command_tower 0.16.0 → 0.18.0

data/docs/bootstrap/03-pin-the-gem.md

@@ -0,0 +1,53 @@
+# 03 — Pin the CommandTower gem
+
+## Purpose
+
+Depend on released CommandTower from **RubyGems** (or a git tag). Path pins are maintainer Local mode, not the committed default for a new host.
+
+## Prerequisites
+
+- [`02-create-the-rails-app.md`](02-create-the-rails-app.md): `make bundle` works
+- You know the CommandTower version (or git tag) this host should adopt
+
+## Files the host edits
+
+`Gemfile` — add:
+
+```ruby
+gem "command_tower"
+```
+
+Pin when you need a floor:
+
+```ruby
+gem "command_tower", "~> X.Y"
+```
+
+Git tag (only if your org does not publish the gem to the RubyGems source the host uses):
+
+```ruby
+gem "command_tower", git: "https://github.com/<org>/command_tower.git", tag: "vX.Y.Z"
+```
+
+**Path pins** (`path: "../command_tower"`) are for engine maintainers iterating locally. They are not the default a new product host commits. If you use a path pin in a workspace, do not document it as the production pin.
+
+## Procedure
+
+1. Add the gem line.
+2. Refresh lockfile **in the container**:
+
+```bash
+make bundle
+```
+
+3. Rebuild if the image copies `Gemfile` / `Gemfile.lock` at build time:
+
+```bash
+make build
+```
+
+Do not run `bundle install` on the Mac.
+
+## Stop
+
+`Gemfile.lock` lists `command_tower`. `make bundle` succeeds. Next: [`04-secrets-and-env.md`](04-secrets-and-env.md).

data/docs/bootstrap/04-secrets-and-env.md

@@ -0,0 +1,59 @@
+# 04 — Secrets and env
+
+## Purpose
+
+Give Compose the secrets CommandTower **doctor** requires. Without them, install may succeed and doctor will fail.
+
+## Prerequisites
+
+- [`03-pin-the-gem.md`](03-pin-the-gem.md)
+- Compose file from [`01-docker-make-compose.md`](01-docker-make-compose.md)
+
+## Files the host creates / edits
+
+| File | Role |
+|------|------|
+| `.env` (gitignored) | Local values interpolated by Compose |
+| `.env.example` (committed, no secrets) | Names only |
+| `docker-compose.yml` `environment:` | Already stubbed in step 01 |
+
+Required (names match [`../initializing.md`](../initializing.md)):
+
+| Secret | Typical env | Used for |
+|--------|-------------|----------|
+| JWT HMAC | `SECRET_KEY_BASE` (or `config.jwt.hmac_secret`) | Access tokens |
+| Signup-session JWT | `SIGNUP_SESSION_JWT_SECRET` | Email verification / signup session |
+| Password-recovery JWT | `PASSWORD_RECOVERY_SESSION_JWT_SECRET` | Password reset session |
+
+Doctor checks these. Failures abort with remediation text.
+
+`.env.example`:
+
+```
+SECRET_KEY_BASE=
+SIGNUP_SESSION_JWT_SECRET=
+PASSWORD_RECOVERY_SESSION_JWT_SECRET=
+```
+
+Generate long random values for `.env`. Do not commit `.env`. Do not reuse production secrets in development.
+
+The initializer generated in step 05 can read these via `ENV.fetch`. You do not need a complete initializer yet.
+
+Optional later: SMTP, SMS, Pushover credentials — [`13-optional.md`](13-optional.md) and [`../messaging_integration_guide.md`](../messaging_integration_guide.md). Not required for `GET /me`.
+
+This step is **local** env for Compose. Production secret distribution is out of scope ([README](README.md#this-is-not-deployment)).
+
+## Procedure
+
+1. Create `.env` with three distinct secrets.
+2. Confirm `docker-compose.yml` passes them into `api`.
+3. Recreate the api container if it was already running:
+
+```bash
+make halt
+make build
+```
+
+## Stop
+
+Compose interpolates the three secrets into `api`. Next: [`05-install-migrate-doctor.md`](05-install-migrate-doctor.md).

data/docs/bootstrap/05-install-migrate-doctor.md

@@ -0,0 +1,74 @@
+# 05 — Install, migrate, doctor
+
+## Purpose
+
+Copy engine migrations, generate the initializer (and default mount unless skipped), migrate, and run doctor. **Invocation is Make.** The contract for flags and schema is [`../initializing.md`](../initializing.md) — do not treat this page as a second copy of that contract.
+
+## Prerequisites
+
+- [`04-secrets-and-env.md`](04-secrets-and-env.md)
+- Database service healthy (`make` recipes that run Rails will start `depends_on`)
+
+## Files this step creates
+
+| File | Role |
+|------|------|
+| `db/migrate/*command_tower.rb` | Installed copies of engine migrations (do not hand-edit) |
+| `config/initializers/command_tower.rb` | Generated unless `SKIP_CONFIGURE=1` |
+| Engine mount in `config/routes.rb` | Unless `SKIP_MOUNT=1` or `--skip-routes` |
+
+`command_tower:install` does **not** run `db:migrate`. Installing and migrating stay separate on purpose.
+
+## Procedure
+
+If the host will own `GET /api/healthz` (or any route that must be declared **before** the engine mount), skip the generator mount and add routes in [`06-mount-and-health.md`](06-mount-and-health.md):
+
+```bash
+make rails ARGS='command_tower:install' SKIP_MOUNT=1
+```
+
+Otherwise:
+
+```bash
+make rails ARGS='command_tower:install'
+```
+
+Then:
+
+```bash
+make db-prepare
+make migrate
+make doctor
+```
+
+`db-prepare` creates the development database if needed. `migrate` applies host and CommandTower migrations.
+
+Existing customized hosts (initializer and mount already present):
+
+```bash
+make rails ARGS='command_tower:install' SKIP_CONFIGURE=1
+make migrate
+make doctor
+```
+
+`FORCE=1` overwrites `config/initializers/command_tower.rb` — do not use it after you have customized the initializer unless you intend to regenerate.
+
+The **task name** inside the container is `bin/rails command_tower:install`. Operators never type that on the Mac.
+
+### What install does (summary)
+
+1. `command_tower:install:migrations` — copies engine migrations with `*.command_tower.rb` scope.
+2. `rails g command_tower:configure` unless skipped — initializer + mount.
+3. Prints next steps.
+
+Full flag table: [`../initializing.md`](../initializing.md).
+
+Doctor checks Rails compatibility, engine baseline migrations, host-installed copies, JWT / session secrets, and messaging adapter names. It does **not** probe Redis/SMTP connectivity.
+
+## In-engine dummy
+
+Generated initializer shape: [`../../rails_app/config/initializers/command_tower.rb`](../../rails_app/config/initializers/command_tower.rb). That file is a dummy-host example, not a product dump.
+
+## Stop
+
+Install is idempotent if re-run. Migrations applied. `make doctor` exits 0 (or you have a documented doctor failure you will fix in steps 08–10). Next: [`06-mount-and-health.md`](06-mount-and-health.md).

data/docs/bootstrap/06-mount-and-health.md

@@ -0,0 +1,53 @@
+# 06 — Mount and health
+
+## Purpose
+
+Mount CommandTower where the product needs it, and keep a host health endpoint **outside** the engine when you skipped the generator mount.
+
+## Prerequisites
+
+- [`05-install-migrate-doctor.md`](05-install-migrate-doctor.md)
+
+## Files the host edits
+
+`config/routes.rb`
+
+## Procedure
+
+### Default (generator mounted)
+
+`command_tower:install` without `SKIP_MOUNT` typically mounts:
+
+```ruby
+mount CommandTower::Engine => "/api"
+```
+
+or at `/`, depending on generator defaults. Confirm the file. Engine routes then live under that prefix (`GET /api/me` vs `GET /me`).
+
+Use **one** mount. Do not mount the engine twice.
+
+### Host-owned healthz (`SKIP_MOUNT=1`)
+
+Declare host routes **before** the engine so health checks never depend on engine routing:
+
+```ruby
+Rails.application.routes.draw do
+  get "/api/healthz", to: "health#show"
+
+  mount CommandTower::Engine => "/api"
+end
+```
+
+`HealthController#show` is host-owned (liveness). Keep it trivial.
+
+If the engine is mounted at `/`, a host `/healthz` still belongs **before** the mount.
+
+### Accidental public mount
+
+If you mounted at `/` and needed `/api`, or the generator mounted when you needed to skip: fix `config/routes.rb` by hand. Re-running configure with `FORCE=1` is not the tool for route cleanup.
+
+More on mount mistakes: [`../initializing.md`](../initializing.md) troubleshooting.
+
+## Stop
+
+`config/routes.rb` has exactly one engine mount at the prefix your API and frontend will call. Host `healthz` (if any) is declared before that mount. Next: [`07-execution-bases.md`](07-execution-bases.md).

data/docs/bootstrap/07-execution-bases.md

@@ -0,0 +1,38 @@
+# 07 — Execution-boundary bases
+
+## Purpose
+
+Host controllers and jobs inherit CommandTower bases so authentication, request context, envelope rendering, and job execution stay on the platform path.
+
+## Prerequisites
+
+- [`06-mount-and-health.md`](06-mount-and-health.md)
+
+## Files the host edits
+
+| File | Inherit |
+|------|---------|
+| `app/controllers/application_controller.rb` | `CommandTower::ApplicationController` |
+| `app/jobs/application_job.rb` | `CommandTower::ApplicationJob` |
+
+## Procedure
+
+Replace the default `ActionController::API` / `ActiveJob::Base` superclasses:
+
+```ruby
+class ApplicationController < CommandTower::ApplicationController
+end
+```
+
+```ruby
+class ApplicationJob < CommandTower::ApplicationJob
+end
+```
+
+Host controllers then subclass `ApplicationController` as usual. Do not subclass `ActionController::API` for product JSON that should share CommandTower auth and envelope behavior.
+
+Background work invokes **workflows** (via CommandTower job helpers), not services as a full business action. See [`../architecture.md`](../architecture.md).
+
+## Stop
+
+`ApplicationController` and `ApplicationJob` inherit CommandTower bases. Next: [`08-initializer.md`](08-initializer.md).

data/docs/bootstrap/08-initializer.md

@@ -0,0 +1,90 @@
+# 08 — Initializer
+
+## Purpose
+
+Set **host_key**, secrets, local mail, and (when the client is Command Tower frontend on web) cookies. The generated file documents every class_composer option; do not uncomment the world.
+
+## Prerequisites
+
+- [`07-execution-bases.md`](07-execution-bases.md)
+- Secrets from [`04-secrets-and-env.md`](04-secrets-and-env.md) already in Compose
+
+## Files the host edits
+
+`config/initializers/command_tower.rb` (created by install)
+
+In-engine dummy for **shape**: [`../../rails_app/config/initializers/command_tower.rb`](../../rails_app/config/initializers/command_tower.rb). Copy **intent** (host_key, secrets, later RBAC/gates), not the dummy’s engine-dev values as a product identity.
+
+## Procedure
+
+### `host_key` (required)
+
+Server-bound host/product identity for CT-generic user-scoped state (experience states). **Not** client-supplied.
+
+```ruby
+CommandTower.configure do |config|
+  config.application.host_key = "your_product"
+end
+```
+
+Blank `host_key` → Me experience-state routes return **503**.
+
+The dummy sets `config.application.host_key = "command_tower"`. A product host uses its **own** key.
+
+### Secrets
+
+Prefer ENV already injected by Compose:
+
+```ruby
+config.jwt.hmac_secret = ENV.fetch("SECRET_KEY_BASE")
+config.signup_session.jwt_secret = ENV.fetch("SIGNUP_SESSION_JWT_SECRET")
+config.password_recovery_session.jwt_secret = ENV.fetch("PASSWORD_RECOVERY_SESSION_JWT_SECRET")
+```
+
+Exact setter names are in the generated initializer comments and [`../initializing.md`](../initializing.md). Match those names; do not invent parallel keys.
+
+### Cookies / CSRF (required for Command Tower frontend on web)
+
+Command Tower frontend `defaultSessionStrategy()` is **cookie + CSRF on web** and Bearer on native. If this API will serve that web client, enable cookies **now**. Curl-only smoke in [`12-smoke-check.md`](12-smoke-check.md) can still send `Authorization: Bearer`.
+
+Contract and defaults: [`../cookie_authentication_guide.md`](../cookie_authentication_guide.md). Local HTTP Compose:
+
+```ruby
+config.jwt.cookie.enabled = true
+config.jwt.cookie.secure = false
+config.jwt.cookie.same_site = :lax
+config.jwt.cookie.csrf.enabled = true
+```
+
+Do not set `secure = true` on `http://localhost`. Leave `domain` nil (host-only). Defaults are `ct_jwt` and `ct_csrf`. Full field table stays in the cookie guide.
+
+A browser stores those cookies by hostname. The port is not part of the key, so two web apps on `localhost` share one `ct_jwt` and one `ct_csrf`. Logout expires both cookies. A second product on the same hostname sets both names, and that host’s frontend `session.csrfCookieName` matches the CSRF name. The header stays `X-CSRF-Token`. A host that runs alone leaves the defaults.
+
+```ruby
+config.jwt.cookie.name = "other_jwt"
+config.jwt.cookie.csrf.cookie_name = "other_csrf"
+```
+
+If the only client is Bearer (`curl`, native-only), leave cookies disabled.
+
+### Email / SMTP
+
+Step 02 already set `:file` delivery in `development.rb`. In the initializer, set the public app URL used in mail links (frontend origin, not the API port):
+
+```ruby
+config.application.url = "http://localhost:8081"
+```
+
+`8081` is one product’s Expo port. Use the port this host’s web app actually publishes, and put that same origin in `CORS_ALLOWED_ORIGINS` (step 01). Production SMTP is out of this manual’s deployment scope.
+
+### What not to do
+
+- Do not duplicate CommandTower default hashes “for completeness”
+- Do not set `FORCE=1` and regenerate after customizing
+- Do not fork engine internals because a comment looked optional
+
+RBAC default role and feature gates are steps 09–10.
+
+## Stop
+
+`host_key` is a real product string. JWT and session secrets resolve from ENV. Cookie + CSRF are on if a CT frontend web client will call this API. Next: [`09-rbac.md`](09-rbac.md).

data/docs/bootstrap/09-rbac.md

@@ -0,0 +1,83 @@
+# 09 — RBAC
+
+## Purpose
+
+Give authenticated users a **product role** that **grants CommandTower entity names**. Without this, login can succeed and `GET /me` returns **403**.
+
+## Prerequisites
+
+- [`08-initializer.md`](08-initializer.md)
+
+## Files the host creates
+
+`config/rbac_groups.yml` — host-owned composition.
+
+CommandTower ships **entity definitions** in `lib/command_tower/authorization/default.yml` (inside the gem). Hosts **grant those names**. Hosts may add host-owned entities for host controllers.
+
+In-engine dummy for **shape**: [`../../rails_app/config/rbac_groups.yml`](../../rails_app/config/rbac_groups.yml). Use it to see a `member` grant list and that Admin bundles are **host policy**. Do not copy dummy-only entities (`dummy_admin_example`) into a product host.
+
+Contract: [`../authorization.md`](../authorization.md), [`../authentication_authorization_guide.md`](../authentication_authorization_guide.md).
+
+## Procedure
+
+### 1. Author `member` (minimum for Me)
+
+Grant the Me/Auth entity names your smoke path needs. A typical starting `member` (from the dummy, minus product-specific extras you do not want yet):
+
+```yaml
+groups:
+  member:
+    description: Standard authenticated application user
+    entities:
+      - email_verification_send
+      - email_verification_verify
+      - session
+      - me
+      - profile
+      - me_name
+      - me_password
+      - me_account
+      - me_inbox
+      - me_audit_events
+      - me_preferences
+      - me_phone
+      - me_phone_verification_send
+      - me_phone_verification_verify
+      - me_pushover
+      - me_pushover_verification
+      - me_push
+      - me_experience_states
+      - principal_capabilities
+```
+
+Trim unused Me surfaces if you want a thinner first grant (you **must** keep `me` and `session` for the smoke in [`12-smoke-check.md`](12-smoke-check.md)). Missing `me` → **403** on `GET /me`.
+
+### 2. `default_membership_role`
+
+In `config/initializers/command_tower.rb`:
+
+```ruby
+config.authorization.default_membership_role = "member"
+```
+
+New users then receive `member` without a manual assign. If you omit this, you must assign roles some other supported way before Me works.
+
+### 3. Admin roles (not required to finish bootstrap)
+
+Do **not** auto-grant new Admin capabilities to a generic Admin role. CommandTower does not ship an accumulating operational `admin` role. `owner` (`entities: true`) is full-access and distinct from host Admin bundles.
+
+If you add Admin later, copy the **pattern** from the dummy (`audit_operator`, `operations_admin`, …): explicit entity lists on a host role. See [`../admin_workspace.md`](../admin_workspace.md).
+
+The frontend workspace and user detail call these entities. Grant each one the role should have:
+
+- `admin_workspace`
+- `admin_users`
+- `admin_audit_events`
+- `admin_messaging_announcements`
+- `admin_impersonation`
+
+`admin_impersonation` is what shows Impersonate. The frontend does not add a route for it.
+
+## Stop
+
+`config/rbac_groups.yml` exists with a `member` group that grants `me` (and the rest you need). `default_membership_role` is `"member"` (or you have a documented assign path). Next: [`10-roles-and-gates.md`](10-roles-and-gates.md).

data/docs/bootstrap/10-roles-and-gates.md

@@ -0,0 +1,62 @@
+# 10 — Roles and feature gates
+
+## Purpose
+
+Assign the default membership role (if you did not in step 09) and **enable** the HTTP gates the smoke path needs. Gates default **off** → **404**.
+
+## Prerequisites
+
+- [`09-rbac.md`](09-rbac.md)
+
+## Files the host edits
+
+`config/initializers/command_tower.rb`
+
+Opening a `with_*` block typically sets its enable flag. Still set `enable` / `enabled` explicitly so a later comment-uncomment does not leave you on the default **off** path.
+
+## Procedure
+
+### Default role
+
+```ruby
+config.authorization.default_membership_role = "member"
+```
+
+### Login / verify / reset (minimum for Me + CT frontend guest screens)
+
+```ruby
+config.login.with_plain_text do |plain_text_config|
+  plain_text_config.enable = true
+
+  plain_text_config.with_email_verify do |email_verify_config|
+    email_verify_config.enable = true
+    # Curl smoke (step 12) can login before the user verifies.
+    # 0.minutes → GET /me is 412 until email is verified.
+    email_verify_config.verify_email_required_within = 7.days
+  end
+
+  plain_text_config.with_password_reset do |password_reset_config|
+    password_reset_config.enabled = true
+  end
+end
+```
+
+### Availability (CT frontend signup)
+
+If the guest signup screen checks username/email availability, enable those gates or the client sees **404**:
+
+```ruby
+config.username.with_realtime_username_check do |realtime_username_check_config|
+  realtime_username_check_config.enable = true
+end
+
+config.signup_session.email_availability.enable = true
+```
+
+Leave Admin and messaging gates off until you need those routes.
+
+Do not use role-**name** checks in host code for authorization. Use entity grants / `allow_everything`. See [`../authorization.md`](../authorization.md).
+
+## Stop
+
+Plain-text login is **on**. Register → login → `GET /me` is not **404**. Next: [`11-auth-client-path.md`](11-auth-client-path.md).

data/docs/bootstrap/11-auth-client-path.md

@@ -0,0 +1,57 @@
+# 11 — Auth client path
+
+## Purpose
+
+Pick **one** client authentication mode and configure the host to match. Mixing a cookie+CSRF frontend with cookies disabled will fail in the browser. `curl` can still send Bearer on the same host.
+
+## Prerequisites
+
+- [`10-roles-and-gates.md`](10-roles-and-gates.md)
+- `gem "rack-cors"` from [`02-create-the-rails-app.md`](02-create-the-rails-app.md) if a browser will call this API
+
+## Two supported modes
+
+| Mode | Client sends | Host initializer |
+|------|----------------|------------------|
+| Bearer | `Authorization: Bearer <jwt>` | Cookie JWT disabled |
+| Cookie + CSRF | HttpOnly JWT cookie + CSRF header/cookie | Cookie + CSRF **enabled** (step 08) |
+
+Command Tower **frontend** on web uses `defaultSessionStrategy()` → cookie + CSRF. Native uses Bearer. Enable cookies when that web client exists; keep Bearer working for `curl` and native.
+
+Contract: [`../cookie_authentication_guide.md`](../cookie_authentication_guide.md).
+
+Do not invent a third session store. Do not put JWTs in `localStorage` as a “simpler cookie.”
+
+## Procedure
+
+1. If the client is Command Tower frontend on web: cookies + CSRF already on from step 08 (`secure = false` on HTTP localhost).
+2. If Bearer-only: leave cookies disabled; step 12 uses `Authorization`.
+3. If a **browser on another origin** calls the API, add host CORS. CommandTower does not ship CORS.
+
+`config/initializers/cors.rb`:
+
+```ruby
+allowed_origins = ENV.fetch(
+  "CORS_ALLOWED_ORIGINS",
+  "http://localhost:8081,http://localhost:8082,http://localhost:19006"
+).split(",").map(&:strip).reject(&:empty?)
+
+Rails.application.config.middleware.insert_before 0, Rack::Cors do
+  allow do
+    origins(*allowed_origins)
+    resource "*",
+             headers: :any,
+             methods: %i[get post put patch delete options head],
+             credentials: true,
+             expose: ["X-Authorization-Expire", "X-Authorization-Reset"]
+  end
+end
+```
+
+`credentials: true` requires an **explicit origin list**, not `*`. Compose already passes `CORS_ALLOWED_ORIGINS` from step 01. The sample origins `8081`, `8082`, and `19006` belong to one web product. Add the origin this Expo web app actually uses, and keep it aligned with `config.application.url` and the API’s published port.
+
+Attaching a Command Tower frontend: [Local FE↔BE join](../../../artifacts/COMMANDTOWER_LOCAL_JOIN.md).
+
+## Stop
+
+You can state which mode the smoke will use. CORS exists if a browser will call this API. Next: [`12-smoke-check.md`](12-smoke-check.md).

data/docs/bootstrap/12-smoke-check.md

@@ -0,0 +1,81 @@
+# 12 — Smoke check (`GET /me`)
+
+## Purpose
+
+Prove the host is a usable Me/Auth API: register, log in, call `GET /me`, receive **200**.
+
+## Prerequisites
+
+- Steps 00–11
+- API listening: `make server` (or `make s`) — Puma bound on `0.0.0.0` (step 01)
+
+Prefix every path with your engine mount (`/api` if you mounted there). Examples below assume mount at `/api` and host port **3000**.
+
+HTTP catalog (full contract): [`../api_reference.md`](../api_reference.md). This page is the **happy path only**.
+
+## Procedure
+
+Run `curl` **on the Mac** against the published Compose port. That is HTTP, not Ruby on the host.
+
+Login succeeds with **201** (not 200). Register succeeds with **201** and **no** token.
+
+### 1. Register
+
+```bash
+curl -sS -X POST http://localhost:3000/api/auth/register \
+  -H "Content-Type: application/json" \
+  -d '{
+    "first_name": "Ada",
+    "last_name": "Lovelace",
+    "username": "ada1",
+    "email": "ada@example.com",
+    "password": "password12",
+    "password_confirmation": "password12"
+  }'
+```
+
+Expect **201**. No JWT. If email verification is required immediately (`verify_email_required_within = 0.minutes`), either verify using the code in `tmp/mails` or raise the grace period (step 10).
+
+If you already have a user in the database, skip to login.
+
+### 2. Login
+
+```bash
+curl -sS -X POST http://localhost:3000/api/auth/plain-text/login \
+  -H "Content-Type: application/json" \
+  -d '{"identifier": "ada@example.com", "password": "password12"}'
+```
+
+Expect **201** and `data.token`. Cookie mode also sets `Set-Cookie` for `ct_jwt` (and `ct_csrf` when CSRF is on).
+
+### 3. Me
+
+```bash
+TOKEN='<paste data.token>'
+curl -sS -H "Authorization: Bearer ${TOKEN}" http://localhost:3000/api/me
+```
+
+Expect **200** and a Me payload.
+
+Cookie mode: omit `Authorization`, send `-b cookies.txt` after login with `-c cookies.txt`, and on mutating requests add `-H "X-CSRF-Token: …"` from the CSRF cookie. `GET /me` still needs the JWT cookie.
+
+## How to read failures
+
+| Status | Meaning |
+|--------|---------|
+| **401** | Not authenticated — missing/invalid token or cookie |
+| **403** | Authenticated but **not authorized** — RBAC grant missing (`me` not on the user’s role) |
+| **404** | Feature gate off or wrong path/mount |
+| **412** | Email verification required — grace period elapsed; verify or raise `verify_email_required_within` |
+| **503** | Often blank `host_key` on experience-state routes; fix step 08 |
+| Connection refused | Compose `command` not binding `0.0.0.0`, or published port mismatch |
+
+Do not “fix” 403 by disabling RBAC. Grant `me` on `member`.
+
+## After `GET /me`
+
+Attaching a Command Tower frontend is **not** this file. Follow [Local FE↔BE join](../../../artifacts/COMMANDTOWER_LOCAL_JOIN.md).
+
+## Stop
+
+`GET /me` is **200** for a `member` user. Optional extras: [`13-optional.md`](13-optional.md). Required wrap-up: [`14-sanity-checks.md`](14-sanity-checks.md).