From 4cf7cb2d1821bfa766f4919fd77e0e8327517e5f Mon Sep 17 00:00:00 2001 From: Tyler Gillispie Date: Mon, 24 Aug 2026 12:27:46 -0700 Subject: [PATCH] docs(tasks): add Phase 4 Prompt 4.1 for Traefik Tier 1 Global Ingress Discovery --- tasks/JULES_PROMPTS.md | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/tasks/JULES_PROMPTS.md b/tasks/JULES_PROMPTS.md index 71c8051..37a70b3 100644 --- a/tasks/JULES_PROMPTS.md +++ b/tasks/JULES_PROMPTS.md @@ -17,8 +17,9 @@ and | **Prompt 2.2** | Ghost Cockpit Protocol & WebSocket Freeze/Re-Auth | ✅ **COMPLETE** | `docs/GHOST_COCKPIT_SPEC.md`, `sdk/hono.ts` | | **Prompt 2.1** | RFC 9421 HTTP Signatures & `Signature-Key` (`hwk`) | ✅ **COMPLETE** | `server/http_signatures.ts`, `server/main.ts` | | **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` | -| **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` | -| **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` | +| **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` | +| **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` | +| **Prompt 4.1** | Traefik Tier 1 Global Ingress Hardening & Discovery | ⏳ **PENDING (Next Milestone)** | `infra/`, Host Traefik Config | --- @@ -168,3 +169,27 @@ _Completed task: 3. Map out the `Target Files`, prerequisites/dependencies, and explicitly identify potential architectural risks, regressions, or friction. 4. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`. ``` + +--- + +## Phase 4 Prompts + +### Prompt 4.1: Traefik Tier 1 Global Ingress Hardening & Infrastructure Discovery + +```text +**Role:** Act as a System Analyst and Solutions Architect. Do not execute code or modify the codebase during this session. Your sole deliverable is to generate a task file in tasks/new/. + +**The Objective:** Perform infrastructure discovery and architectural specification for Tier 1 Global Edge Ingress Protection on the Traefik proxy, ensuring all untagged/pre-release containers across *.atyg.org default to ForwardAuth interception with proper public-bypass exemptions. + +**Scope & Exploration Targets:** +* Traefik host configuration discovery (dynamic/static file location on Synology host, entrypoint definition, middleware chaining). +* Configuring `authyes-forwardauth` on `entryPoints.websecure.http.middlewares` as the default global fallback. +* Bypass rules & path exemptions for public static assets (`/public/*`, `/.well-known/webauthn`, `/health`). +* End-to-end verification of zero-touch default-deny for untagged / unauthenticated containers across the network. + +**Your Task:** +1. Research the Traefik infrastructure conventions in `COMPOSE_CONVENTIONS.md`, `ONBOARDING.md`, and `server/main.ts`. +2. Map out the `Target Files`, host configuration requirements, prerequisites, and potential architectural risks (e.g. infinite redirect loops on auth-api itself). +3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions and structure defined in `tasks/GUIDELINES.md`. +``` +