siriusscan--sirius/tasks/startup-secrets-redesign.json

[
  {
    "id": "0",
    "title": "PHASE 0: Tracking and Architecture Baseline",
    "description": "Create project tracking artifacts and architecture decisions for startup and secrets redesign.",
    "details": "Establish task tracking and explicit architecture guidance before implementation to keep rollout coherent and auditable.",
    "status": "pending",
    "priority": "high",
    "dependencies": [],
    "subtasks": [
      {
        "id": "0.1",
        "title": "Create startup-secrets project plan note",
        "description": "Add high-level planning document under documentation/dev-notes.",
        "details": "Document goals, scope, migration strategy, and rollout phases aligned with installer-first setup and stateless root key auth.",
        "status": "pending",
        "priority": "high",
        "dependencies": [],
        "testStrategy": "Verify file exists, includes complete YAML front matter, and captures objectives/scope/risks."
      },
      {
        "id": "0.2",
        "title": "Create startup-secrets task tracker",
        "description": "Add tasks JSON for phased execution.",
        "details": "Include phases for installer, compose hardening, API/UI auth updates, docs, tests, CI, optional secrets overlays, and release verification.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["0.1"],
        "testStrategy": "Validate JSON syntax and ensure dependencies/status values are valid."
      },
      {
        "id": "0.3",
        "title": "Record architecture decisions",
        "description": "Capture installer-first and stateless root key model in architecture docs.",
        "details": "Update auth surface and operations runbooks to remove bootstrap-centric assumptions and define deterministic key lifecycle behavior.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["0.1"],
        "testStrategy": "Architecture docs explicitly describe root env key fast path and Valkey fallback for user keys."
      }
    ]
  },
  {
    "id": "1",
    "title": "PHASE 1: Installer Implementation",
    "description": "Build a Docker-friendly installer that generates and validates startup secrets/config.",
    "details": "Implement installer module with template loading, idempotent merge, secure generation, interactive and non-interactive operation modes.",
    "status": "pending",
    "priority": "high",
    "dependencies": ["0"],
    "subtasks": [
      {
        "id": "1.1",
        "title": "Scaffold installer module",
        "description": "Create installer command, internal packages, Dockerfile, and README.",
        "details": "Establish Go module and executable layout under installer/ with clear interfaces for env parsing and generation.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["0.2"],
        "testStrategy": "Installer compiles and basic --help output works."
      },
      {
        "id": "1.2",
        "title": "Implement env template loader and serializer",
        "description": "Load .env.production.example and preserve ordering/comments as practical.",
        "details": "Provide robust parser for KEY=VALUE lines and rendering utility for deterministic output.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["1.1"],
        "testStrategy": "Round-trip parse/render keeps expected key ordering and value integrity."
      },
      {
        "id": "1.3",
        "title": "Implement idempotent merge and secure generation",
        "description": "Generate required secrets only when absent unless force regeneration is requested.",
        "details": "Required keys: SIRIUS_API_KEY, POSTGRES_PASSWORD, NEXTAUTH_SECRET, INITIAL_ADMIN_PASSWORD.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["1.2"],
        "testStrategy": "Repeated runs preserve existing values unless --force is set."
      },
      {
        "id": "1.4",
        "title": "Implement interactive and non-interactive modes",
        "description": "Support prompts for local setup and strict no-prompt mode for automation.",
        "details": "Add flags for quiet output and no secret printing; return non-zero on invalid non-interactive input state.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["1.3"],
        "testStrategy": "Non-interactive mode runs cleanly in CI-style shell and prompts are skipped."
      },
      {
        "id": "1.5",
        "title": "Create setup.sh compatibility wrapper",
        "description": "Preserve existing entrypoint while routing to installer workflow.",
        "details": "Replace old generation script logic with a deprecation-safe shim that calls installer behavior.",
        "status": "pending",
        "priority": "medium",
        "dependencies": ["1.4"],
        "testStrategy": "Running setup.sh generates/updates .env via installer and prints migration guidance."
      }
    ]
  },
  {
    "id": "2",
    "title": "PHASE 2: Compose and Runtime Hardening",
    "description": "Enforce secure environment contracts and remove insecure defaults.",
    "details": "Harden compose files, env templates, UI auth runtime config, and seed behavior.",
    "status": "pending",
    "priority": "high",
    "dependencies": ["1"],
    "subtasks": [
      {
        "id": "2.1",
        "title": "Harden compose environment requirements",
        "description": "Remove insecure defaults and require critical variables.",
        "details": "Update base/dev/prod compose files to require auth secrets and root key consistently.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["1.5"],
        "testStrategy": "docker compose config passes only when required vars are provided."
      },
      {
        "id": "2.2",
        "title": "Update .env templates and gitignore",
        "description": "Align templates and ignore generated secret files.",
        "details": "Add INITIAL_ADMIN_PASSWORD guidance and include root .env in gitignore.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["2.1"],
        "testStrategy": "Templates include required keys and .env no longer appears as untracked by default."
      },
      {
        "id": "2.3",
        "title": "Refine API auth middleware",
        "description": "Ensure stateless root key path is explicit and observable.",
        "details": "Add clear request-local metadata/logging for env root key path versus Valkey user-key validation path.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["2.1"],
        "testStrategy": "Requests with env key auth path succeed without Valkey key lookup."
      },
      {
        "id": "2.4",
        "title": "Harden UI auth and seed behavior",
        "description": "Remove password fallback and enforce required secrets in production.",
        "details": "Update seed.ts, env.mjs, auth.ts, and UI startup scripts for fail-fast behavior on missing secrets.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["2.2"],
        "testStrategy": "Seed fails when INITIAL_ADMIN_PASSWORD is missing in production-mode startup."
      }
    ]
  },
  {
    "id": "3",
    "title": "PHASE 3: Docs, Tests, CI, and Optional Hardening",
    "description": "Update docs/runbooks and align validation pipelines with new startup contract.",
    "details": "Rewrite onboarding and deployment docs, update test harnesses and CI pipelines, and add optional secrets overlays.",
    "status": "pending",
    "priority": "medium",
    "dependencies": ["2"],
    "subtasks": [
      {
        "id": "3.1",
        "title": "Rewrite onboarding and operations docs",
        "description": "Update README, UI README, API key operations, deployment guides.",
        "details": "Replace manual secret-sync narrative with installer-first flow and stateless root-key model.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["2.4"],
        "testStrategy": "Documentation references installer workflow and no longer recommends default passwords."
      },
      {
        "id": "3.2",
        "title": "Update container/security tests",
        "description": "Supply required secrets in tests and align auth expectations.",
        "details": "Patch container-testing scripts and security suite assumptions around bootstrap language.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["3.1"],
        "testStrategy": "Container tests and security suites pass with required vars set."
      },
      {
        "id": "3.3",
        "title": "Update CI workflow environment contracts",
        "description": "Set new required variables in compose validation and integration jobs.",
        "details": "Update ci.yml and ci-modernized.yml so pipelines stay green under stricter runtime contracts.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["3.2"],
        "testStrategy": "CI compose config checks and integration jobs pass in dry-run validation."
      },
      {
        "id": "3.4",
        "title": "Add optional secrets overlay files",
        "description": "Provide compose/swarm secrets overlays for hardened deployments.",
        "details": "Add docker-compose.secrets.yaml and docker-stack.swarm.yaml plus docs for _FILE patterns.",
        "status": "pending",
        "priority": "medium",
        "dependencies": ["3.1"],
        "testStrategy": "Overlay files parse via docker compose config and stack file syntax is valid."
      }
    ]
  },
  {
    "id": "4",
    "title": "PHASE 4: Release Verification and Migration Notes",
    "description": "Run end-to-end verification and publish migration guidance.",
    "details": "Validate startup, auth, and key lifecycle behavior and publish upgrade notes for existing users.",
    "status": "pending",
    "priority": "high",
    "dependencies": ["3"],
    "subtasks": [
      {
        "id": "4.1",
        "title": "Execute release verification matrix",
        "description": "Run compose, container, and security validation for redesigned startup path.",
        "details": "Verify first-run installer behavior, login flow, root key rotation semantics, and dynamic key operations.",
        "status": "pending",
        "priority": "high",
        "dependencies": ["3.3"],
        "testStrategy": "All defined verification points pass and issues are documented/fixed."
      },
      {
        "id": "4.2",
        "title": "Publish migration notes",
        "description": "Document upgrade path from manual .env setup to installer-driven setup.",
        "details": "Include compatibility expectations, changed required variables, and safe rollback guidance.",
        "status": "pending",
        "priority": "medium",
        "dependencies": ["4.1"],
        "testStrategy": "Migration notes are present in changelog/docs and reviewed for accuracy."
      }
    ]
  }
]