# Open tasks — dependency graph

_Last synced: 2026-06-04 (RSSH full stack on `feature/rssh-alpha`, RA control HTTP, cluster acl0 DNS). **DNS 2.x off graph** (postponed)._

**Standing rules:** [../bottomline_reminder.txt](../bottomline_reminder.txt) · **Documentation index:** [README.md](README.md) · **Service map:** [20260608_BE_SERVICES_and_infra.md](20260608_BE_SERVICES_and_infra.md)

---

## Removed from graph (done)

| ID | Note |
|----|------|
| **0.1** | Stream dump |
| **3.x** | Auth register + verify + TOTP + migration `008` |
| **4.wg** | WG lab — BE `wg0`, FE + router DNAT persist |
| **RBAC** (core) | Admin panel + lockout clear |
| **Browser** | JS syntax validated; `validate_be_services.sh` |
| **1.1 / 1.2** | Graphs drill-down, columns, full-width |
| **5.3** | RSSH API smoke — `test_rssh_api.sh` |
| **Infra doc** | `20260608_BE_SERVICES_and_infra.md` + PDF |
| **RA control** | `:ra_control` HTTP + WebSocket shell + adb JSON `ra_control` block |

---

## In progress (feature/rssh-alpha)

| ID | Owner | Blocker | Status |
|----|-------|---------|--------|
| **4.rssh** | Agent | BE `provision_users` + FE stream deploy on PO | **In progress** — mobile MINA :8022, bastion provisioner, linux-sim, docs/tests in repo |
| **cluster0** | Agent | cast01–03 reachable | **Ongoing** — lab VMs; DNS `c1–c3.acl0.f0xx.org` noted in `cluster.env` |

---

## Postponed / off graph (DNS + mail)

| ID | Owner | Note |
|----|-------|------|
| **2.1–2.4** | Developer | DNS / forwards — **postponed** (acl0 CNAMEs added for cluster lab only) |
| **2.5** | Agent | SMTP — frozen |
| **5.4** (mail) | Agent | Auth mail E2E — frozen |

---

## Priority tiers (open only)

| Tier | IDs | Alpha blocker |
|------|-----|---------------|
| **P4** | **5.1 OTA**, **5.2 URLs**, **5.5** RBAC UI soak | **Yes** |
| **P4b** | **4.rssh** deploy soak | **Yes** (alpha essential) |
| **P5** | **6.1–6.6** app LAN | LAN alpha |
| **P9** | **9.x** landing (excl. globe FR) | No |
| **Post-alpha** | **SFU** relay | No |

---

## Dependency graph

```mermaid
flowchart TB
    subgraph P4["P4 — backend alpha"]
        OTA["5.1 OTA channel<br/>SVC-OTA · HTTP 400"]
        URL["5.2 device URLs<br/>SVC-URL · legacy host"]
        RBACV["5.5 RBAC UI soak<br/>API ✓"]
        RSSH["4.rssh full stack<br/>feature/rssh-alpha<br/>Agent"]
    end

    subgraph P5["P5 — app LAN · dev"]
        A61["6.1 Opus/Speex"]
        A62["6.2 LAN soak"]
        A63["6.3 lifecycle"]
        A64["6.4 rotation"]
        A65["6.5 audio lag"]
        A66["6.6 stream analysis"]
    end

    subgraph LAB["Lab · cluster0"]
        C0["cast01–03<br/>c1–c3.acl0.f0xx.org"]
    end

    subgraph P9["P9 — landing"]
        L9["9.x hub cards"]
    end

    subgraph POST["Post-alpha"]
        SFU["SFU / Janus relay"]
    end

    FULL["FULL_ALPHA<br/>no DNS/mail"]

    OTA --> FULL
    URL --> FULL
    RBACV --> FULL
    RSSH --> FULL
    A62 --> FULL
    C0 -.-> RSSH

    A63 <--> A64
    A65 --> A66

    SFU -.-> FULL

    style FULL fill:#1e3a5f,color:#fff
    style OTA fill:#991b1b,color:#fff
    style URL fill:#b45309,color:#fff
    style RSSH fill:#7c3aed,color:#fff
    style SFU fill:#e5e7eb,color:#374151
```

---

## Task index (open)

| ID | Owner | Depends on | Status |
|----|-------|------------|--------|
| **4.rssh** | Agent | FE stream + BE sshd Match User | **In progress** — repo complete pending deploy soak |
| **5.1** | 50/50 | nginx OTA path | **Open** |
| **5.2** | 50/50 | — | **Open** |
| **5.5** | Agent | RBAC API ✓ | Light UI soak |
| **6.1–6.6** | Developer (~99%) | 0.1 ✓ | Open |
| **9.x** | Agent (low) | — | Open |
| **cluster0** | Agent | NFS/DNS | cast01–03 lab |
| **SFU** | Agent | owner spec | Hidden |

---

## Critical path

```text
BLOCKER:  5.1 OTA nginx (/v0/ota/ on apps.f0xx.org) ──┐
SHARED:   5.2 production URLs (apps not f0xx.org) ─────┼──► FULL_ALPHA
ALPHA:    4.rssh deploy (FE stream + BE sshd + app) ───┤
OPTIONAL: 5.5 RBAC UI click-through ────────────────────┤
DEV:      6.2 LAN soak ────────────────────────────────┘

Parallel: cluster0 lab (c1–c3.acl0.f0xx.org), 6.1/6.3–6.6, 9.x, SFU
Off graph: 2.x DNS/mail (postponed)
```

---

## Numbered priority legend (PO overrides AI)

1. **5.1 OTA** — nginx path (PO/dev)
2. **5.2 URLs** — production base URLs
3. **4.rssh** — alpha remote access (Agent, `feature/rssh-alpha`)
4. **5.5 RBAC UI soak** — optional click-through
5. **6.2 LAN soak** — developer device validation
6. **cluster0** — cast01–03 integration tests
7. **6.1 / 6.3–6.6** — app LAN quality
8. **9.x** — landing polish