STATE.md

Idea Map Project State

Last updated: 2026-08-10, Europe/Berlin.

Executive state

The develop runtime targets local schema 7 and now contains the non-live V2.1 T1/T2 foundation, the automated T3 creator/organization claim slice, and the technical T4 privacy, moderation, retention, and recovery slice. T2 browser acceptance remains complete. T3 adds bounded source-control proof, conflicts, revocation, double-opt-in claim transfer, organization control, operator commands, and private claim management. Commit 3c55ee8 adds account appeals, hold-safe deletion, complete trust-record retention, public/private legal-text alignment, and SHA-bound atomic post-snapshot rights replay. Controlled proof on a real test domain, qualified legal review, deployment authorization, deployment, and public verification remain open. None of schema 3–7, the legal/report UI, or any V2.1 behavior has been deployed.

Commit 8d6106e prepares the separate Project Signal Loop comprehension gate: Orbit is locked as the consistent first treatment, session mode stores no responses, the five-session protocol and privacy-minimal scorecard are ready, and desktop/mobile captures were visually inspected. Human evidence remains 0/5. On 2026-08-10 the product owner explicitly retired those independent sessions as a prerequisite for a functional alpha and selected the founder-first ladder in docs/17-founder-first-acceptance.md: first make the owned-project and approximately 400-record corpus loop useful to him. The unchanged 0/5 protocol remains optional later research and is not represented as user validation.

The current 2026-08-10 local implementation prepares the first founder gate on both develop and the isolated release/schema3-v1 worktree. Public/legal and production-example contact is standardized on business@moinsen.dev. The exact Idea Map well-known path now fails closed as a non-cacheable text/plain 404 unless an operator installs one valid project/organization token into a mode-0600, maximum-24-hour container file. The route is bound to the configured public host, has no HTTP write path or SQLite state, and the terminal lifecycle never prints the token. Both branches now also implement a conservative structured unlawful-content notice with an immediate reference; public ideas carry machine-readable AI provenance. develop additionally has the non-publishing F3 corpus review. Its command-line audit stops at repository/project boundaries, reads bounded root README plus explicit idea-map.json metadata, follows no symlinks, detects canonical duplicates, and performs no network, AI, write, account, or publication action. An active local account now exposes a browser-only Folder → public proposal review that keeps the private folder name separate from editable public fields, selects nothing by default, requires explicit per-project approval, and exports only a local non-publishing manifest. A real read-only run against /Users/udi/work/moinsen/ideas found 257 workspaces and 195 non-empty public title/summary suggestions without truncation; all 257 still need explicit source metadata, zero were approved, and zero were published. Nothing has been deployed or publicly exercised. The matching schema-3 worktree was rebuilt as local image idea-map-schema3:20260810-founder-rc03 at digest sha256:465afbd9ebd86516becfde20375082e5293a78d4677d0b714de2c4b29bab691f and passed a fresh disposable schema-2 backup, 2→3 migration, restart, claim-response, and schema-2 rollback rehearsal.

The selected 2026-08-10 founder UI direction is now implemented locally as the full-screen Portfolio Command Center. The header exposes an explicit Profil control with the current member name, the profile dialog contains only identity and account state, and folder review plus project/organization trust live in separate full-screen workspaces. Portfolio review now supports a dense three-pane desktop layout, browser-local scan, search, status views, sorting, 25-item pagination, per-project editing, private evidence inspection, and local-only approval/export. Bulk publication remains impossible. Desktop and mobile browser evidence, the source/implementation comparison, and the QA log are recorded in design-qa.md; its final result is passed. The browser fixture contains only two projects, so visual acceptance with a real 200+ project page remains a human founder gate. This change is not deployed or publicly verified.

The public globe now has a local client-only inertia-v1 interaction model. Drag distance is converted relative to the apparent sphere diameter, a flick continues with bounded angular velocity and exponential damping, latitude is limited with a soft polar reflection, and the quiet idle rotation resumes after the existing 4.5-second interaction pause. Reduced-motion mode keeps direct dragging available but disables inertia and automatic rotation. No server, database, analytics, identity, or privacy field changed. This behavior is not deployed or publicly verified.

Commit b0dc5fa closes the independently runnable local T5 technical checks. The real qwen2.5:3b corpus matched 20/20, a full authenticated local-model publication produced one schema-7 idea/revision without private/raw-source leakage, and a production-shaped schema-3→7 backup/restore/rights rehearsal passed on the host and inside local image idea-map-v21:20260809-local-rc02 at digest sha256:25fd39d8f024857e2a38a3843307a13030210d4ce02a62fded8a8ac4745cd43f. The image is local only. Controlled real-domain proof, qualified legal review, deployment authorization, deployment, and public verification remain open.

A separate release/schema3-v1 branch isolates the V1/schema-3 release from the V2.1 runtime. Its app candidate is 703ba8d, its tagged evidence update is 87b9d4a, its off-host backup update is 862dc4e, and its current legal-gate head is 72bbf74. The annotated tag remains schema3-release-candidate-20260808. The locally pinned app image is idea-map-schema3:20260808-rc03 with digest sha256:fc084d0a50a97caf6af2176ea8c17933e2e955c511e555950af433fa9be6398e. That image has passed a disposable schema-2 backup, schema-2-to-3 migration, content-preservation, restart/HTTP, and schema-2 rollback drill.

Production remains unchanged. A fresh read-only public check on 2026-08-08 found healthy database and local Ollama status, one published idea, and the expected 302 Cloudflare Access challenge on /api/account/me. The legal URLs return the generic HTTP 200 SPA shell, but the served index-DqNq8vlo.js bundle lacks the Impressum, Datenschutzerklärung, Nutzungsbedingungen, and Report or correct markers. The last verified database version remains schema 2.

On 2026-08-09 the operator completed the Tailscale SSH additional check. A fresh read-only origin inspection confirmed the expected production host and /opt/idea-map, three running services, healthy app and Ollama containers, loopback-only app publication, schema 2 with integrity_check=ok, one submission/idea/revision, initially zero actors, and no idea_reports table. The daily backup timer is enabled and active. On 2026-08-09 a fresh fifth on-host schema-2 snapshot, idea-map-20260809T093242Z.sqlite, was created without changing application code, schema, or public content. Its manifest has integrity ok, SHA-256 b9273da68c8b47abb224ef45a9095df5de810ab52ce58116ad886e9e67545f9d, matching counts, and mode 0600 for snapshot and manifest.

The FileVault-protected operator Mac is now the selected zero-new-spend off-host destination. The fresh snapshot was pulled over Tailscale SSH, opened read/write in isolation, and independently verified for SHA-256, manifest counts, schema 2, integrity_check=ok, one idea, and one immutable revision. LaunchAgent dev.moinsen.idea-map-offhost-backup runs hourly catch-up pulls, last exited 0, retains only strictly named Idea Map snapshots for 35 days, and leaves unrelated files outside its pruning set. This is unattended while the Mac is online, not a 24/7 copy while it is powered off.

The Cloudflare API confirms one self-hosted Access application scoped exactly to ideamap.moinsen.dev/api/account/*, a 24-hour session, one allowed onetimepin identity provider, and one precedence-1 allow policy for verified users. On a third, operator-timed attempt with the required browser window active, the real Email OTP flow and protected GET /api/account/me request reached the origin. The expected minimal private actor and authentication identity were created. A read-only post-login probe confirmed schema 2, integrity_check=ok, one unchanged idea/revision, one actor, and one identity. The sanitized Access authentication API had not yet ingested the event when it was queried immediately afterward; the origin write is the successful end-to-end proof.

Git and release boundary

• develop: founder-first baseline 2e8fb39, followed by the current F3 private-folder/public-proposal review slice at branch head; schema-7 T1 through technical T4 runtime code ends at 3c55ee8, followed by the isolated moderated-test harness and local T5 release-rehearsal tooling.
• T2 account return/browser acceptance: a9569ca and 78892e6.
• T3 claim lifecycle/UI commits: b9561c5 through dcea776.
• release/schema3-v1: schema-3 V1 release line and recovery evidence through 72bbf74, plus the locally code-frozen RC03 contact, responder, AI-marker, and notice candidate in its separate worktree; this remains the only line eligible for the first production release. Its current local rehearsal is green, but LEGAL_REVIEW_OPEN remains a separate release gate and any review-driven executable changes must be re-tested before deployment.
• Local baseline: 19092e0, tagged baseline-schema7-t2-20260808.
• No Git remote is configured. Nothing was pushed and no container image was published to a registry.
• No production code, schema, Cloudflare configuration, or public content was changed by the 2026-08-10 preparation. The earlier successful OTP proof created the expected minimal private actor and authentication identity in production.

Fresh local verification

develop / schema 7

• npm run check: both TypeScript projects, 24 Vitest files, 134/134 tests, and both builds passed. The existing Vite map-bundle size warning remains non-blocking.
• npm run test:e2e: 42 passed across desktop/mobile with two intentional viewport-specific skips.
• The globe physics has five focused deterministic unit cases for drag scale, bounded velocity, damping, polar reflection, and long-frame clamping. Its real-pointer flick case passed 6/6 repeated focused runs and the full desktop/ mobile suite. Headed Playwright at 1586×992 and 390×844 confirmed direct drag, capped release momentum (95 deg/s), continued movement after release, damping to about 56.5 deg/s after 220 ms, intact layouts, zero horizontal mobile overflow, and zero application console errors. Reduced-motion tests confirm direct manipulation without inertial or idle after-motion. MapLibre's existing WebGL readback performance warning remains non-blocking. The Browser plugin had no connected browser instance, so the repository-authorized Playwright fallback supplied this browser evidence.
• The final Portfolio Command Center browser pass used the exact selected 1487×1058 visual target and a fresh 1487×1058 implementation capture. Focused header and workspace comparisons found no remaining actionable P0/P1/P2 mismatch. At 390×844, measured document and workspace widths are all 390 px with no horizontal overflow. Fresh Portfolio navigation, account activation, folder scan, proposal selection, public/private field inspection, and responsive resizing were exercised in the headed browser. The fresh console had zero application errors; MapLibre emitted only its existing WebGL readback performance warnings while the public globe was mounted.
• design-qa.md records the closed comparison iterations: the initial 781 px mobile overflow, ambiguous project-row semantics, and the legacy CSS-drawn mobile brand mark. The final UI uses the installed Lucide icon family and a matching favicon. The only remaining fidelity gaps are the intentional two-project fixture density and the lack of an avatar field pending an explicit privacy decision.
• The F3 corpus review passed eight focused unit cases covering complete public metadata, incomplete/private drafts, project-boundary discovery, ignored nested support READMEs, grouping folders, canonical duplicate grouping, query/fragment removal from proposed links, explicit local approval, and secret-free summaries. The selected real root contains 257 detected workspaces, not 400 verified records: 195 have non-empty title/summary suggestions, 257 need source metadata, zero are selected, and the scan did not hit its 1,000-workspace limit.
• The authenticated folder-review E2E passed 2/2 at desktop/mobile widths. It proves private folder/public title separation, nested documentation refusal, local approval, private-draft blocking, and manifest export without a publication request. The Browser plugin again exposed no connected instance; after its required connection troubleshooting reported an empty browser list, the repository-authorized Playwright fallback visually inspected output/f3-corpus-review-{desktop,mobile}.png. Both layouts had no horizontal overflow or console errors, and no fixture token appeared in the proposal.
• The unlawful-content notice path passed backend validation/storage and desktop/mobile browser submission cases. Manual Playwright inspection at 1586×992 and 390×844 found one mobile heading hidden after auto-scroll; the final CSS and screenshot pass verify that it remains visible.
• A new formal agentic-testing capture did not start because that skill's project guard rejects the repository's npm symlinks under node_modules. No report was fabricated. A read-only Playwright fallback visually checked /impressum at 1586×992 and 390×844 and confirmed the exact no-token well-known response as 404 text/plain with no-store; the only console error was that intentional negative-request 404.
• The protected session redirect now returns to the app and opens the private Your Idea Map account dialog. It removes the transient query marker instead of rendering a raw API response. Its focused desktop/mobile Playwright test passed 2/2.
• The Browser plugin exposed no connected browser instance, so the repository-authorized Playwright fallback captured and visually verified the pending account panel at 1586×992 and 390×844. Desktop emitted only headless WebGL ReadPixels performance warnings; no application console error was observed.
• Agentic audit docs/agentic-testing/20260808T143411Z-rc01 confirmed one major accessibility defect: modal keyboard focus could escape to background controls.
• The shared focus trap, Escape handling, and trigger-focus restoration were implemented and regression-tested for both account and idea dialogs.
• Focused retest docs/agentic-testing/20260808T145636Z-rc02 reported no findings. Both audit runs passed their project guards.
• The desktop and mobile account activation captures are stored under output/t2-account-activation-desktop.png and output/t2-account-activation-mobile.png; fixture identity is now removed before capture.
• T3 creator-claim management, one-time proof handling, and public/private trust separation passed API and desktop/mobile browser cases. Sanitized captures are output/t3-claim-controls-desktop.png and output/t3-claim-controls-mobile.png. The new response-side well-known route passed exact-host, MIME, no-cache, invalid-token, permission, expiry, and install/remove tests. Controlled proof against the real public domain still requires the responder code to be deployed and one real challenge to be issued and consumed.
• T4 account restriction/appeal and updated privacy pages passed desktop/mobile browser cases. The four sanitized captures under output/t4-* were visually inspected; no email or raw proof token is present.
• The locked Orbit session harness passed 2/2 focused and full-suite desktop/mobile browser cases. Number/arrow switching is disabled, replay preserves the treatment URL, no responses are stored, and the stable captures output/project-signal-loop-session-{desktop,mobile}.png were visually inspected. The moderated result is still 0/5, not a product-validation pass.
• Schema-7 backup/restore tests populate all trust tables, verify the manifest SHA-256 and snapshot-start boundary, replay 11 newer rights actions in one transaction, preserve public revisions, pass integrity_check, and produce zero mutations on the second replay. A mismatched snapshot and a partially invalid journal fail closed and roll back atomically.
• Retention preview rolls back without mutation. Applied retention expires transfers/evidence, removes every terminal trust class, purges a held actor tombstone after hold release/expiry, and removes unreferenced organizations without deleting published ideas or revisions.
• Normal, macOS, and production Compose expansion passed with process-local syntax-only values. No env file or production secret was changed.
• Real local Ollama qwen2.5:3b passed the complete corpus with 20/20 expected decisions and no timeout, malformed output, or schema error.
• The authenticated real-model publication smoke passed from the host and the compiled candidate image: one live idea/revision, schema 7, model/prompt/ extractor/fingerprint provenance, zero demo records, no raw source body in SQLite, and no private identity in the public payload.
• The production-shaped rehearsal migrated a schema-3 copy with an idea, revision, report, identity, tester intent, and legacy verified claim through schema 7. All checksums, foreign keys, content, report history, and integrity passed; no verification was invented. Its mode-0600 backup matched the manifest SHA-256, and restored rights replay applied 3/3 then 0/3 while retaining the archived idea/revision and deleting the private identity.
• Local image idea-map-v21:20260809-local-rc02 passed the compiled AI corpus, publication, and recovery commands plus a production-configured tmpfs smoke: health 200 with real Ollama, schema 7, seven checksum rows, no ideas/demo data, public ideas 200, and unauthenticated account session 401. It was not pushed or deployed. Full evidence is in docs/16-v21-local-release-candidate.md.
• The Mac off-host puller passed two focused regression cases: it verifies a fresh manifest/hash/database including idea revisions, recovers an abandoned lock, prunes only an expired strictly named snapshot, preserves an unrelated file, and fails closed before installation on a bad hash.

release/schema3-v1 / schema 3

• The 2026-08-10 RC03 candidate passed npm run check: 13 Vitest files, 79/79 tests, TypeScript, client build, and server build passed.
• npm run test:e2e: 26 passed across desktop/mobile with two intentional viewport-specific skips, including dialog focus containment/restoration and the rendered business@moinsen.dev legal contact.
• All normal, macOS, and production Compose files expanded with process-local syntax-only values including the exact HTTPS PUBLIC_ORIGIN.
• Local-only image idea-map-schema3:20260810-founder-rc03 at digest sha256:465afbd9ebd86516becfde20375082e5293a78d4677d0b714de2c4b29bab691f passed the responder cycle inside the container: absent 404, exact 65-byte token 200 with text/plain and no-store, wrong-host 404, removal, and restart. No raw token was printed or retained.
• Normal, macOS, and production Compose expansion passed with process-local syntax-only values.
• The current image backed up a schema-2 fixture with one published idea/revision, produced mode-0600 snapshot and manifest with matching SHA-256, passed integrity_check, and correctly recorded reports=null.
• The same image migrated the fixture to schema 3 without losing its idea/revision, created the report table, served the preserved public record, and kept it after container restart. The isolated health endpoint was database-ready but 503 degraded because private Ollama was unavailable to that container; this is not counted as production/model-health evidence.
• Restoring the checked snapshot returned to schema 2 with the idea/revision intact, no report table, integrity_check=ok, and a hash matching the manifest.
• Desktop/mobile RC03 captures are committed on the release branch. Detailed evidence is in that branch's docs/13-schema3-release-candidate.md.

Local versus live

Area	Current local state	Last verified public state
Database	schema 7 on develop; isolated schema-3 release branch	schema 2
Core map/feed, Explore, Stats	tested on both branches	deployed and healthy
Legal pages/footer	implemented and browser-tested with canonical business@moinsen.dev	old bundle; not deployed
Correction/removal reporting	general reporting plus a conservative structured unlawful-content notice and receipt reference implemented and browser-tested	not deployed
Retention/privacy CLI	schema-7 preview/apply retention, holds, moderation, and rights replay implemented and tested	not deployed
Backup/recovery	schema-2/3 container drill green; schema-7 manifest/replay drill green; Mac puller regression-tested	timer active; five on-host snapshots; fresh schema-2 copy independently verified on the FileVault Mac; hourly catch-up LaunchAgent exit 0
Access	origin JWT tests green; exact app/policy/OTP IdP verified	Tailscale and real Email OTP/protected-origin request green
V2 verified publishing	T2 locally complete through browser acceptance, including post-login account return	absent
V2 proof claims	automated T3 lifecycle/UI plus response-side well-known route implemented/tested; controlled real-domain proof remains open	absent; current path still serves the old HTML SPA shell
V2.1 technical candidate	pinned local rc02 passed real AI publication, schema-3→7 migration, backup/restore/replay, and production-configured container smoke	absent
V2 matching/distribution/promotion	isolated shaping/prototypes only; runtime absent	absent
Orbit/Signal Desk/Guided Match	isolated clickable prototypes only	absent
Project Signal Loop validation	optional Orbit research harness remains 0/5; founder-first acceptance now governs alpha sequencing	absent
Founder corpus review	command-line audit plus active-account browser review, editable public proposals, explicit local approval, and non-publishing export implemented; real root scanned as 257 workspaces / 195 suggestions / 0 approvals / 0 publications	absent

Approved product direction

docs/10-v2-product-contract.md remains the approved next generation: account-free browse/reporting, verified-member publication, project-control proof separate from email verification, explicit needs/offers, structured double opt-in, private contact until mutual acceptance, and clearly labelled contextual Moinsen promotion. Open messaging, comments, votes, behavioral tracking, third-party ads, payments, fundraising, and investment transactions remain outside scope.

The local V2.1 candidate does not implement the whole V2 contract. Automated claim proof and claim-control actions exist, but controlled real-domain proof is still open. Candidate V2.1 legal text and recovery mechanics exist locally; qualified review, deployment authorization, deployment, and public verification remain later gates. Matching, distribution, marketing, and house promotion are outside the V2.1 runtime boundary.

The Project Signal Loop shaping work and the three Orbit, Signal Desk, and Guided Match prototypes remain isolated under prototypes/project-signal-loop/. They are comprehension prototypes, not field validation or production runtime. Orbit is the current aesthetic favorite and remains the consistent first treatment if the optional moderated protocol is resumed, but it has passed 0/5 human sessions. Signal Desk and Guided Match remain diagnostics. The owner has selected founder utility, not a prototype preference vote, as the current alpha gate; matching and connections remain outside the V2.1 runtime.

Open production gates

1. Complete the legal/operator decisions in docs/14-schema3-legal-release-review.md, including the Article 13/14, DSA-classification, AI Act, provider-fact, and processor-record gates. Implementation tests do not certify legal compliance.
2. Keep the local technical freeze separate from legal approval. Apply any resulting text/data/workflow corrections additively, then rebuild and repeat relevant checks plus the full rehearsal if executable content changes.
3. Only then deploy the pinned schema-3 branch, migrate 2→3, verify public legal/report/Turnstile flows at desktop/mobile, prove restart persistence, and retain the tested schema-2 rollback snapshot.
4. Before any later V2.1 release, complete controlled real-domain proof, qualified review of the V2.1 privacy/terms/DSA/AI/retention candidate, apply any resulting changes and repeat the now-green local T5 evidence, then obtain explicit V2.1 deploy authorization.

Next exact action

In the local active-account folder review, select /Users/udi/work/moinsen/ideas, complete source, canonical link, responsible party, and relationship for a representative ten-project canary, approve only those ten, and inspect the exported local manifest. Then define and test a separate authenticated canary-ingestion contract before adding any database or bulk-publication path. Resend is the selected provider only when transactional product email is introduced; it has no SDK, key, recipient transfer, webhook, or runtime action today.

Separately, manually send to and reply from the canonical business@moinsen.dev mailbox; the ChatGPT Gmail connector is not part of the product or test path. Complete the remaining bounded decisions in docs/14-schema3-legal-release-review.md, especially controller capacity, processor records, Article 14 handling, DSA classification/outcome workflow, and qualified review. Only the code-frozen schema-3 branch may then be authorized for the first production release; do not deploy develop or schemas 4–7.

After the responder reaches the controlled host, issue one real local V2.1 claim for https://ideamap.moinsen.dev/, install the one-time value through the documented terminal-only flow, verify once, and remove it. Recruiting P01 is no longer a current dependency.