Existing team KSX6GJY9C5 (C1), defer CODE_SIGN_ENTITLEMENTS until
the team is confirmed, local mobile builds mandatory, email_change
needs KTO-11, verified facts separated from spike assumptions,
QUE-06 keyboard criterion, T2 depends on PR A, limited interception
protection on Android < 12 (R13, F11), login CSRF accepted (R14),
supersession of spec 1 E4 recorded as task W2.
Refs #49
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Spec for issue #49: sign-in prompt on the public home screen and
Universal Links / App Links for /auth/confirm on iOS and Android,
web fallback unchanged. Includes options, test strategy, task split
and tasks only Chris can do (Apple/Google accounts, domain files,
SITE_URL on prod).
Refs #49
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Replace tests that could not fail (manual_fields stability, no-op update), select runbook games by id, add grant matrix and forged-admin tests, assert vocabulary seeding and Deno checksum in CI, clarify the set local convention and API notes.
Refs #2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Adds the checks.sql smoke step, the verified CLI result for generated seed content and the created_at/updated_at note for the API.
Refs #2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Includes the checked CLI assumptions (sql_paths, begin/commit) and implementation notes in the spec.
Refs #2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Visibility is immutable, variant copying is derived from visibility,
startbestand idempotency and vocabulary handling are defined, and the
edition deviation from KAT-04 criterion 4 is recorded as N15.
Refs #2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Variants are no longer copied when repointing provisional entries,
all PRs only reference #2, grants, idempotency, checks and merge
rules are spelled out.
Refs #2
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Finish the recovery guard only after the password change, mark the change
in the repository so a late userUpdated event is harmless, keep the form
locked after success, carry from through the reset check-email page,
share the password error texts and focus the continue button.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ForgotPasswordScreen with neutral reaction (F12), CheckEmail reset mode on
its own path, recovery link handling and ResetPasswordScreen with the
recovery guard held until the user confirms the success message. Carries
the from parameter between login, register and forgot password. Removes
the route placeholders.
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- expose legal links to screen readers on web
- allow only http(s) legal URLs, prevent double submit
- detect transport errors without runtimeType, keep extra in memory
- ship third-party license text, document decisions
Refs #1
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
