Sylvain Duchesne
908f7ea973
Participation privacy (decision_2026-10-29_participation-privacy-mechanism): a sign-up is a private Join naming the meeting point, addressed to nobody, handled by the backend on emission. Attendee lists hold member URNs hashed from (WebID, event, a secret kept in the participant's profile), so counts stay public and only contacts recognise anyone; the creator has no read right and is notified anonymously. Each person's participations collection, created by the backend at the first sign-up, is readable by their /contacts WAC group only, never world-readable. The member URN is sticky per (meeting point, participant) and every collection write is verified by reading back, so a refused write leaves the act unrecorded and retryable. The EventRef mechanism and its browser-side provisioning are gone. The backend now runs with WebACL on, as the reference apps do, on its own secure datasets festipod / settings-festipod instead of the pod provider's settings dataset; pod-notifications needs it. The compose header and the deployment leaf say how to reset a stack whose datasets predate this. The rights matrix covers the new mechanism live (148 hard lines), including a forged contact Accept between throwaway accounts: the stranger enters the contacts list (platform defect, reported upstream) but is refused the profile and the participations. Tests may attack as long as they never break the dev environment (rule_tests-never-break-the-dev-environment). Also lands the coherence-pass work that was still uncommitted: contacts as the Pod's social graph and invite links, image upload to the Pod, the meeting-point form, profile completion gate, and the doctrine for them. Superseded briefs and decisions are deleted rather than annotated.
Festipod Documentation
This documentation is split into three parts:
1. Festipod Mobile App
The mobile application being designed - an event discovery and networking platform. This section covers:
- App concept and target users
- User stories (26 stories across 5 categories)
- Screen mockups (13 screens)
- Feature specifications (Cucumber/Gherkin)
2. Prototyping Tool
The web application built to visualize and document the Festipod project. This section covers:
- Architecture and navigation
- Gallery, Demo, Stories, and Specs pages
- Component library (Sketchy UI)
- Build and development setup
3. Cucumber Integration
Technical documentation for the BDD testing framework. This section covers:
- Test architecture and configuration
- World class and state management
- Step definitions (navigation, form, screen)
- Running tests and generating reports
Quick Start
# Install dependencies
bun install
# Start development server
bun run dev
# Run Cucumber tests
bun run test:cucumber
# Parse feature files
bun run features:parse
Open http://localhost:3000 to view the prototyping tool.