60 lines
2.5 KiB
Markdown
60 lines
2.5 KiB
Markdown
# TASK 68 — Shared household state: tasks first, authority intact
|
|
|
|
**Status:** planned 2026-08-10. **Size:** begin with one vertical slice.
|
|
**Design:** [`../SHARED-STATE-ARCHITECTURE.md`](../SHARED-STATE-ARCHITECTURE.md).
|
|
|
|
## Goal
|
|
|
|
Build a shared Household space where distinct people can create and complete
|
|
their own task participation without making the sidebar, Culver, or a CRDT the
|
|
authority.
|
|
|
|
## First slice
|
|
|
|
1. A local service with an append-only admitted event trail and materialized
|
|
task projection.
|
|
2. Household membership with separate Casey and spouse identities.
|
|
3. Tasks with title, notes, assignees, per-assignee status, due/reminder,
|
|
subtasks, and links.
|
|
4. One full QML application plus a sidebar projection asking what needs the
|
|
current person now.
|
|
5. No remote replication until the local data model and authority boundary are
|
|
pleasant and inspectable.
|
|
|
|
## Non-negotiable boundaries
|
|
|
|
- Culver is the Personal-class contacts/messenger client, not household
|
|
admission authority.
|
|
- Culver/machined owns enrolment, membership, revocation, and scoped signing.
|
|
- The service admits mutations; QML surfaces only project them.
|
|
- Loro may merge admitted offline state. It never decides identity,
|
|
membership, or permission.
|
|
- Calendar is a first-class time object, not a task with a date.
|
|
- CalDAV/CardDAV/JMAP are compatibility edges, never the authority model.
|
|
- A local biometric factor may improve step-up once it verifies a real match;
|
|
it does not admit a remote device or replace shared-space identity.
|
|
|
|
## Dependencies to make explicit, not hide
|
|
|
|
- `souveraine-machined` needs scoped, expiring capability tokens (component
|
|
audit P1).
|
|
- Per-agent/account caller identity is needed before a token can name a
|
|
meaningful local producer or caller (P3).
|
|
- `souveraine-secrets` must scope Personal-class release to caller and item
|
|
(P2).
|
|
- sessiond supplies live lock state, step-up, and key eviction; it is not the
|
|
shared-state database.
|
|
|
|
## Acceptance
|
|
|
|
Casey and his wife can each see a Household task, mark only their own
|
|
participation complete, and inspect who changed what. The sidebar and full app
|
|
show the same materialized state. No widget writes another state store, and no
|
|
offline peer becomes a member merely by merging data.
|
|
|
|
## Connects to
|
|
|
|
TASK-16 (Culver contacts as Personal-class data), TASK-23 (locked notification
|
|
cadence), TASK-30 (enumerable surface verbs), TASK-41 (attested producers),
|
|
`souveraine-components/audit-status.md`, and
|
|
`SHARED-STATE-ARCHITECTURE.md`.
|