amadan
ledger
1 file changed,
+6
−0
.superpowers/sdd/2026-08-23-idear/progress.md+6 −0
diff --git a/.superpowers/sdd/2026-08-23-idear/progress.md b/.superpowers/sdd/2026-08-23-idear/progress.md| index 5d54e04..a32fb75 100644 |
| --- a/.superpowers/sdd/2026-08-23-idear/progress.md |
| +++ b/.superpowers/sdd/2026-08-23-idear/progress.md |
| @@ -104,3 +104,9 @@ Task 5: minor (deferred): TestEveryHandlerIsMounted asserts a COUNT, not identit |
| Task 5: minor (deferred): an empty or portless RemoteAddr keys to "" and shares a bucket; not attacker-reachable, since net/http always populates RemoteAddr. |
| Task 5: complete (commits ff6fafa..a909990, review clean) |
| Task 6: dispatched (opus), BASE a909990 — the example app and SKILL.md, the last task |
| +Task 6: review — spec ✅, quality Needs work: 2 Important, 7 Minor. Reviewer ran 10 wiring mutations (3 survivors), drove the built binary end to end, and executed the break-glass SQL verbatim against a real database in the worst realistic shape (recovering onto a DEACTIVATED successor) — it works, and `deactivated_at = NULL` in the second UPDATE is load-bearing. |
| +Task 6: Ruling (Important 1): SKILL.md §2 says idear's models "cannot" go in the app's Models list "because idear does not export them". FALSE — Member and Invitation are exported types; only the LIST is unexported. The reviewer compiled the counterexample and got a CREATE TABLE idear_members collision. This is the one sentence in the doc a reader would act on by NOT checking, and it contradicts §7 of the same file. Fix both it and the same claim in example/models.go. |
| +Task 6: Ruling (Important 2): the invitation-token re-render workaround — the ONE piece of code every password-path app must copy — has no test; deleting it leaves the suite green. A copier who rewrites the signup page loses it silently and the symptom is "invited people can never join", visible only on a second attempt. |
| +Task 6: Ruling: ACCEPT the reviewer's API suggestion — export idear.TokenFrom(r). Today an app's RenderSignup must know both the field name "invite" and that CarryToken already parsed the form: two pieces of folklore. TokenFrom reduces it to one line and keeps the field name inside the module that chose it. Additive, no signature changes. The API freeze held for five tasks precisely so this kind of change is deliberate rather than drift. |
| +Task 6: noted — `go get amadan.net/rastrillo/idear` and the SKILL.md curl line do NOT work yet: the vanity path resolves (go-import 200, git smart-HTTP 200) but the remote is an EMPTY repository. This resolves on push, which is the next step. Do not ship the README believing the curl line works before then. |
| +Task 6: fix round 1 dispatched (resume original implementer, opus), FIX_BASE f254985 |