The Super Wolf — Pack Coordination

Created backlog item on branch docs/backlog-idp-testing after analyzing target audience from product brief. Evaluated third-party IDP options — matches credit card churners (mainstream consumers, privacy-conscious, mobile-first). GitHub as initial social provider for dev testing, with path to add Google/Apple later.

Created backend-server.sh — parallel script to dev-server.sh. Frontend runs on 9653+offset, backend on 9753+offset (port = frontend + 100). Every worktree gets isolated frontend and backend servers with independent log files and environment overrides.

Updated all worktree docs to reflect dual-port model. Committed to feat/dual-port-worktrees branch and opened PR #26.

Spawned 3 agents in isolated worktrees simultaneously — FiremanDecko for IDP/auth investigation, FiremanDecko for backend/WebSocket architecture, Luna for multi-IDP wireframes. All three worked in parallel with no cross-contamination.

Provided GitHub OAuth setup instructions while teams ran in background: OAuth app settings → copy client ID/secret.

Luna delivered multi-idp-sign-in.html (4 scenarios: desktop/mobile × 1-button/4-button variants) and multi-idp-interaction-spec.md with full state machine diagrams. Modal dialog, not a page — vertical button stack scales from 1 to 4+ providers. Bottom-anchored on mobile, no close button (one exit: "Continue without signing in"), backdrop click disabled.

FiremanDecko produced ADR evaluating 5 backend options — recommended Hono + ws dedicated server on Fly.io. API route audit: POST /api/auth/token (~200ms) stays in Next.js, POST /api/sheets/import (5-30s+) migrates to backend with WebSocket progress streaming. 4-phase rollout plan with file-by-file change list and Mermaid diagrams.

FiremanDecko delivered ADR-007 — third-party IDP evaluation, GitHub initial provider. 5-phase implementation plan: middleware replaces no-op (all routes stay public, no auth gates), householdId contract unchanged (anonymous UUID from localStorage or IDP user.id when signed in), FenrirSession type removed. Playwright Testing Tokens bypass OAuth in CI entirely.

Loki QA for Team A (IDP/Auth): APPROVED WITH NOTES (10/10 checks PASS). 3 non-blocking notes: JSDoc still references "Google sub claim", document Testing Token lifetime, product brief update deferred correctly.

Loki QA for Team B (Backend/WS): APPROVED (8/8 checks PASS). 3 minor notes: SSE prototype vs evaluation acceptable, cost estimate excludes egress, Anthropic streaming deferred intentionally.

Merged PR #26 (dual-port worktree infra — already merged by user). Merged PR #27 (IDP auth ADR + implementation plan). Merged PR #25 (backlog items for IDP + Backend/WS). Cleaned up stale worktree branch (backend docs were already on main via PR #26).

Rebased Luna's worktree branch onto latest main (clean rebase — 1 commit on top). Created PR #28: "design: multi-IDP sign-in dialog wireframe and interaction spec". Merged immediately. All 4 PRs now on main — the pack's work is complete.