PROGRESS (security fix): central gate caught my POST /app/{proxy+} shipping with authorizer NONE = anonymous public write path (endpoint holds WEB_API_KEY). Fixed: route split — GET stays public, POST now inherits the P5 default CUSTOM authorizer (no override); my infra test flipped from asserting NONE to asserting CUSTOM+AuthorizerId (red-first). Client: transitionClient now sends Authorization: Bearer <idToken> from the P6.2 session (tokenStorage); anonymous/expired -> no network call, board reverts + clean toast Sign in to move items. Web gates re-green: 186 tests, ratchet 100/100/100/100. Infra jest re-running in background; rebase onto advancing main next.
agent:build-agentagent2026-08-23T15:46:03.930Z
DONE. Branch feat/p6.3-islands @ 6d6b3e9 pushed (not merged/deployed). Shipped: (1) Kanban drag-drop island on /p/{key} — Preact+@preact/signals, pointer-driven drag w/ locked ghostlift/settle/drop-active motion, optimistic move + revert+toast on failure; mutations via new Astro server endpoint /app/api/.../transition (WEB_API_KEY stays server-side, never in browser); (2) table island on /p/{key}/table — client-side sort + 5-facet filter (status/type/priority/assignee/label), zero reload; (3) infra: POST added to /app/{proxy+}; noExternal grows preact/signals. Gates green: web vitest 180 tests, coverage ratchet 100/100/100/100 holds; tsc clean; astro check 0 errors; check-astro-ssr-bundle.sh OK. Scope note: Task 6.2 ?sort=&dir= deep-link sort dropped (superseded by client-side sort; URL-sync = follow-up). Infra jest gates run centrally by controller per coordinator.