> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase05-session02-worker-api-hardening-and-client-contract/tasks.md). # Task Checklist **Session ID**: `phase05-session02-worker-api-hardening-and-client-contract` **Total Tasks**: 22 **Estimated Duration**: 3-4 hours **Created**: 2026-05-29 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 3 | 3 | 0 | | Foundation | 6 | 6 | 0 | | Implementation | 10 | 10 | 0 | | Testing | 3 | 3 | 0 | | **Total** | **22** | **22** | **0** | *** ## Setup (3 tasks) Initial configuration and environment preparation. ### Spec System * [x] T001 \[S0502] Verify current protocol and Worker test baseline and record commands/results (`.spec_system/specs/phase05-session02-worker-api-hardening-and-client-contract/implementation-notes.md`) ### apps/warroom * [x] T002 \[S0502] Add explicit `@factionos/protocol` workspace dependency for Worker contract imports (`apps/warroom/package.json`) ### Workspace Root * [x] T003 \[S0502] Sync workspace lockfile after War Room dependency metadata changes (`package-lock.json`) *** ## Foundation (6 tasks) Core shared contracts and base validation structures. ### packages/protocol * [x] T004 \[S0502] \[P] Expand War Room constants, lifecycle states, role values, limits, and error-code unions (`packages/protocol/src/warroom.ts`) * [x] T005 \[S0502] Define War Room REST request/response contracts for create, snapshot, join, approve, reject, socket, catch-up, and rate-limit flows (`packages/protocol/src/warroom.ts`) * [x] T006 \[S0502] Add War Room runtime validators and error builders with schema-validated input and explicit error mapping (`packages/protocol/src/warroom.ts`) * [x] T007 \[S0502] Align War Room event and catch-up types with shared protocol contracts and exhaustive enum handling (`packages/protocol/src/events.ts`) * [x] T008 \[S0502] \[P] Create War Room protocol contract tests for valid payloads, bounds, unknown fields, blocked categories, and error envelopes (`packages/protocol/tests/warroom.test.ts`) * [x] T009 \[S0502] \[P] Document protocol ownership for Worker client contracts and safe management frame scope (`packages/protocol/README_protocol.md`) *** ## Implementation (10 tasks) Main Worker hardening and contract consumption. ### apps/warroom * [x] T010 \[S0502] Import shared protocol contracts into the Worker boundary with type-safe request/response serialization (`apps/warroom/src/index.ts`) * [x] T011 \[S0502] Harden top-level `POST /rooms` and malformed room-code routing with schema-validated input and explicit error mapping (`apps/warroom/src/index.ts`) * [x] T012 \[S0502] Harden Durable Object `/init` and `/info` room snapshot serialization with bounded fields and deterministic participant ordering (`apps/warroom/src/index.ts`) * [x] T013 \[S0502] Harden `/join` validation, duplicate join idempotency, and room-full behavior with duplicate-trigger prevention while in-flight (`apps/warroom/src/index.ts`) * [x] T014 \[S0502] Harden `/approve` authority checks, stale decision handling, and response envelopes with authorization enforced at the Worker boundary (`apps/warroom/src/index.ts`) * [x] T015 \[S0502] Implement or harden `/reject` join decision contract with stale duplicate handling and authorization enforced at the Worker boundary (`apps/warroom/src/index.ts`) * [x] T016 \[S0502] Harden socket handshake participant revalidation and safe initial frames with explicit loading, pending, forbidden, and not-found error mapping (`apps/warroom/src/index.ts`) * [x] T017 \[S0502] Replace schema-loose client message persistence with allowlisted safe management frames and unknown-type drop/reject behavior before persistence or catch-up (`apps/warroom/src/index.ts`) * [x] T018 \[S0502] Preserve bounded recent-event storage, sender-excluded broadcast, and socket close/error cleanup after validation changes (`apps/warroom/src/index.ts`) * [x] T019 \[S0502] Update Worker README endpoint, deterministic error, rate-limit, and safe-frame contract notes (`apps/warroom/README_warroom.md`) *** ## Testing (3 tasks) Verification and quality assurance. ### apps/warroom * [x] T020 \[S0502] Expand Durable Object tests for invalid payloads, stale approval/rejection, reject route, socket frame drops, catch-up bounds, and sender exclusion (`apps/warroom/tests/warroom.test.ts`) * [x] T021 \[S0502] Expand top-level Worker router tests for typed 429 envelopes, CORS headers, invalid room codes, create-body validation, and delegated errors (`apps/warroom/tests/worker.test.ts`) ### Spec System * [x] T022 \[S0502] Run focused typecheck, Vitest, ASCII/LF validation, and record final results (`.spec_system/specs/phase05-session02-worker-api-hardening-and-client-contract/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing * [x] All files ASCII-encoded * [x] `implementation-notes.md` updated * [x] Ready for the validate workflow step *** ## Next Steps Run the implement workflow step to begin AI-led implementation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase05-session02-worker-api-hardening-and-client-contract/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.