kanban-dev-webapp/PHASE-8-PROGRESS.md

# Phase 8 — progress log

> Canonical record for Phase 8 (8a public route, 8b PWA shell, 8c markdown context).
> Mirrored to the Apple Notes note titled "Phase 8 — Public intake + PWA + project context".
> Workflow: a task moves `pending → in_progress → done` as I work it; TDD red/green noted where applicable.

## How to read

- `[ ]` pending
- `[~]` in progress
- `[x]` done — TDD green + commit landed
- `[!]` blocked, needs decision

---

## Plan 8a — Public intake links and route

- [x] Task 1: Schema — `c99be4d`. Bridge: plan assumed `getOrCreateCollection` extended existing select values; it doesn't, so added `ensureCardsCreatedByRoleValues` and extended `ensureActivityActionValues`. Tests: 446 pass.
- [x] Task 2: Token generator — `36572d9`. 24 bytes CSPRNG → base64url → 32 chars. `isIntakeToken` matches.
- [x] Task 3: Best-effort client IP — `f608931`. x-forwarded-for → x-real-ip → "unknown".
- [x] Task 4: Rate limiter — `70ce019`. 60 req / 5 min per opaque key, in-memory, lossy on restart. 4 unit tests.
- [x] Task 5: Token resolver and daily counter — `3ece6cb`. `resolveIntakeLink`, `isLinkUsable` with lazy date-reset, `validateIntakeLinkForStep` returns 3-valued LinkState.
- [x] Task 6: Middleware carve-out — `65b0cf4`. `/intake/:path*` short-circuits before cookie check.
- [x] Task 7: Public Server Action — `9081659`. token-shape → rate-limit → daily-cap → `nextStep`. Same `InterviewStep` shape as signed-in.
- [x] Task 8: Public submission route — `4004aec`. `POST /api/public/intake`. Sibling of `/api/client/intake` with `created_by_role='anonymous'` set in code. Dropped vestigial `tokenHeader` line per the plan's own comment.
- [x] Task 9: Minimal intake layout — `5137a6d`. Deviation: no `<html>`/`<body>` (Next.js root layout owns those). Intent preserved — no ThemeScript, ThemeSync, Inter, or globals.css.
- [x] Task 10: Public intake page — `c9be1d2`. 404 on unknown/revoked/expired with same wording. IntakePublic placeholder kept build green between Tasks 10/11.
- [x] Task 11: Public wizard + brief preview — `a3972f5`. Replaced Task 10 placeholder with the real wizard. POST to `/api/public/intake`, redirect to `/intake/[token]/sent/[cardId]`.
- [x] Task 12: Thanks page — `07ece87`. Resolves token only to confirm still alive — revoked tokens landing here still show "Thanks" so the submission cannot be probed.
- [x] Task 13: Card submitted-by badge — `bb78c9b`. CardSubmittedBy: nothing for owner, "Requested" for client, "Submitted via public link" for anonymous. Renders nothing when accepted.
- [x] Task 14: Owner actions — `c29f855`. `createIntakeLinkAction`, `rotateIntakeTokenAction`, `setIntakeLinkActiveAction`, `setIntakeLinkNotesAction`. Owner-only via requireOwner(). URL shown once.
- [x] Task 15: Intake links panel — `1e97655`. New-link button → label input → URL shown once with Copy. Rotate / Revoke / Re-activate buttons. Notes editor (saves on blur).
- [x] Task 16: Wire panel into admin — `4335af4`. Reads `intake_links` sorted by `-created`, renders `<IntakeLinksPanel>` after `SummaryPanel`.
- [ ] Task 17: Integration tests — the public route
- [ ] Task 18: Integration tests — the owner UI actions
- [ ] Task 19: Full verification

## Plan 8b — PWA shell

- [ ] Task 1: The source SVG
- [ ] Task 2: The icon build script
- [ ] Task 3: The manifest
- [ ] Task 4: The service worker
- [ ] Task 5: The manifest link in the intake layout
- [ ] Task 6: Manual install verification
- [ ] Task 7: Final test run

## Plan 8c — Per-project markdown context

- [ ] Task 1: Schema
- [ ] Task 2: The intake context extension
- [ ] Task 3: The prompt modules
- [ ] Task 4: The prompt tests
- [ ] Task 5: The owner editor
- [ ] Task 6: Wire the editor into the admin page
- [ ] Task 7: Full verification