Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.
Session probe lands on /vw_pages (Research). Use main designlang extract
with --cookie-file — pack ignores auth. 39 artifacts under
docs/design-extract; tolerate designlang late summary crash when cores exist.
Ran authenticated extract against coulomb.social; session metadata
matched anonymous Bubble defaults, so treat docs/design-extract as a
public shell baseline (PROVENANCE.md). Capture script now refuses to
overwrite storage-state.json with thin anonymous sessions.
Interactive Playwright session capture (XDG storageState, mode 0600)
plus a designlang pack wrapper that never prints secrets. Document the
intended OpenBao lane tenants/binky/coulomb-social/bubble-member for
later password custody; interactive capture is the default for Bubble.
Prepare the greenfield rebuild of coulomb.social (bubble.io exit) with
orientation docs, TRSL license, Claude/Codex agent integration, and repo
classification under domain communication / topic coulomb-social. Workplan
CSOC-WP-0001 (exit assessment) is already registered via fix-consistency.
