docs EOD: roadmap status (phases 1-4,7 done), AGENTS.md live-state, tuxedo board, deploy-frontend tasks

AGENTS.md

@@ -12,12 +12,17 @@ Where Woof — a **return-tag platform** (not a tracker): pre-coded QR/NFC tags
 - Per change: **openspec** (propose → design/specs → tasks, `openspec validate`) → **plannotator** plan (`plans/<name>.md`, submit → approve) → execute with `[DONE:n]` → run `/tmp` verify suites → `code-analysis` review → commit + push to Gitea.
 - This is a **learning exercise for the user** — explain decisions, don't just execute.
 
-## Where we are (2026-08-05)
+## Where we are (2026-08-07 EOD)
 
-- **Phase 1 `frontend-foundation` — DONE** (22/22 scenarios verified)
-- **Phase 2 `scan-flow` — CODE DONE + verified (19/19)**; **step 9 (real SMS) PENDING** — needs the user's SMSGlobal (MXT) API key/secret; verify `frontend/internal/sms/smsglobal.go` auth against their prior globalsms integration before the real send
-- **Phase 2.5 queued (tuxedo, priority B):** ① re-alert when a *different* finder phone arrives within the 250 m / 10-min window; ② JS browser fingerprint + 24 h block (store fingerprint in DB)
-- **Phases 3–9 pending** (see roadmap in `where_woof.md`): HTMX/Alpine polish → Laravel admin → billing (Stripe AU) → photo uploads → deploy frontend (.13 + Caddy .35 + InMotion redirect) → deploy admin → anti-abuse hardening
+- **Phase 1 `frontend-foundation` — DONE** (22/22)
+- **Phase 2 `scan-flow` — DONE** (19/19 + real SMS via SMSGlobal HTTP API)
+- **Phase 2.5 `scan-alert-hardening` — DONE** (12/12: different-finder re-alert + fingerprint 24h block)
+- **Phase 3 HTMX/Alpine polish — DONE** (+ tuxedo notes: photo upload, username/email display, favicon)
+- **Phase 4 `laravel-admin` — DONE** (Docker Laravel + Filament on .27:3030, shared Postgres, verified)
+- **Phase 7 `deploy-frontend` — LIVE on .13** (systemd user service :3020, Caddy blocks saved on .35)
+  - ⏳ **Outstanding (user, AM)**: where-woof.com DNS/redirect — A record still at InMotion (173.231.229.92); lab domains use a redirect mechanism (NOT a plain A record — user correction, investigate how both are configured); may involve router/NAT settings
+  - Admin (`admin.where-woof.com` → .13:3030) is Phase 8 — nothing runs on 3030 yet
+- **Remaining**: Phase 5 billing, Phase 6 photos, Phase 8 admin deploy, Phase 9 hardening
 
 ## Key locations
 
@@ -31,8 +36,10 @@ Where Woof — a **return-tag platform** (not a tracker): pre-coded QR/NFC tags
 | Build/run targets | `Makefile` — `db-up`, `seed`, `run`, `build`, `generate`, `psql` |
 | Dev DB | `wherewoof-db` Postgres 16 container on **.13:5434** (user/db `wherewoof`; compose + `.env` in `/home/sam/Docker/Containers/wherewoof-db/` on .13) |
 | Run locally | `make db-up && make seed && make run` → `http://localhost:3020` (SMS in **log mode** until creds set) |
-| Verify suites | `/tmp/verify.sh` (Phase 1, 22 checks), `/tmp/verify2.sh` (Phase 2, 19 checks) — ephemeral, they reset the DB |
-| Prod target | `.13:/var/www/where-woof` — **NOT deployed yet (Phase 7)**; Caddy on .35; InMotion redirect → `where-woof.com` |
+| Live frontend | **.13:3020** systemd user service `where-woof` (`/var/www/where-woof`, env `~/.config/where-woof.env`); `where-woof.home.lab` works via .35 Caddy |
+| Admin (dev) | **.27:3030** Docker Laravel (`admin/`, Filament) — `cd admin && docker compose up -d`; live deploy = Phase 8 |
+| Verify suites | `/tmp/verify.sh` (Phase 1, 22), `/tmp/verify2.sh` (Phase 2, 19), `/tmp/verify3.sh` (hardening, 12) — ephemeral, they reset the DB (incl. admin user — re-seed via `php artisan wherewoof:admin`) |
+| Prod target | `.13:/var/www/where-woof` — **frontend LIVE**; admin not yet deployed; Caddy on .35; `where-woof.com` DNS at InMotion (outstanding)
 | Gitea | `sam/where_woof` — `ssh://git@gitea.lab.audasmedia.com.au:2222/sam/where_woof.git` |
 
 ## Tools