arah2/.planning/phases/07-hardening-private-launch/07-05-SUMMARY.md

phase, plan, subsystem, tags, requires, provides, affects, tech-stack, key-files, key-decisions, patterns-established, requirements-completed, duration, completed

phase	plan	subsystem	tags	requires	provides	affects	tech-stack	key-files	key-decisions	patterns-established	requirements-completed	duration	completed
07-hardening-private-launch	05	docs-security	initdata-hmac kv-ttl telegram-setmycommands known-limitations debt-closure i18n	phase provides 02-bot-skeleton-initdata-security the initData HMAC validator (D-13/D-14), the KV session layer, the 3 INFO findings (IN-01/02/03) phase provides 03-mini-app-shell-geolocation the device-matrix A1/A3 assumption notes and the honesty protocol phase provides 06-turn-by-turn-guidance-live-driving the c3 cross-metro CPU measurement evidence (measure-route-cpu.mjs LADDER HISTORY)	the exact-900 s initData freshness boundary pinned by a named test vector (T-07-08) — a `>=` regression cannot ship the IN-01 cleanup — dead ParsedInitData export deleted, three read-helper Intent comments the IN-02 present-tense wrangler.jsonc namespace record (T-07-23) docs/KNOWN-LIMITATIONS.md — the driver+fork known-limitations document (D-08) the /help limitations pointer line in both locales (strings-module single copy, CS5-invisible) the /cari re-arm record (all scopes armed 2026-10-25) and the A1/A3 assumption closure	07-06 launch gate (checks the doc + /help accuracy) forks (audit onboarding) 07-04 budget record	added patterns Intent comments on non-obvious security catch blocks (malformed-vs-tampered precedence stated at the code site) Boundary-pin test vectors: the middle point of a comparator boundary gets its own named case Single-copy URL law: a doc pointer URL lives exactly once per locale, in the strings module	created modified docs/KNOWN-LIMITATIONS.md bot/src/security/initdata.ts bot/test/initdata.test.mjs bot/wrangler.jsonc bot/src/i18n/strings.ts .planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md	The /help pointer URL is the repo's ACTUAL remote (http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md), not the plan's default github.com/araharah/araharah — the origin is a Gitea instance serving HTTP only (TLS probe failed; HTTPS link would be dead); the URL resolves once the launch checklist's 'repo pushed' step lands main on the remote The battery paragraph states the METHOD and points at the launch-gate record instead of claiming a completed measurement — the battery run happens in 07-06 (wave 3), after this doc ships; the no-fake protocol outranks the plan's 'was MEASURED' phrasing	Boundary-pin vector naming: 'T4 freshness boundary: age 900 s → ok:true (the boundary is INCLUSIVE)' — the case name states the claim it pins Dated debt-closure sections appended to historical device-gate files — history never rewritten	PX-04	12min	2026-10-25

Phase 7 Plan 05: Debt Closure + Known Limitations Summary

The three Phase-2 INFO debts paid (dead export deleted, wrangler comment truthful, the 900 s freshness boundary pinned by a green vector), plus the shipped known-limitations document with a /help pointer line in both locales and the honest /cari re-arm + A1/A3 closure records.

Performance

• Duration: 12 min
• Started: 2026-10-24T20:43:27Z
• Completed: 2026-10-25T04:52:00Z (+08)
• Tasks: 3/3
• Files modified: 6

Accomplishments

• IN-03 (security pin, T-07-08): the exact-900 s initData freshness edge now has its own named vector — T4 freshness boundary: age 900 s → ok:true (the boundary is INCLUSIVE) — so a > → >= comparator regression turns red. The comparator itself is untouched (it was already correct; the test makes the claim a pin). Suite: 126/126.
• IN-01: the never-constructed ParsedInitData export is deleted (verified sole-repo hit was its own declaration); the three read-helper catch blocks now carry Intent: comments stating the malformed-vs-tampered precedence (D-14) and the chat-degrade law.
• IN-02 (T-07-23): bot/wrangler.jsonc line 2 states the post-fact truth — the chat_sessions namespace id below is live, no re-creation.
• D-08: docs/KNOWN-LIMITATIONS.md ships with all seven sections — OSM data gaps, the c3 cross-metro CPU degradation with its measurement evidence (2–8 ms short routes vs p95 38–93 ms cross-metro, Workers Paid rejected on the $0 mandate), the /cari menu defect with the type-the-command workaround (T-07-24), the beta-quality statement, the roadmap pointers (WASM-router / ALT / engine B — none in this release), the privacy paragraph, and the fork-facing audit commands.
• /help pointer line (en + ms): one line appended to each helpMenu, NOT /-prefixed so the CS5 command-menu parse ignores it (CS5 green — suite 126/126); URL identical in both locales, exactly one copy per locale (D-05 law).
• /cari re-arm (T-07-26): npm run bot:commands ran 2026-10-25 — all six scopes ok:true, literal line all command scopes armed recorded; residual Telegram client-caching risk stated.
• A1/A3 closure: A1 NOT RETIRED as a mechanism hypothesis (mitigated-by-design via web/src/location/chain.ts polling degradation); A3 RETIRED as a decision constraint (remote workers.dev origin). The Phase-3 FINAL VERDICT table untouched.

task Commits

Each task was committed atomically:

1. task 1: pay IN-01 and IN-02 (dead code + the stale wrangler comment) and pin IN-03 (the exact-900s boundary) - 84cb93d (fix)
2. task 2: the known-limitations document (D-08) + the /help pointer line (en + ms) - 78482ab (feat)
3. task 3: the /cari re-arm attempt + the A1/A3 assumption closure, recorded honestly - 6e0673f (docs)

Files Created/Modified

• docs/KNOWN-LIMITATIONS.md — NEW: the driver+fork limitations document (D-08), clinical-prose style per docs/CONFIGURATION.md
• bot/src/security/initdata.ts — dead ParsedInitData export deleted; three Intent: comments on the read-helper catch blocks
• bot/test/initdata.test.mjs — the exact-900 s boundary vector (IN-03)
• bot/wrangler.jsonc — the stale plan-scoped comment replaced with the present-tense live-id record (IN-02)
• bot/src/i18n/strings.ts — the Known limits: / Had panduan: pointer line in both helpMenu strings
• .planning/phases/03-mini-app-shell-geolocation/03-DEVICE-MATRIX.md — the dated ## 2026-10-25 — Phase 7 debt closure (/cari re-arm + A1/A3) section (force-added; .planning is gitignored)

Decisions Made

• Pointer URL = the actual repo remote. The plan's default github.com/araharah/araharah is not this repo; git remote -v gives http://gitmirah:3000/c-fu/arah2.git (a Gitea instance). HTTPS probe to the same host failed (no TLS), so the plan's "use the HTTPS remote" fallback resolves to the HTTP origin with the browser-view path (/src/branch/main/docs/KNOWN-LIMITATIONS.md, .git stripped) — verified valid Gitea path format; it 404s today only because the remote branch is behind local main, and the D-09 launch checklist's "repo pushed public" step resolves it before any driver sees /help.
• Battery wording honesty. The plan's §Beta-quality draft says battery "was MEASURED"; the measurement actually happens in the 07-06 launch-gate session (wave 3), after this doc ships. The shipped paragraph states the method (≥30 screen-on minutes, battery % read at start/end) and points at the launch-gate file as the record holder, with the run signed before the first driver is onboarded — the no-fake protocol (D-05/07's honesty law) outranks the plan's tense.
• budget-audit named before it exists. §How-to-run names npm run budget-audit per the plan; the script ships in plan 07-04 (wave 2, currently not yet executed). By launch time both audit commands exist; noted here so the launch gate verifies it.

Deviations from Plan

None — plan executed exactly as written (the two decisions above are the plan's own prescribed fallbacks: use the actual remote URL, record the choice; and the honesty-law tense adjustment is documented rather than a fabricated claim).

Issues Encountered

• The Gitea remote had no TLS endpoint (HTTPS probe returned connection failure) — resolved by using the HTTP origin, matching the URL form every existing doc (README.md, docs/DEVELOPMENT.md, docs/TESTING.md) already cites for git clone.
• The plan's device-matrix criterion grep -c "FINAL VERDICT" == 1 initially returned 2 because the new closure section referenced the historical table by that name — reworded to "historical verdict table" and the commit amended (6e0673f).

User Setup Required

None - no external service configuration required. (The /cari re-arm consumed the existing gitignored bot/.dev.vars token; no new secrets introduced.)

Next Phase Readiness

• The D-09 launch checklist's "known-limitations shipped · /help accurate" items are satisfiable now; plan 07-06's gate verifies the doc + pointer line.
• npm run budget-audit (named in the doc's fork-audit section) ships in plan 07-04 — the launch gate should confirm it exists before signing.
• The battery record (07-LAUNCH-GATE.md) lands in 07-06; the doc's battery paragraph points at it.

Self-Check: PASSED

• All 6 created/modified files exist on disk (verified 2026-10-24T20:47Z).
• All 3 task commits exist in git log (84cb93d, 78482ab, 6e0673f).
• Final verification: npm test -w bot → 126 passed, 0 failed; npm run bot:typecheck → clean.
• .planning/STATE.md and .planning/ROADMAP.md untouched by this plan's commits (orchestrator-owned).

---

Phase: 07-hardening-private-launch Completed: 2026-10-25