All notable changes to this project are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions follow [Semantic Versioning](https://semver.org/).
- Phase 1: identity. Sign-in with the domain account and password against PESCO's Active Directory over LDAPS (search with the service account, then bind as the user; nested groups resolved; disabled accounts refused). Roles are the union of a person's `PS-*` groups, mapped by a table derived from the department list.
- Server-side sessions: HttpOnly, SameSite=Strict cookie, idle sign-out after 15 minutes, absolute 12 hours for password sessions and 10 hours for PIN sessions, server-recorded lock after 3 idle minutes or a tab hidden for over a minute, step-up unlock with PIN or password. Origin and `X-Requested-With` check on every state-changing request.
- Optional Packet Station PIN, 6 to 12 digits, set by the user with their domain password, hashed with Argon2id. PIN sign-in by employee ID on registered devices only. Five wrong attempts disable the PIN; three wrong attempts at unlock or signature end the session.
- Rate limits before any AD bind: 5 failed attempts per account per 5 minutes then a 10-minute cooldown, 30 per client address per 5 minutes.
- Device registration by an Admin or a shop Supervisor in a password session, with a device cookie; devices listed and revocable by Admin.
- Signatures table and the `sign` helper for the sign-off actions of later phases.
- Audit rows for every identity event through the hash-chained audit log.
-`GET /api/events`: server-sent events over PostgreSQL LISTEN/NOTIFY with presence.
- Account settings: AD details, PIN create or change, sessions and sign-out-others, own access log, register this device.
- Admin: read-only AD view of users and any account, devices, PIN clearing with a reason, the group map with missing-group flags, sign-in attempts, and "Refresh from AD now", which enumerates the groups' members and creates or refreshes the users.
- Frontend: real sign-in (password tab, PIN keypad tab on registered devices), lock screen, role switcher, Account settings, Admin shell, placeholders for the screens of later phases.
- CLI: `packetstation ad-groups --list` and `packetstation ad-refresh`.
- Migration 0002: users keyed on the AD objectGUID, user_roles, sessions, devices, user_pins, signin_attempts, signatures, departments and stations seeded with the 18 departments.
- CI: a Samba Active Directory domain controller container (`PSTEST.LOCAL`) with a generated CA, seeded groups and test users; the CI compose overlay and Gitea workflow run it; a Playwright sign-in scenario runs against the stack.
- Phase 0: new repo for the Packet Station rebuild.
- CLAUDE.md with the safety rules, connection facts, layout, commands and related projects.
- README with the status, phase list, folder map and how to run.
- docs/BRIEF.md (the brief, copied verbatim) and docs/PLAN.md (the approved plan, copied verbatim).
- docs/SECURITY.md rewritten for the server build: the 20 old layers and where each now lives, the new controls, and the requirement ID table with the phase that closes each.
- docs/DEPLOY.md with the docker-1 host facts, the two stacks, secrets layout, NPM proxy host settings and the pip index rule.
- Stubs for docs/FEED.md, docs/POLICY.md, docs/SCHEMA.md, docs/GO-LIVE.md and docs/PAPER-FALLBACK.md.
- .gitignore and .editorconfig.
- Python package skeleton, `packetstation` CLI (`doctor`, `migrate`, `app`, `worker`), migration runner and first migration (roles and grants).
- Multi-stage Dockerfile, compose files for the test stack and CI, Gitea Actions CI.
- Security headers, CSP and a build version endpoint.
- Frontend skeleton (Vite, React, TypeScript) with the PESCO dark theme ported from the old page and self-hosted fonts.
- The image was built on docker-1 and the CI compose stack ran end to end there: roles, migration, app and worker healthchecks, doctor database checks.
