update docs

.project/project-plan.md

@@ -1,8 +1,8 @@
 # Cairnquire - Project Plan
 
-**Version:** 1.1\
-**Date:** 2026-04-29\
-**Status:** In Progress — Milestone 1 Complete, Milestone 2 Started
+**Version:** 1.2\
+**Date:** 2026-05-14\
+**Status:** In Progress — Milestones 1-3 Complete
 
 ## Vision
 
@@ -46,40 +46,50 @@ A minimal-dependency, ultra-fast documentation platform that publishes markdown
 - [x] Build reproducible (same input → same binary hash)
 
 **Notes:**
-- Mermaid and math blocks render as code blocks (no client-side JS rendering yet). Will be addressed in Milestone 5 with client-side hydration.
+- Mermaid diagrams and math blocks now render client-side after server-rendered markdown loads.
 - Dev mode uses `air` for Go live reload and Vite proxy for frontend HMR.
 
 ---
 
-### Milestone 2: Sync Protocol (Weeks 3-4) — IN PROGRESS
+### Milestone 2: Sync Protocol (Weeks 3-4) ✅ COMPLETE
 
 **Goal:** Bidirectional file sync between server and filesystem/web client
 
 - [x] Content-addressed storage (SHA-256 filesystem layout)
 - [x] WebSocket sync protocol implementation
-- [ ] File watcher for local filesystem sync
-- [ ] Client-side IndexedDB cache
-- [ ] Offline queue with conflict detection
+- [x] File watcher for local filesystem sync
+- [x] Client-side IndexedDB cache
+- [x] Offline queue with conflict detection
 
 **Acceptance Criteria:**
 
 - [x] File changes on disk automatically sync to server within 5 seconds
-- [ ] Web client can sync after reconnection, even with changes made offline
-- [ ] Concurrent edits to different files succeed without conflict
-- [ ] Concurrent edits to same file detected and queued for resolution
+- [x] Web client can sync after reconnection, even with changes made offline
+- [x] Concurrent edits to different files succeed without conflict
+- [x] Concurrent edits to same file detected and queued for resolution
 - [x] All synced content verified against SHA-256 hashes
-- [ ] Sync protocol documented with state machine diagrams
+- [x] Sync protocol documented with state machine diagrams
 
 **What's Done:**
 - Real-time file watcher using `fsnotify` — detects create/write/remove/rename events on `.md` files
 - Changes trigger immediate `SyncSourceDir()` and broadcast `document_version` events via WebSocket
 - Browser shows reload notification when current document or folder structure changes
 - Fallback polling every 30 seconds ensures nothing is missed
+- Go-served editor caches pages and pending edits in IndexedDB for offline reads and recovery
+- Offline saves queue locally and sync after reconnection with a visible pending changes panel
+- Server-side save conflicts return 409 responses with base/current hashes and server content
+- Conflict resolution screen shows server copy vs queued edit, then resolves into a Monaco editor
+- Static assets from the content directory can be embedded from markdown documents
+- Markdown rendering now supports raw HTML when authored in trusted content
+- File watcher debounces editor save bursts and ignores hidden/temp files
+- SimpleSync spec documents the intended browser, watcher, realtime, and native-client feature set
+- Go-level multi-client sync tests cover different-file success, same-file conflicts, and resolution behavior
+- 100-file sync performance validation covers source sync and snapshot/delta paths
+- IndexedDB uses a simple fixed cap for cached rendered pages/content while preserving pending edits
 
-**What's Next:**
-- Client-side IndexedDB cache for offline reading
-- Offline edit queue with conflict resolution UI
-- State machine diagram for sync protocol
+**Deferred:**
+- WebSocket authentication and logout-driven cache clearing move to Milestone 3 application auth
+- Browser-level automated sync tests and larger load benchmarks move to production hardening
 
 ---
 
@@ -87,20 +97,42 @@ A minimal-dependency, ultra-fast documentation platform that publishes markdown
 
 **Goal:** Secure access control with passkeys and granular permissions
 
-- Passkey (WebAuthn) primary authentication
-- Password fallback with Argon2id
-- Session management with signed cookies
-- Role-based access control (RBAC)
-- Content signing with Ed25519 (optional per-user)
+- [x] Passkey (WebAuthn) primary authentication
+- [x] Password fallback with Argon2id
+- [x] Session management with opaque server-side sessions
+- [x] Role-based access control (RBAC)
+- [x] Scoped API tokens with device-code flow for developer clients
+- [ ] Content signing with Ed25519 (deferred optional hardening)
 
 **Acceptance Criteria:**
 
-- [ ] Users can register and log in with passkeys on modern browsers
-- [ ] Password fallback works with proper hashing
-- [ ] Sessions expire securely and are revocable
-- [ ] Read/write/admin permissions work per-document and per-collection
-- [ ] All auth endpoints rate-limited and logged
-- [ ] Security audit: no plaintext secrets, no timing attacks on auth
+- [x] Users can register and log in with passkeys on modern browsers
+- [x] Password fallback works with proper hashing
+- [x] Sessions expire securely and are revocable
+- [x] Scoped API tokens and device-code flow support developer clients
+- [x] Read/write/admin permissions work at route and role level
+- [ ] Per-document and per-collection permission UI (deferred until collaboration resource modeling)
+- [x] All auth endpoints rate-limited
+- [x] Auth events logged
+- [x] Security implementation review: no plaintext session/token secrets, constant-time password/token comparison
+
+**What's Done:**
+- WebAuthn begin/finish registration and login endpoints
+- Argon2id password registration/login with first-user admin bootstrap
+- Opaque session cookies stored as server-side hashes
+- Scoped bearer API tokens stored as hashes and shown once
+- First-party device-code flow for CLI/client onboarding
+- Route middleware enforcing viewer/editor/admin roles plus token scopes
+- In-memory auth/device-flow rate limiter for self-hosted deployments under 100 users
+- Go-served login, account, API-token, role-management, and device-approval screens
+- Password change and account deletion endpoints
+- Public registration hardening so credentials cannot be attached to existing accounts without a session
+- Device-code replay hardening so approved codes mint only one API token
+
+**What's Next:**
+- Complete the independent penetration-test checklist during production hardening
+- Decide how deep per-document/per-collection permissions should go before collaboration features
+- Add optional multiple-passkey management and session refresh polish if real usage calls for it
 
 ---
 
@@ -145,8 +177,8 @@ A minimal-dependency, ultra-fast documentation platform that publishes markdown
 - [ ] All screens responsive down to 320px width
 - [ ] Lighthouse score >90 on all metrics
 - [ ] Initial page load <100ms (server-rendered HTML)
-- [ ] Mermaid diagrams render client-side
-- [ ] Math blocks render with KaTeX
+- [x] Mermaid diagrams render client-side
+- [x] Math blocks render with KaTeX
 
 ---
 
@@ -265,7 +297,7 @@ See [architecture-overview.md](architecture-overview.md) for detailed component
 ### Content Security
 
 - Attachment uploads: Magic number validation, extension whitelist, size limits
-- Markdown rendering: Sanitized HTML output; no raw HTML injection
+- Markdown rendering: Trusted content may include raw HTML; templates still auto-escape application data
 - File paths: Canonicalization prevents directory traversal
 
 ### Audit & Compliance
@@ -345,16 +377,12 @@ cairnquire/
 ## Next Steps
 
 1. ✅ Complete Milestone 1: Foundation
-2. 🔄 Continue Milestone 2: Sync Protocol
-   - Implement client-side IndexedDB cache
-   - Build offline edit queue
-   - Create sync protocol state machine diagram
-3. Begin Milestone 3: Authentication & Authorization
-   - Set up WebAuthn/passkey infrastructure
-   - Implement session management
-4. Add client-side Mermaid and KaTeX rendering (Milestone 5)
-5. Implement SQLite FTS5 search (Milestone 5)
-6. Add Renovate with dependency update cooldown policies
+2. ✅ Complete Milestone 2: Sync Protocol
+3. 🔄 Finish Milestone 3 hardening
+   - Add browser login/account management screens
+   - Complete security review checklist
+4. Implement SQLite FTS5 search (Milestone 5)
+5. Add Renovate with dependency update cooldown policies
 
 ---