> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session03-hosted-identity-and-authorization-guardrails/tasks.md). # Task Checklist **Session ID**: `phase07-session03-hosted-identity-and-authorization-guardrails` **Total Tasks**: 25 **Estimated Duration**: 3-4 hours **Created**: 2026-05-30 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 2 | 2 | 0 | | Foundation | 8 | 8 | 0 | | Implementation | 12 | 12 | 0 | | Testing | 3 | 3 | 0 | | **Total** | **25** | **25** | **0** | *** ## Setup (2 tasks) Initial context review and evidence setup. ### Cross-cutting * [x] T001 \[S0703] Verify Session 01, Session 02, War Room authority, hosted-config diagnostics, and current open finding prerequisites before editing source (`.spec_system/PRD/phase_07/phase07_requirement_routing_matrix.md`) * [x] T002 \[S0703] \[P] Create implementation evidence notes shell for source, docs, test commands, skipped checks, and residual risks (`.spec_system/specs/phase07-session03-hosted-identity-and-authorization-guardrails/implementation-notes.md`) *** ## Foundation (8 tasks) Core identity guardrail artifact, shared contracts, and package scaffolding. ### Cross-cutting * [x] T003 \[S0703] \[P] Create hosted identity guardrail artifact with account lifecycle, consent, revocation, authorization, role, audit, local-only fallback, non-overclaim, and Phase 08 handoff sections (`.spec_system/PRD/phase_07/hosted_identity_authorization_guardrails.md`) ### packages/protocol * [x] T004 \[S0703] Create hosted identity protocol contracts with planned/unavailable state, lifecycle, authorization surface, role, audit, docs path, and non-overclaim vocabulary (`packages/protocol/src/hostedIdentity.ts`) * [x] T005 \[S0703] Add protocol tests for hosted identity vocabulary, bounded summary builders, and Worker authority non-overclaim labels (`packages/protocol/tests/hostedIdentity.test.ts`) ### apps/server * [x] T006 \[S0703] Create local hosted identity diagnostics builder with status-only planned output and no raw token, account id, authority token, request body, or local path fields (`apps/server/src/lib/hostedIdentity.ts`) * [x] T007 \[S0703] Wire hosted identity diagnostics route with existing local auth, CORS, rate-limit, and compact error handling (`apps/server/src/routes/diagnostics.ts`) * [x] T008 \[S0703] Add server diagnostics route tests for auth inheritance, local-only fallback, planned/unavailable state, and synthetic secret redaction (`apps/server/tests/hostedIdentityDiagnostics.test.ts`) ### apps/web * [x] T009 \[S0703] Create browser hosted identity helper with planned/unavailable copy, local-only fallback, and War Room authority distinction (`apps/web/src/lib/hostedIdentity.ts`) * [x] T010 \[S0703] Add web helper tests for planned hosted identity state, no account UI implication, and room-local authority non-overclaim (`apps/web/tests/hostedIdentity.test.ts`) *** ## Implementation (12 tasks) Source exports and documentation alignment. ### packages/protocol * [x] T011 \[S0703] Export hosted identity contracts from the protocol barrel for server and web consumers (`packages/protocol/src/index.ts`) ### docs * [x] T012 \[S0703] \[P] Update API docs for `GET /diagnostics/hosted-identity` as local planned-state diagnostics, not hosted runtime behavior (`docs/api/README_api.md`) * [x] T013 \[S0703] \[P] Update hosted-service docs with Session 03 identity guardrails, lifecycle requirements, authorization boundaries, and Worker non-overclaim wording (`docs/hosted-services.md`) * [x] T014 \[S0703] \[P] Update privacy docs with account-token, authority-token, consent, revocation, audit, and no-raw-value diagnostic guarantees (`docs/privacy-and-security.md`) * [x] T015 \[S0703] \[P] Update architecture docs to route hosted identity through protocol-first planned-state contracts while preserving local server and Worker separation (`docs/ARCHITECTURE.md`) * [x] T016 \[S0703] \[P] Update environment docs so reserved Supabase, OAuth, and hosted-auth variables do not imply active account identity (`docs/environments.md`) * [x] T017 \[S0703] \[P] Update deployment docs so deployed Worker health, Cloudflare operations, and browser Worker URLs are not hosted identity proof (`docs/deployment.md`) * [x] T018 \[S0703] \[P] Update release docs with hosted identity guardrails, negative-claim checks, and Phase 08 validation and erasure deferrals (`docs/release.md`) ### Package READMEs * [x] T019 \[S0703] \[P] Update protocol README to document hosted identity contract ownership and future consumer rules (`packages/protocol/README_protocol.md`) * [x] T020 \[S0703] \[P] Update server README to document hosted identity diagnostics, unavailable state, local auth inheritance, and redaction boundaries (`apps/server/README_server.md`) * [x] T021 \[S0703] \[P] Update web README to document browser planned-state helper, local-only fallback, and no hosted account UI (`apps/web/README_web.md`) * [x] T022 \[S0703] \[P] Update War Room README to reaffirm room-local authority is not hosted account identity, SSO, organization membership, production audit proof, public collaboration safety, analytics consent, or trusted erasure (`apps/warroom/README_warroom.md`) *** ## Testing (3 tasks) Verification and quality checks. ### Cross-cutting * [x] T023 \[S0703] Run focused protocol, server, and web hosted identity tests and record command evidence and outcomes (`.spec_system/specs/phase07-session03-hosted-identity-and-authorization-guardrails/implementation-notes.md`) * [x] T024 \[S0703] Run focused typechecks or equivalent package checks for changed TypeScript packages and record skipped-check rationale if any (`.spec_system/specs/phase07-session03-hosted-identity-and-authorization-guardrails/implementation-notes.md`) * [x] T025 \[S0703] Validate ASCII encoding, Unix LF line endings, and `git diff --check` for all changed files before handoff (`.spec_system/specs/phase07-session03-hosted-identity-and-authorization-guardrails/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing or skipped with explicit rationale * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the validate workflow step to verify session completeness. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session03-hosted-identity-and-authorization-guardrails/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.