Phase 1a — Foundation & Accounts #1

New issue

Closed

opened 2026-10-08 04:33:21 +00:00 by agent-pi · 2 comments

agent-pi commented

2026-10-08 04:33:21 +00:00

Collaborator

Xique has no code yet — only an initial commit, README, and LICENSE.

Before any user-facing feature (Jellyfin sync, Trakt import, recommendations, browse UI) can be built, the project needs its foundation: a Python package scaffold, configuration, a persistent store with schema migrations, and a way for people to have accounts and sign in. Xique is multi-user, with each user connecting their own Jellyfin server, so the account system is not optional — it is the substrate every later feature hangs off.

This issue covers that foundation and the invite-only account system: first-run admin setup, login/logout, invite links, server-side sessions, CSRF protection, and a worker process skeleton with a job table (the coordination mechanism later sync/import work will use).

Design spec: .superpowers/specs/2026-10-08-xique-design.md (local working artifact, not committed per AGENTS.md).

Xique has no code yet — only an initial commit, README, and LICENSE. Before any user-facing feature (Jellyfin sync, Trakt import, recommendations, browse UI) can be built, the project needs its foundation: a Python package scaffold, configuration, a persistent store with schema migrations, and a way for people to have accounts and sign in. Xique is multi-user, with each user connecting their own Jellyfin server, so the account system is not optional — it is the substrate every later feature hangs off. This issue covers that foundation and the invite-only account system: first-run admin setup, login/logout, invite links, server-side sessions, CSRF protection, and a worker process skeleton with a job table (the coordination mechanism later sync/import work will use). Design spec: .superpowers/specs/2026-10-08-xique-design.md (local working artifact, not committed per AGENTS.md).

agent-pi added this to the (deleted) milestone

2026-10-08 04:33:21 +00:00

agent-pi commented

2026-10-08 04:33:33 +00:00

Author

Collaborator

Plan of attack

Full plan: .superpowers/plans/2026-10-08-xique-01-foundation.md (local working artifact; not committed per AGENTS.md).

Approach. FastAPI app factory with per-request aiosqlite connections; Jinja2 server-rendered templates; zero JavaScript. A separate worker process owns schema migrations and claims jobs from a jobs table in the same SQLite DB. Sessions are server-side (opaque token hashed at rest). Python 3.14; every compiled dependency has a 3.14 wheel.

Key files. pyproject.toml, ruff.toml, src/xique/config.py, src/xique/db/{__init__,schema,users,jobs}.py, src/xique/services/auth.py, src/xique/web/{app,deps,server}.py + routes/templates, src/xique/worker.py, tests alongside.

Sequence (7 tasks, each TDD with its own commit):

Project scaffold, tooling, settings
DB connection and migration mechanism
Auth primitives (argon2, session tokens, CSRF)
Users/sessions/invites data access
App factory, per-request DB, auth dependencies
Auth routes — setup, login, logout, invite
Worker skeleton and job queue

Branch: feat/issue-1-phase-1a-foundation

Commits:

:sparkles: feat: project scaffold, tooling, and settings
:sparkles: feat: sqlite connection and migration mechanism
:sparkles: feat: password, session-token, and CSRF primitives
:sparkles: feat: users, sessions, and invites data access
:sparkles: feat: FastAPI app factory, per-request DB, and auth dependencies
:sparkles: feat: setup, login, logout, and invite routes
:sparkles: feat: worker skeleton and job queue

PR (opened once work is complete):

curl -X POST -H "Authorization: token $FORGE_AGENT_PI_TOKEN" -H "Content-Type: application/json" \
  -d '{"title":"Phase 1a: foundation and accounts","body":"Closes #1","head":"feat/issue-1-phase-1a-foundation","base":"main"}' \
  "https://forge.marvin8.zone/api/v1/repos/marvin8/xique/pulls"

## Plan of attack Full plan: `.superpowers/plans/2026-10-08-xique-01-foundation.md` (local working artifact; not committed per AGENTS.md). **Approach.** FastAPI app factory with per-request aiosqlite connections; Jinja2 server-rendered templates; zero JavaScript. A separate worker process owns schema migrations and claims jobs from a `jobs` table in the same SQLite DB. Sessions are server-side (opaque token hashed at rest). Python 3.14; every compiled dependency has a 3.14 wheel. **Key files.** `pyproject.toml`, `ruff.toml`, `src/xique/config.py`, `src/xique/db/{__init__,schema,users,jobs}.py`, `src/xique/services/auth.py`, `src/xique/web/{app,deps,server}.py` + routes/templates, `src/xique/worker.py`, tests alongside. **Sequence (7 tasks, each TDD with its own commit):** 1. Project scaffold, tooling, settings 2. DB connection and migration mechanism 3. Auth primitives (argon2, session tokens, CSRF) 4. Users/sessions/invites data access 5. App factory, per-request DB, auth dependencies 6. Auth routes — setup, login, logout, invite 7. Worker skeleton and job queue **Branch:** `feat/issue-1-phase-1a-foundation` **Commits:** - `:sparkles: feat: project scaffold, tooling, and settings` - `:sparkles: feat: sqlite connection and migration mechanism` - `:sparkles: feat: password, session-token, and CSRF primitives` - `:sparkles: feat: users, sessions, and invites data access` - `:sparkles: feat: FastAPI app factory, per-request DB, and auth dependencies` - `:sparkles: feat: setup, login, logout, and invite routes` - `:sparkles: feat: worker skeleton and job queue` **PR (opened once work is complete):** ```bash curl -X POST -H "Authorization: token $FORGE_AGENT_PI_TOKEN" -H "Content-Type: application/json" \ -d '{"title":"Phase 1a: foundation and accounts","body":"Closes #1","head":"feat/issue-1-phase-1a-foundation","base":"main"}' \ "https://forge.marvin8.zone/api/v1/repos/marvin8/xique/pulls" ```

agent-pi referenced this issue from a pull request that will close it,

2026-10-08 06:09:56 +00:00

Phase 1a: foundation and accounts #2

agent-pi commented

2026-10-08 07:16:54 +00:00

Author

Collaborator

Merged in PR #2 (merge commit 0788c8b). Phase 1a delivered: scaffold/settings, SQLite+migrations, auth primitives, users/sessions/invites access, app factory+deps, auth routes (setup/login/logout/invite), worker+jobs. CI green (pr-review, gitleaks, checks).

Merged in PR #2 (merge commit 0788c8b). Phase 1a delivered: scaffold/settings, SQLite+migrations, auth primitives, users/sessions/invites access, app factory+deps, auth routes (setup/login/logout/invite), worker+jobs. CI green (pr-review, gitleaks, checks).

agent-pi closed this issue

2026-10-08 07:16:54 +00:00

agent-pi modified the milestone from (deleted) to Phase 1 — Core

2026-10-08 07:30:19 +00:00