New plan file closing out the Fase 4 deferrals with specifics confirmed
by user on 2026-04-14:
- 6.1 PWA injectManifest, MINIMAL scope (precache shell only; Supabase
GETs stay network-only since $lib/sync + SyncBanner already cover
offline writes + the offline indicator)
- 6.2 manifest.webmanifest + neutral placeholder icons (192/512/180 +
maskable 512) + iOS meta tags
- 6.3 Kong rate-limiting — 10/min + 60/hour on /auth/v1/token per IP,
30/min on /auth/v1/authorize per IP, 20/hour on invitations POST
per authenticated user
- 6.4 JWT rotation — dev rotate now + .env.production.example template
+ infra/scripts/rotate-jwt.sh
- 6.5 Lighthouse PWA ≥ 90 + scripted rls-audit.sh (curl edition of
Vitest's rls-audit.test.ts)
- 6.Z verification
Explicitly out of scope (recorded at bottom of the plan):
- Push notifications (no current use case)
- Ephemeral-Docker CI (deferred)
- Runtime caching of Supabase in the SW (deferred)
- Final production icon art (placeholders land now; real art before
public launch)
README phase table + index updated; plan total now 11–16 weeks.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
