spaps-server-quickstart 0.5.0__tar.gz → 0.5.1__tar.gz

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/.gitignore

@@ -78,7 +78,10 @@ storybook-static/
 # IDE
 .vscode/
 .idea/
+.codex/
+.mcp.json
 .claude/settings.local.json
+.claude/skills/
 *.swp
 *.swo
 *.swn
@@ -151,6 +154,13 @@ backup-feb8.sql
 # Stripe CLI
 .stripe-listen.pid
 
+# Local modes/swarm artifacts
+.ntm/
+.skillbox/
+MODES_ANALYSIS_PROGRESS.md
+MODES_OF_REASONING_REPORT_AND_ANALYSIS_OF_PROJECT.md
+MODES_SWARM/
+
 # OS files
 Thumbs.db
 Desktop.ini
@@ -171,3 +181,7 @@ playwright/.cache/
 # pnpm-lock.yaml*.tgz
 
 **/coverage.xml
+
+context.yaml
+MODES_OF_REASONING_SECOND_PASS_REPORT.md
+skillbox-config/

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/CHANGELOG.md

@@ -8,6 +8,18 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 - No changes yet.
 
+## [0.5.0] - 2026-03-29
+
+### Added
+
+- End-user issue-reporting flows, runtime token admin support, and support-telemetry helpers for downstream FastAPI services.
+- Browser-friendly device-flow verification and expanded reusable database helper surface.
+
+### Fixed
+
+- Magic-link redirect handling, stale session admin-email behavior, and related auth/session hardening.
+- Hotspot complexity and coverage gaps across webhook, auth, and session paths.
+
 ## [0.4.0] - 2026-02-11
 
 ### Added

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spaps-server-quickstart
-Version: 0.5.0
+Version: 0.5.1
 Summary: Shared FastAPI/Celery scaffolding for Sweet Potato service backends.
 Project-URL: Homepage, https://api.sweetpotato.dev
 Project-URL: Repository, https://github.com/sweet-potato/spaps
@@ -25,6 +25,7 @@ Requires-Dist: eth-account<1.0,>=0.13.0
 Requires-Dist: fastapi<0.119,>=0.118.0
 Requires-Dist: greenlet<4.0,>=3.0.3
 Requires-Dist: httpx<0.29,>=0.28.1
+Requires-Dist: orjson<4.0,>=3.10.0
 Requires-Dist: pgvector<0.5,>=0.4.1
 Requires-Dist: psycopg[binary]<3.3,>=3.2.10
 Requires-Dist: pydantic-settings<3.0,>=2.3.0
@@ -71,35 +72,28 @@ Requires-Dist: respx<0.23,>=0.22.0; extra == 'testing'
 Requires-Dist: testcontainers[postgres]<5.0,>=4.0.0; extra == 'testing'
 Description-Content-Type: text/markdown
 
-# SPAPS Server Quickstart
+# spaps-server-quickstart
 
-Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for Sweet Potato service backends. This is the active backend package in the repository and the shared foundation for SPAPS-aligned Python services.
+Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for SPAPS-aligned Python services. This is the active backend package in this repository.
+
+Examples in this README use placeholders such as `https://api.example.test` and local-only database URLs. Replace them with values from your own environment.
+
+## Install
 
 ```bash
 pip install spaps-server-quickstart
 ```
 
-## TL;DR
-
-**The Problem**: new FastAPI services keep re-solving the same problems around app factories, auth middleware, RBAC, async database wiring, Celery bootstrapping, and deployment guardrails.
-
-**The Solution**: `spaps-server-quickstart` packages the shared SPAPS backend conventions into one installable Python package so new services start from a tested baseline instead of ad hoc scaffolding.
+This package targets Python 3.12+.
 
-### Why Use `spaps-server-quickstart`?
+## When It Fits
 
-| Feature | What it gives you |
+| Need | Package gives you |
 | --- | --- |
-| App factory and startup checks | `create_app`, settings loaders, and environment validation |
-| Shared auth + RBAC | SPAPS auth middleware, auth channels, trusted-service middleware, and role dependencies |
-| Async data layer | SQLAlchemy 2.0 async helpers, migration runner, and session dependencies |
-| Operational templates | Deployment scripts, compose stubs, dev DB helpers, and packaging patterns |
-
-## Metadata
-
-- `package_name`: `spaps-server-quickstart`
-- `latest_version`: `0.4.0`
-- `minimum_runtime`: `Python >=3.12`
-- `api_base_url`: `https://api.sweetpotato.dev`
+| A real FastAPI starting point | `create_app`, settings loaders, request logging, and startup checks |
+| Shared auth and RBAC | SPAPS auth middleware, auth channels, cookies, and role dependencies |
+| Async database plumbing | SQLAlchemy 2 async session helpers and Alembic support |
+| Operational scaffolding | Celery setup, deploy templates, local-mode helpers, and service SDK utilities |
 
 ## Quick Start
 
@@ -107,47 +101,59 @@ pip install spaps-server-quickstart
 from fastapi import APIRouter
 
 from spaps_server_quickstart import create_app
-from spaps_server_quickstart.settings import BaseServiceSettings
+from spaps_server_quickstart.settings import (
+    BaseServiceSettings,
+    create_settings_loader,
+)
 
 
-def load_settings() -> BaseServiceSettings:
-    return BaseServiceSettings(env="test", app_name="README Quickstart")
+class ExampleSettings(BaseServiceSettings):
+    app_name: str = "Example Service"
+    spaps_auth_enabled: bool = False
 
 
 router = APIRouter()
 
 
-@router.get("/hello")
-async def hello() -> dict[str, str]:
-    return {"message": "Hello from SPAPS"}
+@router.get("/health")
+async def health() -> dict[str, bool]:
+    return {"ok": True}
 
 
-app = create_app(settings_loader=load_settings, api_router=router)
+app = create_app(
+    settings_loader=create_settings_loader(ExampleSettings),
+    api_router=router,
+)
 ```
 
-## Design Principles
-
-1. Start from a real service baseline, not a toy template.
-2. Keep auth, middleware, and operational guardrails reusable across services.
-3. Prefer explicit service composition through settings loaders and dependency injection.
-4. Keep the local-development path close to production behavior.
-5. Make the happy path easy without hiding the underlying FastAPI and SQLAlchemy primitives.
-
-## What the Package Includes
+## What the Package Ships
 
 | Area | Highlights |
 | --- | --- |
-| App lifecycle | `create_app`, startup checks, environment validation, logging |
-| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local auth mode |
-| Routing and RBAC | Base router builder, role helpers, authenticated-user dependencies |
+| App lifecycle | `create_app`, startup validation, logging, CORS wiring |
+| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local mode |
+| Routing and RBAC | Base router builder, authenticated-user dependencies, `require_roles`, `has_required_roles` |
 | Database | Async sessionmaker factory, migration runner, Alembic helpers |
 | Tasks | Celery app factory plus notification and ping task helpers |
-| Service SDK helpers | Admin token cache, server-side SPAPS clients, feature evaluation, trusted-service middleware |
-| Templates | Domain examples, operations bundle, env examples, and local dev helpers |
+| Service SDK helpers | Admin token cache, server-side SPAPS clients, trusted-service middleware, feature evaluation |
+| Templates | Domain examples, tests, deployment scaffolding, and local operations helpers |
+| Reference contract | The `golden_path` app blueprint, seeded paid-access policy, and downstream runbook for the core auth -> billing -> entitlement -> access loop |
+
+## Golden App Pack
+
+If you want one SPAPS-native reference contract instead of a blank scaffold, start with the `golden_path` blueprint.
+
+It is the canonical pack for:
+
+- browser auth and session bootstrap
+- Stripe checkout or subscription flows
+- entitlement projection into `paid_access`
+- policy-gated access through the seeded `access-paid-features` rule
+- an operator runbook under `docs/downstream_apps/golden-path-reference/`
 
 ## Local Development Mode
 
-Set `DEVELOPMENT_ENVIRONMENT=local` to enable the local-auth bypass workflow used in development and tests.
+Set `DEVELOPMENT_ENVIRONMENT=local` to enable local auth bypass in development and tests.
 
 ```python
 from spaps_server_quickstart.local_mode import (
@@ -171,73 +177,49 @@ Default personas:
 
 ## Configuration
 
-Key settings exposed through `BaseServiceSettings` and related SPAPS settings:
+Common settings exposed through `BaseServiceSettings`:
 
 | Setting | Purpose |
 | --- | --- |
 | `development_environment` | Enables local bypass mode when set to `local` |
+| `spaps_auth_enabled` | Turns SPAPS auth middleware on or off |
 | `spaps_auth_exempt_paths` | Comma-separated paths that skip SPAPS auth |
 | `cors_allow_origins` | Shared CORS configuration |
-| `secure_messages_enabled` | Toggles secure-messaging gateway support |
-| `secure_messages_timeout` | HTTP timeout for secure-messaging calls |
+| `database_url` | Async SQLAlchemy database URL |
+| `redis_url` | Redis URL used by Celery defaults |
+| `secure_messages_enabled` | Enables secure-messaging gateway support |
 
 Example environment:
 
 ```bash
 DEVELOPMENT_ENVIRONMENT=local
+SPAPS_API_URL=https://api.example.test
+SPAPS_API_KEY=spaps_sec_example
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/service
 SPAPS_AUTH_EXEMPT_PATHS=/health,/docs
 CORS_ALLOW_ORIGINS=http://localhost:3000,http://localhost:5173
 ```
 
-## Operational Templates
-
-The package ships with templates and scripts for the workflows the real SPAPS services use:
-
-- Docker Compose and reverse-proxy stubs
-- Deploy scripts with preflight and post-deploy checks
-- Database backup, restore, and migration helpers
-- Shared dev DB helpers and local debug-loop support
-- Example domains and tests for bootstrapping new services
-
-## Architecture
-
-```text
-FastAPI service
-  |
-  +--> create_app + settings loader
-  |
-  +--> auth middleware / RBAC / dependencies
-  |
-  +--> async DB session + Alembic helpers
-  |
-  +--> Celery tasks + service SDK helpers
-  |
-  +--> shared operational templates
-          |
-          v
-    SPAPS-aligned production service
-```
-
-## Validation and Development
+## Validation
 
-When working in this repository, the root `Makefile` is the canonical workflow:
+From the repository root, the `Makefile` is the canonical workflow:
 
 ```bash
 make install
 make pytest
 make lint
 make typecheck
+make pytest-cov
 make test
-make local-up
 ```
 
 Useful additional commands:
 
 ```bash
 make pytest-full
-make pytest-cov
 make migrate
 make new-migration MSG="add_example_table"
+make local-up
 ```
 
 ## Troubleshooting
@@ -248,29 +230,29 @@ That is expected when testmon sees no impacted tests. Use `make pytest-full` whe
 
 ### Local auth bypass is not active
 
-Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup.
+Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup and that `LocalAuthMiddleware` is wired into the app.
 
 ### Unauthenticated routes still require auth
 
-Check `spaps_auth_exempt_paths` and make sure the configured paths match the actual router paths.
+Check `spaps_auth_exempt_paths` and make sure the configured paths match the router paths exactly.
 
 ### Startup fails on environment validation
 
-Review the required settings and any environment-safety checks triggered during startup validation.
+Review the required settings and any safety checks triggered during startup.
 
 ### I need a new service quickly
 
-Start from the included templates and keep the repo-root validation path intact while adapting the service-specific settings.
+Start from the included templates, then keep the repo-root validation path intact while adapting domain code and settings.
 
 ## Limitations
 
-- This package is a scaffold, not a complete application by itself.
-- Downstream services still need their own domain routers, schemas, repositories, and deployment configuration.
-- Some operational templates intentionally require environment-specific edits before production use.
+- This package is a scaffold, not a finished application.
+- Downstream services still need their own routers, schemas, repositories, and deployment settings.
+- Some operational templates intentionally need environment-specific edits before production use.
 
 ## FAQ
 
-### Is this the active SPAPS backend in this repo?
+### Is this the active backend package in this repo?
 
 Yes. This package replaces the old Node/Express stack as the active backend surface.
 
@@ -288,7 +270,14 @@ Yes. Use `require_roles`, `has_required_roles`, and the authenticated-user depen
 
 ### What is the recommended validation path here?
 
-From the repository root: `make pytest`, `make lint`, `make typecheck`, and `make test`.
+From the repository root: `make pytest`, `make lint`, `make typecheck`, `make pytest-cov`, and `make test`.
+
+## Metadata
+
+- `package_name`: `spaps-server-quickstart`
+- `latest_version`: `0.5.0`
+- `minimum_runtime`: `Python >=3.12`
+- `api_base_url`: `https://api.sweetpotato.dev`
 
 ## About Contributions
 

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/README.md

@@ -1,32 +1,25 @@
-# SPAPS Server Quickstart
+# spaps-server-quickstart
 
-Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for Sweet Potato service backends. This is the active backend package in the repository and the shared foundation for SPAPS-aligned Python services.
+Reusable FastAPI, SQLAlchemy, Celery, auth, and operational scaffolding for SPAPS-aligned Python services. This is the active backend package in this repository.
+
+Examples in this README use placeholders such as `https://api.example.test` and local-only database URLs. Replace them with values from your own environment.
+
+## Install
 
 ```bash
 pip install spaps-server-quickstart
 ```
 
-## TL;DR
-
-**The Problem**: new FastAPI services keep re-solving the same problems around app factories, auth middleware, RBAC, async database wiring, Celery bootstrapping, and deployment guardrails.
-
-**The Solution**: `spaps-server-quickstart` packages the shared SPAPS backend conventions into one installable Python package so new services start from a tested baseline instead of ad hoc scaffolding.
+This package targets Python 3.12+.
 
-### Why Use `spaps-server-quickstart`?
+## When It Fits
 
-| Feature | What it gives you |
+| Need | Package gives you |
 | --- | --- |
-| App factory and startup checks | `create_app`, settings loaders, and environment validation |
-| Shared auth + RBAC | SPAPS auth middleware, auth channels, trusted-service middleware, and role dependencies |
-| Async data layer | SQLAlchemy 2.0 async helpers, migration runner, and session dependencies |
-| Operational templates | Deployment scripts, compose stubs, dev DB helpers, and packaging patterns |
-
-## Metadata
-
-- `package_name`: `spaps-server-quickstart`
-- `latest_version`: `0.4.0`
-- `minimum_runtime`: `Python >=3.12`
-- `api_base_url`: `https://api.sweetpotato.dev`
+| A real FastAPI starting point | `create_app`, settings loaders, request logging, and startup checks |
+| Shared auth and RBAC | SPAPS auth middleware, auth channels, cookies, and role dependencies |
+| Async database plumbing | SQLAlchemy 2 async session helpers and Alembic support |
+| Operational scaffolding | Celery setup, deploy templates, local-mode helpers, and service SDK utilities |
 
 ## Quick Start
 
@@ -34,47 +27,59 @@ pip install spaps-server-quickstart
 from fastapi import APIRouter
 
 from spaps_server_quickstart import create_app
-from spaps_server_quickstart.settings import BaseServiceSettings
+from spaps_server_quickstart.settings import (
+    BaseServiceSettings,
+    create_settings_loader,
+)
 
 
-def load_settings() -> BaseServiceSettings:
-    return BaseServiceSettings(env="test", app_name="README Quickstart")
+class ExampleSettings(BaseServiceSettings):
+    app_name: str = "Example Service"
+    spaps_auth_enabled: bool = False
 
 
 router = APIRouter()
 
 
-@router.get("/hello")
-async def hello() -> dict[str, str]:
-    return {"message": "Hello from SPAPS"}
+@router.get("/health")
+async def health() -> dict[str, bool]:
+    return {"ok": True}
 
 
-app = create_app(settings_loader=load_settings, api_router=router)
+app = create_app(
+    settings_loader=create_settings_loader(ExampleSettings),
+    api_router=router,
+)
 ```
 
-## Design Principles
-
-1. Start from a real service baseline, not a toy template.
-2. Keep auth, middleware, and operational guardrails reusable across services.
-3. Prefer explicit service composition through settings loaders and dependency injection.
-4. Keep the local-development path close to production behavior.
-5. Make the happy path easy without hiding the underlying FastAPI and SQLAlchemy primitives.
-
-## What the Package Includes
+## What the Package Ships
 
 | Area | Highlights |
 | --- | --- |
-| App lifecycle | `create_app`, startup checks, environment validation, logging |
-| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local auth mode |
-| Routing and RBAC | Base router builder, role helpers, authenticated-user dependencies |
+| App lifecycle | `create_app`, startup validation, logging, CORS wiring |
+| Auth | `SpapsAuthMiddleware`, auth cookies, auth channel service, local mode |
+| Routing and RBAC | Base router builder, authenticated-user dependencies, `require_roles`, `has_required_roles` |
 | Database | Async sessionmaker factory, migration runner, Alembic helpers |
 | Tasks | Celery app factory plus notification and ping task helpers |
-| Service SDK helpers | Admin token cache, server-side SPAPS clients, feature evaluation, trusted-service middleware |
-| Templates | Domain examples, operations bundle, env examples, and local dev helpers |
+| Service SDK helpers | Admin token cache, server-side SPAPS clients, trusted-service middleware, feature evaluation |
+| Templates | Domain examples, tests, deployment scaffolding, and local operations helpers |
+| Reference contract | The `golden_path` app blueprint, seeded paid-access policy, and downstream runbook for the core auth -> billing -> entitlement -> access loop |
+
+## Golden App Pack
+
+If you want one SPAPS-native reference contract instead of a blank scaffold, start with the `golden_path` blueprint.
+
+It is the canonical pack for:
+
+- browser auth and session bootstrap
+- Stripe checkout or subscription flows
+- entitlement projection into `paid_access`
+- policy-gated access through the seeded `access-paid-features` rule
+- an operator runbook under `docs/downstream_apps/golden-path-reference/`
 
 ## Local Development Mode
 
-Set `DEVELOPMENT_ENVIRONMENT=local` to enable the local-auth bypass workflow used in development and tests.
+Set `DEVELOPMENT_ENVIRONMENT=local` to enable local auth bypass in development and tests.
 
 ```python
 from spaps_server_quickstart.local_mode import (
@@ -98,73 +103,49 @@ Default personas:
 
 ## Configuration
 
-Key settings exposed through `BaseServiceSettings` and related SPAPS settings:
+Common settings exposed through `BaseServiceSettings`:
 
 | Setting | Purpose |
 | --- | --- |
 | `development_environment` | Enables local bypass mode when set to `local` |
+| `spaps_auth_enabled` | Turns SPAPS auth middleware on or off |
 | `spaps_auth_exempt_paths` | Comma-separated paths that skip SPAPS auth |
 | `cors_allow_origins` | Shared CORS configuration |
-| `secure_messages_enabled` | Toggles secure-messaging gateway support |
-| `secure_messages_timeout` | HTTP timeout for secure-messaging calls |
+| `database_url` | Async SQLAlchemy database URL |
+| `redis_url` | Redis URL used by Celery defaults |
+| `secure_messages_enabled` | Enables secure-messaging gateway support |
 
 Example environment:
 
 ```bash
 DEVELOPMENT_ENVIRONMENT=local
+SPAPS_API_URL=https://api.example.test
+SPAPS_API_KEY=spaps_sec_example
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/service
 SPAPS_AUTH_EXEMPT_PATHS=/health,/docs
 CORS_ALLOW_ORIGINS=http://localhost:3000,http://localhost:5173
 ```
 
-## Operational Templates
-
-The package ships with templates and scripts for the workflows the real SPAPS services use:
-
-- Docker Compose and reverse-proxy stubs
-- Deploy scripts with preflight and post-deploy checks
-- Database backup, restore, and migration helpers
-- Shared dev DB helpers and local debug-loop support
-- Example domains and tests for bootstrapping new services
-
-## Architecture
-
-```text
-FastAPI service
-  |
-  +--> create_app + settings loader
-  |
-  +--> auth middleware / RBAC / dependencies
-  |
-  +--> async DB session + Alembic helpers
-  |
-  +--> Celery tasks + service SDK helpers
-  |
-  +--> shared operational templates
-          |
-          v
-    SPAPS-aligned production service
-```
-
-## Validation and Development
+## Validation
 
-When working in this repository, the root `Makefile` is the canonical workflow:
+From the repository root, the `Makefile` is the canonical workflow:
 
 ```bash
 make install
 make pytest
 make lint
 make typecheck
+make pytest-cov
 make test
-make local-up
 ```
 
 Useful additional commands:
 
 ```bash
 make pytest-full
-make pytest-cov
 make migrate
 make new-migration MSG="add_example_table"
+make local-up
 ```
 
 ## Troubleshooting
@@ -175,29 +156,29 @@ That is expected when testmon sees no impacted tests. Use `make pytest-full` whe
 
 ### Local auth bypass is not active
 
-Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup.
+Confirm `DEVELOPMENT_ENVIRONMENT=local` is set before application startup and that `LocalAuthMiddleware` is wired into the app.
 
 ### Unauthenticated routes still require auth
 
-Check `spaps_auth_exempt_paths` and make sure the configured paths match the actual router paths.
+Check `spaps_auth_exempt_paths` and make sure the configured paths match the router paths exactly.
 
 ### Startup fails on environment validation
 
-Review the required settings and any environment-safety checks triggered during startup validation.
+Review the required settings and any safety checks triggered during startup.
 
 ### I need a new service quickly
 
-Start from the included templates and keep the repo-root validation path intact while adapting the service-specific settings.
+Start from the included templates, then keep the repo-root validation path intact while adapting domain code and settings.
 
 ## Limitations
 
-- This package is a scaffold, not a complete application by itself.
-- Downstream services still need their own domain routers, schemas, repositories, and deployment configuration.
-- Some operational templates intentionally require environment-specific edits before production use.
+- This package is a scaffold, not a finished application.
+- Downstream services still need their own routers, schemas, repositories, and deployment settings.
+- Some operational templates intentionally need environment-specific edits before production use.
 
 ## FAQ
 
-### Is this the active SPAPS backend in this repo?
+### Is this the active backend package in this repo?
 
 Yes. This package replaces the old Node/Express stack as the active backend surface.
 
@@ -215,7 +196,14 @@ Yes. Use `require_roles`, `has_required_roles`, and the authenticated-user depen
 
 ### What is the recommended validation path here?
 
-From the repository root: `make pytest`, `make lint`, `make typecheck`, and `make test`.
+From the repository root: `make pytest`, `make lint`, `make typecheck`, `make pytest-cov`, and `make test`.
+
+## Metadata
+
+- `package_name`: `spaps-server-quickstart`
+- `latest_version`: `0.5.0`
+- `minimum_runtime`: `Python >=3.12`
+- `api_base_url`: `https://api.sweetpotato.dev`
 
 ## About Contributions
 

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/docs/MIGRATION_GUIDE.md

@@ -222,7 +222,7 @@ the structure expected by downstream dependencies like `require_roles` and `requ
     - Log into ghcr.io using `GHCR_DEPLOY_USER` / `GHCR_DEPLOY_TOKEN` secrets.
     - Pull the commit-tagged image and restart the app (or compose stack) with `SPAPS_IMAGE=<image:tag>` set in the environment.
     - Refresh `/opt/sweet-potato/deploy/reverse-proxy` so the shared proxy reloads certificates and vhosts.
-6. Document these steps in the service README so operators can redeploy from GHCR without rebuilding locally (see `sweet-potato/deploy/production-checklist.md` for reference).
+6. Document these steps in the service README so operators can redeploy from GHCR without rebuilding locally.
 
 ## 13. Alembic & CI/CD Templates
 

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/docs/TM-ENV-001-checklist.md

@@ -49,7 +49,6 @@ This checklist ensures the email environment safety implementation is complete a
 ### ✅ Documentation
 
 - [x] Created `docs/TM-ENV-001-email-environment-safety.md` (comprehensive threat model doc)
-- [x] Created `docs/TM-ENV-001-summary.md` (implementation summary)
 - [x] Created `docs/TM-ENV-001-checklist.md` (this file)
 
 ### ✅ Code Search

{spaps_server_quickstart-0.5.0 → spaps_server_quickstart-0.5.1}/docs/feature-plans/INDEX.md

@@ -8,6 +8,7 @@ Only slice folders under this directory should be treated as tracked feature pla
 
 | Status | Slice | Scope | Notes |
 | --- | --- | --- | --- |
+| PLANNED | [trust-invariants-kernel](./trust-invariants-kernel/README.md) | Request principal, scope rules, secret redaction, and truthful JSON contract enforcement in the active FastAPI runtime | Narrow follow-on slice that supersedes the "already compliant" trust-boundary assumptions in `security-audit-remediation-2026q1`. |
 | DONE | [security-audit-remediation-2026q1](./security-audit-remediation-2026q1/README.md) | `TM-002`, `TM-007`, `TM-008`, `TM-009`, `TM-010`, `TM-011`, `TM-013` | Audit-validated in `AUDIT_REPORT.md`; implemented in the active Python/FastAPI runtime. |
 
 ## Notes

spaps_server_quickstart-0.5.1/docs/feature-plans/trust-invariants-kernel/README.md

@@ -0,0 +1,38 @@
+# Trust Invariants Kernel Plan
+
+This folder contains a domain-planner style slice for consolidating trust-boundary rules in the active SPAPS Python runtime.
+
+## Scope
+
+- Active stack only: `packages/python-server-quickstart/` (FastAPI/Python)
+- Explicitly out of scope: deprecated Node/Express runtime under `src/`
+- Focus: one request principal, one set of scope rules, one secret-exposure policy, and one truthful JSON contract model
+
+## Why This Slice Exists
+
+The previous security remediation slice marked several trust-model items as complete, but the live code still allows drift between:
+
+- API key rotation and API key validation
+- route-level scope intent and repository filtering
+- secret-bearing models and normal read responses
+- runtime JSON envelopes and generated OpenAPI/client contracts
+- trusted proxy IP resolution and rate-limit identity
+
+This slice addresses that drift by introducing an executable kernel instead of more one-off fixes.
+
+## Plan Artifacts
+
+- `plan.md`: strategy, landscape, user stories, and tradeoffs
+- `shared.md`: locked contract deltas and runtime trust contract
+- `backend.md`: backend rules, migrations, and TDD matrix
+- `frontend.md`: API-only downstream consumer impact
+- `flows.md`: critical request, rotation, and redaction flows
+- `schema.mmd`: conceptual ERD for trust-boundary entities
+
+## Suggested Execution Order
+
+1. Principal and proxy-trust kernel
+2. Scope-rule consolidation for audit and security surfaces
+3. Secret write-only policy for webhook and credential surfaces
+4. Truthful envelope/OpenAPI/manifest contract alignment
+5. Describe packets for each implementation wave