Build on Phases 1–7. Adds the two override paths from AGENTS.md §4 FR-10/FR-11:
the shared device keycode and the versioned admin HTTP API the separate Kotlin
admin app will call.
- store: migration 004 adds state.grant_until and a settings table. New
overrides.go records every override in `overrides` and verifies the shared
keycode (bcrypt; one code for every device, §10 rule 3). ExpireLocks also
clears an expired grant, and NextScheduleBoundary includes the grant end so a
device re-locks on time.
- effective state: a grant unlocks a device inside a schedule window; a manual
lock clears a grant and a grant clears a manual lock. The retained config
payload gains grant_until (additive, v stays 1).
- web: /api/v1/admin/... (list, state, lock, unlock, grant) guarded by
CONTROL_ADMIN_API_TOKEN, separate from the session login, plus the on-device
keycode endpoint POST /api/v1/device/override with per-address throttling.
A state change is published retained before the API responds.
- cmd/control: `keycode` subcommand and start-up seeding from
CONTROL_DEVICE_KEYCODE_HASH.
- deploy/verify-phase8.sh + `make verify-phase8` prove the definition of done:
an API lock reaches a real broker subscriber in well under a second.
- Version 0.6.0-phase8 (compose, Makefile, docs).
Measured on .13: the lock reached the TLS broker subscriber in 7 ms (handler
1 ms, request to retained publish accepted).
Tests: go vet ./... and go test -count=1 ./... pass in golang:1.25-alpine.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Weekly schedule editor per device: a Monday-Sunday grid of blocking
windows, including windows that cross midnight.
- Blocklist/allowlist editor per device: app (Android package / Windows
process) and site (hostname) entries, tagged by the device platform.
- Effective desired state: a manual lock, an active schedule window, or
neither. While blocked the allowlist is honoured (Spotify stays while
other apps are blocked). Published retained with reason schedule/manual.
- Boundary-aware republish loop so a window turns on and off on time,
and manual lock expiry is cleared promptly.
- CONTROL_TIMEZONE (default Australia/Sydney) with embedded tzdata, so
wall-clock windows are evaluated in the family zone, not the container.
- Every change is written to the append-only audit log (FR-15).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
