# Current

> Keep this file short. One active step, one ordered backlog. Completed work moves to
> [progress.md](progress.md). If this file starts reading like a changelog, it has
> drifted — that's exactly what went wrong last time.

## Active: Milestone 2 — Profile page

**Goal:** `/{handle}` is the real profile page — public, working signed out, and the
frame that repos, writing, and projects hang off later. It replaces the Milestone 0
placeholder.

**Out of scope:** repos, posts, and projects don't exist yet, so there is nothing to
list. Avatars, following, and anything social. Organisation profiles beyond what falls
out for free.

### Phase 1 — the page

Shippable on its own: a public profile that renders signed out.

- [x] Settle URL shape — handles at the root, routes grouped under prefixes
      ([0004](decisions/0004-root-handles-grouped-routes.md))
- [x] Reserved-handle denylist in `OrgName::new`; auth routes moved under `/auth/`
- [ ] **Spike: route precedence.** Does `/auth/login` still win once `/{handle}` exists
      at the root? Most routers prefer a static segment over a parameterised one, but
      this is load-bearing and unverified — check before designing around it
- [ ] Decide `module_router!` vs explicit `#[page]` paths, informed by the spike
- [ ] `PublicProfile` read model + `view_profile` use case — **must not carry email**
- [ ] `/{handle}` page: renders label and handle, 404 on unknown, case-insensitive
- [ ] `/` redirects to the owner's profile once claimed, retiring the placeholder
- [ ] `/api/users/{handle}` — same read model, public JSON

### Phase 2 — make it yours

A profile you can't change is a stub. This is what makes it a portfolio page.

- [ ] Migration: `orgs.bio`
- [ ] Flash messages — the first edit form needs success and failure feedback, and
      every form after it inherits whatever we build here
- [ ] `/{handle}/settings` — edit display name and bio, owner only, enforced in the use
      case
- [ ] Owner-only affordances on the profile (edit link)

### Done when

Signed out, `/{handle}` renders the owner's display name and handle and nothing
private. An unknown handle 404s. The owner can set a display name and bio and see them
on the page. `/api/users/{handle}` returns the same public view.

### Watch for

- **Do not leak email.** `describe_identity` carries email, and `/api/me` returns it —
  correctly, because that endpoint describes the caller to themselves. The public
  profile needs its **own** read model; reusing `Identity` would publish the owner's
  email address to anonymous visitors. This is the single most likely mistake in this
  milestone.
- **Route precedence** between `/auth/login` and `/{handle}`. Verify, don't assume.
- **Case-insensitive handles.** Storage is `collate nocase` and `OrgName::new`
  lowercases, so `/JamesGill` must resolve rather than 404.
- **Authorization on settings** belongs in the use case, taking an `Actor` — not in the
  page. Otherwise `/api` gets a different answer from the web form.
- **A profile is public.** This is the first page rendering for anonymous visitors by
  design, so anything private must be gated explicitly rather than by assuming a
  session exists.
- **Reserve handles early.** Adding to the denylist later is a breaking change for
  whoever holds that handle ([0004](decisions/0004-root-handles-grouped-routes.md)).

### Open questions

- **Where do settings live?** `/{handle}/settings` is consistent with grouping and
  scales to organisations; `/settings` is simpler for a single user but would need
  another reserved word (already reserved). Leaning `/{handle}/settings`.
- **Empty sections or none?** Rendering "Repositories (none yet)" makes the frame
  visible but is speculative scaffolding for things that don't exist. Leaning towards
  omitting them until the content type lands.

### Carried over — small, unblocked

- **No rate limiting** on `/auth/login` or `/auth/setup`.
- **`sweep_expired` is never called**, so expired session rows accumulate. Expiry is
  enforced on read, so this is tidiness, not a hole.
- **CSRF.** `SameSite=Lax` covers the common case; whether forms also want tokens is
  still undecided. Phase 2 adds a form, so this is the natural time to settle it.
- **Styling.** Everything is unstyled HTML. Topcoat ships Tailwind without Node, and
  `steid-backup/AGENTS/UI.md` has a full OKLCH system to mine. Cheaper now than at ten
  pages — see [ui.md](ui.md).

## Backlog

Ordered. Pull from the top.

1. **Milestone 3 — Writing.** Posts, markdown rendering, `/{handle}/posts/{slug}`.
   *Open question: is writing actually the first portfolio feature, or is it
   projects/showcases?*
2. **Milestone 4 — Repo model.** `Repository` entity, `Visibility`, `create_repo`,
   bare repo on disk at `{data_dir}/{org}/{repo}.git`. Watch the DB-plus-filesystem
   atomicity problem — see [architecture.md](architecture.md#db-plus-filesystem-writes).
3. **Milestone 5 — Git over HTTP.** `git http-backend` subprocess, PATs over HTTP
   Basic. See [0001](decisions/0001-git-over-http-not-ssh.md).

## Open questions

- **Topcoat is early** (v0.5.0, first released 2026-07-22, breaking changes expected
  by its own authors). Expect churn that isn't feature work.
- Body size limits will reject large pushes at Milestone 5 — `topcoat-router` has a
  `body_limit` layer that needs raising on the git routes. Recorded here because it
  will surface as a confusing failure rather than a clear one.
- Topcoat ships Tailwind without Node, which reopens the design system attempt #1
  dropped purely to avoid an npm build step — see [ui.md](ui.md).

## Routing findings (Milestone 0)

- **Topcoat 0.5 requires rustc ≥ 1.95.** On an older toolchain `cargo add topcoat`
  silently resolves to an empty `topcoat v0.0.0` placeholder instead of failing. Local
  stable is now 1.97.1.
- `Router::builder().discover()` collects `#[page]`-annotated items **at link time**,
  so pages can live in any module. Layering is our choice, not the framework's.
- `module_router!` derives each URL from the module tree rather than a path string.
  Still deferred. Application routes now group cleanly (`auth/login`, `api/me`), but
  handles sit at the root ([0004](decisions/0004-root-handles-grouped-routes.md)), so a
  parameterised root segment still has to coexist with static ones. Worth checking how
  `module_router!` handles that before committing to it.
- Path and query params are read from `Cx` via `path_param!` / `#[query_params]`, not
  injected as handler arguments. Parses are memoized per request.
- Layouts wrap by path prefix and nest outermost-first, and a layout can catch a page's
  `NotFoundError` to render a branded 404.
- `HOST` / `PORT` configure the bind address, so `STEID_LISTEN_ADDR` is gone.
- `Body` is a boxed `http_body::Body` used for both requests and responses, with
  `into_data_stream()` to read and `Body::new()` to wrap a stream — pack data can
  stream both directions without buffering. This is what makes Milestone 5 viable.