- Rate limits in the shared cache for comments, issues, uploads and
invites; a limited HTMX reply keeps the draft.
- Content-Security-Policy (self only, no inline script or style, bucket
origin for images and frames) and Permissions-Policy on every page.
htmx configured not to inject styles or eval.
- Moderation: deactivating a user ends their sessions and keeps their
content; deleted accounts show as "ghost"; reserved usernames; the
admin won't delete an org's last owner.
- Admin requires a TOTP code (django-otp), with add_admin_totp to enrol.
- Email provider chosen by environment through django-anymail.
- Playwright browser tests: axe WCAG 2.1 AA on every page in light and
dark, no CSP violations, keyboard walkthrough, theme toggle. Explicit
Canvas/CanvasText on :root fixes dark-mode contrast detection.
- bin/start creates the data dir if missing; docs/operations.md runbook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Files: prototype and documentation files on features, with versions.
Adding, replacing or removing a file is a feature revision with a
change note. Types come from the extension; uploads are capped at
25 MB and stored under opaque paths. Every file URL checks project
access, then redirects to a short-lived signed URL on the bucket, or
streams with nosniff and a CSP sandbox when no bucket is configured.
HTML prototypes run in a sandboxed iframe without same-origin access.
Threads: whole-file threads and pins at a point on an image, drawn as
an SVG overlay in percentages. Pins are placed with number fields, or
by clicking the image with JS.
Implementations: name, link and status, plus a per-feature status grid
stamped with the feature revision, marked behind when the feature
changes, and confirmable without changing the status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Issues: per-project numbers, statuses (open, accepted, rejected,
withdrawn, duplicate), feature links, edits, and a timeline of comments
and events. From an issue, collaborators create or update a feature
with the revision tied to the issue and an option to accept it.
Comments: general and line-anchored threads on features, one
discussion thread per issue, edit history, tombstone deletes, resolve,
and promoting a feature thread to an issue. Line threads attach to
top-level Markdown blocks and go outdated only when the text changes.
HTMX swaps threads in place with focus management; every action also
works as a plain form post. Markdown headings are re-levelled so user
text never skips heading levels on the page.
The example flow from concept.md (steps 1-7) is covered end to end in
tests/test_example_flow.py.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Signed-out visitors get the same login redirect for missing and
private projects, so the redirect no longer reveals private ones.
- Production refuses the console email backend; sign-in codes must
never reach the logs.
- Database cache shared by all workers for allauth rate limits; invite
sending throttled per sender and per recipient.
- Email invite links are claimed on first use and the token rotated,
so a token copied from request logs is worthless.
- allauth password URLs removed; adding an email requires a fresh code
and notifies existing addresses.
- Markdown drops remote images until uploads exist.
- Project and org slugs lowercased; only superusers can grant staff
status or permissions in the admin.
- Container runs as a non-root user; CI actions pinned to commits.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Projects under organizations with fixed URL name and feature ID
prefix, three visibility levels, open contribution, per-project
roles, settings and typed-confirmation delete. Hidden projects 404.
Leaving an org drops its project roles. Project access rules live in
intent/access.py alongside org access.
Features numbered per project (INT-12) in a tree. Every change is a
revision with a required note; history, old revisions, and
side-by-side field and line diffs between any two. Cycles and
superseded-without-replacement are rejected. Markdown renders safely
with source-line attributes for Phase 3 line comments and headings
shifted below the page h1. Server-side preview works without JS.
Structural accessibility check runs on every page in tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign-in via django-allauth: emailed one-time codes, GitHub, Discord,
and Forgejo instances as OpenID Connect apps registered in admin.
Regular users never have a password; sysadmins sign in only at
/admin/ and are redirected there from the normal sign-in.
Organizations at the URL root with owner and collaborator roles, a
per-member project-create grant, and invites by username or email.
Email invites carry a bearer token stored only as a hash. The last
owner can't leave, be removed or be demoted. Permission checks live
in intent/access.py.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Django 5.2 with dev/test/prod settings, SQLite tuned for Litestream
(WAL, IMMEDIATE transactions), ULID primary keys via a shared base
model, and a custom User model ahead of the first migration.
Minimal accessible base template with dark mode via color-scheme and
an optional theme picker. /healthz answers before host validation so
Fly checks pass.
Dockerfile (dev and prod targets), compose for local dev, fly.toml
with placeholder app/region, Litestream backups to B2, and a Forgejo
Actions workflow. Migrations run in bin/start because Fly release
machines don't mount volumes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
