> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session02-hosted-configuration-and-client-exposure-boundaries/tasks.md). # Task Checklist **Session ID**: `phase07-session02-hosted-configuration-and-client-exposure-boundaries` **Total Tasks**: 22 **Estimated Duration**: 3-4 hours **Created**: 2026-05-30 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 3 | 3 | 0 | | Foundation | 5 | 5 | 0 | | Implementation | 10 | 10 | 0 | | Testing | 4 | 4 | 0 | | **Total** | **22** | **22** | **0** | *** ## Setup (3 tasks) Initial configuration and environment preparation. ### Cross-cutting * [x] T001 \[S0702] Verify Session 01 artifacts, analyzer state, package scope, and current hosted config source inventory before implementation (`.spec_system/PRD/phase_07/hosted_services_requirements_privacy_baseline.md`) * [x] T002 \[S0702] Review current env examples, diagnostics patterns, War Room browser config helpers, and hosted-service docs for concrete source boundaries (`.env.local.example`) * [x] T003 \[S0702] Confirm no stale current-session files or older-than-retention specs need cleanup before implementation starts (`.spec_system/specs/phase07-session02-hosted-configuration-and-client-exposure-boundaries/spec.md`) *** ## Foundation (5 tasks) Core structures and base implementations. ### packages/protocol * [x] T004 \[S0702] \[P] Create hosted config variable categories, exposure vocabulary, docs paths, and metadata tables with exhaustive enum handling (`packages/protocol/src/hostedConfig.ts`) * [x] T005 \[S0702] \[P] Create protocol hosted config contract tests for category values, metadata coverage, blocked exposure, and summary shapes (`packages/protocol/tests/hostedConfig.test.ts`) ### apps/server * [x] T006 \[S0702] \[P] Create server hosted config posture builder from explicit env records with schema-validated input and no raw-value output (`apps/server/src/lib/hostedConfig.ts`) * [x] T007 \[S0702] \[P] Create server hosted config unit tests for absent, blank, public-client, server-only, deploy-only, reserved, and unsafe `VITE_` variables with secret-leak assertions (`apps/server/tests/hostedConfig.test.ts`) ### apps/web * [x] T008 \[S0702] \[P] Create browser hosted config helper for public `VITE_` values with local-only fallback, URL credential rejection, and exhaustive status handling (`apps/web/src/lib/hostedConfig.ts`) *** ## Implementation (10 tasks) Main feature implementation. ### packages/protocol * [x] T009 \[S0702] Export hosted config contracts from the protocol barrel so server and web packages consume shared vocabulary (`packages/protocol/src/index.ts`) ### apps/server * [x] T010 \[S0702] Implement redacted hosted config posture details and aggregate counts with blocked categories, docs paths, and deterministic ordering (`apps/server/src/lib/hostedConfig.ts`) * [x] T011 \[S0702] Add `GET /diagnostics/hosted-config` to the local diagnostics router with authorization inherited from existing route middleware and explicit safe error mapping (`apps/server/src/routes/diagnostics.ts`) * [x] T012 \[S0702] Wire hosted config diagnostics dependencies through server creation without making hosted variables startup requirements (`apps/server/src/server.ts`) * [x] T013 \[S0702] Create hosted config diagnostics route tests for auth inheritance, empty-env local fallback, synthetic secret redaction, and bounded JSON shape (`apps/server/tests/hostedConfigDiagnostics.test.ts`) ### apps/web * [x] T014 \[S0702] Integrate browser hosted config helper into existing War Room Worker URL default handling without changing disabled, invalid, local Wrangler, workers.dev, or custom-domain states (`apps/web/src/lib/warRoomDiagnostics.ts`) * [x] T015 \[S0702] Create web hosted config helper tests for valid public config, blank fallback, malformed URLs, URL credentials, reserved Supabase placeholders, and unsafe secret-like browser values (`apps/web/tests/hostedConfig.test.ts`) ### Cross-cutting docs and examples * [x] T016 \[S0702] Update root and server env examples with source-backed public-client, server-only secret, deploy-only, reserved, and blocked hosted config comments (`.env.local.example`, `apps/server/.env.example`) * [x] T017 \[S0702] Update environment, hosted-service, privacy/security, deployment, release, and API docs for hosted config diagnostics, local-only fallback, and no hosted feature enablement (`docs/environments.md`, `docs/hosted-services.md`, `docs/privacy-and-security.md`, `docs/deployment.md`, `docs/release.md`, `docs/api/README_api.md`) * [x] T018 \[S0702] Update server, web, protocol, and War Room README files with hosted config ownership, diagnostics, public browser config limits, and deploy-only credential boundaries (`apps/server/README_server.md`, `apps/web/README_web.md`, `packages/protocol/README_protocol.md`, `apps/warroom/README_warroom.md`) *** ## Testing (4 tasks) Verification and quality assurance. ### Focused tests * [x] T019 \[S0702] Run focused protocol, server, and web hosted config tests plus existing War Room diagnostics tests, then record outcomes (`.spec_system/specs/phase07-session02-hosted-configuration-and-client-exposure-boundaries/implementation-notes.md`) * [x] T020 \[S0702] Run focused package typechecks for changed TypeScript workspaces and fix contract drift (`.spec_system/specs/phase07-session02-hosted-configuration-and-client-exposure-boundaries/implementation-notes.md`) ### Quality gates * [x] T021 \[S0702] Run formatting/linting or focused Biome checks, `git diff --check`, and ASCII/LF validation for touched source, docs, env examples, and spec files (`.spec_system/specs/phase07-session02-hosted-configuration-and-client-exposure-boundaries/implementation-notes.md`) * [x] T022 \[S0702] Record implementation notes with changed files, command outcomes, residual risks, docs review, and handoff to validate workflow (`.spec_system/specs/phase07-session02-hosted-configuration-and-client-exposure-boundaries/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the implement workflow step to begin AI-led implementation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session02-hosted-configuration-and-client-exposure-boundaries/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.