---
gsd_state_version: 1.0
milestone: v1.0
milestone_name: milestone
status: completed
stopped_at: Phase 4 fully executed — payments, multi-project, slug, deploy on hub.iamcavalli.net
last_updated: "2026-05-27"
last_activity: 2026-05-27 -- Phase 4 confirmed complete (04-00 through 04-07 + payments)
progress:
  total_phases: 5
  completed_phases: 4
  total_plans: 17
  completed_plans: 17
  percent: 100
---

# Project State

## Project Reference

See: .planning/PROJECT.md (updated 2026-05-09)

**Core value:** Il cliente apre il link e vede esattamente a che punto è il suo progetto, cosa deve ancora succedere e cosa ha già approvato — senza dover scrivere email per chiedere aggiornamenti.

## Current Position

Phase: 4 — COMPLETE
Plan: All plans done (04-00 through 04-07)
Status: Production deployed on hub.iamcavalli.net

## What Was Built (Phase 4)

- **04-00**: Infra — route /c/ → /client/, Dockerfile, deploy Gitea → Coolify
- **04-01**: DB schema migration — projects, settings, FK pivot
- **04-02**: Admin projects list + client detail project cards
- **04-03**: Project workspace + timer analytics + settings page
- **04-04**: Slug resolution + multi-project client dashboard + slug edit
- **04-05/06**: Post-deploy bug fixes
- **04-07**: Debug code removed, public page restored
- **security**: Full hardening — auth guards, rate limiting, security headers
- **payments**: Init payments + split payment in project workspace

## Production State

- App: hub.iamcavalli.net (Coolify, Hetzner)
- DB: Postgres self-hosted on Coolify
- Auth: Auth.js (admin) + token middleware (clients)
- Routes: /admin/* (admin), /client/[token]/* (clients)

## Decisions (All Phases)

- `clients.token` è campo separato (non la PK) — rotazionabile via single UPDATE
- `clients.accepted_total` denormalizzato — client API non tocca mai `quote_items`
- `deliverables.approved_at` immutabile — audit trail dal giorno uno
- Edge middleware (`proxy.ts`) usa fetch() a route interna — postgres-js non può girare nell'Edge runtime
- Tailwind v4 auto-detection allargata — aggiunto `@source not` per escludere `.01_projects/` e `.claude/`
- Authelia va solo davanti ad /admin — /client/[token] deve bypassare per accesso via link token

## Deferred Items

| Category | Item | Status |
|----------|------|--------|
| v2 | Claude AI onboarding (CLAUDE-01, CLAUDE-02, CLAUDE-03) | Backlog |
| Infrastructure | Authelia SSO davanti ad /admin | After Phase 4 (now ready) |
| Infrastructure | Higgsfield clone deploy (nuovo progetto Coolify) | Pending |
| SEO | WordPress auto-publish articoli | Mentioned, not planned |

## Session Continuity

Last session: 2026-05-27
All Phase 4 plans complete. Next: Authelia infra or new feature scope.