📅 Daily Agenda: August 22, 2026 ( PST )

• Operation Baseline: 1615-2100
• Workspace: lantern_app
• Active User: fixture-operator
• Focus: get the app, the admin portal and the merchant portal working end to end
• Status: ⬜ not started

🎯 Key Focus Blocks

• [ ] 1615-1730: local admin and merchant login, mint a custom token off a local stack (#819)
• [ ] 1730-1900: local service stacks, one command per preset with port-collision guards (#855)
• [ ] 1900-2000: doctor learns more, establish what #857 actually shipped, then finish the rest (#858)

🕐 Realtime Log & Activity Blockers

• [ 2026-08-22 16:08 PST ]: AGENDA BUILT > 3 sessions ranked from the Prototype Phase 1 rows and the Aug 21 carry, 4 parked, 7 cut, 1 gap; no git, branch, worktree or PR state was inspected, and there was no 2026-08-22 carry file, so every carried item comes from August 21

🧩 Focus Tasks & Session Prompts ( Chronologically ordered )

Session 1: Local admin and merchant login [1615-1730]

• Skills: cloud-service, env-vars, verify
• Context: Application Default Credentials cannot mint custom tokens, so there is no way to sign into the admin or merchant portal outside deployed dev.
• Project: none yet ( run project-creation on pickup )
• Needs from you: none
• Status: ⬜ not started

Goal: A local auth-api mints a custom token and both the admin and merchant portals accept a login against a local stack.
Start here: gh issue view 819, then services/api/auth/
Done when: You sign into apps/admin and the merchant portal against locally running services, with no deployed-dev auth in the path.
Watch out: ADC lacks iam.serviceAccounts.signBlob, so every failure ends at the same signBlob call; this is a credential-path change, not something a retry or a scope tweak fixes.

Session 2: Local service stacks [1730-1900]

• Skills: repo-map, script-wiring, safe-automation
• Context: One command to bring up a named preset of local services, with guards that catch a port collision before it binds.
• Project: none yet ( run project-creation on pickup )
• Needs from you: none
• Status: ⬜ not started

Goal: lantern up <preset> starts a named set of services together, and refuses with a named owner when a port is already taken.
Start here: gh issue view 855, then tooling/scripts/lantern.mjs and tooling/vscode-extension/src/config.js (PORT_MAP)
Done when: lantern up <preset> brings the preset up, and running it a second time exits nonzero naming which process holds the busy port.
Watch out: The Firestore emulator and venues-api both want 8080, so the guard has to name the owner rather than just refuse; never invent a port, read PORT_MAP.

Session 3: Doctor learns more [1900-2000]

• Skills: repo-map, script-wiring, verified-done
• Context: Extend lantern doctor to cover worktree health, port status and the stale-server hint, starting from what already shipped.
• Project: none yet ( run project-creation on pickup )
• Needs from you: none
• Status: ⬜ not started

Goal: ./lantern doctor reports worktree health, per-port status with the owning process, and the stale-server hint, and the plan row matches reality.
Start here: gh issue view 857 (CLOSED, read what actually landed), then gh issue view 858, then tooling/scripts/doctor-env.mjs
Done when: ./lantern doctor prints all three on this machine, and tooling/scripts/__tests__/doctor-env.test.js passes.
Watch out: The plan row reads Not started while its cited issue #857 is already closed, so establish what shipped before writing anything or you will rebuild it.

❓ User Question Log

Append-only. Every question asked of her, logged when asked.

• [ 2026-08-22 16:08 PST ] Q: When the retry loop drops an event, is it replayed from the log, or accepted as lost? > A: UNANSWERED > Affected: the whole confirmed webhook fix. It changes the shape of the fix, so no code can start. Carried unanswered from the August 21 "Needs from you" line; the owning session no longer exists.
• [ 2026-08-22 16:08 PST ] Q: What is the retention window? > A: UNANSWERED > Affected: the retention work, parked four consecutive days for the same reason. No technical blocker and no capacity blocker; asking it is the entire task.
• [ 2026-08-22 16:08 PST ] Q: The geocoder's unpark condition already fired (it failed twice). Pick up the second provider, or accept single-provider risk on the record? > A: UNANSWERED > Affected: nothing downstream, but the row is stuck in a false state and has sat released and unworked for at least two days. Either answer gets it out of Parked.

🅿️ Parked

Carried in from August 21's Parked section and August 21's EOD report.

Task	Why parked	What unparks it
Decide the retention window	Needs a decision nobody has ever asked her for. Named in both EOD summaries ("three days running", then "four days running"); the Aug 21 1400-1700 block meant to hold it did not happen	Her answer, which nobody has requested. One question, in the log above
Second-source the geocoder	FLAG: CONDITION ALREADY FIRED. The parked row's own unpark cell reads "ALREADY UNPARKED BY ITS OWN CONDITION, and still sitting here", on Aug 20 and again on Aug 21	Already unparked. It now needs her call between picking it up and accepting single-provider risk on the record. Not independently verified beyond the agenda's own wording
Rewrite the onboarding email	Not this leg. It belongs to activation work that is deliberately out of scope	A decision to open activation as a workstream at all. Nothing has changed against that condition
Replace the CI cache action	The current action still works, so there is no forcing reason to touch it. New on Aug 21, needs nothing from her	The action breaking, or the vendor deprecating it. Neither is recorded as having happened

Cut today

• Fix the webhook retry loop (confirmed bug, nobody working it): confirmed, reproducible and unowned, and it deserves a day soon, but it is event-delivery correctness and would still drop the second delivery even with all three surfaces green. Hard-blocked on a decision she has not been asked; the answerable half is in the question log.
• Credential and identity colocation: in-progress Phase 2 P0, so it stays live work, but it is a confidentiality fix on what admin reads pull into the browser. The admin portal leaks whether or not it runs end to end.
• Personal context sync: the last unfinished Phase 1 P0 and in progress, but it is agent and session durability across machines, not the app or either portal. Working portals tomorrow leave it exactly as unfinished.
• Contrast enforced for real: in-progress Phase 3 P0 and a real gate hole, but a blind a11y gate does not stop the three surfaces from running, and it would still be blind the day after they do.
• Data classification and egress: Phase 2 P0 policy work aimed at search, the assistant and the apps platform. Those are later legs; the policy is still unwritten after the portals work.
• Tidy the settings screen spacing: the only carried item with no decision dependency, so genuinely pick-up-able, but explicitly cosmetic, no issue and no project folder, and two cards on different spacing scales block nothing.
• Prebuilt Codespace: the lowest-priority row left in the phase, and the plan itself qualifies it as only worth doing if someone joins who cannot use the local path. Today's leg is making the local path work.

Gaps

Nobody is carrying this. It came from neither reader.

• An actual end-to-end pass across the three surfaces, recording what breaks: the carry file holds only the four carried tasks and the parked rows, and PROTOTYPE.md Phase 1 holds the enabling rows (login, stacks, doctor) but no row that says run all three surfaces together and list the failures. The focus is a state, and nothing gathered defines that state or measures the distance to it: all three ranked rows unblock the attempt, none of them is the attempt.