessions, bootstrap recovery access, and all existing authority boundaries.",
|
|
"requirement_ids": ["INV-AUTH-001", "CONSTITUTION-1.3.28"],
|
|
"allowed_change_scope": {
|
|
"modules": ["identity"],
|
|
"paths": [
|
|
"contracts/identity/session.go",
|
|
"modules/identity/domain/session.go",
|
|
"cmd/core-runtime/main.go",
|
|
"cmd/core-runtime/main_test.go",
|
|
"cmd/creator-web/server_test.go",
|
|
"cmd/creator-web/static/index.html",
|
|
"cmd/creator-web/static/assets/console.js",
|
|
"cmd/creator-web/static/assets/console.css",
|
|
"deploy/docker-compose.dev.yml",
|
|
"deploy/docker-compose.prod.yml",
|
|
"docs/DEPLOYMENT.md",
|
|
"tests/creator_auth/**",
|
|
"tests/creator_web/**",
|
|
"dev/ACTIVE_TASK.json",
|
|
"dev/tasks/DEV-000033-creator-username-password.json"
|
|
]
|
|
},
|
|
"forbidden_change_scope": {
|
|
"paths": [
|
|
"architecture/**",
|
|
"ci/**",
|
|
".gitea/**",
|
|
"security/**",
|
|
"database/**",
|
|
"modules/authority/**",
|
|
"modules/commit/**",
|
|
"modules/continuity/**",
|
|
"adapters/**"
|
|
]
|
|
},
|
|
"allowed_architecture_delta": {
|
|
"new_cross_module_dependencies": 0,
|
|
"new_canonical_owners": 0,
|
|
"new_privileges": 0
|
|
},
|
|
"contracts": {
|
|
"consume": ["contracts.identity@v1", "Creator bootstrap recovery credential"],
|
|
"may_change": ["Creator session issuance request adds typed username/password credentials"]
|
|
},
|
|
"semantic_owner": "identity",
|
|
"canonical_state": ["no new canonical state; the single Creator identity remains domovoy-creator-actor/domovoy-creator-principal"],
|
|
"state_transitions": ["valid configured credentials issue the existing eight-hour bounded Creator session"],
|
|
"side_effects_and_privileges": ["reads externally injected Creator username and password", "does not grant Authority or accept Actor/Principal from the client"],
|
|
"persistence_and_migrations": ["none; credentials remain external runtime configuration"],
|
|
"failure_retry_restart": ["missing configuration and invalid credentials fail with the same generic denial", "credentials are not logged or persisted in browser storage", "bootstrap Bearer remains for test and recovery compatibility"],
|
|
"assumptions": [
|
|
"The user explicitly selected username m and supplied the Creator password",
|
|
"The user requested execution, which authorizes this authentication contract change",
|
|
"ADR-0004 requires the active pointer update to be reviewed as a Tier E protected-path change"
|
|
],
|
|
"acceptance_scenarios": [
|
|
"valid username/password issues the existing bounded Creator session",
|
|
"wrong username, wrong password, empty fields and malformed JSON are denied without credential disclosure",
|
|
"the browser sends credentials only in the session request body and stores only the issued session token",
|
|
"Actor and Principal remain server-selected constants",
|
|
"legacy bootstrap Bearer remains accepted for recovery and remote harnesses",
|
|
"production credentials are injected outside the repository",
|
|
"desktop and mobile login remain accessible",
|
|
"remote login and current-session checks succeed through the deployed gateway"
|
|
],
|
|
"required_tests": [
|
|
"unit",
|
|
"adversarial authentication",
|
|
"gateway request forwarding",
|
|
"architecture preflight",
|
|
"exact diff scope",
|
|
"go vet",
|
|
"responsive browser",
|
|
"remote Docker smoke"
|
|
],
|
|
"terminal_gap_states": [
|
|
"BLOCKED_BY_ARCHITECTURE_GAP",
|
|
"BLOCKED_BY_SPEC_GAP",
|
|
"BLOCKED_BY_CONFLICT"
|
|
]
|
|
}
|