Phase 6 — Web UI: Astro + islands (Kanban drag-drop, table), deep links

**PHASE 6 COMPLETE — live at https://project.lasitava.com** - P6.4 deployed (b1db238): regional ACM cert + API GW custom domain + A/AAAA aliases (NoskanaWeb precedent, no CloudFront) - Verified: board/detail/island-JS 200 on the domain; POST /mcp 403 unauthed (authorizer intact); execute-api URL still live for agents - All 4 subtasks effectively done (checkbox flip blocked on BUILD-24) - Phase 6 total: SSR shell, deep links, sign-in, drag-drop Kanban, table filters, custom domain — plus 3 deploy-verify SEV catches hardened into CI invariants

**P6.4 — done, pushed** - sha `a0e6eb4` on `feat/p6.4-domain`, pushed to origin - Gates: full `npx jest projects-stack` 64/64 green standalone (~9min, no ENOENT flake); `pnpm run typecheck` clean; one `cdk synth LasitavaProjectsStack --quiet` clean — confirmed template has 1 Certificate, 1 DomainName, 1 ApiMapping, 2 RecordSet (A+AAAA), 0 CloudFront - cdk.out + bundling temp dirs cleaned - NOT deployed (controller deploys) — cert DNS validation will pend at deploy, expected - No merge/PR opened per instructions

**P6.4 — red then green** - Wrote 6 RED tests (ACM cert, ApiGatewayV2::DomainName, ApiMapping, R53 A/AAAA, execute-api still enabled, no CloudFront) — 4 failed as expected, implementation absent - Implemented in `infra/stacks/projects-stack.ts`: `HostedZone.fromHostedZoneAttributes` (Z02834603N4GCBU7KG115) + regional DNS-validated ACM cert + `apigwv2.DomainName`/`ApiMapping` mapped onto the SAME `httpApi` + R53 A/AAAA alias — mirrors NoskanaWeb precedent exactly - All 6 P6.4 tests GREEN standalone - Now running full `projects-stack` suite + typecheck + synth gates

**P6.4 — started** - Branch `feat/p6.4-domain` off `main`@fade5d7 - Grepped LasitavaAdmin + NoskanaWeb for domain precedent - Found: NoskanaWeb `lasitava-web-stack.ts` (noskana.lasitava.com) — API GW v2 custom domain + regional ACM (DNS-validated) + R53 A/AAAA alias, no CloudFront on the API domain. Matches goal exactly (SSR-on-HTTP-API, no CDN needed for /app+/mcp+JSON). - Plan: mirror that shape in `infra/stacks/projects-stack.ts` for `project.lasitava.com`, RED tests first.

**P6.3 SHIPPED + LIVE-VERIFIED** (subtask 3 of 4 done — done-toggle blocked on BUILD-24) - Kanban drag-drop + table sort/filter interactive in prod - Security: mutations authed (403 anon), WEB_API_KEY server-side only - 3 deploy-verify catches en route: BUILD-17 bundle, BUILD-25 stale dist-lambda, BUILD-26 static 404 - Next: P6.4 — project.lasitava.com domain (CloudFront/ACM/Route53, pre-approved)

**P6.3 merged + first deploy caught stale-frontend footgun** - Merged: 2da2eab islands + 0b46a31 auth fix (main, ff) - Deploy verify: routes 200, anon mutation 403 (auth fix LIVE) — but ZERO client JS: Code.fromAsset shipped the morning dist-lambda (no build in synth) - Filed the footgun as its own bug; rebuilding fresh + redeploying now - Next verify: astro-island/script tags present, then P6.4

**P6.3 recovery + gates running** - Build agent session died (auth error) AFTER completing the hard part: rebase onto main + security fix committed (0b46a31 on 2da2eab) - Auth fix: POST /app/{proxy+} now requires the unified CUSTOM authorizer; web gates were green pre-death (186 tests, 100% cov) - Now: central gates on the rebased tree (stack suite + web + synth) - Next: push -> ff-merge -> deploy -> live auth verify (401 anon / authed transition)

Backfilled phase subtasks P6.1-P6.4 (JC directive: distinct work units = subtasks, visible individually, not buried in comments). NOTE: subtask done-state stuck false — API gap, see new bug item; status temporarily in subtask titles.

P6.3 code-complete: feat/p6.3-islands @ 6d6b3e9. Kanban drag-drop (pointer-driven, locked motion classes, optimistic move + revert toast; WEB_API_KEY stays server-side via new same-origin /app/api transition endpoint + POST /app/{proxy+} infra route) + table client sort/5-facet filter. Web gates green: 180/180 tests, 100% coverage all dims, tsc clean, astro check 0/0, SSR-bundle invariant OK. Now: central infra gates (full jest + synth) -> merge -> deploy -> live verify.

P6.2 SHIPPED + LIVE (2026-08-23): feat/p6-routes (51ba8e9 deep-link routes /p/{k} board + /table + /items/{itemKey} + /signin, SSR live data via typed client + Cognito scaffold; 1382f2d pnpm shared-store pilot) ff-merged to main, deployed LasitavaProjectsStack, all routes 200 with live board data (one SEV en route, see BUILD-17). Remaining: P6.3 islands (agent p6-3-islands in flight, branch feat/p6.3-islands — Kanban drag-drop + table sort/filter, Preact+signals, dark power-tool) then P6.4 final deploy + optional domain.

P6.1 SHIPPED + live: real Astro SSR-on-Lambda (Plan B: @astrojs/node middleware + hand-rolled shim, no Docker) at GET /app, dark power-tool styled, deep-linkable foundation. web/ workspace isolates Astro from root gates; vitest + astro-check wired into the pipeline. Hit + fixed a runtime 500 (standalone-mode hang) via deploy-verify. Next: 6.2 routes + typed-client data + Cognito sign-in.

START Task 6.1: scaffold Astro web app, SSR-on-Lambda, no Docker. Verifying @astro-aws/adapter vs current Astro before scaffolding.