f1fbe0e29a
Archived 4 completed OpenSpec changes (2026-04-02): - phase-3-enterprise (100/100 tasks) — 6 Phase 3 capabilities synced - devops-documentation (48/48 tasks) — 3 new + 1 merged capability - bedroom-developer-docs (33/33 tasks) — 4 new capabilities synced - engineering-docs (superseded by 2026-03-29 archive) — no tasks Main spec library grows from 21 → 35 capabilities (+14 new): federation, multi-tenancy, oidc, soc2, w3c-dids, webhooks, database, operations, system-overview, api-reference, core-concepts, developer-guides, quick-start + deployment (merged additive requirements) Active changes: 0 — project board is clear for Phase 4 planning. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2.5 KiB
2.5 KiB
ADDED Requirements
Requirement: Annotated code walkthrough documents
The system SHALL include a document (docs/engineering/06-walkthroughs.md) containing three annotated end-to-end walkthroughs of the system's critical flows, with file:line references to actual source code.
Scenario: Token issuance walkthrough complete
- WHEN a new engineer reads the token issuance walkthrough
- THEN they SHALL be guided step by step from: HTTP POST /oauth2/token → Express router → auth middleware → OAuth2Controller → OAuth2Service → CredentialRepository → Vault/bcrypt credential check → Redis token cache check → JWT signing (src/utils/jwt.ts) → AuditService.logEvent → HTTP 200 response
- AND every step SHALL reference the actual file and line number where it occurs
Scenario: Agent registration walkthrough complete
- WHEN a new engineer reads the agent registration walkthrough
- THEN they SHALL be guided step by step from: HTTP POST /agents → auth middleware → validation middleware → AgentController → AgentService.createAgent → input validation (src/utils/validators.ts) → AgentRepository.create → PostgreSQL INSERT → AuditService.logEvent → HTTP 201 response with agent object
- AND every step SHALL reference the actual file and line number
Scenario: Credential rotation walkthrough complete
- WHEN a new engineer reads the credential rotation walkthrough
- THEN they SHALL be guided step by step from: HTTP POST /agents/:id/credentials/:credId/rotate → auth middleware → CredentialController → CredentialService.rotateCredential → old credential revocation → new secret generation (src/utils/crypto.ts) → Vault write or bcrypt hash → CredentialRepository.update → token revocation for old credentials → AuditService.logEvent → HTTP 200 response
- AND every step SHALL reference the actual file and line number
Scenario: Walkthroughs include version reference
- WHEN a new engineer reads any walkthrough
- THEN the document SHALL include a header stating the commit hash it was last verified against, so engineers know if the walkthrough may have drifted from the current code
Scenario: Each walkthrough annotates why, not just what
- WHEN a new engineer reads a walkthrough step
- THEN each step SHALL explain not just what the code does but WHY — e.g., why Redis is checked before signing a new JWT, why constant-time comparison is used for credential verification, why audit logging happens after persistence not before