> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/tasks.md). # Task Checklist **Session ID**: `phase07-session06-push-remote-access-and-operator-diagnostics-guardrails` **Total Tasks**: 25 **Estimated Duration**: 3-4 hours **Created**: 2026-05-30 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 2 | 2 | 0 | | Foundation | 7 | 7 | 0 | | Implementation | 13 | 13 | 0 | | Testing | 3 | 3 | 0 | | **Total** | **25** | **25** | **0** | *** ## Setup (2 tasks) Initial context review and evidence setup. ### Cross-package * [x] T001 \[S0706] Verify Sessions 01-05, routing matrix P07-R017 through P07-R019, hosted payload blocklist, notification/service worker behavior, CLI diagnostics, server diagnostics, VAPID/Cloudflare env examples, and local-only prerequisites before editing source (`.spec_system/PRD/phase_07/phase07_requirement_routing_matrix.md`) * [x] T002 \[S0706] \[P] Create implementation evidence notes shell for source changes, docs changes, test commands, skipped checks, and residual risks (`.spec_system/specs/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/implementation-notes.md`) *** ## Foundation (7 tasks) Core guardrail artifact, shared contracts, config metadata, and server diagnostics baseline. ### Cross-package * [x] T003 \[S0706] \[P] Create push, remote access, tunnel, and operator diagnostic guardrail artifact with consent, VAPID exposure, routing, unsubscribe, retention, payload minimization, remote opt-in, token handling, revocation, local auth, rate-limit, CORS/Origin, audit, unsupported-state, and Phase 08 handoff sections (`.spec_system/PRD/phase_07/push_remote_access_operator_diagnostics_guardrails.md`) ### packages/protocol * [x] T004 \[S0706] Create hosted operation protocol contracts and barrel export with planned/disabled/unavailable state, push/remote/tunnel/diagnostics surfaces, requirements, blocked payload labels, docs paths, unsupported claims, and bounded summary helpers (`packages/protocol/src/hostedOperations.ts`, `packages/protocol/src/index.ts`) * [x] T005 \[S0706] Add protocol tests for hosted operation vocabulary, surface requirements, blocked payload labels, unsupported push/remote/diagnostic claims, summary counts, docs paths, and exported value uniqueness (`packages/protocol/tests/hostedOperations.test.ts`) * [x] T006 \[S0706] Refine hosted config metadata for VAPID, Cloudflare, and tunnel variables so private keys, account ids, zone ids, API tokens, and tunnel tokens remain server-only, deploy-only, reserved, or blocked from browser exposure (`packages/protocol/src/hostedConfig.ts`) * [x] T007 \[S0706] Add hosted config regression tests for VAPID, Cloudflare, and tunnel variable categories, browser-blocked mirrors, reserved states, and no raw secret/id/token value exposure (`packages/protocol/tests/hostedConfig.test.ts`) ### apps/server * [x] T008 \[S0706] Create local hosted operation diagnostics builder and route plumbing with planned/unavailable posture, optional test status, local auth/CORS/rate-limit inheritance, compact errors, and no request-body echo (`apps/server/src/lib/hostedOperations.ts`, `apps/server/src/routes/diagnostics.ts`, `apps/server/src/server.ts`) * [x] T009 \[S0706] Add server diagnostics route tests for auth inheritance, CORS, local-only fallback, planned/unavailable state, unsupported methods, and synthetic secret/id/token/path/payload non-leakage (`apps/server/tests/hostedOperationsDiagnostics.test.ts`) *** ## Implementation (13 tasks) CLI output, browser unavailable states, and documentation alignment. ### apps/cli * [x] T010 \[S0706] Add loopback-only hosted operation diagnostics fetch, compact response validation, sanitized failure handling, and status description helpers (`apps/cli/src/lib/orchestrationDiagnostics.js`) * [x] T011 \[S0706] Print compact hosted operation posture in status and doctor output while preserving local-first success when push and remote access are disabled or unavailable (`apps/cli/src/commands/status.js`, `apps/cli/src/commands/doctor.js`) * [x] T012 \[S0706] Add CLI diagnostics and runtime tests for hosted operation compaction, non-loopback rejection, malformed response handling, auth-required failures, timeout sanitization, status/doctor output, and synthetic sensitive value redaction (`apps/cli/tests/orchestrationDiagnostics.test.js`, `apps/cli/tests/cliRuntime.test.js`) ### apps/web * [x] T013 \[S0706] \[P] Create browser hosted operation helper with local notification posture, push unavailable state, remote access unavailable state, safe status copy, and no subscription/backend/tunnel implication (`apps/web/src/lib/hostedOperations.ts`) * [x] T014 \[S0706] \[P] Add web helper tests for local-only notification posture, disabled push, unavailable remote access, safe labels, and no hosted capability implication (`apps/web/tests/hostedOperations.test.ts`) * [x] T015 \[S0706] Refine notification copy and local payload handling so browser notifications remain local OS notifications with platform-appropriate accessibility labels, denied/default/revoked handling, and no push subscription or backend delivery implication (`apps/web/src/lib/notifications.ts`) * [x] T016 \[S0706] Bound and document service worker future push payload handling with sanitized click targets, explicit unavailable backend posture, no subscription code, and no raw prompt/path/token/payload forwarding (`apps/web/public/sw.js`) * [x] T017 \[S0706] Add notification and service worker regression coverage for local-only copy, bounded push-adjacent payload fields, safe click targets, and no VAPID/backend/remote-access claim (`apps/web/tests/notifications.test.ts`) ### docs * [x] T018 \[S0706] \[P] Align VAPID and Cloudflare tunnel env comments with optional, reserved, server-only, deploy-only, local-first, and no-raw-value posture (`.env.local.example`) * [x] T019 \[S0706] \[P] Update API and hosted-service docs for `GET /diagnostics/hosted-operations`, push, remote access, tunnel, compact diagnostics, local fallback, and unsupported states (`docs/api/README_api.md`, `docs/hosted-services.md`) * [x] T020 \[S0706] \[P] Update privacy and architecture docs with push/diagnostics blocked payload categories, credential boundaries, remote executor non-claims, retention limits, and no raw-value guarantees (`docs/privacy-and-security.md`, `docs/ARCHITECTURE.md`) * [x] T021 \[S0706] \[P] Update environment, deployment, and release docs so VAPID, Cloudflare, tunnel, and diagnostic placeholders do not imply active push delivery, remote access, production validation, or trusted erasure (`docs/environments.md`, `docs/deployment.md`, `docs/release.md`) * [x] T022 \[S0706] \[P] Update protocol, server, CLI, and web READMEs for hosted operation contract ownership, diagnostics route behavior, CLI loopback-only probes, local notification posture, and unavailable push/remote states (`packages/protocol/README_protocol.md`, `apps/server/README_server.md`, `apps/cli/README_cli.md`, `apps/web/README_web.md`) *** ## Testing (3 tasks) Verification and quality checks. ### Cross-package * [x] T023 \[S0706] Run focused protocol, server, CLI, and web hosted operation tests and record command evidence, outcomes, and skipped-check rationale if any (`.spec_system/specs/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/implementation-notes.md`) * [x] T024 \[S0706] Run focused typechecks or equivalent package checks for changed TypeScript packages and record skipped-check rationale if any (`.spec_system/specs/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/implementation-notes.md`) * [x] T025 \[S0706] Validate ASCII encoding, Unix LF line endings, and `git diff --check` for all changed files before handoff (`.spec_system/specs/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing or skipped with explicit rationale * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the validate workflow step to review the implementation handoff. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session06-push-remote-access-and-operator-diagnostics-guardrails/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.