akif/arclet-boards

Arclet Boards — private Kanban workspaces with AppID, DataK3, shared web and MCP actions.

A remix template · 1 remixes · Remix akif/arclet-boards

AUDIT.md

Arclet Boards — starter audit

Audit date: 2026-10-31 (Asia/Karachi).

Provenance

Official starter: https://git.dodil.io/dodil/boards-challenge, commit 2815f0bbc39ae589ff78be4dfcd87757e7cfe268. Its history and MIT license are preserved. The workspace challenge file matches the starter's challenge text. An untouched checkout is retained outside this repository at ../.audit/starter.

Environment

  • Windows PowerShell; Git 2.54.0, Python 3.14.6, Node 24.16.0, npm 11.13.0.
  • Claude Code 2.1.237; Playwright MCP connected. Python Playwright is installed; a browser installation is being prepared. Edge is installed.
  • No Docker executable found. WSL's launcher exists, but no distribution is assumed or required. Git Bash is available.
  • Official Windows Dodil CLI 0.1.91 (3a045fb) downloaded from cli.dodil.io. Signed SHA256SUMS verified with the installer's ECDSA public key, then the Windows binary's SHA256 verified. Infrastructure MCP registered in Claude Code.
  • Initial dodil auth status: not logged in. Device login requested from the account holder. No organization, remix, live resource, or deploy is yet verified.

Authoritative references read

  • Full DODIL-BOARDS-CHALLENGE.md and starter source, tests, Dockerfile, workflow, deploy.yaml, remix.yaml, and schema.sql.
  • dodil guide and dodil guide remix from CLI 0.1.91.
  • dodil://k3/sql read through the actual CLI MCP resource protocol.
  • https://docs.dodil.io/appid/recipes/ignite-apps
  • https://docs.dodil.io/appid/recipes/data-isolation
  • Product llms.txt indexes for DataK3, Git, and Ignite.

The SQL-specific resource documents atomic multi-table transactions, read-your-own writes on current engines, FOR UPDATE optimistic guards, and retry on SQLSTATE 40001. It supersedes the older build guide's statement about stale reads inside transactions. The current remix guide says deploy registers callbacks from Git 1.6.11; this must be checked in real deploy logs, with a documented fallback.

Starter findings

Present integrations (source inspection, not live verification):

  • AppID gateway login redirect and RFC 9728 MCP discovery.
  • One FastAPI service with web and MCP using the same use cases.
  • Parameterized psycopg DataK3 queries and service-account token refresh.
  • Dodil Models wrapper unwrapping the gateway's data envelope.
  • MIT license, templated resource names, bucket-scoped service-account grants.
  • Git CI test/build workflow, registry publishing, and Ignite CD manifest.

Incomplete or unsafe for the requested product:

  • Fixed lists; no workspaces, ordering, drag and drop, card details, assignment editing, labels, due-date editing, checklist persistence, dependency model, member removal, member role UI, or readable activity history.
  • Six starter tests; no real deployed user isolation or persistence evidence.
  • Data writes and activity writes use separate autocommit connections.
  • No concurrency versions or replay protection.
  • Identity trusts any X-Dodil-User and permits DEV_USER; the production boundary must also require pool authentication and reject non-person principals.
  • Client HTML interpolates user content through innerHTML without escaping.
  • Startup health checks do not prove database access.
  • Baseline dependency installation fails on Python 3.14: FastAPI 0.115 requires Starlette <0.47 while MCP 2.3 requires Starlette >=0.48 on Python 3.14. The untouched baseline has not passed tests in this environment.

Authorized implementation scope

Build Arclet Boards incrementally on the starter integrations, using only DataK3 for persistent runtime state, AppID for people, Ignite hosting, Dodil Models for AI, and Dodil Git CI/CD. One same-origin FastAPI deployment, one /mcp, one shared application layer. Owner/member/viewer permissions are scoped to each board; workspace membership alone does not disclose private boards. Owners manage memberships. Outsiders receive the same 404 as an absent record.

Core and fresh-organization remix verification take precedence over optional AI. No paid credits or services will be purchased. Live claims require real evidence; local test doubles are confined to tests and never become a runtime backend.