docs: complete Phase 9 backlog triage (issues map, briefs, ADRs)

Map design IDs to Gitea #1-#37, add tasks 80-88, stub ADRs 0004-0006, and point STATUS at the P1 batch order.
2026-07-04 01:23:30 -05:00
parent 5dfc8b8034
commit 76f68548b2
17 changed files with 815 additions and 3 deletions
@@ -0,0 +1,39 @@
+# 87 — API surface + token auth
+
+## Goal
+
+Documented HTTP API for existing modules (calendar, lists, notes, garden, bangs) with token auth suitable for non-browser clients, coexisting with OIDC session auth.
+
+## Why
+
+API-early batch order: foundation lands after bugs so journal and notes can extend it; LLM agent (88) maps tools onto it.
+
+## Depends on
+
+- ADR `0006-api-llm-agent.md` research half (Gitea #14) — auth model and API shape decided before implementation
+
+## Scope
+
+- Architecture ADR 0006: token auth vs OIDC session coexistence; API shape; additive versioning (no freeze that blocks journal).
+- Token auth for non-browser clients.
+- Endpoints for existing entities: events, lists/items, notes, garden, bangs (dashboards as needed).
+- API docs (OpenAPI or equivalent living doc).
+- Vitest for auth + route handlers; optional Playwright smoke only if useful.
+
+## Out of scope
+
+- LLM agent chat UI and tool-calling (88).
+- Journal endpoints (86 adds them).
+
+## Acceptance criteria
+
+- [ ] ADR 0006 documents auth coexistence and API shape.
+- [ ] Token-authenticated client can read/write covered entities.
+- [ ] Session (OIDC) auth still works for the web app.
+- [ ] Docs list endpoints and auth.
+- [ ] Unit/integration tests for auth and handlers.
+
+## Notes
+
+- Gitea: epic [#13](https://gitea.ginnoir.com/ginnoir/famapp/issues/13); research [#14](https://gitea.ginnoir.com/ginnoir/famapp/issues/14); implementation [#15](https://gitea.ginnoir.com/ginnoir/famapp/issues/15)
+- Batch step 6 (after bugs 80–84)