Skip to content

docs: Block 1 critical ship-blockers implementation plan#59

Merged
aksOps merged 1 commit intomainfrom
plan/block1-critical-tasks
Apr 23, 2026
Merged

docs: Block 1 critical ship-blockers implementation plan#59
aksOps merged 1 commit intomainfrom
plan/block1-critical-tasks

Conversation

@aksOps
Copy link
Copy Markdown
Contributor

@aksOps aksOps commented Apr 23, 2026

Summary

Task-level implementation plan for Block 1 of the production-polish roadmap (spec #58).

8 tasks, all TDD, PR-sized commits:

  1. Bounded multipart upload (MaxBytesReader)
  2. Refuse insecure default on non-loopback bind
  3. Bounded worker pool — new `internal/workq` package
  4. Wire workq into upload handler + graceful drain
  5. Session cookie endpoint + middleware acceptance
  6. UI switches to credentials: include + one-shot exchange
  7. Remove API-key meta-tag injection from SPA handler
  8. Scoped entity fetch via relationships.doc_id

Out of scope

Blocks 2–7 of the spec (security headers, observability, UI polish, testing & CI, OSS surface). Each becomes its own plan before execution.

🤖 Generated with Claude Code

Task-level plan for the five Block 1 items from the production-polish
roadmap spec (docs/superpowers/specs/2026-04-23-production-polish-
roadmap-design.md):

- Task 1 — bounded multipart upload (MaxBytesReader + config knob)
- Task 2 — refuse insecure default on non-loopback bind
- Task 3 — bounded worker pool (new internal/workq package)
- Task 4 — wire workq into upload handler + graceful drain
- Task 5 — session cookie endpoint + middleware acceptance
- Task 6 — UI switches to credentials: include + one-shot exchange
- Task 7 — remove API-key meta-tag injection from SPA handler
- Task 8 — scoped entity fetch via relationships.doc_id

Every task follows TDD: failing test → implementation → passing test →
commit. Each commit is PR-sized; tasks are independent except 3→4, 5→6
→7 (same ship-blocker).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@aksOps aksOps enabled auto-merge (squash) April 23, 2026 14:20
@aksOps aksOps merged commit 2a7028d into main Apr 23, 2026
11 checks passed
@aksOps aksOps deleted the plan/block1-critical-tasks branch April 23, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant