docs: phase 1 plan, identity

Seven tasks: the index swap, the hq fields, the three scoped lookups,
removing admin's unscoped control-plane login, and an end-to-end
verification that two users sharing one address sign in to different
instances.

Also corrects the spec's phase list, which claimed phase 1 projects the
creator as owner. Projection needs instance creation, which is phase 2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mrhid6
2026-07-26 12:28:25 +01:00
co-authored by Claude Opus 5
parent d15ab78bd5
commit 88f49a96ae
2 changed files with 938 additions and 2 deletions
@@ -60,8 +60,9 @@ empty `PaddleCustomerID`, which spec 5's account model already permits.
Three phases, each shippable, in this order. The plan should not interleave them
— phase 1 changes an index that everything else then depends on.
1. **Identity** — drop the global email index, scope the lookups, project the
creator as owner. No new UI.
1. **Identity** — drop the global email index, scope the two unscoped lookups,
add the `hq` fields to the user document, and remove admin's unscoped
control-plane login branch. No new UI, and nothing is projected yet.
2. **Instance creation and Free lifecycle**`POST /api/instances`, renewal,
notices, the reaper, the sitesvc cutover.
3. **Membership** — account roles, invitations, per-instance grants, password