Release 0.10.0: user-set passcodes (OTC stays as fallback)

After a successful OTC sign-in, a contributor can set a passcode
(4-20 characters, bcrypt-hashed) and use email + passcode for
subsequent sign-ins. OTC remains the structural fallback: five
consecutive failed verifies lock the passcode path for 15 minutes
(HTTP 423), and a forgotten passcode is recovered by requesting a
fresh code. Migration 015_passcode.sql adds four nullable columns
to the users table; existing rows pass through as OTC-only and can
opt into a passcode from a new Sign-in tab in /settings/notifications.
The /login surface is extended to a five-step flow (email → either
passcode or OTC code → optional post-OTC passcode offer → optional
set-passcode). SPEC corrections per §19.3 rule 2: §6 names the
three auth paths, §14.1 documents the stepped login flow, §17 lists
the four new /auth/passcode/* endpoints, §19.2 surfaces four new
candidates and refreshes the cross-refs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -23,6 +23,699 @@ skip versions are the composition of each intervening adjacent
 release's steps in order — no A-to-B path is pre-computed beyond
 that.
 
+## 0.10.0 — 2026-05-28
+
+**Minor — schema migration required; new auth path is additive.**
+This release lands user-set passcodes after OTC (roadmap item #8,
+SPEC §6.2). After a successful one-time-code sign-in, the user can
+set a passcode (4–20 characters) and use email + passcode for
+subsequent sign-ins. OTC remains the structural fallback: a
+forgotten passcode is recovered by requesting a fresh code, and
+five consecutive failed passcode verifies lock the passcode path
+for 15 minutes (HTTP 423) while leaving the OTC path open. The
+`/login` surface now consults a new `GET /auth/passcode/check`
+endpoint after the email step to decide whether to render a
+passcode input or an OTC code input; an "Use a code instead" link
+on the passcode step lets the user fall back to OTC manually. The
+`/settings/notifications` page grew a new "Sign-in" tab where the
+user can set, change, or remove their passcode.
+
+### Upgrade steps (from 0.8.0)
+
+1. **MUST** restart the backend so migration `015_passcode.sql`
+   runs. The migration adds four nullable columns to the `users`
+   table: `passcode_hash`, `passcode_set_at`,
+   `passcode_failed_attempts` (default 0), `passcode_locked_until`.
+   Existing rows pass through with `passcode_hash = NULL`, which
+   the runtime treats as "no passcode set" — every existing user
+   continues to sign in via OTC unchanged, and can opt into a
+   passcode from the new settings tab at any time.
+2. **MUST** rebuild the frontend so the v0.10.0 `/login` flow and
+   the new settings tab ship. `frontend/package.json#version` and
+   `VERSION` both move to `0.10.0`.
+3. **SHOULD** announce the new sign-in option to users. Wording
+   suggestion: "You can now set a passcode for faster sign-in.
+   We'll keep emailing one-time codes as a fallback — if you
+   forget your passcode, just request a code as usual."
+4. **MAY** leave the §6.2 default lockout shape (5 attempts,
+   15-minute window) unchanged. v0.10.0 does not expose env
+   tunables for these; raising or lowering them lives in §19.2
+   as a candidate.
+
+### Added
+
+- **`POST /auth/passcode/set`** — authenticated. Body `{passcode}`.
+  Validates length (4–20) and refuses obvious patterns from a small
+  denylist (`0000`, `1234`, `aaaa`, `password`, etc.). bcrypt-hashes
+  the passcode and writes `users.passcode_hash` plus
+  `users.passcode_set_at`. Clears any active lockout and the
+  failure counter (a user setting a fresh passcode is implicitly
+  re-authenticating). Replaces any prior passcode.
+- **`DELETE /auth/passcode`** — authenticated. Clears the passcode
+  hash and the set-at stamp; the user is back to OTC-only.
+- **`POST /auth/passcode/verify`** — unauthenticated. Body
+  `{email, passcode}`. Returns HTTP 200 + minimal user payload on
+  success; HTTP 423 with `locked_until` when the account is in the
+  lockout window; HTTP 400 for every other failure (the
+  wrong-passcode and unknown-email modes both collapse to 400 so
+  the response does not enumerate account state).
+- **`GET /auth/passcode/check`** — unauthenticated. Query param
+  `email`. Returns `{has_passcode: boolean}`. The Login.jsx flow
+  consults this after the email step to decide whether to render a
+  passcode input or fall back to OTC. The response carries only
+  the boolean; lockout state, the hash, and the `passcode_set_at`
+  stamp are not leaked. An unknown email and a known-without-
+  passcode email both return `false`, so the endpoint is
+  account-enumeration-safe.
+- **Schema migration** `015_passcode.sql` — four ALTER TABLE ADD
+  COLUMN statements on the `users` table:
+  - `passcode_hash TEXT` (nullable) — the bcrypt hash. NULL means
+    "no passcode set".
+  - `passcode_set_at TEXT` (nullable) — ISO-8601 timestamp.
+  - `passcode_failed_attempts INTEGER NOT NULL DEFAULT 0` —
+    consecutive failure counter since last success.
+  - `passcode_locked_until TEXT` (nullable) — lockout window
+    expiry; verify refuses with HTTP 423 while populated and
+    in the future.
+- **`backend/app/passcode.py`** — the passcode state machine:
+  validation (length + denylist), bcrypt hashing, set/clear,
+  status check, and the verify path with lockout management.
+- **`frontend/src/components/Login.jsx`** — extended to a five-step
+  surface: email → passcode-or-code → optional post-OTC
+  passcode-offer → optional set-passcode. The "Use a code instead"
+  link on the passcode step re-dispatches an OTC and switches to
+  the code step. A 423 from passcode verify auto-falls back to OTC
+  with a visible status message.
+- **"Sign-in" tab** in `/settings/notifications` — shows
+  passcode-set status, the recorded `passcode_set_at` stamp when
+  set, and Set / Change / Remove buttons. Mirrors the §14.5
+  "Privacy & cookies" tab pattern.
+- **SPEC `§6` / `§14.1` / `§17` / `§19.2`** corrections per §19.3
+  rule 2:
+  - §6 names the three current auth paths (OTC, passcode-with-OTC-
+    fallback, OAuth-fallback-during-migration).
+  - §14.1 documents the stepped `/login` surface and the passcode
+    check endpoint.
+  - §17 lists the four new `/auth/passcode/*` endpoints.
+  - §19.2 surfaces four new candidates (passcode policy tunables
+    via env, per-IP rate-limit on `/auth/passcode/verify`,
+    passcode-change "old passcode" challenge, passkey/WebAuthn);
+    the "device-trust 30d" entry's passcode cross-ref is updated;
+    the "first-OTC profile capture" entry's roadmap cross-ref is
+    updated.
+
+### Changed
+
+- **`backend/app/main.py`** — registers the four new
+  `/auth/passcode/*` routes on the existing oauth router, alongside
+  the v0.7.0 `/auth/otc/*` routes.
+- **`backend/app/api.py`** — `/api/auth/me` payload now includes
+  `has_passcode` (boolean) and `passcode_set_at` (string or null)
+  so the settings surface can render the Set / Change / Remove
+  affordances without a second round trip.
+- **`frontend/src/api.js`** — adds `checkPasscode`, `verifyPasscode`,
+  `setPasscode`, `clearPasscode` helpers, neighboring the v0.7.0
+  `requestOtc` / `verifyOtc` block.
+- **`frontend/src/components/NotificationSettings.jsx`** — adds the
+  `SignInSection` component between `MutesSection` and
+  `PrivacyCookiesSection`.
+
+### Tests
+
+- **`backend/tests/test_passcode_vertical.py`** — 17 new tests
+  cover: set requires session; check returns false for unknown and
+  for set-less users; check returns true after set without leaking
+  other fields; happy-path OTC → set → verify roundtrip; wrong
+  passcode increments the counter without locking; five consecutive
+  failures lock with 423 and persist `passcode_locked_until`;
+  lockout expires and the next attempt clears the counter; the OTC
+  path is unaffected by passcode lockout; clear wipes the hash and
+  set-at; setting a new passcode replaces the prior one and resets
+  the lockout; `passcode_set_at` updates on every set; validation
+  refuses too-short passcodes and denylist patterns; `/api/auth/me`
+  carries `has_passcode` and `passcode_set_at` correctly.
+
+### Environment variables
+
+None new. The existing `SECRET_KEY` continues to sign session
+cookies; passcode hashing reuses the bcrypt dependency added in
+v0.7.0. The lockout shape (5 attempts, 15 minutes) and the length
+range (4–20) are hard-coded in `backend/app/passcode.py`. See
+§19.2 for the env-tunable candidate.
+
+## 0.13.0 — 2026-05-28
+
+**Minor — schema migration required; new optional env vars.** This
+release ships the cookie / privacy consent surface (roadmap item #11,
+SPEC §14.5 / §14.6). Every viewer — authenticated and anonymous alike —
+now sees a non-modal bottom-of-page banner on first visit asking which
+categories of cookies they allow (essential / essential + analytics /
+essential + analytics + other). The choice persists in `localStorage`
+for anonymous viewers and in a new `cookie_consent` table for
+authenticated viewers, with server-side overriding local on sign-in.
+The framework also ships default `/privacy` and `/cookies` policy pages
+that deployments can layer their own policy URL on top of via two new
+optional env vars. No analytics SDK ships in this release — the
+consent infrastructure is wired so item #13 (v0.15.0) can read from
+`frontend/src/lib/consent.js` when the SDK lands.
+
+### Added
+
+- **Cookie consent banner** (`frontend/src/components/CookieConsentBanner.jsx`).
+  Non-modal, bottom of viewport. Three single-select choices with
+  inline descriptions. Visible until the user makes a choice; hides
+  thereafter. Reachable for revision via the settings surface.
+- **Consent helper** (`frontend/src/lib/consent.js`). Exports
+  `getConsent()`, `hasChosen()`, `onConsentChange(cb)`, `setConsent()`,
+  `hydrateFromServer()`, `clearLocal()`. Cross-tab sync via the
+  `storage` event. Item #13's analytics SDK reads consent here before
+  importing.
+- **Privacy and cookies policy pages**
+  (`frontend/src/pages/Privacy.jsx`, `frontend/src/pages/Cookies.jsx`).
+  Default minimal policies that describe the framework's stance and
+  list the cookies the framework sets. Deployments override via the
+  two new env vars below; the framework's stub always renders above
+  the link so the framework-level contract stays visible.
+- **"Privacy & cookies" tab** in `/settings/notifications` showing
+  the current consent choice, the recorded-at stamp, and a "Change"
+  button that re-opens the banner via a custom DOM event.
+- **`§17` endpoints** —
+  - `GET  /api/users/me/cookie-consent` — read the current consent
+    record.
+  - `PUT  /api/users/me/cookie-consent` — write a new consent record.
+    Upserts a single row per user, stamps `recorded_at` to now,
+    accepts `essential` for symmetry but always persists it as true.
+- **Schema migration** `013_cookie_consent.sql` — new
+  `cookie_consent` table keyed by `user_id`, three flags
+  (`essential`, `analytics`, `other_cookies`), and `recorded_at`.
+  (Renumbered from `012_*` during driver integration because v0.7.0
+  also added a `012_otc.sql` migration that landed in the integration
+  order before this one.)
+- **SPEC `§14.5` Cookie / privacy consent** — settles the banner
+  shape, the three-category single-select, the storage shape (local
+  for anon, server row for authenticated), the precedence rule on
+  sign-in, and the `consent.js` helper surface for downstream
+  callers including item #13.
+- **SPEC `§14.6` Privacy and cookies policy pages** — settles the
+  `/privacy` and `/cookies` routes, the framework's stub content, and
+  the `VITE_PRIVACY_POLICY_URL` / `VITE_COOKIES_POLICY_URL` override
+  shape.
+- **SPEC `§5`** — names the `cookie_consent` table in the canonical
+  app-tables list.
+- **SPEC `§17`** — lists the two new cookie-consent endpoints.
+- **SPEC `§19.2`** — surfaces four candidates: policy content via
+  content-repo file vs env var, GPC / DNT headers, multi-language
+  consent text, and the item #13 analytics-SDK gating dependency.
+
+### Changed
+
+- **`frontend/.env.example`** — documents the two new optional env
+  vars `VITE_PRIVACY_POLICY_URL` and `VITE_COOKIES_POLICY_URL`. Unset
+  is supported; defaults render the framework's stub.
+- **`backend/app/api_notifications.py`** — module docstring grew two
+  endpoint lines; the new endpoints sit alongside the existing
+  `/api/users/me/*` neighbors.
+- **`frontend/src/App.jsx`** — registers `/privacy` and `/cookies`
+  routes (anonymous-reachable), wires `<CookieConsentBanner>` into
+  the global chrome, and listens for a `rfc-app:cookie-consent-reopen`
+  custom event to re-open the banner from the settings surface.
+
+### Upgrade steps (from 0.7.0)
+
+- You **MUST** rebuild the frontend and restart the backend after
+  upgrading. `frontend/package.json#version` and `VERSION` both move
+  to `0.13.0` and the build embeds the new env-var contract.
+- You **MUST** apply schema migration `013_cookie_consent.sql`. The
+  migration creates a single new table keyed by `user_id` with three
+  flag columns and a `recorded_at` stamp. The framework runs
+  migrations automatically at process start; no manual step is
+  required beyond restarting the backend so the migration runner
+  picks the file up.
+- You **MAY** set `VITE_PRIVACY_POLICY_URL` to an http(s) URL that
+  points at your deployment's full privacy policy. The framework's
+  `/privacy` page renders its built-in stub above a link to the
+  configured URL. Unset is supported — the stub is sufficient for a
+  default-config deployment.
+- You **MAY** set `VITE_COOKIES_POLICY_URL` to an http(s) URL that
+  points at your deployment's full cookies policy. Same shape as the
+  privacy URL.
+- You **MAY** announce the new consent banner to your users. Existing
+  authenticated users will see the banner on their next visit
+  (because their `cookie_consent` row does not yet exist); their
+  current sessions remain valid.
+
+## 0.7.0 — 2026-05-28
+
+**Minor — schema migration required; new auth path is additive.**
+This release lands email + one-time-code sign-in (roadmap item #5,
+SPEC §6.2) as the primary human-auth gesture. Users sign in by
+typing their email, receiving a six-digit code via email, and
+entering it. The Gitea OAuth callback (`/auth/callback`) remains
+functional during migration — the new UI no longer points at it
+primarily, but a "Sign in with Gitea (fallback)" link survives on
+the new login surface so users with active OAuth sessions or older
+invite paths still have a way in. A future release retires the
+OAuth path entirely once every active user has signed in at least
+once via OTC.
+
+The migration path for existing users: first OTC sign-in matches by
+`users.email` (case-insensitive) to the OAuth-era row and reuses
+that row's `id` and `gitea_id`. New users provisioned via OTC carry
+`gitea_id = NULL` and `gitea_login = NULL`. The `gitea_id` linker
+remains the canonical handle for grandfathered users; `email`
+becomes the identity key for everything provisioned after v0.7.0.
+
+The Gitea **bot** user + token are still required (server-side git
+operations — repo reads, PR creation — still flow through it). Only
+the operator-facing sign-in surface moves.
+
+### Upgrade steps (from 0.6.0)
+
+1. **MUST** restart the backend so migration `012_otc.sql` runs.
+   The migration rebuilds the `users` table (SQLite cannot ALTER
+   COLUMN); existing rows pass through unchanged, but the new
+   schema relaxes `gitea_id` / `gitea_login` to nullable (with
+   partial unique indexes that ignore NULL) and adds a partial
+   unique index on `email`. A new `otc_codes` table is created.
+2. **MUST** confirm the SMTP overlay is set (`SMTP_HOST`,
+   `SMTP_PORT`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_STARTTLS`,
+   `EMAIL_FROM`, `EMAIL_FROM_NAME`). The OHM overlay already
+   carries these as of v0.5.0; deployments without them fall back
+   to logging the code to stdout (dev-only path — production
+   visitors will not receive their codes).
+3. **SHOULD** announce the new email-based sign-in to existing
+   users. Wording suggestion: "You can now sign in by entering
+   your email and a one-time code we'll send you. Your old
+   account is linked automatically the first time you sign in."
+4. **MAY** keep the existing OAuth callback as a fallback path.
+   The new login UI surfaces a small "Sign in with Gitea
+   (fallback)" link beneath the primary email/code form; a
+   deployment that prefers to hide it can override the Login
+   component in a future framework release that exposes the link
+   behind a feature flag. For v0.7.0, the link is hard-coded.
+
+### New environment variables (all optional with defaults)
+
+- `OTC_TTL_MINUTES` (default `10`) — how long a one-time code is
+  valid after issuance. Re-requesting invalidates the prior code
+  immediately regardless of TTL.
+- `OTC_REQUEST_COOLDOWN_SECONDS` (default `60`) — per-email cooldown
+  between successive `/auth/otc/request` calls. The endpoint returns
+  HTTP 429 when the cooldown blocks a request (the loud-failure
+  shape; the abuse path is visible rather than swallowed).
+
+No new secrets are required. The existing `SECRET_KEY` continues to
+sign session cookies; OTC codes are bcrypt-hashed at rest using a
+per-row salt the library generates.
+
+### Added
+
+- **`POST /auth/otc/request`** — body `{email}`. Generates a six-digit
+  code, stores its bcrypt hash with an expiry, and dispatches a plain
+  text email via the existing SMTP layer. Returns HTTP 200 (`{ok:true}`)
+  uniformly so allowlist state is not leaked. Returns HTTP 429 when
+  the per-email cooldown blocks the request.
+- **`POST /auth/otc/verify`** — body `{email, code}`. Validates the
+  bcrypt hash against the most-recent unconsumed non-expired row, marks
+  the row consumed, provisions or links the `users` row by email, and
+  stores the session cookie. Returns HTTP 200 on success, HTTP 400 on
+  any failure (expired, consumed, wrong, unknown).
+- **`backend/migrations/012_otc.sql`** — creates `otc_codes` and
+  rebuilds `users` with nullable `gitea_id` / `gitea_login` plus a
+  partial unique index on `email`.
+- **`backend/app/otc.py`** — the OTC request/verify state machine and
+  the `provision_or_link_user` linker.
+- **`backend/app/email_otc.py`** — outbound OTC mail composition. Reuses
+  the SMTP plumbing from `email.py` (`EmailConfig.from_env()`) and the
+  test buffer (`_SENT`) but writes its own envelope (no unsubscribe
+  footer, no quiet-hours hold — OTC mail carries a credential and
+  ignores notification preferences).
+- **`frontend/src/components/Login.jsx`** — two-step sign-in surface
+  at `/login`. Step 1: enter email → request code. Step 2: enter
+  six-digit code → verify. Cmd/Ctrl+Enter on the code field submits.
+  The previous header "Sign in" link and the `Welcome` component's
+  inline link now route to `/login` instead of jumping straight to
+  the Gitea OAuth dance.
+- **SPEC `§6.1` / `§6.2` / `§14.1` / `§17` / `§19.2`** corrections per
+  §19.3 rule-2 — see below.
+- **`backend/tests/test_otc_vertical.py`** — 11 new tests covering
+  the happy path, expired/consumed/wrong codes, the per-email rate
+  limit (and its per-email isolation), the allowlist gate, the
+  migration link to OAuth-era users, fresh provisioning, and the
+  prior-code-invalidation behavior on re-request.
+
+### Changed
+
+- **`backend/app/auth.py#current_user`** — coerces NULL `gitea_id` and
+  NULL `gitea_login` to `0` / `""` so the `SessionUser` shape stays
+  stable for OTC-only users. The DB remains the source of truth for
+  "is this user OAuth-linked" (`gitea_id IS NOT NULL`).
+- **`backend/requirements.txt`** — adds `bcrypt>=4.2` for OTC code
+  hashing. Pure-Python wheels are available on every platform the
+  deployment matrix targets; `pip install -r backend/requirements.txt`
+  picks it up.
+- **`frontend/src/App.jsx`** — adds the `/login` route and replaces
+  the header "Sign in" `<a href="/auth/login">` with `<Link to="/login">`.
+  The `Welcome` component's inline sign-in link follows suit.
+- **`frontend/src/components/Landing.jsx`** — the `/welcome` page's
+  primary action moves from "Sign in with Gitea" to "Sign in" pointing
+  at `/login`.
+
+### Deferred to later releases
+
+Per the v0.7.0 scope discipline (the foundation for items #6, #8, #9,
+#10), several adjacent capabilities are intentionally not in this
+release and surface as §19.2 candidates:
+
+- **First-OTC profile capture** (first name, last name, "why") — item
+  #6, expected v0.8.0.
+- **Open beta-access request flow** replacing the allowlist gate —
+  also item #6, v0.8.0.
+- **Passcodes** (a long-term reauth token alternative) — item #8,
+  expected v0.10.0.
+- **Device-trust 30-day skip** — item #9, expected v0.11.0.
+- **Cloudflare Turnstile** on `/auth/otc/request` — item #10,
+  expected v0.12.0.
+- **Removing the Gitea OAuth `/auth/callback` route entirely** — a
+  later release after every active user has signed in via OTC.
+
+## 0.6.0 — 2026-05-28
+
+**Minor — no operator action required.** A sweep-the-edges hardening
+release (roadmap item #4, "anon discuss + contribute off-limits") that
+audits every write-shaped backend endpoint and asserts each one
+enforces an explicit `auth.require_contributor` (or stricter) gate
+before doing any state-changing work. v0.3.0 hid write affordances
+behind a sign-in CTA on the frontend; v0.5.0 added the PR-less
+discussion surface with its own write gate; v0.6.0 sweeps the rest
+and adds a regression test net so future endpoints can't quietly
+ship without a gate. No schema migration, no env-var changes, no
+new dependencies. The only behavioural change is one tightening: the
+`GET /api/rfcs/<slug>/graduate/progress` SSE now requires
+`auth.require_user` since it surfaces operator-visible step detail
+(repo name, PR number, rollback steps) not part of the v0.3.0
+anonymous-read contract for catalog/RFC bodies.
+
+### Changed
+
+- **`backend/app/api_graduation.py`** — `GET /graduate/progress`
+  now calls `auth.require_user(request)` as its first line.
+  Anonymous callers receive 401 instead of being able to subscribe
+  to a graduation's SSE. The floor is `require_user` (not
+  `require_contributor`) so a write-muted operator can still observe
+  the progress of a graduation they kicked off before being muted.
+- **SPEC `§6.1`** (`SPEC.md`) — the Anonymous role's bullet now
+  documents the v0.6.0 audit: every write-shaped endpoint in §17
+  enforces an explicit gate; anonymous writes refuse 401. The list
+  of audited write families is recorded in-line.
+- **SPEC `§10.10`** — the discussion-vs-contribution section now
+  records that the v0.5.0 write gates have a regression test net
+  (`test_anon_offlimits_vertical.py`) added in v0.6.0.
+- **SPEC `§17`** — the `GET /api/rfcs/<slug>/graduate/progress`
+  bullet now documents the `require_user` gate added in v0.6.0,
+  with the rationale.
+
+### Added (tests)
+
+- **`backend/tests/test_anon_offlimits_vertical.py`** — twelve new
+  tests asserting that every write-shaped endpoint surveyed in the
+  v0.6.0 audit refuses anonymous callers with 401, and that the five
+  anonymous-read surfaces (health, philosophy, auth/me, catalog,
+  RFC view, discussion threads, proposals) stay reachable. Sixty-six
+  assertions in total, covering: propose; proposal merge / decline /
+  withdraw; branch promote-to-branch / start-edit-branch / metadata /
+  manual-flush / visibility / grants (POST + DELETE) / threads (POST)
+  / messages (POST) / resolve / chat-seen / changes (accept / decline
+  / reask) / chat-stream; super-draft start-edit-branch + metadata;
+  PR pr-draft / open / seen / review / merge / withdraw /
+  description / resolution-branch; discussion thread create + message
+  post + resolve; admin role / mute / allowlist (POST + DELETE) plus
+  the admin reads; notification preferences / quiet-hours / watch /
+  mark-read / user-mute (POST + DELETE); funder credentials (POST +
+  DELETE) + consent (POST + DELETE); graduation kickoff + claim +
+  progress SSE; PR review page anonymous-readable.
+
+### Anonymous-writeable allowlist
+
+Two endpoints are intentionally anonymous-by-design. They are not
+audit findings; they are documented here so the contract is
+explicit:
+
+- `GET  /auth/login` and `GET  /auth/callback` — the OAuth
+  round-trip. Anonymous-by-design because they ARE the sign-in
+  entrypoint.
+- `POST /api/webhooks/gitea` and `POST /api/webhooks/email-bounce`
+  — anonymous in the session sense but authenticated by HMAC shared
+  secret (`GITEA_WEBHOOK_SECRET` and `WEBHOOK_EMAIL_BOUNCE_SECRET`
+  respectively). The webhook receiver is the wrong place for an
+  authenticated session; the shared-secret shape is correct.
+
+### §19.2 candidates surfaced
+
+- None unique to this release. The two pre-existing candidates the
+  audit touched — anonymous-read polish for the discussion surface
+  (carried from v0.5.0) and the operator-visibility floor on
+  graduation progress — were settled here as `require_user` on
+  `/graduate/progress` rather than deferred.
+
+### Upgrade steps (from 0.5.0)
+
+1. The deployment **MUST** rebuild the frontend (`npm install &&
+   npm run build`) so the frontend bundle's reported version matches
+   the backend's. No new env vars; existing `frontend/.env` is
+   sufficient.
+2. The deployment **MUST** restart the backend so the new
+   `require_user` gate on `/graduate/progress` is enforced. No
+   schema migration runs.
+3. The deployment **MAY** announce the audit completion to
+   operators: every write-shaped backend endpoint now enforces an
+   explicit gate, and the `test_anon_offlimits_vertical.py` test
+   net asserts the contract on every CI run. The audited surfaces
+   are listed in the `Added (tests)` section above and in `SPEC.md`
+   §6.1.
+4. The deployment **MUST NOT** assume any new envelope behaviour:
+   v0.6.0 is purely a hardening release. No schema, no env, no
+   dependency changes; the operator's role is reduced to rebuild +
+   restart.
+
+
+## 0.5.0 — 2026-05-27
+
+**Minor — no operator action required.** This release wires the
+PR-less per-RFC discussion surface (roadmap item #3, SPEC §10.10).
+An RFC's main view now carries a discussion panel distinct from PR
+comments and branch chat; contribution — proposing edits the document
+will land — still requires opening a PR via the §10.1 affordance.
+The substrate is the existing `threads` / `thread_messages` tables;
+rows with `threads.branch_name IS NULL` scope to the RFC's main view.
+No schema migration is required.
+
+### Added
+
+- **PR-less discussion endpoints** (`backend/app/api_discussion.py`)
+  mounted at `/api/rfcs/<slug>/discussion/...`:
+  - `GET  /api/rfcs/<slug>/discussion/threads` — list threads where
+    `threads.branch_name IS NULL`. Anonymous-readable per the v0.3.0
+    contract; the default whole-doc chat thread is materialized
+    lazily on first read.
+  - `POST /api/rfcs/<slug>/discussion/threads` — open a new
+    discussion thread (`thread_kind='chat'`, `anchor_kind='whole-doc'`,
+    `branch_name=NULL`). Body: optional `label`, optional first
+    `message`. Requires contributor role.
+  - `GET  /api/rfcs/<slug>/discussion/threads/<thread_id>/messages`
+    — read messages on a discussion thread. Anonymous-readable.
+  - `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages`
+    — post a message. Body: `text`, optional `quote`. Requires
+    contributor role.
+  - `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve`
+    — resolve a discussion thread. Permission per §10.10: thread
+    creator, RFC owner / arbiter, or app admin / owner.
+- **`RFCDiscussionPanel.jsx`** — the right-column surface on the RFC
+  view when the viewer is on `main`. Composer requires sign-in;
+  Cmd/Ctrl+Enter sends. Multiple threads surface as pill-shaped
+  tabs above the message feed. A "New thread" affordance opens a
+  fresh thread on the same RFC.
+- **SPEC `§10.10` PR-less discussion vs. contribution** — settles
+  the distinction between discussion (RFC-scoped, no PR, both
+  anonymous-readable and contributor-writeable) and contribution
+  (still requires a PR via §10.1). Also extends `§5`'s `threads`
+  table commentary so the null-branch interpretation is documented
+  as actively used rather than reserved scaffold.
+- **SPEC `§17`** — lists the five new `discussion/...` endpoints
+  in the illustrative table.
+
+### Changed
+
+- **`backend/app/chat.py`** — `_fan_out_chat` now passes
+  `branch_name` straight through to the notify chokepoint instead of
+  coercing `None` to `"main"`. The notifications row carries the
+  null through, which preserves the §15.7 reconciler's keying on
+  `(rfc_slug, branch_name)` for the eventual discussion-side
+  chat-seen advance (deferred to a §19.2 candidate). Existing
+  branch-scoped chat continues to pass non-null branch names; the
+  change is invisible to that path.
+- **`backend/app/notify.py`** — `fan_out_chat_message`'s
+  `branch_name` parameter is now typed `str | None` to match the
+  v0.5.0 PR-less shape. Routing rules are unchanged; the inbox prose
+  renders identically whether the chat lives on a branch or on the
+  RFC's discussion surface, which is the right honest signal.
+- **`RFCView.jsx`** — the right-column panel is now conditional:
+  when `branchParam === 'main'`, render `RFCDiscussionPanel`
+  (the new PR-less surface); otherwise render the existing
+  `ChatPanel` (branch chat unchanged).
+
+### §19.2 candidates surfaced
+
+- PR-less discussion: range / paragraph anchors (the data model
+  permits them; the UI is the deferred part).
+- PR-less discussion: distinct notification `event_kind`s
+  (`open_rfc_discussion_thread`, etc.) if usage shows contributors
+  want to filter discussion-vs-branch in the §15.2 inbox.
+- PR-less discussion: chat-seen cursor closing the §15.7
+  reconciliation loop for the new surface.
+- PR-less discussion: AI participant invocation (discussion-only,
+  no `<change>` block side-effects).
+- PR-less discussion: anonymous-read polish to match the v0.6.0
+  write-gate hardening (item #4).
+
+### Upgrade steps (from 0.4.0)
+
+1. The deployment **MUST** rebuild the frontend (`npm install &&
+   npm run build`) so `RFCDiscussionPanel.jsx` ships in the bundle.
+   No new env vars; existing `frontend/.env` is sufficient.
+2. The deployment **MUST** restart the backend so the new
+   `api_discussion` router mounts. No schema migration runs — the
+   `threads` table already supports `branch_name IS NULL` per §5,
+   and the v0.5.0 build is the first to write rows in that shape.
+3. The deployment **MAY** announce the new surface to its
+   contributors: the RFC view's main page now carries a discussion
+   panel below the document. Existing branch chat and PR review
+   surfaces are unchanged.
+4. The deployment **SHOULD NOT** expect a hardening of the
+   anonymous-write gate in v0.5.0 — that lands in v0.6.0 (item #4).
+   v0.5.0's write paths already refuse anonymous posts, so no
+   pre-emptive operator action is needed.
+
+## 0.4.0 — 2026-05-27
+
+**Minor — no operator action required beyond rebuild + restart.** The
+proposer of a new RFC is now the implicit first owner of its super-
+draft entry, set automatically at propose time from the session user.
+The §13.1 claim flow remains available for *additional* owners. No
+schema changes, no env-var changes, no API-shape changes; only newly
+proposed RFCs receive the auto-owner — existing super-drafts whose
+`owners:` is empty are unaffected and can still be claimed via §13.1
+as before. This is a §19.3 rule-2 spec correction: `SPEC.md` §9.1,
+§9.2, and §13.1 are updated to reflect the new shape.
+
+### Changed
+
+- **`POST /api/rfcs/propose`** (`backend/app/api.py`) now sets
+  `Entry.owners = [user.gitea_login]` when constructing the new
+  super-draft entry, instead of `owners=[]`. The session's
+  `gitea_login` is the canonical source; the endpoint never accepted
+  an owner field from the request payload and still doesn't.
+- **`SPEC.md` §9.1** narrowed: the "no proposed-owner or working-
+  group fields" sentence becomes a proposer-owner-auto / working-
+  group-deferred split, with a §19.3 rule-2 note.
+- **`SPEC.md` §9.2** frontmatter shape: `owners: []` → `owners:
+  [<proposer.gitea_login>]`, with a §19.3 rule-2 note.
+- **`SPEC.md` §13.1** reframed: claim flow is now a graduation-time
+  broadening for additional owners, not a precondition for the
+  proposer's own RFC. The §13.1 / §13.2 / §13.3 graduation pipeline
+  itself is unchanged — the "at least one owner" precondition for
+  graduation still holds and is now satisfied by default.
+
+### Upgrade steps (from 0.3.0)
+
+1. The deployment **MUST** rebuild and restart per the routine
+   deploy steps. No `.env` changes, no schema/migration changes, no
+   API-shape changes.
+2. Operators **SHOULD** note that newly proposed RFCs after the
+   upgrade carry the proposer in `owners:` automatically. Existing
+   super-drafts with empty `owners:` are not migrated; they remain
+   claimable via the §13.1 flow exactly as before. No deployment-
+   side data action is required.
+3. Deployments **MAY** communicate the UX shift to active proposers
+   (the "Claim ownership" affordance no longer applies to your own
+   newly proposed RFC), but the affordance simply hides on RFCs the
+   viewer already owns, so no operator-side action is required.
+
+## 0.3.0 — 2026-05-27
+
+**Minor — operator action required if a deployment wants to enable the
+private-beta gate; no action required to stay open.** This release adds
+an email allowlist that, when populated, restricts OAuth sign-in to the
+listed emails while keeping all read paths public. Anonymous visitors
+now see the full app (catalog, RFC bodies, public branch conversations)
+in read-only mode instead of the §14.1 landing-page wall.
+
+### Added
+
+- **`allowed_emails` table** (`backend/migrations/011_allowlist.sql`).
+  Empty list = gate off (any successful OAuth provisions a user, as
+  before). Any rows present = gate on (only listed emails, plus
+  users already grandfathered by `gitea_id`, may sign in).
+- **Admin → Allowlist tab** at `/admin/allowlist`. Add/remove emails,
+  see who added each row and when. Status banner shows whether the
+  gate is currently active.
+- **`/beta-pending` page** shown after a rejected OAuth callback. Free-
+  text invite-contact line is configurable via the new
+  `VITE_BETA_CONTACT` env var (optional; falls back to a generic line).
+- **Beta chips** next to the Discuss/Contribute mode toggle, the Sign
+  in link, and the header Sign-in button so anonymous viewers see
+  immediately what is gated.
+- **Anonymous read mode** in the React app: the §14.1 Landing page is
+  preserved at `/welcome` for deployments that want to link to it, but
+  the default route now renders the full app shell with write
+  affordances hidden behind a sign-in CTA.
+
+### Changed
+
+- **`/auth/callback`** now consults `auth.is_allowed_sign_in()` after
+  fetching the Gitea profile. Rejected sign-ins clear the OAuth state
+  and redirect to `/beta-pending`; the session is not populated.
+- **`Catalog`** receives a `viewer` prop. Anonymous viewers see "Sign
+  in to propose (Beta)" instead of "+ Propose New RFC".
+- **`PhilosophyWithSidebar`** now reads `authenticated` from the
+  current viewer instead of hardcoded `true`.
+
+### Fixed
+
+- **Single-finger scroll on the `/philosophy` page** (and any other
+  `.chrome-pane`-hosted view: `/admin/*`, `/settings/notifications`)
+  was broken on iOS Safari. The `.app` container used `height: 100vh`,
+  which on iOS measures the URL-bar-hidden ("largest") viewport — so
+  `.app` overflowed what's actually visible. Combined with the
+  `body { overflow: hidden }` in `index.css`, this meant single-finger
+  touches on the visible area were consumed by the (blocked) page-
+  level scroll attempt rather than reaching the nested `.chrome-pane`
+  scroll. Two-finger touches bypassed the page-level layer and
+  one-finger then worked once the URL bar had collapsed. Switched
+  `.app` to `height: 100dvh` (dynamic viewport — adjusts as the URL
+  bar shows/hides), with `100vh` retained as a fallback for browsers
+  predating iOS 15.4 / Chrome 108.
+
+### Upgrade steps (from 0.2.3)
+
+1. The deployment **MUST** rebuild the frontend with the new
+   `VITE_BETA_CONTACT` env var optionally set in `frontend/.env` (it
+   is OK to leave it blank — the `/beta-pending` page falls back to
+   a generic line).
+2. The deployment **MUST** restart the backend so migration
+   `011_allowlist.sql` runs. No data loss; the new table starts
+   empty, which keeps the gate off and preserves existing behavior.
+3. To **enable** the private-beta gate, the deployment operator
+   **SHOULD** sign in once (so their `users` row exists and they
+   grandfather in by `gitea_id`), then open `/admin/allowlist` and
+   add the first invited email. The first row added turns the gate
+   on for any user not yet in `users`.
+4. To **stay open**, do nothing — leave `allowed_emails` empty and
+   the deployment behaves exactly as 0.2.3.
+5. The deployment **MAY** customise its `/beta-pending` contact line
+   by setting `VITE_BETA_CONTACT` (an email, a URL, or a short
+   instruction) before the frontend build. Unset is fine.
+
 ## 0.2.3 — 2026-05-26
 
 **Patch — no operator action required.** Rebuild and restart per the

SPEC.md

@@ -253,13 +253,18 @@ and exact columns are illustrative; the implementing session can adjust.
 - `threads` — every conversation in the system, whether scoped to an RFC's
   main view, a branch, or a span within a branch's document. Columns:
   `id`, `rfc_slug`, `branch_name` (nullable — null means scoped to the
-  RFC's main view), `anchor_kind` (`whole-doc` | `range` | `paragraph`),
+  RFC's main view, the PR-less per-RFC discussion surface per §10's
+  closing note; non-null means scoped to a branch's work, including
+  PR-comment threads), `anchor_kind` (`whole-doc` | `range` | `paragraph`),
   `anchor_payload` (JSON: serialized ProseMirror range or paragraph id),
   `thread_kind` (`chat` | `flag` | `review` — `review` is the diff-anchored
   PR-review thread defined in §10.4), `label` (short human-authored summary;
   for flags this is the entire content), `state` (`open` | `resolved` |
   `stale`), `created_by`, `created_at`, `resolved_at`, `resolved_by`.
-  Visibility is derived from the underlying branch (§11.1).
+  Visibility is derived from the underlying branch (§11.1); for the
+  null-branch PR-less discussion surface, visibility follows the RFC
+  (anonymous read open per the §14 / v0.3.0 contract, write requires
+  contributor per §6.1, tightened toward anon-write-refused in v0.6.0).
 - `thread_messages` — the actual chat content for `chat`-kind threads.
   Columns: `id`, `thread_id`, `role` (`user` | `assistant` | `system`),
   `author_user_id` (nullable; null for assistant), `model_id` (nullable;
@@ -327,6 +332,13 @@ and exact columns are illustrative; the implementing session can adjust.
 - `actions` — append-only audit log for every state transition, every
   graduation, every grant change. Includes the acting user, the bot
   commit hash if any, and the on-behalf-of trailer applied.
+- `cookie_consent` — per-user record of the §14.5 cookie consent
+  choice. One row per user. Columns: `user_id` (PK, FK users), three
+  flags (`essential`, `analytics`, `other_cookies`), and
+  `recorded_at`. `essential` is permanently 1; `recorded_at` is set
+  on first write and updated on every change. Absence of a row means
+  "no choice yet" — the banner shows. Anonymous viewers persist their
+  choice in `localStorage` only, with no corresponding row here.
 
 **Super-draft scoping.** For rows in `threads` and `changes` where the
 entry referenced by `rfc_slug` is in state `super-draft`, `branch_name`
@@ -344,17 +356,61 @@ merge with no data movement.
 
 Authorization is owned by the app. Gitea sees only the bot account.
 
+Authentication has three paths, in the order a visitor encounters
+them:
+
+1. **Email + one-time code (OTC).** The v0.7.0 primary path: a
+   visitor enters their email address, receives a six-digit code via
+   SMTP, and exchanges the code for a session. Used by every visitor
+   on first sign-in, and as the fallback for the other two paths.
+2. **Email + passcode (with OTC fallback).** Added in v0.10.0
+   (roadmap item #8). After a successful OTC sign-in, the visitor
+   may set a user-chosen passcode (4–20 characters, bcrypt-hashed at
+   rest) and use email + passcode on subsequent sign-ins. Five
+   consecutive failed verifies lock the passcode path for 15 minutes
+   (HTTP 423); during the lockout the user falls back to OTC. The
+   OTC path is unaffected by the passcode lockout, so a forgotten
+   passcode is recovered by requesting a fresh OTC — there is no
+   separate "forgot passcode" flow. The user can remove the passcode
+   at any time from the §6.2 sign-in settings tab, returning to
+   OTC-only.
+3. **Gitea OAuth fallback (migration only).** The v0.1 OAuth
+   callback remains functional during the v0.7.0 window, with a
+   small "Sign in with Gitea (fallback)" link on `/login` so users
+   with active OAuth sessions or older invite paths still have a
+   way in. Scheduled for removal in a future release per §19.2.
+
+`users.gitea_id` is preserved on existing rows so a grandfathered
+user signing in via any of the three paths resolves to the same row.
+`users.email` is the identity key for everything provisioned after
+v0.7.0; `users.gitea_id` is the grandfathering linker (nullable,
+partial-unique). The Gitea bot user + token are still required for
+server-side git operations (repo reads, PR creation); only the
+operator-facing sign-in surface moved.
+
 ### 6.1 Four roles, each a strict superset of the one below
 
 1. **Anonymous.** Can read public RFCs (the meta repo's main branch,
    every RFC repo's main branch), read any branch whose `read_public`
    is true, read any PR. Cannot chat, propose, create branches, or
-   open PRs.
-2. **Contributor.** Default role for any authenticated account.
-   Everything anonymous can do, plus: propose new RFCs (open a PR
-   against the meta repo), create branches on any RFC repo, open PRs
-   from branches they have contribute access to, chat on anything
-   they can read, claim ownership of unclaimed super-drafts.
+   open PRs. v0.6.0 (roadmap item #4) closed the audit: every
+   write-shaped endpoint surveyed in §17 enforces an explicit
+   `auth.require_contributor` (or stricter) gate before doing any
+   state-changing work; anonymous writes refuse 401. The explicit
+   audit covers propose, branch create, branch threads, PR-less
+   discussion threads + messages, PR open / merge / withdraw,
+   funder credentials + consent, admin allowlist add, graduation
+   kickoff + claim. Anonymous reads on every catalog and RFC-body
+   surface remain open per the v0.3.0 contract.
+2. **Contributor.** Default role for any authenticated account. A
+   first OTC sign-in by a previously unknown email provisions a row
+   at this role; v0.7.0 keeps the v0.3.0 allowlist gate (`allowed_emails`)
+   as the admission control, deferring the open beta-access request
+   flow to a later release. Everything anonymous can do, plus:
+   propose new RFCs (open a PR against the meta repo), create
+   branches on any RFC repo, open PRs from branches they have
+   contribute access to, chat on anything they can read, claim
+   ownership of unclaimed super-drafts.
 3. **Admin.** Everything contributor can do, plus: act on any RFC
    (merge PRs on behalf of arbiters, graduate super-drafts, set
    branch visibility on anyone's behalf, downgrade or restore
@@ -372,6 +428,14 @@ subject to the standard 30/90 hygiene rules (§12). Restoring is the
 reverse action. Every mute and restore is logged in
 `permission_events`.
 
+The write-mute is keyed on `users.id` and is auth-path-agnostic: a
+contributor muted under the v0.1 OAuth-era flow stays muted after
+the v0.7.0 email/OTC migration, since the same row is reused via the
+email-match linker. Identity in this section means the `users.id`
+column; the v0.7.0 identity-key shift (`gitea_id` → `email`) is
+about which column carries the unique constraint for new
+provisioning, not about which column the permission gates read.
+
 This write-mute is structurally distinct from the two notification
 mutes introduced in §15.8 — the per-RFC notification mute (the
 `muted` state on the `watches` row, §15.6) and the per-user
@@ -1120,12 +1184,20 @@ The modal collects four fields:
   type their own.
 
 No proposer name or email — the logged-in identity is canonical and
-need not be retyped. No proposed-owner or working-group fields —
-ownership flows through the post-merge claim flow (§13.1), and
+need not be retyped. No proposer-owner field either: the proposer is
+implicitly the first owner of their own RFC, set automatically at
+submit-time from the session user (see §9.2); the post-merge claim
+flow (§13.1) remains for *other* contributors to add themselves as
+owners on an RFC they didn't propose. No working-group field —
 arbiters are admin work, not the proposer's call. AI's drafting role
 is intentionally narrow: tag suggestions only. The proposer is
 making a specific claim about a specific word, and having AI propose
-the claim for them would undercut the gesture.
+the claim for them would undercut the gesture. (§19.3 rule-2
+correction: 0.4.0 narrowed this paragraph; the prior version asserted
+"no proposed-owner field" without qualification, but running code
+revealed that forcing a separate claim-flow gesture for the
+proposer's own RFC was UX friction with no benefit — the proposer
+already self-identified by proposing.)
 
 Primary action: **"Open proposal PR"** — naming the actual Git
 artifact produced, consistent with §10.1's *Open PR* and §13's
@@ -1141,7 +1213,13 @@ is populated from the modal and session:
 - `state: super-draft`, `id: null`, `repo: null`,
   `graduated_at: null`, `graduated_by: null` — fixed at creation.
 - `proposed_by: <session email>`, `proposed_at: <today>` — auto.
-- `owners: []` — empty; the claim flow (§13.1) fills this.
+- `owners: [<proposer.gitea_login>]` — the proposer is the first
+  owner at propose time, set automatically from the session user.
+  The §13.1 claim flow remains available for *additional* owners on
+  the same entry. (§19.3 rule-2 correction: 0.4.0 changed this from
+  `owners: []`; the prior shape required a separate claim-flow
+  gesture for the proposer's own RFC, which running code surfaced
+  as needless UX friction.)
 - `arbiters: []` — empty; arbiters are admin work, not the
   proposer's call.
 
@@ -1625,6 +1703,44 @@ framework's evidence unit; admitting plumbing commits — "fix merge
 conflict with main" — into that timeline would dilute the signal each
 commit is meant to carry.
 
+### 10.10 PR-less discussion vs. contribution
+
+PR comments and branch chat (§10.4, §8.4) are PR-scoped: they live on
+the `threads` rows whose `branch_name` names a branch (the PR's head
+or, pre-PR, a feature branch). They are the right surface for *this
+specific proposed change*. They are not the right surface for "what
+about this part of the RFC overall?" or "have we considered…?" — a
+question that doesn't yet warrant cutting a branch and that would
+distort a PR's review timeline if it landed there.
+
+The RFC view carries a **discussion surface** distinct from PR
+comments. Its substrate is `threads` rows whose `branch_name IS NULL`
+(§5) — the same conversation table used by branch chat, with the
+nullable column doing the segregating. Posting a discussion thread or
+message does not open a PR; the §1 chokepoint is unaffected because
+chat messages never produced Git writes. Contribution — proposing
+edits the document will land — still requires opening a PR via the
+§10.1 affordance.
+
+The distinction in one line: **discussion is what the RFC is for;
+contribution is how the RFC changes.** Either is honest; conflating
+them was the failure mode of generic-PR-comments-as-only-conversation.
+
+Reads on the discussion surface follow §14 / the v0.3.0 anonymous-read
+contract: anyone can see the conversation. Writes require contributor
+role per §6.1: v0.5.0 implemented the gate on the three discussion
+write paths (POST threads, POST messages, POST resolve); v0.6.0 (item
+#4) audited the adjacent surfaces and added the matching test net
+(`test_anon_offlimits_vertical.py`) so a regression on any write
+endpoint is caught immediately. The gates use `auth.require_contributor`
+as the canonical helper. The notification routing reuses the
+existing `chat_message_in_participated_thread` /
+`chat_reply_to_my_message` event kinds with `branch_name=null` on the
+fan-out row; the §15.7 reconciler and §15 inbox prose render
+identically whether the chat lives on a branch or on the RFC's
+discussion surface. A distinct `open_rfc_discussion_thread` event
+kind is a §19.2 candidate if evidence demands the split.
+
 ---
 
 ## 11. Branches and PRs: visibility, contribute, lifecycle
@@ -1718,11 +1834,20 @@ PR do not block graduation; they remain on the meta repo subject to
 
 ### 13.1 Claim ownership (prerequisite)
 
-If a super-draft has no owner, any signed-in contributor can click
-"Claim ownership," which opens a PR against the meta repo adding their
-username to the `owners:` field of the entry. Owners and admins can
-merge. (A self-merge window for un-acted claims is not enabled in v1;
-configurable later if needed.) Multiple claims simply append.
+The proposer is already the first owner of any super-draft they
+proposed (per §9.2; auto-set at propose time). The claim flow exists
+for *additional* contributors to become owners on an existing super-
+draft — typically a draft whose proposer has stepped away, or a draft
+graduating with a working group. Any signed-in contributor can click
+"Claim ownership," which opens a PR against the meta repo adding
+their username to the `owners:` field of the entry. Owners and admins
+can merge. (A self-merge window for un-acted claims is not enabled in
+v1; configurable later if needed.) Multiple claims simply append.
+(§19.3 rule-2 correction: 0.4.0 narrowed this section's framing; the
+prior version implied owners always started empty and the claim flow
+was a hard prerequisite to graduation, but with the proposer now
+auto-set as first owner, the claim flow is a graduation-time
+broadening rather than a precondition for the proposer's own RFC.)
 
 ### 13.2 The Graduate dialog
 
@@ -1872,8 +1997,36 @@ and its public face.
 The app's root URL, accessed by an unauthenticated visitor, renders a
 landing page consisting of the title, the subtitle, and the short-form
 deck from the top of `PHILOSOPHY.md` (see §2). Beneath the deck, a
-single primary action: "Sign in with Gitea." Beneath that, a secondary
-link: "Read the full philosophy" → `/philosophy`.
+single primary action: "Sign in" → the email + one-time-code surface
+at `/login` (per §6.2). Beneath that, a secondary link: "Read the
+full philosophy" → `/philosophy`. The v0.1 landing said "Sign in
+with Gitea"; v0.7.0's email/OTC surface replaced that as the primary
+gesture, with a small "Sign in with Gitea (fallback)" link surviving
+on `/login` itself for the migration window.
+
+`/login` itself is a stepped surface, driven by which auth path the
+viewer is currently on (§6):
+
+1. **Email step.** The viewer enters their email. The frontend
+   consults `GET /auth/passcode/check?email=…` to learn whether
+   this email has a passcode set. The check endpoint is
+   account-enumeration-safe — it returns `has_passcode: false` for
+   both "unknown email" and "known email without passcode", so a
+   probing client cannot distinguish the two from the response.
+2. **Either the passcode step or the OTC code step.** If the email
+   has a passcode set, the viewer is asked for it (v0.10.0).
+   Otherwise an OTC is dispatched and the viewer is asked for the
+   six-digit code from their email (v0.7.0).
+3. **Optional post-OTC passcode-offer step.** After a successful
+   OTC verify on an account with no passcode set, the surface
+   asks "Set a passcode for faster sign-in next time?" — the user
+   can dismiss the offer or set one inline. The skip-for-now path
+   redirects straight to `/`.
+
+The passcode step carries a "Use a code instead" link that
+re-dispatches an OTC and switches to the code step — the same path
+the lockout response (HTTP 423) takes automatically after five
+consecutive failed passcode verifies.
 
 This is the front door. It sets expectation before the user encounters
 the mechanics, so the mechanics (super-drafts, graduation, public
@@ -1911,6 +2064,92 @@ The visual design of the landing page and the `/philosophy` route —
 typography, layout, illustrations if any — is deferred. The structural
 decisions above are the binding part.
 
+### 14.5 Cookie / privacy consent (v0.13.0)
+
+The framework ships a non-modal cookie consent banner reachable by
+every viewer — authenticated and anonymous alike. The banner appears
+at the bottom of the viewport on first load and stays visible until
+the user makes a choice, after which it hides and the choice is
+persisted. The `/settings/notifications` page carries a "Privacy &
+cookies" tab that surfaces the current choice and re-opens the banner
+on demand.
+
+The choice has three categories, presented as a single-select:
+
+- **Essential only** — the framework's strictly-necessary cookies
+  (sign-in session, signed payloads, the consent-choice record
+  itself). Always on; the user cannot switch this off because the
+  app cannot function without it.
+- **Essential + analytics** — adds the optional analytics layer
+  gated by this choice. As of v0.13.0 no analytics SDK ships in the
+  framework; roadmap item #13 (v0.15.0) lands one behind this gate.
+  Off by default — the user has to opt in.
+- **Essential + analytics + other** — adds third-party embeds or
+  social widgets a deployment may configure. The framework ships no
+  such cookies by default; this category exists so deployments that
+  add them have a categorized opt-in to wire them behind.
+
+Storage shape:
+
+- **Anonymous viewer** — choice persists in `localStorage` only
+  (`rfc-app.cookie-consent.v1`). The same browser carries the choice
+  forward; a different browser, or cleared storage, re-prompts.
+- **Authenticated viewer** — choice persists in the `cookie_consent`
+  row keyed by `user_id`. On sign-in, the server row (if present)
+  overrides the local snapshot; if the server has no row, the local
+  choice is uploaded.
+
+The `essential` flag is permanently true at the API surface. The
+endpoint accepts it for symmetry but never persists a false value.
+A deployment that wants strictly-necessary cookies to be optional
+must change the framework contract, not flip a flag.
+
+The framework exports a small JavaScript helper (`frontend/src/lib/
+consent.js`) for downstream surfaces:
+
+- `getConsent()` — current snapshot.
+- `hasChosen()` — true once the user has made a choice.
+- `onConsentChange(cb)` — subscribe to updates.
+- `setConsent({analytics, other})` — record a new choice locally
+  (the banner / settings surface handles server persistence on top).
+
+Roadmap item #13's analytics SDK (v0.15.0) will read from this helper:
+read consent, then conditionally `import()` the SDK module. The gate
+is wired before the SDK lands so the contract is already in place.
+
+### 14.6 Privacy and cookies policy pages
+
+The framework ships two policy routes:
+
+- `/privacy` — a minimal default privacy policy that describes the
+  framework's stance (what is stored, why, how to revoke consent,
+  how to reach the deployment operator). The page is reachable by
+  anonymous and authenticated viewers alike.
+- `/cookies` — the framework's cookies policy, listing exactly which
+  cookies the framework sets, by category. Self-documenting: a future
+  framework release that adds or removes a cookie updates this page
+  as part of the change.
+
+Each page links to the other and to the §14.5 banner. The consent
+banner links to both.
+
+Deployments override the policy content via two optional build-time
+env vars documented in `frontend/.env.example`:
+
+- `VITE_PRIVACY_POLICY_URL` — an http(s) URL the `/privacy` page
+  links to as the "full deployment policy". The framework's stub
+  always renders above the link so the framework-level contract is
+  always visible; the link layers deployment-specific content on
+  top.
+- `VITE_COOKIES_POLICY_URL` — same shape for `/cookies`.
+
+Both are optional. Unset is the supported default; the stub pages are
+sufficient for a default-config deployment that has nothing
+deployment-specific to add. The framework chose the env-var path over
+a content-repo file because it composes with the existing build-time
+config layer; the content-repo-file alternative is the §19.2
+candidate.
+
 ---
 
 ## 15. Notifications
@@ -2427,6 +2666,60 @@ The follow-up session will refine this. A minimal starting set:
   returned `version` matches the tag the operator just deployed,
   catching the failure mode where a restart did not pick up the
   new code.
+- `POST /auth/otc/request` — unauthenticated. Body carries `email`.
+  Generates a six-digit code, stores its bcrypt hash with an expiry
+  (`OTC_TTL_MINUTES`, default 10), and dispatches a plain-text email
+  via the SMTP layer. Returns HTTP 200 (`{ok:true}`) uniformly so
+  allowlist state (§6.1 / §6.2) is not leaked to callers. Returns
+  HTTP 429 when the per-email cooldown (`OTC_REQUEST_COOLDOWN_SECONDS`,
+  default 60) blocks back-to-back requests — the loud-failure shape
+  for the abuse path. A re-request invalidates the prior unused
+  code for the same email so only one code is outstanding at a time.
+  Per §19.2's expected next session, this endpoint is the lead-up
+  to the Cloudflare-Turnstile abuse-mitigation overlay.
+- `POST /auth/otc/verify` — unauthenticated. Body carries `email` and
+  `code`. Validates the bcrypt hash against the most-recent unconsumed
+  non-expired row for the email, marks the row consumed, provisions
+  or links the `users` row by email (per §6.2's migration path —
+  match by `users.email` case-insensitive, otherwise insert a fresh
+  contributor row with `gitea_id = NULL`), and stores the session
+  cookie. Returns HTTP 200 on success with a minimal user payload;
+  HTTP 400 on any failure (expired, consumed, wrong, unknown). The
+  failure modes collapse to a single generic message so a probing
+  client cannot distinguish "you got the wrong code" from "we don't
+  know this email" — the operator logs carry the distinction.
+- `GET  /auth/passcode/check` — unauthenticated. Query param `email`.
+  Returns `{has_passcode: boolean}`. The frontend's `/login` surface
+  calls this after the email step to decide whether to render a
+  passcode input or fall back to OTC. The response carries only the
+  boolean; lockout state, the bcrypt hash, and the `passcode_set_at`
+  stamp are not leaked. An unknown email and a known-without-passcode
+  email both return `false`, so the endpoint is enumeration-safe.
+- `POST /auth/passcode/set` — authenticated (any role). Body carries
+  `passcode` (4–20 characters). bcrypt-hashes the passcode, writes
+  `users.passcode_hash` + `users.passcode_set_at`, clears the failure
+  counter and any active lockout. Refuses obvious patterns (a small
+  denylist: `0000`, `1234`, `aaaa`, `password`, etc.) and length
+  violations with HTTP 422. Replaces any prior passcode. v0.10.0.
+- `DELETE /auth/passcode` — authenticated. Clears
+  `users.passcode_hash` and `users.passcode_set_at`, returning the
+  user to OTC-only on next sign-in. v0.10.0.
+- `POST /auth/passcode/verify` — unauthenticated. Body carries
+  `email` and `passcode`. Locates the user, checks the lockout
+  window, and compares via bcrypt. On success: clears the failure
+  counter, refreshes `last_seen_at`, stores the session cookie,
+  returns HTTP 200 with the minimal user payload. On failure:
+  increments `passcode_failed_attempts`. After five consecutive
+  failures, stamps `passcode_locked_until = now + 15 minutes` and
+  returns HTTP 423 with a `locked_until` field; subsequent attempts
+  inside the window are refused with the same shape. After the
+  window expires, the next attempt clears the counter and proceeds
+  normally. The OTC path (§17 above) is unaffected by the passcode
+  lockout — a locked-out user can still request and verify a fresh
+  OTC. The wrong-passcode and unknown-email failure modes both
+  return HTTP 400 with a generic message; the no-passcode-set
+  failure also collapses to 400 so the response does not enumerate
+  account state. v0.10.0.
 - `GET /api/rfcs` — list entries with state, id, title, slug, repo,
   owners, last_active_at, has_open_prs, starred-by-me. Supports
   search, sort, filter chips, and the `unclaimed` predicate.
@@ -2482,7 +2775,13 @@ The follow-up session will refine this. A minimal starting set:
   trailing `rollback` step's events if any earlier step fails. The
   Graduate dialog opens this stream on confirm and renders the step
   stack from the events. The stream closes on success or on
-  rollback completion.
+  rollback completion. Requires `auth.require_user` per v0.6.0
+  (item #4): the step detail (repo name, PR number, rollback steps)
+  is operator-visible state and isn't part of the v0.3.0
+  anonymous-read contract for catalog and RFC bodies. The floor is
+  `require_user` (not `require_contributor`) so a write-muted
+  operator can still observe a graduation they kicked off before
+  being muted.
 - `GET  /api/rfcs/<slug>/blocking-prs` — list open meta-repo PRs
   against `rfcs/<slug>.md` per §13.2's precondition popover. Returns
   PR number, title, author, last-activity timestamp, and the
@@ -2529,6 +2828,26 @@ The follow-up session will refine this. A minimal starting set:
 - `POST /api/rfcs/<slug>/branches/<branch>/threads/<thread_id>/resolve`
   — resolve a thread per §8.12; permission per the rules in that
   section.
+- `GET  /api/rfcs/<slug>/discussion/threads` — list threads on the
+  RFC's PR-less discussion surface per §10.10 (rows where
+  `threads.branch_name IS NULL`). Anonymous-readable per the v0.3.0
+  anonymous-read contract; the default whole-doc chat thread is
+  materialized lazily on first read, mirroring the §8.12 branch-chat
+  default.
+- `POST /api/rfcs/<slug>/discussion/threads` — open a discussion
+  thread per §10.10. Body: optional `label` (short summary), optional
+  first `message`. Writes require contributor role; anonymous viewers
+  receive 401. Thread is created with `anchor_kind='whole-doc'`,
+  `thread_kind='chat'`, `branch_name=NULL`.
+- `GET  /api/rfcs/<slug>/discussion/threads/<thread_id>/messages` —
+  read messages on a discussion thread. Anonymous-readable.
+- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages` —
+  post a message into a discussion thread per §10.10. Body: `text`,
+  optional `quote`. Writes require contributor role.
+- `POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve` —
+  resolve a discussion thread per §10.10; permission collapses to the
+  thread creator, any RFC owner / arbiter per §6.3, and any app
+  admin / owner per §6.1.
 - `POST /api/rfcs/<slug>/branches/<branch>/open-pr` — open a PR per
   §10.1; body carries the AI-drafted (and possibly edited) title and
   description.
@@ -2634,6 +2953,16 @@ The follow-up session will refine this. A minimal starting set:
   short confirmation page.
 - `POST /api/webhooks/email-bounce` — bounce and complaint receiver
   per §15.4; sets the recipient's global email opt-out.
+- `GET  /api/users/me/cookie-consent` — read the signed-in user's
+  cookie consent record per §14.5. Returns `{essential, analytics,
+  other, recorded_at}`. `recorded_at: null` means "no choice yet"
+  and the banner should be shown; the framework treats absence of a
+  row as equivalent to that. `essential` is permanently true.
+- `PUT  /api/users/me/cookie-consent` — write the signed-in user's
+  cookie consent record per §14.5. Body: `{essential, analytics,
+  other}`. The `essential` flag is accepted for symmetry but always
+  persisted as true. Upserts (a single row per user) and stamps
+  `recorded_at` to now.
 
 Plus all the chat / streaming / model-picker endpoints, scoped to
 per-RFC and per-branch threads.
@@ -3264,6 +3593,55 @@ binding.
   ("operators MAY configure their monitoring to probe `/api/health`;
   the endpoint is unauthenticated by design"). §17 now lists the
   endpoint in its illustrative table.*
+- **PR-less discussion: range and paragraph anchors.** v0.5.0 lands
+  the structural discussion surface (§10.10) but constrains every
+  PR-less thread to `anchor_kind='whole-doc'` — the data model permits
+  `range` and `paragraph` anchors (§5) but the UI work to surface a
+  passage-anchored thread on a non-branch view is the deferred half.
+  The natural follow-on is a margin-icon affordance on the main view
+  matching §8.12's branch-side surface, with the anchor stored on the
+  null-branch thread. Earns its session when discussion volume warrants
+  the precision; v0.5.0's flat surface is sufficient for most "have we
+  considered…?" gestures. Touches §10.10 and §8.12.
+- **PR-less discussion: distinct notification event_kinds.** v0.5.0
+  routes per-RFC discussion messages through the existing
+  `chat_message_in_participated_thread` and `chat_reply_to_my_message`
+  event kinds with `branch_name=null` on the fan-out row. The inbox
+  prose reads identically whether the chat lives on a branch or on the
+  RFC's discussion surface, which is honest signal: the conversation
+  shape is the same; only the scope differs. A future session may
+  introduce `open_rfc_discussion_thread` / `post_rfc_discussion_message`
+  if evidence shows contributors want to filter discussion-vs-branch
+  chat distinctly in the §15.2 inbox. Touches §15.1 (the event_kind
+  enum), §15.2 (the inbox filter chips), and §10.10.
+- **PR-less discussion: chat-seen cursor.** §15.7 commits the
+  `branch_chat_seen` cursor for branch-scoped chat. The PR-less
+  discussion surface has no equivalent cursor in v0.5.0; the inbox
+  reconciler's keying on `(rfc_slug, branch_name)` does match a
+  null-branch advance, but no write path advances it. A natural
+  follow-on is a sibling table — `rfc_discussion_seen` or a
+  null-branch row on `branch_chat_seen` — that the discussion panel
+  advances on read, closing the §15.7 reconciliation loop for
+  discussion-surface notifications. Defer-able until inbox volume on
+  the new surface shows it matters.
+- **PR-less discussion: AI participation.** v0.5.0's discussion
+  surface is human-only — no AI participant invocation, no `<change>`
+  block parsing, no per-thread model picker. The branch chat (§8.12)
+  retains the §18 AI surface. The natural follow-on is wiring the AI
+  participant into discussion threads (the model picker, the
+  `Ask Claude` button on a selection tooltip) without enabling
+  document edits — a discussion-only AI turn produces only chat
+  content, no `changes` row, no commit. Contribution still requires a
+  PR; the AI's discussion-side help is just better prompts. Touches
+  §10.10, §8.12, and §18.
+- **PR-less discussion: anonymous read polish.** v0.5.0 inherits the
+  v0.3.0 anonymous-read contract — anyone can read; only signed-in
+  contributors can write. The composer affordance for anonymous
+  viewers ("Sign in to comment.") matches the existing read-only-bar
+  treatment but the surface has not yet been audited for the v0.6.0
+  hardening that tightens write gates app-wide. The §19.2 "public
+  face of discuss mode" entry overlaps; this entry is its discussion-
+  surface variant.
 - **Deployment-supplied subject framing.** The framework was built
   with one deployment in mind (OHM, standardizing natural-language
   vocabulary), but the substrate generalizes to any domain that
@@ -3317,6 +3695,142 @@ the new §15 (Notifications, in full), and §17 (the notification
 endpoints — list, mark-read, stream, watch mutation, preferences,
 quiet-hours, per-user mute, unsubscribe, bounce webhook).
 
+- **First-OTC profile capture.** *Surfaced by v0.7.0's email/OTC
+  migration.* When a fresh email lands at `/auth/otc/verify` with
+  no matching `users.email` row, v0.7.0 provisions the row with
+  `display_name = <local part of email>` and no other identity
+  fields. The roadmap item-#6 candidate (v0.8.0) is expected to
+  add a one-shot profile-capture step on the first-OTC sign-in:
+  first name, last name, and a free-text "why I want access" field
+  that flows into the open beta-access request queue (also item #6)
+  that replaces the v0.3.0 `allowed_emails` gate. The schema slot
+  exists implicitly already (`users.display_name` is updateable,
+  the audit-log + permission-events tables carry the freeform
+  notes); the structural decision is what gates the capture (modal
+  on `/login` after verify? a one-time redirect to `/welcome/profile`?
+  a deferred banner on the main view?) and how it interacts with
+  the open-access request flow that replaces the allowlist. Earns
+  its session as the v0.8.0 design pass.
+- **Removing the Gitea OAuth fallback.** *Surfaced by v0.7.0.*
+  v0.7.0 keeps `/auth/callback` functional and links to it as a
+  "Sign in with Gitea (fallback)" affordance on the new `/login`
+  surface, so users with active OAuth sessions or older invite
+  paths still have a way in during the migration window. A later
+  release retires the route entirely. Decision points: how do we
+  know "every active user has signed in via OTC at least once"
+  (probably: a `users.otc_first_signed_in_at` timestamp added in
+  v0.7.x and a query that confirms 100% population), how do we
+  handle users who never come back (probably: silently leave them
+  with stale rows; OAuth callback returning 404 is a sufficient
+  message), and whether the `/auth/login` and `/auth/callback`
+  routes get a tombstone redirect to `/login` or just 404. Earns
+  its session once the OTC adoption curve flattens.
+- **Device trust (30-day skip).** *Surfaced by v0.7.0 — the
+  signed-in cookie already lasts 30 days via SessionMiddleware,
+  but every sign-in still requires a fresh OTC or passcode.* The
+  roadmap item-#9 candidate adds a "trust this device" affordance
+  on the verify step that issues a longer-lived rotating token,
+  so returning visitors on the same device skip both the OTC and
+  the passcode step. The shape question is whether the trust is a
+  signed cookie distinct from the session, a row in a `device_trust`
+  table keyed by a random device-id, or a property of the session
+  itself; and whether the trust survives password-equivalent events
+  — v0.10.0's passcode-change and passcode-clear gestures are the
+  v1 instances — or only survives explicit logout. Earns its
+  session as the v0.11.0 design pass.
+- **Cloudflare Turnstile (or equivalent) on `/auth/otc/request`.**
+  *Surfaced by v0.7.0 — the endpoint is now the new abuse hot
+  path.* Per-email cooldown stops the trivial loop; what it
+  doesn't stop is a distributed scrape that fans out across a
+  large invitee list to harvest the "this email is admitted vs.
+  this email is not" signal indirectly (timing differences, SMTP
+  bounce-rate observation). The roadmap item-#10 candidate gates
+  the request endpoint behind a one-step browser-side challenge
+  before the bcrypt hash + SMTP send. Open questions: which
+  provider (Turnstile is the default since it's free and
+  privacy-respecting; hCaptcha and reCAPTCHA are also viable);
+  how the deployment configures it (`TURNSTILE_SITE_KEY` +
+  `TURNSTILE_SECRET_KEY` env vars, gated by `if
+  config.turnstile_site_key:` at the handler so existing
+  deployments don't break); whether the verify endpoint also
+  gets a challenge (probably yes for parity); and how the test
+  harness mocks the challenge. Earns its session as the v0.12.0
+  design pass.
+
+Candidates surfaced during v0.10.0 (user-set passcodes, §6.2 /
+roadmap item #8):
+
+- **Passcode policy tunables via env.** v0.10.0 hard-codes the
+  lockout shape (5 consecutive failures → 15-minute lockout) and
+  the min/max passcode length (4 / 20) in
+  `backend/app/passcode.py`. The denylist of obvious patterns is
+  also hard-coded. A deployment that wants tighter or looser rules
+  has to fork the constants. Two env vars
+  (`PASSCODE_LOCKOUT_AFTER_ATTEMPTS`,
+  `PASSCODE_LOCKOUT_DURATION_MINUTES`) would let operators
+  reshape the lockout without forking; a third
+  (`PASSCODE_MIN_LENGTH`) would cover the length floor. Earns its
+  session if a deployment surfaces evidence that the v1 defaults
+  bite.
+- **Per-IP rate-limiting on `/auth/passcode/verify`.** v0.10.0's
+  lockout is per-account: 5 failures against the same email lock
+  that account for 15 minutes. A distributed attacker that knows
+  many emails can fan out across them without ever tripping any
+  one account's lockout. Adding a per-IP throttle (e.g., 30
+  passcode-verify attempts / minute / IP, returning HTTP 429) is
+  the natural pairing. Defer-able — the per-account lockout is
+  the v1 shape that closes the loud-loop case; the per-IP
+  distributed case waits on evidence. Touches §6.2 and §17.
+- **Passcode-change "still know your old passcode" challenge.**
+  v0.10.0 lets a signed-in user replace their passcode from
+  `/settings/notifications` without re-entering the old one — the
+  session is sufficient. A future hardening pass may require the
+  old passcode (or a fresh OTC verify) before accepting the
+  change, to mitigate session-hijack scenarios where the attacker
+  rotates the passcode to lock the legitimate owner out. The same
+  question applies to the clear gesture. Earns its session if
+  session-hijack becomes a real threat surface.
+- **Passkey / WebAuthn.** A much heavier next step than passcodes:
+  hardware-backed device credentials that resist phishing. The
+  v0.10.0 passcode shape is a stopgap for the "I'd rather not
+  type a code every time" ergonomic problem; passkeys are the
+  long-term answer. Out of scope for the current roadmap —
+  earns a dedicated session if/when the deployment grows enough
+  that the phishing surface justifies the integration cost.
+
+Candidates surfaced during v0.13.0 (cookie / privacy consent, §14.5
+and §14.6):
+
+- **Policy content via content-repo file vs env var.** v0.13.0
+  shipped the deployment-policy-override path as two env vars
+  (`VITE_PRIVACY_POLICY_URL`, `VITE_COOKIES_POLICY_URL`) that the
+  framework's stub pages link out to. The alternative — accepting
+  a markdown file path the framework renders inline, parallel to
+  `PHILOSOPHY_PATH` per §14.2 — was deferred. The two compose:
+  a deployment could carry both an inline file (rendered above
+  the fold) and an external link (rendered below). Earns its own
+  topic when a real deployment ships a policy long enough that
+  the link-out shape bites and renders the link unread.
+- **Global Privacy Control / Do-Not-Track headers.** v0.13.0
+  scoped the consent surface to the in-app banner and did not
+  honor browser-side GPC or DNT signals. The framework's stance
+  is that the in-app banner is the authoritative gesture — a
+  user who clears their consent in the banner has expressed
+  intent, and the GPC header is a coarser signal layered on top.
+  Earns its own topic if a regulatory regime emerges that treats
+  GPC as the legally-binding gesture, in which case the framework
+  would honor GPC as an automatic "essential only" choice unless
+  the user explicitly broadened it in-app.
+- **Multi-language consent text.** The banner ships English-only.
+  i18n of the framework's user-facing strings is a broader topic
+  than the consent banner; carrying the work in that future topic
+  rather than as a per-surface translation pass.
+- **Analytics SDK gating against `consent.js`.** Roadmap item #13
+  (target v0.15.0) lands the analytics SDK behind
+  `lib/consent.js`'s `getConsent().analytics` gate. The framework
+  contract is already in place; the SDK integration is the work
+  the item ships. Listed here so the dependency is documented.
+
 ### 19.3 Working agreement for the queue
 
 Pre-build sessions ran on the queue agreement from prior versions

VERSION

@@ -1 +1 @@
-0.2.3
+0.10.0

backend/.env.example

@@ -81,3 +81,14 @@ WEBHOOK_EMAIL_BOUNCE_SECRET=
 # Production default is hourly; tests override to seconds via the same
 # env var.
 HYGIENE_TICK_SECONDS=3600
+
+# --- v0.7.0: email + one-time-code sign-in (§6.2) ---
+# How long a one-time code stays valid after issuance. Re-requesting
+# invalidates the prior code immediately regardless of TTL.
+OTC_TTL_MINUTES=10
+
+# Per-email cooldown between successive /auth/otc/request calls. The
+# endpoint returns HTTP 429 when the cooldown blocks a request (the
+# loud-failure shape so the abuse path is visible). Set to 0 to
+# disable the cooldown — useful for tests but never in production.
+OTC_REQUEST_COOLDOWN_SECONDS=60

backend/app/api.py

@@ -20,6 +20,7 @@ from pydantic import BaseModel, Field
 from . import (
     api_admin,
     api_branches,
+    api_discussion,
     api_graduation,
     api_notifications,
     api_prs,
@@ -81,6 +82,12 @@ def make_router(
     # the §15.8 mute typeahead) and the §6/§17 admin surfaces
     # (role, write-mute, audit-log, graduation-readiness queue).
     router.include_router(api_admin.make_router(config))
+    # v0.5.0: §5 / §7 / §10 — PR-less per-RFC discussion endpoints.
+    # The substrate is the existing threads/thread_messages tables;
+    # rows whose branch_name IS NULL scope to the RFC's main view.
+    # Contribution still requires a PR (api_prs above); this surface
+    # is for discussion that does not yet warrant a branch.
+    router.include_router(api_discussion.make_router())
 
     # ---------------------------------------------------------------
     # §17: /api/health — unauthenticated post-flight probe.
@@ -113,6 +120,17 @@ def make_router(
         user = auth.current_user(request)
         if user is None:
             return {"authenticated": False, "user": None}
+        # v0.10.0: surface a single `has_passcode` flag so the §6.2
+        # settings tab can render "Set passcode" vs. "Change/Remove
+        # passcode" without a second round trip. The set-at timestamp
+        # rides along for the same reason. The hash itself is never
+        # exposed.
+        row = db.conn().execute(
+            "SELECT passcode_hash, passcode_set_at FROM users WHERE id = ?",
+            (user.user_id,),
+        ).fetchone()
+        has_passcode = bool(row and row["passcode_hash"])
+        passcode_set_at = row["passcode_set_at"] if (row and has_passcode) else None
         return {
             "authenticated": True,
             "user": {
@@ -122,6 +140,8 @@ def make_router(
                 "email": user.email,
                 "avatar_url": user.avatar_url,
                 "role": user.role,
+                "has_passcode": has_passcode,
+                "passcode_set_at": passcode_set_at,
             },
         }
 
@@ -298,7 +318,11 @@ def make_router(
             proposed_at=entry_mod.today(),
             graduated_at=None,
             graduated_by=None,
-            owners=[],
+            # §9.2: the proposer is the implicit first owner at propose time.
+            # The §13.1 claim flow exists for *other* contributors to become
+            # owners on an RFC they didn't propose; the proposer never needs
+            # to claim their own RFC.
+            owners=[user.gitea_login],
             arbiters=[],
             tags=[t.strip() for t in payload.tags if t.strip()],
             body=payload.pitch.strip() + "\n",

backend/app/api_admin.py

@@ -50,6 +50,11 @@ class MuteBody(BaseModel):
     muted: bool
 
 
+class AllowlistAddBody(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+    note: str | None = Field(default=None, max_length=200)
+
+
 # ---------------------------------------------------------------------------
 # Router
 # ---------------------------------------------------------------------------
@@ -385,6 +390,103 @@ def make_router(config: Config) -> APIRouter:
             ]
         }
 
+    # ----- Private-beta allowlist (`migrations/011_allowlist.sql`) -----
+
+    @router.get("/api/admin/allowlist")
+    async def list_allowlist(request: Request) -> dict[str, Any]:
+        auth.require_admin(request)
+        rows = db.conn().execute(
+            """
+            SELECT a.email, a.note, a.created_at,
+                   u.gitea_login AS added_by_login,
+                   u.display_name AS added_by_display
+              FROM allowed_emails a
+         LEFT JOIN users u ON u.id = a.added_by_user_id
+             ORDER BY a.created_at DESC
+            """
+        ).fetchall()
+        return {
+            "active": len(rows) > 0,
+            "items": [
+                {
+                    "email": r["email"],
+                    "note": r["note"] or "",
+                    "added_by_login": r["added_by_login"],
+                    "added_by_display": r["added_by_display"],
+                    "created_at": r["created_at"],
+                }
+                for r in rows
+            ],
+        }
+
+    @router.post("/api/admin/allowlist")
+    async def add_allowlist(body: AllowlistAddBody, request: Request) -> dict[str, Any]:
+        viewer = auth.require_admin(request)
+        email = body.email.strip()
+        if "@" not in email or len(email.split("@")[-1]) < 2:
+            raise HTTPException(422, "Email looks malformed")
+        existing = db.conn().execute(
+            "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+        ).fetchone()
+        if existing is not None:
+            raise HTTPException(409, "Email already on the allowlist")
+        db.conn().execute(
+            """
+            INSERT INTO allowed_emails (email, added_by_user_id, note)
+            VALUES (?, ?, ?)
+            """,
+            (email, viewer.user_id, body.note),
+        )
+        # Audit trail: when the email already maps to a known user, emit a
+        # permission_events row so §6.5's log stays the single place to
+        # look for "who let this person in." For brand-new emails the
+        # allowed_emails row itself carries (added_by_user_id, created_at)
+        # which is sufficient until the user actually signs in.
+        subject = db.conn().execute(
+            "SELECT id FROM users WHERE email = ? COLLATE NOCASE LIMIT 1", (email,)
+        ).fetchone()
+        if subject is not None:
+            db.conn().execute(
+                """
+                INSERT INTO permission_events
+                    (actor_user_id, subject_user_id, event_kind, details)
+                VALUES (?, ?, 'allowlist_added', ?)
+                """,
+                (
+                    viewer.user_id,
+                    subject["id"],
+                    json.dumps({"email": email, "note": body.note or ""}),
+                ),
+            )
+        return {"ok": True, "email": email}
+
+    @router.delete("/api/admin/allowlist/{email}")
+    async def remove_allowlist(email: str, request: Request) -> dict[str, Any]:
+        viewer = auth.require_admin(request)
+        existing = db.conn().execute(
+            "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+        ).fetchone()
+        if existing is None:
+            raise HTTPException(404, "Email not on the allowlist")
+        db.conn().execute("DELETE FROM allowed_emails WHERE email = ?", (email,))
+        subject = db.conn().execute(
+            "SELECT id FROM users WHERE email = ? COLLATE NOCASE LIMIT 1", (email,)
+        ).fetchone()
+        if subject is not None:
+            db.conn().execute(
+                """
+                INSERT INTO permission_events
+                    (actor_user_id, subject_user_id, event_kind, details)
+                VALUES (?, ?, 'allowlist_removed', ?)
+                """,
+                (
+                    viewer.user_id,
+                    subject["id"],
+                    json.dumps({"email": email}),
+                ),
+            )
+        return {"ok": True, "email": email}
+
     return router
 
 

backend/app/api_discussion.py

@@ -0,0 +1,330 @@
+"""§5 / §7 / §10 — PR-less per-RFC discussion endpoints (v0.5.0).
+
+This module surfaces the discussion-without-PR shape committed by the
+roadmap's item #3. The substrate is the existing `threads` /
+`thread_messages` pair from §5: rows whose `branch_name` is NULL are
+scoped to the RFC's main view (the schema comment on the column says
+exactly this; until now no write path produced such rows). This module
+is the read+write surface for those rows.
+
+Contribution still requires a PR: the §10 PR flow is unchanged, the
+branch-scoped chat in `api_branches.py` is unchanged, and accept /
+decline of AI `<change>` blocks still lives on a branch. What this
+module adds is the "discuss freely about the RFC, no branch yet" surface
+— a place to drop a question, a flag-style observation, or a multi-turn
+conversation that does not yet warrant cutting a branch.
+
+Auth shape mirrors the v0.3.0 anonymous-read contract: reads are open,
+writes require `auth.require_contributor`. Item #4 ("anon discuss/
+contribute off-limits") tightens the read gate in v0.6.0; v0.5.0's
+write gate already holds the line.
+
+Notification routing reuses the existing `fan_out_chat_message` path
+with `branch_name=None`; the `notifications.branch_name` column is
+nullable, and the inbox row prose ("@alice posted a chat message on
+<RFC title>") renders identically whether the chat lives on a branch
+or on the RFC's discussion surface. The existing
+`chat_message_in_participated_thread` / `chat_reply_to_my_message`
+event kinds carry both shapes; introducing a parallel
+`open_rfc_discussion_thread` / `post_rfc_discussion_message` enum pair
+would split routing without adding signal. The §15 §19.2 candidate
+"distinct event_kinds for PR-less discussion" notes the option for a
+future session if evidence demands the split.
+"""
+from __future__ import annotations
+
+import json
+import logging
+from typing import Any
+
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel, Field
+
+from . import auth, chat as chat_layer, db
+
+log = logging.getLogger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# Request bodies
+# ---------------------------------------------------------------------------
+
+
+class DiscussionThreadCreateBody(BaseModel):
+    """A discussion thread is a `thread_kind='chat'`, `anchor_kind='whole-doc'`,
+    `branch_name=NULL` row. Anchored-range / per-paragraph threads on the
+    RFC discussion surface are a §19.2 candidate — the schema supports
+    them; the UI work to surface a range-anchor on a non-branch view is
+    the deferred part. v0.5.0 keeps the shape narrow."""
+    label: str | None = Field(default=None, max_length=400)
+    message: str | None = Field(default=None, max_length=20_000)
+
+
+class DiscussionMessageBody(BaseModel):
+    text: str = Field(min_length=1, max_length=20_000)
+    quote: str | None = Field(default=None, max_length=2000)
+
+
+# ---------------------------------------------------------------------------
+# Router
+# ---------------------------------------------------------------------------
+
+
+def make_router() -> APIRouter:
+    router = APIRouter()
+
+    # -------------------------------------------------------------------
+    # GET /api/rfcs/<slug>/discussion/threads
+    # Lists every PR-less thread on the RFC. The default whole-doc thread
+    # is materialized lazily on first list (mirroring the §8.12 branch-
+    # chat default-thread treatment) so the UI always has a target for
+    # the compose-message affordance.
+    # -------------------------------------------------------------------
+
+    @router.get("/api/rfcs/{slug}/discussion/threads")
+    async def list_discussion_threads(slug: str, request: Request) -> dict[str, Any]:
+        viewer = auth.current_user(request)
+        _require_rfc_readable(slug)
+        # Ensure the default whole-doc discussion thread exists. We mint
+        # it on first read regardless of viewer (anonymous viewers can
+        # trigger the creation — the row's `created_by` is null in that
+        # case, mirroring `_ensure_branch_chat_thread`).
+        _ensure_discussion_thread(slug, viewer)
+        rows = db.conn().execute(
+            """
+            SELECT id, anchor_kind, anchor_payload, thread_kind, label, state,
+                   created_by, created_at, resolved_at, resolved_by
+              FROM threads
+             WHERE rfc_slug = ? AND branch_name IS NULL
+             ORDER BY id
+            """,
+            (slug,),
+        ).fetchall()
+        return {"items": [_serialize_thread(r) for r in rows]}
+
+    # -------------------------------------------------------------------
+    # POST /api/rfcs/<slug>/discussion/threads
+    # Open a fresh discussion thread. Writes require require_contributor
+    # — anonymous viewers can read but cannot open a thread, per item
+    # #4's hardening anticipated in v0.6.0 (we already enforce it here
+    # to avoid the open window).
+    # -------------------------------------------------------------------
+
+    @router.post("/api/rfcs/{slug}/discussion/threads")
+    async def create_discussion_thread(
+        slug: str, body: DiscussionThreadCreateBody, request: Request
+    ) -> dict[str, Any]:
+        viewer = auth.require_contributor(request)
+        _require_rfc_readable(slug)
+        cur = db.conn().execute(
+            """
+            INSERT INTO threads
+                (rfc_slug, branch_name, anchor_kind, anchor_payload,
+                 thread_kind, label, created_by)
+            VALUES (?, NULL, 'whole-doc', NULL, 'chat', ?, ?)
+            """,
+            (slug, body.label, viewer.user_id),
+        )
+        thread_id = cur.lastrowid
+        message_id = None
+        if body.message:
+            message_id = chat_layer.append_user_message(
+                thread_id=thread_id,
+                author_user_id=viewer.user_id,
+                text=body.message,
+                quote=None,
+            )
+        return {"thread_id": thread_id, "message_id": message_id}
+
+    # -------------------------------------------------------------------
+    # GET /api/rfcs/<slug>/discussion/threads/<thread_id>/messages
+    # -------------------------------------------------------------------
+
+    @router.get("/api/rfcs/{slug}/discussion/threads/{thread_id}/messages")
+    async def get_discussion_thread_messages(
+        slug: str, thread_id: int, request: Request
+    ) -> dict[str, Any]:
+        _viewer = auth.current_user(request)
+        _require_rfc_readable(slug)
+        thread = _require_discussion_thread(slug, thread_id)
+        rows = db.conn().execute(
+            """
+            SELECT m.id, m.role, m.author_user_id,
+                   u.gitea_login AS author_login,
+                   u.display_name AS author_display,
+                   m.model_id, m.text, m.quote, m.created_at
+              FROM thread_messages m
+         LEFT JOIN users u ON u.id = m.author_user_id
+             WHERE m.thread_id = ?
+             ORDER BY m.id
+            """,
+            (thread_id,),
+        ).fetchall()
+        return {
+            "thread": _serialize_thread(thread),
+            "messages": [_serialize_message(r) for r in rows],
+        }
+
+    # -------------------------------------------------------------------
+    # POST /api/rfcs/<slug>/discussion/threads/<thread_id>/messages
+    # -------------------------------------------------------------------
+
+    @router.post("/api/rfcs/{slug}/discussion/threads/{thread_id}/messages")
+    async def post_discussion_message(
+        slug: str, thread_id: int, body: DiscussionMessageBody, request: Request
+    ) -> dict[str, Any]:
+        viewer = auth.require_contributor(request)
+        _require_rfc_readable(slug)
+        _require_discussion_thread(slug, thread_id)
+        message_id = chat_layer.append_user_message(
+            thread_id=thread_id,
+            author_user_id=viewer.user_id,
+            text=body.text,
+            quote=body.quote,
+        )
+        return {"ok": True, "message_id": message_id}
+
+    # -------------------------------------------------------------------
+    # POST /api/rfcs/<slug>/discussion/threads/<thread_id>/resolve
+    # -------------------------------------------------------------------
+
+    @router.post("/api/rfcs/{slug}/discussion/threads/{thread_id}/resolve")
+    async def resolve_discussion_thread(
+        slug: str, thread_id: int, request: Request
+    ) -> dict[str, Any]:
+        viewer = auth.require_contributor(request)
+        rfc = _require_rfc_readable(slug)
+        thread = _require_discussion_thread(slug, thread_id)
+        if not _can_resolve(rfc, thread, viewer):
+            raise HTTPException(
+                403,
+                "Only the thread creator, an RFC owner/arbiter, or an app admin/owner may resolve",
+            )
+        db.conn().execute(
+            """
+            UPDATE threads
+               SET state = 'resolved',
+                   resolved_by = ?,
+                   resolved_at = datetime('now')
+             WHERE id = ?
+            """,
+            (viewer.user_id, thread_id),
+        )
+        return {"ok": True, "thread_id": thread_id}
+
+    return router
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _require_rfc_readable(slug: str):
+    """Per the v0.3.0 anonymous-read contract: any cached RFC is readable
+    by anyone. Withdrawn entries refuse reads of every shape — same rule
+    `_require_rfc_with_repo` in `api_branches.py` follows."""
+    row = db.conn().execute(
+        "SELECT * FROM cached_rfcs WHERE slug = ?", (slug,)
+    ).fetchone()
+    if row is None:
+        raise HTTPException(404, "RFC not found")
+    if row["state"] == "withdrawn":
+        raise HTTPException(409, "RFC is withdrawn")
+    return row
+
+
+def _require_discussion_thread(slug: str, thread_id: int):
+    """A discussion thread is one whose (rfc_slug, branch_name) = (slug,
+    NULL). Refuse cleanly if the thread id resolves to a branch-scoped
+    thread instead — that lookup belongs on the branch endpoints."""
+    row = db.conn().execute(
+        """
+        SELECT * FROM threads
+         WHERE id = ? AND rfc_slug = ? AND branch_name IS NULL
+        """,
+        (thread_id, slug),
+    ).fetchone()
+    if not row:
+        raise HTTPException(404, "Discussion thread not found")
+    return row
+
+
+def _ensure_discussion_thread(slug: str, viewer) -> int:
+    """Per the §8.12 lazy-create pattern, materialize a default whole-doc
+    chat thread on the RFC's discussion surface on first read. Created_by
+    is null when an anonymous viewer triggers creation — the thread is
+    structurally owned by the RFC, not by whoever opened the view."""
+    row = db.conn().execute(
+        """
+        SELECT id FROM threads
+         WHERE rfc_slug = ? AND branch_name IS NULL
+           AND anchor_kind = 'whole-doc' AND thread_kind = 'chat'
+         ORDER BY id LIMIT 1
+        """,
+        (slug,),
+    ).fetchone()
+    if row:
+        return row["id"]
+    cur = db.conn().execute(
+        """
+        INSERT INTO threads
+            (rfc_slug, branch_name, anchor_kind, thread_kind, label, created_by)
+        VALUES (?, NULL, 'whole-doc', 'chat', NULL, ?)
+        """,
+        (slug, viewer.user_id if viewer else None),
+    )
+    return cur.lastrowid
+
+
+def _can_resolve(rfc, thread, viewer) -> bool:
+    if viewer is None:
+        return False
+    if viewer.role in ("owner", "admin"):
+        return True
+    owners = json.loads(rfc["owners_json"] or "[]")
+    arbiters = json.loads(rfc["arbiters_json"] or "[]")
+    if viewer.gitea_login in owners or viewer.gitea_login in arbiters:
+        return True
+    if thread["created_by"] == viewer.user_id:
+        return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Serializers — mirror api_branches.py's shape
+# ---------------------------------------------------------------------------
+
+
+def _serialize_thread(row) -> dict[str, Any]:
+    payload = row["anchor_payload"]
+    try:
+        anchor = json.loads(payload) if payload else None
+    except Exception:
+        anchor = None
+    return {
+        "id": row["id"],
+        "anchor_kind": row["anchor_kind"],
+        "anchor_payload": anchor,
+        "thread_kind": row["thread_kind"],
+        "label": row["label"],
+        "state": row["state"],
+        "created_by": row["created_by"],
+        "created_at": row["created_at"],
+        "resolved_at": row["resolved_at"] if "resolved_at" in row.keys() else None,
+        "resolved_by": row["resolved_by"] if "resolved_by" in row.keys() else None,
+    }
+
+
+def _serialize_message(row) -> dict[str, Any]:
+    return {
+        "id": row["id"],
+        "role": row["role"],
+        "author_user_id": row["author_user_id"],
+        "author_login": row["author_login"],
+        "author_display": row["author_display"],
+        "model_id": row["model_id"],
+        "text": row["text"],
+        "quote": row["quote"],
+        "created_at": row["created_at"],
+    }

backend/app/api_graduation.py

@@ -520,7 +520,16 @@ def make_router(
 
     @router.get("/api/rfcs/{slug}/graduate/progress")
     async def graduate_progress(slug: str, request: Request):
-        del request
+        # v0.6.0 (item #4): the progress SSE surfaces admin-internal step
+        # detail (repo name, PR number, rollback steps) that isn't part of
+        # the v0.3.0 anonymous-read contract for catalog/RFC bodies. The
+        # corresponding POST /graduate is gated to RFC owners/arbiters and
+        # app admins/owners via `_can_graduate`; the read SSE shares that
+        # operator-visible surface, so it requires at least an
+        # authenticated viewer. We keep the floor at require_user (not
+        # require_contributor) so a write-muted operator can still observe
+        # the progress of a graduation they kicked off before being muted.
+        auth.require_user(request)
         state = _get_active(slug)
         if state is None:
             raise HTTPException(404, "No graduation in flight for this slug")

backend/app/api_notifications.py

@@ -14,6 +14,8 @@ The endpoints in this module are:
   - `POST /api/users/me/quiet-hours`                       — set / clear
   - `POST /api/users/<id>/notification-mute`               — §15.8
   - `DELETE /api/users/<id>/notification-mute`             — §15.8
+  - `GET  /api/users/me/cookie-consent`                    — §14.5
+  - `PUT  /api/users/me/cookie-consent`                    — §14.5
   - `GET  /api/email/unsubscribe`                          — §15.4 one-click
   - `POST /api/webhooks/email-bounce`                      — §15.4 receiver
 
@@ -73,6 +75,15 @@ class BounceBody(BaseModel):
     kind: str = Field(default="hard")  # 'hard' or 'complaint'
 
 
+class CookieConsentBody(BaseModel):
+    # `essential` is always true at the surface; we accept it for symmetry
+    # but never persist a false value (the framework's strictly-necessary
+    # cookies are not user-optional per SPEC §14.5).
+    essential: bool = True
+    analytics: bool = False
+    other: bool = False
+
+
 # ---------------------------------------------------------------------------
 # Router
 # ---------------------------------------------------------------------------
@@ -362,6 +373,74 @@ def make_router(config: Config) -> APIRouter:
         )
         return {"ok": True}
 
+    # ----- Cookie consent (v0.13.0 / roadmap item #11; SPEC §14.5) -----
+    #
+    # The shape is intentionally small: three flags + a recorded-at stamp.
+    # The banner's local-vs-server precedence rule lives in the frontend
+    # (`consent.js`): on sign-in, the server row (if any) overrides local;
+    # otherwise local is uploaded.
+
+    @router.get("/api/users/me/cookie-consent")
+    async def get_cookie_consent(request: Request) -> dict[str, Any]:
+        viewer = auth.require_user(request)
+        row = db.conn().execute(
+            """
+            SELECT essential, analytics, other_cookies, recorded_at
+              FROM cookie_consent WHERE user_id = ?
+            """,
+            (viewer.user_id,),
+        ).fetchone()
+        if row is None:
+            return {
+                "essential": True,
+                "analytics": False,
+                "other": False,
+                "recorded_at": None,
+            }
+        return {
+            "essential": bool(row["essential"]),
+            "analytics": bool(row["analytics"]),
+            "other": bool(row["other_cookies"]),
+            "recorded_at": row["recorded_at"],
+        }
+
+    @router.put("/api/users/me/cookie-consent")
+    async def set_cookie_consent(body: CookieConsentBody, request: Request) -> dict[str, Any]:
+        viewer = auth.require_user(request)
+        # `essential` is the framework's strictly-necessary set; the
+        # surface accepts the flag for symmetry but never persists a
+        # false value. SPEC §14.5: a deployment that wants to make
+        # session-cookie storage optional must change the framework
+        # contract, not flip a flag here.
+        db.conn().execute(
+            """
+            INSERT INTO cookie_consent
+                   (user_id, essential, analytics, other_cookies, recorded_at)
+            VALUES (?, 1, ?, ?, datetime('now'))
+            ON CONFLICT(user_id) DO UPDATE SET
+                essential     = 1,
+                analytics     = excluded.analytics,
+                other_cookies = excluded.other_cookies,
+                recorded_at   = excluded.recorded_at
+            """,
+            (
+                viewer.user_id,
+                1 if body.analytics else 0,
+                1 if body.other else 0,
+            ),
+        )
+        row = db.conn().execute(
+            "SELECT recorded_at FROM cookie_consent WHERE user_id = ?",
+            (viewer.user_id,),
+        ).fetchone()
+        return {
+            "ok": True,
+            "essential": True,
+            "analytics": bool(body.analytics),
+            "other": bool(body.other),
+            "recorded_at": row["recorded_at"] if row else None,
+        }
+
     # ----- Email: one-click unsubscribe + bounce webhook -----
 
     @router.get("/api/email/unsubscribe")

backend/app/auth.py

@@ -77,6 +77,43 @@ async def fetch_user_profile(config: Config, access_token: str) -> dict[str, Any
         return resp.json()
 
 
+def allowlist_is_active() -> bool:
+    """The private-beta gate is on iff the `allowed_emails` table has any
+    rows. Empty list means "open" — any successful OAuth provisions a
+    user; first row added flips the deployment into private-beta mode.
+    See `migrations/011_allowlist.sql` for the reasoning.
+    """
+    row = db.conn().execute("SELECT 1 FROM allowed_emails LIMIT 1").fetchone()
+    return row is not None
+
+
+def is_allowed_sign_in(profile: dict[str, Any]) -> bool:
+    """Decide whether a freshly-completed OAuth profile may sign in.
+
+    Three accept paths:
+      1. The allowlist is empty (gate off).
+      2. The Gitea profile's email is in `allowed_emails` (case-insensitive).
+      3. A `users` row already exists for this `gitea_id` — grandfather
+         per `migrations/011_allowlist.sql`.
+    """
+    gitea_id = profile.get("id")
+    if gitea_id is not None:
+        existing = db.conn().execute(
+            "SELECT 1 FROM users WHERE gitea_id = ? LIMIT 1", (gitea_id,)
+        ).fetchone()
+        if existing is not None:
+            return True
+    if not allowlist_is_active():
+        return True
+    email = (profile.get("email") or "").strip()
+    if not email:
+        return False
+    row = db.conn().execute(
+        "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+    ).fetchone()
+    return row is not None
+
+
 def provision_user(config: Config, profile: dict[str, Any]) -> SessionUser:
     """Insert or update the users row for this Gitea profile.
 
@@ -156,10 +193,16 @@ def current_user(request: Request) -> SessionUser | None:
     ).fetchone()
     if row is None:
         return None
+    # v0.7.0: OTC-provisioned users have NULL gitea_id / gitea_login.
+    # Coerce nulls to the SessionUser's typed defaults so downstream
+    # code (Actor, _on_behalf_trailer) reads a stable shape regardless
+    # of which sign-in path the row came from. The DB remains the
+    # source of truth for "is this an OAuth-linked user" (gitea_id IS
+    # NOT NULL); the in-memory SessionUser is the per-request handle.
     return SessionUser(
         user_id=row["id"],
-        gitea_id=row["gitea_id"],
-        gitea_login=row["gitea_login"],
+        gitea_id=row["gitea_id"] or 0,
+        gitea_login=row["gitea_login"] or "",
         display_name=row["display_name"],
         email=row["email"] or "",
         avatar_url=row["avatar_url"] or "",

backend/app/chat.py

@@ -168,10 +168,15 @@ def _fan_out_chat(thread_id: int, author_user_id: int, message_id: int) -> None:
         ).fetchone()
         if pr_row:
             pr_number = pr_row["pr_number"]
+    # v0.5.0 (§5 / §10 — PR-less discussion): a thread with
+    # branch_name IS NULL is scoped to the RFC's main view. Pass None
+    # through to the notify chokepoint so the notifications row keeps
+    # `branch_name` null — coercing it to "main" would misroute the
+    # §15.7 chat-seen reconciler (which keys on branch_name).
     notify.fan_out_chat_message(
         actor_user_id=author_user_id,
         rfc_slug=row["rfc_slug"],
-        branch_name=row["branch_name"] or "main",
+        branch_name=row["branch_name"],
         thread_id=thread_id,
         message_id=message_id,
         is_review_thread=(row["thread_kind"] == "review"),

backend/app/email_otc.py

@@ -0,0 +1,96 @@
+"""Outbound OTC email — a thin wrapper over the existing SMTP layer.
+
+The §15.4 notification mailer in `email.py` is purpose-built for
+inbox-driven mail (unsubscribe footers, quiet-hours holds, bundling).
+OTC mail is structurally different: it carries a credential, has no
+inbox row behind it, and ignores user-preferences (a contributor
+who's opted out of every notification still needs to receive the
+code they explicitly requested).
+
+So this module reuses `EmailConfig.from_env()` for the SMTP plumbing
+and the From identity, but writes its own envelope. In dev (no
+SMTP_HOST set), the envelope is logged at INFO level and pushed to
+the same `_SENT` buffer the notification mailer uses, so the
+integration tests can assert on the outbound shape without standing
+up an SMTP server.
+
+The send is synchronous. The `/auth/otc/request` endpoint always
+returns 202 regardless of send outcome — the user-facing surface
+doesn't know whether the SMTP relay was reachable, since revealing
+that would let an attacker probe for valid emails on a tight loop.
+"""
+from __future__ import annotations
+
+import logging
+import smtplib
+from email.message import EmailMessage
+from email.utils import formataddr
+
+from .email import EmailConfig, _SENT
+
+log = logging.getLogger(__name__)
+
+
+def send_otc_email(to_address: str, code: str) -> bool:
+    """Compose and send the one-time-code email. Returns True on the
+    happy path; False on SMTP failure. The notifier-side buffer
+    `_SENT` is appended either way so tests can assert on content.
+
+    The subject and body intentionally avoid branding strings that
+    belong to a deployment — only `EMAIL_FROM_NAME` (operator-supplied
+    via env) lands in the From line. The body names the code, the
+    TTL, and a single instruction line. No tracking pixel, no
+    deep-link query, no embedded JS — plain text only."""
+    cfg = EmailConfig.from_env()
+    subject = f"Your sign-in code for {cfg.from_name}"
+    body = _body(code, cfg)
+    envelope = {
+        "to": to_address,
+        "from": formataddr((cfg.from_name, cfg.from_address)),
+        "subject": subject,
+        "body": body,
+        "kind": "otc",
+    }
+    _SENT.append(envelope)
+
+    if not cfg.enabled:
+        log.info("otc email disabled (EMAIL_ENABLED=0): to=%s", to_address)
+        return True
+    if not cfg.smtp_host:
+        # Dev fallback: surface the code at INFO so the operator can
+        # complete a sign-in flow without an SMTP relay. In production
+        # SMTP_HOST is always set per OHM's overlay.
+        log.info("otc email (stdout fallback): to=%s code=%s", to_address, code)
+        return True
+
+    try:
+        msg = EmailMessage()
+        msg["From"] = envelope["from"]
+        msg["To"] = to_address
+        msg["Subject"] = subject
+        msg.set_content(body)
+        smtp = smtplib.SMTP(cfg.smtp_host, cfg.smtp_port, timeout=30)
+        try:
+            if cfg.smtp_starttls:
+                smtp.starttls()
+            if cfg.smtp_user:
+                smtp.login(cfg.smtp_user, cfg.smtp_password)
+            smtp.send_message(msg)
+        finally:
+            smtp.quit()
+        return True
+    except Exception:
+        log.exception("otc email send failed: to=%s", to_address)
+        return False
+
+
+def _body(code: str, cfg: EmailConfig) -> str:
+    return (
+        f"Your sign-in code is:\n\n"
+        f"    {code}\n\n"
+        f"Enter this code in the sign-in screen to finish signing in.\n"
+        f"The code expires in 10 minutes. If you did not request this,\n"
+        f"you can safely ignore this email — no account was created.\n\n"
+        f"---\n"
+        f"{cfg.from_name} · {cfg.app_url}\n"
+    )

backend/app/main.py

@@ -12,9 +12,22 @@ from contextlib import asynccontextmanager
 
 from fastapi import APIRouter, FastAPI, HTTPException, Request
 from fastapi.responses import RedirectResponse
+from pydantic import BaseModel, Field
 from starlette.middleware.sessions import SessionMiddleware
 
-from . import api as api_routes, auth, cache, db, digest, hygiene, providers as providers_mod, webhooks
+from . import (
+    api as api_routes,
+    auth,
+    cache,
+    db,
+    digest,
+    email_otc,
+    hygiene,
+    otc,
+    passcode as passcode_mod,
+    providers as providers_mod,
+    webhooks,
+)
 from .bot import Bot
 from .config import load_config
 from .gitea import Gitea
@@ -23,6 +36,24 @@ logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(name
 log = logging.getLogger("rfc_app")
 
 
+class OtcRequestBody(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+
+
+class OtcVerifyBody(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+    code: str = Field(min_length=1, max_length=16)
+
+
+class PasscodeSetBody(BaseModel):
+    passcode: str = Field(min_length=1, max_length=64)
+
+
+class PasscodeVerifyBody(BaseModel):
+    email: str = Field(min_length=3, max_length=320)
+    passcode: str = Field(min_length=1, max_length=64)
+
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
     config = load_config()
@@ -107,6 +138,12 @@ def _oauth_router(config) -> APIRouter:
         if not access_token:
             raise HTTPException(400, "Token exchange failed")
         profile = await auth.fetch_user_profile(config, access_token)
+        if not auth.is_allowed_sign_in(profile):
+            # Private-beta gate: clear any partial OAuth state and bounce to
+            # the public /beta-pending page. The session is left empty so the
+            # rejected viewer continues as anonymous read-only.
+            request.session.pop(auth.SESSION_STATE_KEY, None)
+            return RedirectResponse("/beta-pending")
         user = auth.provision_user(config, profile)
         auth.store_session(request, user)
         return RedirectResponse("/")
@@ -116,4 +153,111 @@ def _oauth_router(config) -> APIRouter:
         request.session.clear()
         return RedirectResponse("/")
 
+    # ---------------------------------------------------------------
+    # v0.7.0: email + one-time-code sign-in (§6.2).
+    #
+    # Replaces the OAuth gesture as the primary human-auth path. The
+    # /auth/callback handler above remains functional as a fallback;
+    # the new UI no longer surfaces it. A future release retires the
+    # OAuth path entirely once every active user has signed in at
+    # least once via OTC.
+    # ---------------------------------------------------------------
+
+    @router.post("/auth/otc/request")
+    async def otc_request(body: OtcRequestBody):
+        outcome = otc.request_code(body.email)
+        if outcome.reason == "cooldown":
+            # Loud failure per the rate-limit primitive — the abuse
+            # surface should be visible to clients hammering /request.
+            raise HTTPException(429, "Wait before requesting another code")
+        if outcome.sent and outcome.code is not None:
+            email_otc.send_otc_email(body.email.strip(), outcome.code)
+        # 202 regardless of allowlist/invalid — don't leak which
+        # emails are recognized.
+        return {"ok": True}
+
+    @router.post("/auth/otc/verify")
+    async def otc_verify(body: OtcVerifyBody, request: Request):
+        result = otc.verify_code(body.email, body.code)
+        if not result.ok or result.user is None:
+            raise HTTPException(400, "Invalid or expired code")
+        auth.store_session(request, result.user)
+        return {
+            "ok": True,
+            "user": {
+                "id": result.user.user_id,
+                "display_name": result.user.display_name,
+                "email": result.user.email,
+                "role": result.user.role,
+            },
+        }
+
+    # ---------------------------------------------------------------
+    # v0.10.0: user-set passcodes after OTC (§6.2, roadmap item #8).
+    #
+    # After a successful OTC sign-in, a contributor may set a passcode
+    # and use email + passcode for subsequent sign-ins. OTC remains the
+    # forgot-passcode fallback — a verify failure beyond 5 consecutive
+    # attempts locks the passcode path for 15 minutes; the OTC path is
+    # unaffected by the lockout.
+    # ---------------------------------------------------------------
+
+    @router.get("/auth/passcode/check")
+    async def passcode_check(email: str = ""):
+        """Does this email have a passcode set? Anonymous endpoint —
+        the Login.jsx flow calls this after the user types their email
+        to decide whether to render a passcode input or fall back to
+        OTC. We surface only the boolean; lockout state, the hash, and
+        the set-at stamp are not leaked here."""
+        status = passcode_mod.passcode_status(email)
+        return {"has_passcode": status.has_passcode}
+
+    @router.post("/auth/passcode/set")
+    async def passcode_set(body: PasscodeSetBody, request: Request):
+        """Set or replace the signed-in user's passcode. Requires an
+        active session (OTC- or passcode-authenticated)."""
+        user = auth.require_user(request)
+        try:
+            passcode_mod.set_passcode(user.user_id, body.passcode)
+        except passcode_mod.PasscodeValidationError as e:
+            raise HTTPException(422, str(e))
+        return {"ok": True}
+
+    @router.delete("/auth/passcode")
+    async def passcode_delete(request: Request):
+        """Remove the signed-in user's passcode. The user is back to
+        OTC-only on next sign-in."""
+        user = auth.require_user(request)
+        passcode_mod.clear_passcode(user.user_id)
+        return {"ok": True}
+
+    @router.post("/auth/passcode/verify")
+    async def passcode_verify(body: PasscodeVerifyBody, request: Request):
+        """Sign in with email + passcode. Returns the standard session
+        payload on success; HTTP 423 with `locked_until` when the
+        account is in the lockout window; HTTP 400 for every other
+        failure (the wrong-vs-unknown distinction is intentionally
+        collapsed so a probing client cannot enumerate emails)."""
+        result = passcode_mod.verify_passcode(body.email, body.passcode)
+        if result.reason == "locked":
+            raise HTTPException(
+                423,
+                {
+                    "detail": "Too many failed attempts; sign in with a one-time code instead",
+                    "locked_until": result.locked_until,
+                },
+            )
+        if not result.ok or result.user is None:
+            raise HTTPException(400, "Invalid passcode")
+        auth.store_session(request, result.user)
+        return {
+            "ok": True,
+            "user": {
+                "id": result.user.user_id,
+                "display_name": result.user.display_name,
+                "email": result.user.email,
+                "role": result.user.role,
+            },
+        }
+
     return router

backend/app/notify.py

@@ -212,7 +212,7 @@ def fan_out_chat_message(
     *,
     actor_user_id: int,
     rfc_slug: str,
-    branch_name: str,
+    branch_name: str | None,
     thread_id: int,
     message_id: int,
     is_review_thread: bool = False,
@@ -227,6 +227,14 @@ def fan_out_chat_message(
     (state='watching', i.e. full stream) get a churn-class
     `chat_message_in_participated_thread`. The two are union'd so a user
     who is both gets only the personal-direct row.
+
+    v0.5.0: `branch_name` may be None — that is the PR-less per-RFC
+    discussion shape (`threads.branch_name IS NULL`, §5). The
+    notifications row carries the null through; the inbox prose renders
+    identically whether the chat lives on a branch or on the RFC's
+    discussion surface, and the §15.7 reconciler keys on
+    (rfc_slug, branch_name) so a null branch correctly matches the
+    PR-less discussion's eventual chat-seen-equivalent advance.
     """
     _bump_auto_watch(actor_user_id, rfc_slug)
 

backend/app/otc.py

@@ -0,0 +1,329 @@
+"""§6.2 / v0.7.0: email + one-time-code sign-in.
+
+Replaces the Gitea OAuth gesture as the primary human-auth path. The
+Gitea bot user + token are still needed for server-side git
+operations (repo reads, PR creation); only the operator-facing
+sign-in surface moves through this module.
+
+The shape:
+
+  * `request_code(email)` generates a 6-digit decimal code,
+    hashes it (bcrypt), stores the hash + expiry in `otc_codes`,
+    and dispatches a plain-text email via `email_otc.send`. It
+    invalidates any prior unused codes for the same email so a
+    re-request keeps the surface to one outstanding code per
+    address. The TTL comes from `OTC_TTL_MINUTES` (default 10).
+    A per-email cooldown (`OTC_REQUEST_COOLDOWN_SECONDS`, default
+    60) refuses back-to-back requests inside the window.
+
+  * `verify_code(email, code)` walks the most recent unconsumed
+    non-expired row for the email, checks the bcrypt hash, marks
+    the row consumed, and returns the linked or freshly-provisioned
+    user row.
+
+  * `provision_or_link_user(email)` is the migration path: if a
+    `users` row already carries `email` (case-insensitive), it is
+    reused — `gitea_id` is left alone so a grandfathered OAuth-era
+    user keeps the linker intact. Otherwise a fresh contributor
+    row is provisioned with `gitea_id = NULL`, `gitea_login = NULL`.
+
+The endpoints in `main.py` thin-wrap this module. The allowlist gate
+from v0.3.0 is consulted at request time — if `allowed_emails` is
+populated and the requested address isn't on it, the request returns
+202 as usual but no email is sent. This intentionally does not leak
+allowlist state to the caller; the §19.2 candidate for v0.8.0
+replaces this gate with an admin-grant flow.
+"""
+from __future__ import annotations
+
+import logging
+import os
+import secrets
+from dataclasses import dataclass
+
+import bcrypt
+
+from . import db
+from .auth import SessionUser, allowlist_is_active
+
+log = logging.getLogger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# Tunables — env-driven with defaults so v0.7.0 needs no new secrets.
+# ---------------------------------------------------------------------------
+
+
+def _ttl_minutes() -> int:
+    raw = os.environ.get("OTC_TTL_MINUTES", "").strip()
+    if not raw:
+        return 10
+    try:
+        return max(1, int(raw))
+    except ValueError:
+        return 10
+
+
+def _cooldown_seconds() -> int:
+    raw = os.environ.get("OTC_REQUEST_COOLDOWN_SECONDS", "").strip()
+    if not raw:
+        return 60
+    try:
+        return max(0, int(raw))
+    except ValueError:
+        return 60
+
+
+# ---------------------------------------------------------------------------
+# Code generation + hashing
+# ---------------------------------------------------------------------------
+
+
+def _new_code() -> str:
+    """Six decimal digits. `secrets.randbelow` is CSPRNG-backed so the
+    code resists guessing even at the small (10^6) keyspace. The TTL
+    + rate-limit are what carry the security weight — the entropy of a
+    six-digit code by itself is intentionally human-readable."""
+    return f"{secrets.randbelow(1_000_000):06d}"
+
+
+def _hash_code(code: str) -> str:
+    """bcrypt over the code bytes. The hash is stored at rest; the code
+    itself only travels in the outbound email and the inbound verify
+    body."""
+    return bcrypt.hashpw(code.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
+
+
+def _check_code(code: str, code_hash: str) -> bool:
+    try:
+        return bcrypt.checkpw(code.encode("utf-8"), code_hash.encode("ascii"))
+    except (ValueError, TypeError):
+        return False
+
+
+# ---------------------------------------------------------------------------
+# Allowlist gate — shared with the OAuth flow.
+# ---------------------------------------------------------------------------
+
+
+def _allowlist_admits(email: str) -> bool:
+    """The same allowlist v0.3.0 introduced for OAuth, applied to OTC
+    requests. If the allowlist is populated and the email is not on it,
+    we still respond 202 to the caller, but no code is sent."""
+    if not allowlist_is_active():
+        return True
+    row = db.conn().execute(
+        "SELECT 1 FROM allowed_emails WHERE email = ? LIMIT 1", (email,)
+    ).fetchone()
+    return row is not None
+
+
+# ---------------------------------------------------------------------------
+# Request path
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class RequestOutcome:
+    """The outcome of a `request_code` call.
+
+    `code` is None whenever no code was generated — either because the
+    allowlist denied the email or because the cooldown window blocked
+    the request. The caller (the API endpoint) does not surface this
+    distinction to the user; it returns 202 either way.
+    """
+    sent: bool
+    code: str | None
+    reason: str  # 'sent' | 'allowlist' | 'cooldown' | 'invalid'
+
+
+def request_code(email: str) -> RequestOutcome:
+    email = (email or "").strip()
+    if not email or "@" not in email:
+        return RequestOutcome(sent=False, code=None, reason="invalid")
+
+    # Cooldown: refuse if a code was issued for this email in the last
+    # COOLDOWN_SECONDS. We surface it as a distinct outcome so the
+    # endpoint can return 429 — the spec calls this out as a "loud
+    # failure" so the abuse path is visible rather than swallowed.
+    cooldown = _cooldown_seconds()
+    if cooldown > 0:
+        row = db.conn().execute(
+            f"""
+            SELECT 1 FROM otc_codes
+             WHERE email = ?
+               AND datetime(created_at, '+{cooldown} seconds') > datetime('now')
+             LIMIT 1
+            """,
+            (email,),
+        ).fetchone()
+        if row is not None:
+            return RequestOutcome(sent=False, code=None, reason="cooldown")
+
+    # Allowlist: silently drop the send if the email isn't on the list.
+    # The row is not written either — there's nothing for verify to
+    # match against, so the user-facing experience is "I never got an
+    # email", which is the intended shape for the private-beta gate.
+    if not _allowlist_admits(email):
+        return RequestOutcome(sent=False, code=None, reason="allowlist")
+
+    # Invalidate prior unused codes for this email. A re-request is
+    # always for the most recent code; older codes are dead.
+    db.conn().execute(
+        """
+        UPDATE otc_codes
+           SET consumed_at = datetime('now')
+         WHERE email = ?
+           AND consumed_at IS NULL
+        """,
+        (email,),
+    )
+
+    code = _new_code()
+    code_hash = _hash_code(code)
+    ttl = _ttl_minutes()
+    db.conn().execute(
+        f"""
+        INSERT INTO otc_codes (email, code_hash, expires_at)
+        VALUES (?, ?, datetime('now', '+{ttl} minutes'))
+        """,
+        (email, code_hash),
+    )
+    return RequestOutcome(sent=True, code=code, reason="sent")
+
+
+# ---------------------------------------------------------------------------
+# Verify path
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class VerifyOutcome:
+    """Result of a `verify_code` call.
+
+    `user` is populated only on success. `reason` distinguishes the
+    failure modes the UI can render — 'expired', 'consumed', 'wrong',
+    'unknown' (no outstanding code at all). The endpoint maps the
+    failure modes to a single 400 with a generic message; the reason
+    is logged for the operator.
+    """
+    ok: bool
+    user: SessionUser | None
+    reason: str
+
+
+def verify_code(email: str, code: str) -> VerifyOutcome:
+    email = (email or "").strip()
+    code = (code or "").strip()
+    if not email or not code:
+        return VerifyOutcome(ok=False, user=None, reason="invalid")
+
+    rows = db.conn().execute(
+        """
+        SELECT id, code_hash, expires_at, consumed_at
+          FROM otc_codes
+         WHERE email = ?
+         ORDER BY id DESC
+         LIMIT 5
+        """,
+        (email,),
+    ).fetchall()
+    if not rows:
+        return VerifyOutcome(ok=False, user=None, reason="unknown")
+
+    # Walk the recent rows so a user who pasted an older code still
+    # gets a sensible error — without this, the most-recent-row check
+    # would mask "you entered yesterday's code" as "wrong code".
+    matched = None
+    for row in rows:
+        if _check_code(code, row["code_hash"]):
+            matched = row
+            break
+
+    if matched is None:
+        return VerifyOutcome(ok=False, user=None, reason="wrong")
+
+    if matched["consumed_at"] is not None:
+        return VerifyOutcome(ok=False, user=None, reason="consumed")
+
+    expired = db.conn().execute(
+        "SELECT datetime(?) < datetime('now') AS expired",
+        (matched["expires_at"],),
+    ).fetchone()["expired"]
+    if expired:
+        return VerifyOutcome(ok=False, user=None, reason="expired")
+
+    # Stamp consumed before provisioning so a parallel verify of the
+    # same row can't double-sign-in.
+    db.conn().execute(
+        "UPDATE otc_codes SET consumed_at = datetime('now') WHERE id = ?",
+        (matched["id"],),
+    )
+    user = provision_or_link_user(email)
+    return VerifyOutcome(ok=True, user=user, reason="ok")
+
+
+# ---------------------------------------------------------------------------
+# Provisioning — the migration path from OAuth identity to email identity.
+# ---------------------------------------------------------------------------
+
+
+def provision_or_link_user(email: str) -> SessionUser:
+    """Link the OTC sign-in to a `users` row.
+
+    Match order:
+      1. An existing row whose email equals (case-insensitive) the
+         requested email — the OAuth-era user is grandfathered in via
+         this path. `gitea_id` is preserved so a future OAuth round
+         trip still resolves the same row.
+      2. Otherwise: a fresh contributor row with `gitea_id = NULL`,
+         `gitea_login = NULL`. The display name defaults to the local
+         part of the email (everything before the `@`) — users can
+         rename later via the §19.2 first-OTC profile-capture flow
+         that v0.8.0 introduces.
+
+    The §6.1 owner-zero bootstrap still applies: if the email matches
+    the configured `OWNER_GITEA_LOGIN`-derived owner identity, the row
+    is provisioned with role='owner'. v0.7.0 keeps that field as the
+    Gitea login (so existing deployments don't break); a future
+    release may add a parallel `OWNER_EMAIL` env if the OAuth route is
+    dropped entirely.
+    """
+    email = email.strip()
+    existing = db.conn().execute(
+        "SELECT * FROM users WHERE email = ? COLLATE NOCASE",
+        (email,),
+    ).fetchone()
+    if existing is not None:
+        db.conn().execute(
+            "UPDATE users SET last_seen_at = datetime('now') WHERE id = ?",
+            (existing["id"],),
+        )
+        return SessionUser(
+            user_id=existing["id"],
+            gitea_id=existing["gitea_id"] or 0,
+            gitea_login=existing["gitea_login"] or "",
+            display_name=existing["display_name"],
+            email=existing["email"] or email,
+            avatar_url=existing["avatar_url"] or "",
+            role=existing["role"],
+        )
+
+    display = email.split("@", 1)[0] or email
+    cur = db.conn().execute(
+        """
+        INSERT INTO users (gitea_id, gitea_login, email, display_name, avatar_url, role)
+        VALUES (NULL, NULL, ?, ?, '', 'contributor')
+        """,
+        (email, display),
+    )
+    user_id = cur.lastrowid
+    return SessionUser(
+        user_id=user_id,
+        gitea_id=0,
+        gitea_login="",
+        display_name=display,
+        email=email,
+        avatar_url="",
+        role="contributor",
+    )

backend/app/passcode.py

@@ -0,0 +1,367 @@
+"""§6.2 / v0.10.0: user-set passcodes after OTC (roadmap item #8).
+
+After a successful OTC sign-in, a contributor may set a passcode and
+use email + passcode for subsequent sign-ins. OTC remains the fallback
+— a forgotten passcode is recovered by requesting a fresh OTC.
+
+This module is the state machine behind the four `/auth/passcode/*`
+endpoints (`set`, `clear`, `verify`, `check`). The endpoints in
+`main.py` thin-wrap these helpers in the same shape the OTC module
+uses (see `otc.py`).
+
+Shape:
+
+  * `set_passcode(user_id, passcode)` — bcrypt-hash the passcode and
+    write it to `users.passcode_hash` + `users.passcode_set_at`.
+    Validation (length, denylist) happens here, not at the endpoint,
+    so the rule lives in one place. Replaces any prior passcode.
+  * `clear_passcode(user_id)` — null out `passcode_hash` and
+    `passcode_set_at`. The user is back to OTC-only.
+  * `verify_passcode(email, passcode)` — locate the user by email,
+    check lockout, compare via bcrypt, manage the failure counter,
+    and return a populated `SessionUser` on success.
+  * `passcode_status(email)` — does this email have a passcode set?
+    Used by the `/auth/passcode/check` endpoint that the Login.jsx
+    flow consults after the user types their email.
+
+Lockout is a v1 shape: 5 consecutive failures sets
+`passcode_locked_until` to `now + 15 minutes`, after which a verify
+attempt that lands inside the window returns HTTP 423. The OTC path
+is unaffected by the lockout — a user can request and verify a fresh
+OTC to sign in while their passcode is locked out, and `verify_code`
+in `otc.py` does not consult these columns.
+
+The lockout window and the failure threshold are hard-coded here.
+Tuning them via env vars (or moving to per-IP rate-limiting) is a
+§19.2 candidate; see SPEC §19.2.
+"""
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+
+import bcrypt
+
+from . import db
+from .auth import SessionUser
+
+log = logging.getLogger(__name__)
+
+
+# ---------------------------------------------------------------------------
+# Tunables — intentionally hard-coded in v0.10.0 (see module docstring).
+# ---------------------------------------------------------------------------
+
+LOCKOUT_AFTER_FAILED_ATTEMPTS = 5
+LOCKOUT_DURATION_MINUTES = 15
+
+PASSCODE_MIN_LENGTH = 4
+PASSCODE_MAX_LENGTH = 20
+
+# A small denylist of patterns we never want a passcode to be. The
+# rule is "no obvious patterns"; the list is deliberately small —
+# every entry here is a verbatim string match. A heavier check
+# (sequential digits, single-character runs of length >= N, etc.)
+# is a §19.2 candidate.
+PASSCODE_DENYLIST: frozenset[str] = frozenset(
+    {
+        "0000",
+        "1111",
+        "2222",
+        "3333",
+        "4444",
+        "5555",
+        "6666",
+        "7777",
+        "8888",
+        "9999",
+        "1234",
+        "12345",
+        "123456",
+        "1234567",
+        "12345678",
+        "123456789",
+        "1234567890",
+        "0123",
+        "01234",
+        "012345",
+        "0123456",
+        "01234567",
+        "012345678",
+        "0123456789",
+        "abcd",
+        "abcde",
+        "abcdef",
+        "qwer",
+        "qwerty",
+        "asdf",
+        "asdfg",
+        "asdfgh",
+        "aaaa",
+        "bbbb",
+        "cccc",
+        "password",
+        "letmein",
+    }
+)
+
+
+# ---------------------------------------------------------------------------
+# Validation
+# ---------------------------------------------------------------------------
+
+
+class PasscodeValidationError(Exception):
+    """The proposed passcode failed validation. The endpoint surface
+    maps this to HTTP 422 with the message intact."""
+
+
+def _validate(passcode: str) -> str:
+    """Return the normalized passcode (stripped) or raise.
+
+    Rules:
+      * 4-20 characters after stripping leading/trailing whitespace.
+      * Not on the small denylist of obvious patterns.
+
+    No character-class restriction beyond that — the spec says
+    "numeric PIN or short alphanumeric"; we don't refuse other
+    characters because the entropy isn't load-bearing (the per-account
+    lockout is what carries the security weight, mirroring the OTC
+    shape from v0.7.0).
+    """
+    pc = (passcode or "").strip()
+    if not pc:
+        raise PasscodeValidationError("Passcode is required")
+    if len(pc) < PASSCODE_MIN_LENGTH:
+        raise PasscodeValidationError(
+            f"Passcode must be at least {PASSCODE_MIN_LENGTH} characters"
+        )
+    if len(pc) > PASSCODE_MAX_LENGTH:
+        raise PasscodeValidationError(
+            f"Passcode must be at most {PASSCODE_MAX_LENGTH} characters"
+        )
+    if pc.lower() in PASSCODE_DENYLIST:
+        raise PasscodeValidationError("Passcode is too common; pick something less obvious")
+    return pc
+
+
+# ---------------------------------------------------------------------------
+# Hashing
+# ---------------------------------------------------------------------------
+
+
+def _hash(passcode: str) -> str:
+    return bcrypt.hashpw(passcode.encode("utf-8"), bcrypt.gensalt()).decode("ascii")
+
+
+def _check(passcode: str, passcode_hash: str) -> bool:
+    try:
+        return bcrypt.checkpw(passcode.encode("utf-8"), passcode_hash.encode("ascii"))
+    except (ValueError, TypeError):
+        return False
+
+
+# ---------------------------------------------------------------------------
+# Set / clear
+# ---------------------------------------------------------------------------
+
+
+def set_passcode(user_id: int, passcode: str) -> None:
+    """Hash and store the passcode. Replaces any prior passcode on the
+    same row; clears the failure counter and lockout (a user setting a
+    fresh passcode is implicitly re-authenticating their account)."""
+    pc = _validate(passcode)
+    h = _hash(pc)
+    db.conn().execute(
+        """
+        UPDATE users
+           SET passcode_hash = ?,
+               passcode_set_at = datetime('now'),
+               passcode_failed_attempts = 0,
+               passcode_locked_until = NULL
+         WHERE id = ?
+        """,
+        (h, user_id),
+    )
+
+
+def clear_passcode(user_id: int) -> None:
+    """Remove the passcode. The user is back to OTC-only on next sign-in."""
+    db.conn().execute(
+        """
+        UPDATE users
+           SET passcode_hash = NULL,
+               passcode_set_at = NULL,
+               passcode_failed_attempts = 0,
+               passcode_locked_until = NULL
+         WHERE id = ?
+        """,
+        (user_id,),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Check (status surface for the Login.jsx flow)
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class PasscodeStatus:
+    """The shape `/auth/passcode/check` returns.
+
+    `has_passcode` is the only signal the frontend needs to decide
+    whether to show a passcode input or an OTC request step. We do
+    not leak the hash, the set-at timestamp, or the lockout state —
+    a probing client that wants to know "is this account locked
+    out" can attempt a verify and read the 423.
+    """
+    has_passcode: bool
+
+
+def passcode_status(email: str) -> PasscodeStatus:
+    email = (email or "").strip()
+    if not email or "@" not in email:
+        return PasscodeStatus(has_passcode=False)
+    row = db.conn().execute(
+        "SELECT passcode_hash FROM users WHERE email = ? COLLATE NOCASE",
+        (email,),
+    ).fetchone()
+    if row is None:
+        return PasscodeStatus(has_passcode=False)
+    return PasscodeStatus(has_passcode=bool(row["passcode_hash"]))
+
+
+# ---------------------------------------------------------------------------
+# Verify
+# ---------------------------------------------------------------------------
+
+
+@dataclass
+class VerifyOutcome:
+    """Result of a `verify_passcode` call.
+
+    `reason` distinguishes the failure modes the endpoint surfaces as
+    distinct HTTP shapes:
+      * 'ok'        — populated `user`, HTTP 200.
+      * 'unknown'   — no user with this email, HTTP 400 (generic).
+      * 'no_passcode' — user exists but never set a passcode, HTTP 400
+        (the frontend should fall back to OTC).
+      * 'locked'    — user is currently in the lockout window, HTTP
+        423. `locked_until` carries the ISO-8601 stamp for the client.
+      * 'wrong'     — passcode didn't match. HTTP 400. If the failure
+        crossed the lockout threshold the row is now locked; the
+        endpoint surfaces this as a fresh `locked` response on the
+        next attempt rather than collapsing the two states here.
+    """
+    ok: bool
+    user: SessionUser | None
+    reason: str
+    locked_until: str | None = None
+
+
+def verify_passcode(email: str, passcode: str) -> VerifyOutcome:
+    email = (email or "").strip()
+    passcode = (passcode or "").strip()
+    if not email or not passcode:
+        return VerifyOutcome(ok=False, user=None, reason="unknown")
+
+    row = db.conn().execute(
+        """
+        SELECT id, gitea_id, gitea_login, email, display_name, avatar_url, role,
+               passcode_hash, passcode_failed_attempts, passcode_locked_until
+          FROM users
+         WHERE email = ? COLLATE NOCASE
+        """,
+        (email,),
+    ).fetchone()
+    if row is None:
+        return VerifyOutcome(ok=False, user=None, reason="unknown")
+    if not row["passcode_hash"]:
+        return VerifyOutcome(ok=False, user=None, reason="no_passcode")
+
+    # Lockout check: if `passcode_locked_until` is populated and in the
+    # future, the verify is refused without touching the hash. Once the
+    # window has elapsed we let the verify proceed; the failed-attempts
+    # counter is also reset so the user gets a fresh 5-attempt budget.
+    locked_until = row["passcode_locked_until"]
+    if locked_until:
+        still_locked = db.conn().execute(
+            "SELECT datetime(?) > datetime('now') AS still_locked",
+            (locked_until,),
+        ).fetchone()["still_locked"]
+        if still_locked:
+            return VerifyOutcome(
+                ok=False,
+                user=None,
+                reason="locked",
+                locked_until=locked_until,
+            )
+        # Lockout expired — clear the counter so the next failure starts
+        # from zero, and continue with the verify.
+        db.conn().execute(
+            """
+            UPDATE users
+               SET passcode_failed_attempts = 0,
+                   passcode_locked_until = NULL
+             WHERE id = ?
+            """,
+            (row["id"],),
+        )
+
+    if _check(passcode, row["passcode_hash"]):
+        # Success: clear the counter (a single success wipes the
+        # accumulated failures — the threshold tracks *consecutive*
+        # failures).
+        db.conn().execute(
+            """
+            UPDATE users
+               SET passcode_failed_attempts = 0,
+                   passcode_locked_until = NULL,
+                   last_seen_at = datetime('now')
+             WHERE id = ?
+            """,
+            (row["id"],),
+        )
+        return VerifyOutcome(
+            ok=True,
+            user=SessionUser(
+                user_id=row["id"],
+                gitea_id=row["gitea_id"] or 0,
+                gitea_login=row["gitea_login"] or "",
+                display_name=row["display_name"],
+                email=row["email"] or email,
+                avatar_url=row["avatar_url"] or "",
+                role=row["role"],
+            ),
+            reason="ok",
+        )
+
+    # Failure: increment the counter. If this push crosses the
+    # threshold, stamp the lockout. The next verify attempt against
+    # the same row returns 423 with the `locked_until` stamp.
+    next_count = (row["passcode_failed_attempts"] or 0) + 1
+    if next_count >= LOCKOUT_AFTER_FAILED_ATTEMPTS:
+        db.conn().execute(
+            f"""
+            UPDATE users
+               SET passcode_failed_attempts = ?,
+                   passcode_locked_until = datetime('now', '+{LOCKOUT_DURATION_MINUTES} minutes')
+             WHERE id = ?
+            """,
+            (next_count, row["id"]),
+        )
+        new_locked_until = db.conn().execute(
+            "SELECT passcode_locked_until FROM users WHERE id = ?",
+            (row["id"],),
+        ).fetchone()["passcode_locked_until"]
+        return VerifyOutcome(
+            ok=False,
+            user=None,
+            reason="locked",
+            locked_until=new_locked_until,
+        )
+    db.conn().execute(
+        "UPDATE users SET passcode_failed_attempts = ? WHERE id = ?",
+        (next_count, row["id"]),
+    )
+    return VerifyOutcome(ok=False, user=None, reason="wrong")

backend/migrations/011_allowlist.sql

@@ -0,0 +1,22 @@
+-- Private-beta email allowlist.
+--
+-- The framework supports a deployment-gated sign-in mode: when this
+-- table contains rows, only emails listed here (case-insensitively)
+-- may sign in via OAuth. Users already provisioned in the `users`
+-- table are grandfathered in by gitea_id and never re-checked against
+-- this list — so the operator who allow-listed themselves, signed in
+-- once, then removed their own email from the list does not lose
+-- access.
+--
+-- An empty `allowed_emails` table is the "open" state: no allowlist
+-- gate runs, and any successful OAuth sign-in provisions a new user
+-- as before. This means a fresh framework install behaves exactly as
+-- prior versions until the operator adds the first row, at which
+-- point the gate turns on for everyone not yet in `users`.
+
+CREATE TABLE allowed_emails (
+    email            TEXT PRIMARY KEY COLLATE NOCASE,
+    added_by_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+    note             TEXT,
+    created_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);

backend/migrations/012_otc.sql

@@ -0,0 +1,105 @@
+-- §6.2 / v0.7.0: email + one-time-code sign-in.
+--
+-- Replaces the Gitea OAuth gesture as the primary human-auth path.
+-- The Gitea bot user + token are still needed for server-side git
+-- operations (repo reads, PR creation); only the operator-facing
+-- sign-in surface moves. The /auth/callback OAuth route remains
+-- functional during migration as a fallback, scheduled for removal
+-- in a future release once every active user has signed in via OTC
+-- at least once.
+--
+-- A row in `otc_codes` represents an outstanding 6-digit code that
+-- was emailed to `email`. Codes are stored hashed (bcrypt) rather
+-- than plaintext, so a database compromise does not expose the
+-- in-flight code. TTL is enforced by `expires_at`. Each `verify`
+-- success stamps `consumed_at` and refuses every later attempt
+-- against the same row.
+--
+-- The §6.2 identity model under v0.7.0:
+--
+--   * `users.email` is the primary identity key for new sign-ins.
+--   * `users.gitea_id` stays populated for users grandfathered in
+--     via the OAuth-era flow; new users have `gitea_id = NULL`.
+--     The unique-constraint on `gitea_id` is relaxed (in v0.5.0 it
+--     was `INTEGER UNIQUE NOT NULL`) to permit the NULL.
+--   * `users.email` becomes a (case-insensitive) unique key. An
+--     existing OAuth user whose Gitea profile carried an email is
+--     linked on first OTC sign-in; if no row matches, a fresh
+--     contributor row is provisioned.
+--
+-- New env vars (v0.7.0):
+--   * `OTC_TTL_MINUTES` (default 10): how long a code stays valid.
+--   * `OTC_REQUEST_COOLDOWN_SECONDS` (default 60): per-email rate
+--     limit between successive `/auth/otc/request` calls.
+
+CREATE TABLE otc_codes (
+    id              INTEGER PRIMARY KEY AUTOINCREMENT,
+    email           TEXT NOT NULL COLLATE NOCASE,
+    code_hash       TEXT NOT NULL,
+    created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+    expires_at      TEXT NOT NULL,
+    consumed_at     TEXT
+);
+
+CREATE INDEX idx_otc_codes_email ON otc_codes (email, consumed_at, expires_at);
+
+-- Relax `users.gitea_id` from `INTEGER UNIQUE NOT NULL` to a nullable
+-- column with a partial unique index that ignores nulls. SQLite does
+-- not support ALTER COLUMN, so we rebuild the table.
+--
+-- A few defensive notes:
+--   * Every foreign key into `users(id)` continues to resolve — `id`
+--     is the same INTEGER PRIMARY KEY in the rebuilt table.
+--   * `email` is now declared NOCASE so a `WHERE email = ?` match
+--     is case-insensitive without changing every read site. The
+--     prior column accepted any text; existing rows pass through
+--     unchanged.
+--   * `gitea_login` likewise relaxes from NOT NULL to nullable, so
+--     users provisioned by OTC alone don't carry a synthetic login.
+
+CREATE TABLE users_new (
+    id                                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    gitea_id                            INTEGER,
+    gitea_login                         TEXT,
+    email                               TEXT COLLATE NOCASE,
+    display_name                        TEXT NOT NULL,
+    avatar_url                          TEXT,
+    role                                TEXT NOT NULL CHECK (role IN ('owner', 'admin', 'contributor')),
+    muted                               INTEGER NOT NULL DEFAULT 0,
+    email_personal_direct               INTEGER NOT NULL DEFAULT 1,
+    email_watched_structural            INTEGER NOT NULL DEFAULT 0,
+    email_admin_actionable              INTEGER NOT NULL DEFAULT 1,
+    email_opt_out_all                   INTEGER NOT NULL DEFAULT 0,
+    digest_cadence                      TEXT NOT NULL DEFAULT 'weekly' CHECK (digest_cadence IN ('off', 'weekly', 'daily')),
+    notification_quiet_hours_start      TEXT,
+    notification_quiet_hours_end        TEXT,
+    notification_quiet_hours_timezone   TEXT,
+    created_at                          TEXT NOT NULL DEFAULT (datetime('now')),
+    last_seen_at                        TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+INSERT INTO users_new (
+    id, gitea_id, gitea_login, email, display_name, avatar_url, role,
+    muted, email_personal_direct, email_watched_structural,
+    email_admin_actionable, email_opt_out_all, digest_cadence,
+    notification_quiet_hours_start, notification_quiet_hours_end,
+    notification_quiet_hours_timezone, created_at, last_seen_at
+)
+SELECT
+    id, gitea_id, gitea_login, email, display_name, avatar_url, role,
+    muted, email_personal_direct, email_watched_structural,
+    email_admin_actionable, email_opt_out_all, digest_cadence,
+    notification_quiet_hours_start, notification_quiet_hours_end,
+    notification_quiet_hours_timezone, created_at, last_seen_at
+FROM users;
+
+DROP TABLE users;
+ALTER TABLE users_new RENAME TO users;
+
+CREATE INDEX idx_users_role ON users (role);
+-- Partial unique indexes so NULLs are permitted but populated values
+-- collide. Gitea linkage stays unique per gitea_id; OTC-era identity
+-- is keyed on email (case-insensitive via NOCASE on the column).
+CREATE UNIQUE INDEX idx_users_gitea_id ON users (gitea_id) WHERE gitea_id IS NOT NULL;
+CREATE UNIQUE INDEX idx_users_gitea_login ON users (gitea_login) WHERE gitea_login IS NOT NULL;
+CREATE UNIQUE INDEX idx_users_email ON users (email) WHERE email IS NOT NULL AND email != '';

backend/migrations/013_cookie_consent.sql

@@ -0,0 +1,35 @@
+-- v0.13.0 / roadmap item #11 — cookie consent.
+--
+-- The framework now ships a non-modal cookie consent banner per the
+-- privacy-and-cookies UX (SPEC §14.5 / §14.6). Authenticated viewers
+-- get their choice persisted server-side so it survives sign-out /
+-- sign-in across devices; anonymous viewers persist their choice in
+-- localStorage only.
+--
+-- Shape: a single row per user, three flags, plus a recorded-at stamp.
+-- The flags are:
+--   - essential:  the framework's strictly-necessary cookies (session,
+--                 itsdangerous-signed payloads, CSRF if any). Permanently
+--                 true at the API surface — included in the row for
+--                 symmetry with the analytics / other flags rather than
+--                 because the user can switch it off.
+--   - analytics:  reserved for the §13 analytics SDK gating that lands
+--                 in v0.15.0. Off by default; opt-in via the banner.
+--   - other:      everything else (third-party embeds, social widgets).
+--                 Off by default; opt-in via the banner.
+--
+-- A NULL recorded_at means "no choice yet" — the banner should re-prompt
+-- the next time the user signs in on a fresh device. Once recorded_at is
+-- set, the banner is hidden until the user re-opens it from the
+-- /settings/notifications "Privacy & cookies" tab.
+--
+-- The row is created lazily on first PUT. Absence of a row is equivalent
+-- to NULL recorded_at — the banner shows.
+
+CREATE TABLE cookie_consent (
+    user_id        INTEGER PRIMARY KEY REFERENCES users(id) ON DELETE CASCADE,
+    essential      INTEGER NOT NULL DEFAULT 1 CHECK (essential IN (0, 1)),
+    analytics      INTEGER NOT NULL DEFAULT 0 CHECK (analytics IN (0, 1)),
+    other_cookies  INTEGER NOT NULL DEFAULT 0 CHECK (other_cookies IN (0, 1)),
+    recorded_at    TEXT
+);

backend/migrations/015_passcode.sql

@@ -0,0 +1,52 @@
+-- §6.2 / v0.10.0: user-set passcodes after OTC (roadmap item #8).
+--
+-- After a successful OTC sign-in, a contributor may set a passcode
+-- (numeric PIN or short alphanumeric). Subsequent sign-ins on the same
+-- account can use email + passcode instead of email + OTC. OTC remains
+-- the structural fallback — a forgotten passcode is recovered by
+-- requesting a fresh OTC and signing in via that path. Per-account
+-- lockout after 5 consecutive verify failures redirects the user to
+-- the OTC path for 15 minutes; the OTC path itself is unaffected by
+-- the passcode lockout (a locked-out user can still receive a fresh
+-- code and sign in).
+--
+-- The columns are additive to the `users` table from `012_otc.sql`.
+-- v0.8.0's `permission_state` column (roadmap item #6) lands in the
+-- driver's integration order ahead of this migration; we do not touch
+-- that column here. v0.7.0's nullable-`gitea_id`/`gitea_login` shape
+-- is preserved verbatim.
+--
+-- Storage shape:
+--
+--   * `passcode_hash` (nullable) — bcrypt hash of the passcode.
+--     NULL means "no passcode set"; the user is OTC-only.
+--   * `passcode_set_at` (nullable) — timestamp of the most recent
+--     `passcode/set` call. Updated when a passcode is set or
+--     replaced; cleared when the passcode is removed.
+--   * `passcode_failed_attempts` — count of consecutive failed
+--     verify attempts since the last successful verify (or since
+--     the lockout cleared). Resets to 0 on success and on lockout
+--     expiry. Defaults to 0 so existing rows post-migration are
+--     not implicitly half-locked.
+--   * `passcode_locked_until` (nullable) — if populated and the
+--     timestamp is in the future, passcode verify is refused with
+--     HTTP 423. Cleared on successful verify after the window
+--     expires, or by the operator via direct DB intervention if
+--     ever needed (no admin endpoint surfaces this in v1).
+--
+-- v0.10.0 introduces no new env vars. The lockout window (5 attempts,
+-- 15 minutes) is hard-coded in `backend/app/passcode.py`; raising or
+-- lowering it is a future-§19.2 candidate. Passcode hashing reuses
+-- the bcrypt dependency added in v0.7.0 for OTC; no new secret is
+-- required (the existing `SECRET_KEY` continues to sign sessions).
+--
+-- Note on SQLite: ALTER TABLE ... ADD COLUMN is supported, so this
+-- migration does not need the rebuild dance that `012_otc.sql`
+-- required. The runner wraps each file in a single BEGIN/COMMIT
+-- block — see `backend/app/db.py` — so either every ADD COLUMN
+-- here lands or none do.
+
+ALTER TABLE users ADD COLUMN passcode_hash TEXT;
+ALTER TABLE users ADD COLUMN passcode_set_at TEXT;
+ALTER TABLE users ADD COLUMN passcode_failed_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE users ADD COLUMN passcode_locked_until TEXT;

backend/requirements.txt

@@ -8,3 +8,4 @@ anthropic>=0.39
 google-generativeai>=0.8
 openai>=1.50
 PyYAML>=6.0
+bcrypt>=4.2

backend/tests/test_anon_offlimits_vertical.py

@@ -0,0 +1,476 @@
+"""v0.6.0 (roadmap item #4) — "anon discuss + contribute off-limits"
+vertical.
+
+A sweep-the-edges hardening release. The v0.3.0 release hid the write
+affordances from anonymous viewers; v0.5.0 added the PR-less discussion
+surface with its own write gate. v0.6.0 audits both: every write-shaped
+endpoint refuses anonymous callers with 401 (or 403 when the role check
+runs after the auth check), and every anonymous-read surface stays
+reachable.
+
+This test is the regression net for the audit. It walks each module's
+representative write endpoint as an anonymous client and asserts the
+401/403, then walks the same surfaces' representative read endpoints
+as anonymous and asserts the 200. The intent is breadth over depth:
+one assertion per write endpoint family is enough to catch a
+regression where someone strips the `auth.require_contributor` line.
+
+Endpoints covered (one or two from each module):
+
+  - api.py:          propose, decline (admin), withdraw,
+                     funder credentials POST/DELETE, funder consent
+                     POST/DELETE
+  - api_branches.py: promote-to-branch, start-edit-branch, metadata,
+                     manual-flush, visibility, grants POST/DELETE,
+                     threads POST, thread messages POST, resolve,
+                     chat-seen, change accept/decline/reask
+  - api_prs.py:      pr-draft, open-pr, seen, review, merge, withdraw,
+                     description, resolution-branch
+  - api_discussion.py: thread create, message post, resolve
+  - api_admin.py:    role POST, mute POST, allowlist POST/DELETE
+  - api_notifications.py: prefs POST, watch POST, mark-read POST,
+                          quiet-hours POST, user-mute POST/DELETE
+  - api_graduation.py: graduate POST, claim POST, progress GET
+
+The §15.7 reads (`/api/notifications`, `/api/watches`,
+`/api/users/me/*`) are per-user surfaces — they require an
+authenticated viewer by definition; an anonymous 401 on those reads is
+shape-correct, not a regression. The test does not assert reads on
+those.
+"""
+from __future__ import annotations
+
+import pytest
+
+# Reuse the fixture / session / fake-Gitea harness from Slice 1.
+from test_propose_vertical import (  # noqa: F401 — fixtures land via import
+    FakeGitea,
+    app_with_fake_gitea,
+    provision_user_row,
+    sign_in_as,
+    tmp_env,
+)
+from test_rfc_view_vertical import SEED_BODY, seed_active_rfc
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+def test_anonymous_can_read_every_public_surface(app_with_fake_gitea):
+    """Per §14 / the v0.3.0 anonymous-read contract: the catalog, the
+    RFC view, the PR-less discussion surface, the philosophy page, and
+    the health probe must remain reachable for unauthenticated viewers.
+    This is the read side of the item #4 contract — the read surfaces
+    must NOT regress to require auth as the write gates tighten.
+    """
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=1, login="alice", role="contributor")
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+
+        # No session cookie — viewer is anonymous.
+        client.cookies.clear()
+
+        # The five read surfaces an anonymous viewer must reach.
+        assert client.get("/api/health").status_code == 200
+        assert client.get("/api/philosophy").status_code == 200
+        assert client.get("/api/auth/me").status_code == 200
+        assert client.get("/api/rfcs").status_code == 200
+        assert client.get("/api/rfcs/ohm").status_code == 200
+        assert client.get("/api/rfcs/ohm/main").status_code == 200
+        assert client.get("/api/rfcs/ohm/discussion/threads").status_code == 200
+        assert client.get("/api/proposals").status_code == 200
+
+
+def test_anonymous_propose_refused(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        client.cookies.clear()
+        r = client.post(
+            "/api/rfcs/propose",
+            json={"title": "X", "slug": "x", "pitch": "p", "tags": []},
+        )
+        assert r.status_code == 401
+
+
+def test_anonymous_proposal_admin_paths_refused(app_with_fake_gitea):
+    """The admin-gated proposal actions — merge, decline — must refuse
+    anonymous callers with 401 (the auth check runs before the role
+    check; both refusals are correct, but 401 is the structural signal
+    "no session at all")."""
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        client.cookies.clear()
+        # PR number doesn't need to exist — the gate runs first.
+        assert client.post("/api/proposals/1/merge").status_code == 401
+        assert (
+            client.post("/api/proposals/1/decline", json={"comment": "no"}).status_code
+            == 401
+        )
+        assert client.post("/api/proposals/1/withdraw").status_code == 401
+
+
+def test_anonymous_branch_writes_refused_on_active_rfc(app_with_fake_gitea):
+    """Branch-scoped writes on an active RFC: promote-to-branch,
+    manual-flush, visibility, grants, threads create, message post,
+    resolve, chat-seen, change accept/decline/reask. All must 401 for
+    anonymous callers."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        client.cookies.clear()
+
+        # Branch-scoped writes — slug + branch values are placeholders;
+        # the auth gate runs before any state lookup.
+        slug = "ohm"
+        branch = "feature-x"
+
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/main/promote-to-branch",
+                json={},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/manual-flush",
+                json={"new_content": "hi", "paragraph_count": 1},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/visibility",
+                json={"read_public": False},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/grants",
+                json={"grantee_gitea_login": "alice"},
+            ).status_code == 401
+        )
+        assert (
+            client.delete(
+                f"/api/rfcs/{slug}/branches/{branch}/grants/alice",
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/threads",
+                json={"thread_kind": "chat", "anchor_kind": "whole-doc"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/threads/1/messages",
+                json={"text": "hi"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/threads/1/resolve",
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/chat-seen",
+                json={"last_seen_message_id": 1},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/changes/1/accept",
+                json={"proposed": "x"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/changes/1/decline",
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/changes/1/reask",
+            ).status_code == 401
+        )
+        # Chat stream — POST shaped, same auth gate.
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/threads/1/chat",
+                json={"text": "hi"},
+            ).status_code == 401
+        )
+
+
+def test_anonymous_super_draft_writes_refused(app_with_fake_gitea):
+    """Super-draft-scoped writes: start-edit-branch and metadata. The
+    PR open / merge paths share the gate via api_prs.py — see the
+    PR-flow test below for those."""
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/rfcs/anything/start-edit-branch", json={}
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/rfcs/anything/metadata", json={"title": "x"}
+            ).status_code == 401
+        )
+
+
+def test_anonymous_pr_flow_writes_refused(app_with_fake_gitea):
+    """All §10 PR-flow writes — open, merge, withdraw, description,
+    review, seen, pr-draft, resolution-branch — must 401 for anonymous."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        client.cookies.clear()
+        slug, branch, pr = "ohm", "feature-x", 1
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/pr-draft"
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/branches/{branch}/open-pr",
+                json={"title": "t", "description": "d"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/seen",
+                json={"last_seen_message_id": 1},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/review",
+                json={"text": "x", "anchor_payload": {}},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/merge"
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/withdraw"
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/description",
+                json={"title": "t", "description": "d"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                f"/api/rfcs/{slug}/prs/{pr}/resolution-branch"
+            ).status_code == 401
+        )
+
+
+def test_anonymous_discussion_writes_refused(app_with_fake_gitea):
+    """The v0.5.0 PR-less discussion surface — write gates must hold.
+    This duplicates the assertion in `test_discussion_vertical.py` and
+    keeps it here too as the canonical home for the item #4 audit."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/rfcs/ohm/discussion/threads",
+                json={"message": "drive-by"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/rfcs/ohm/discussion/threads/1/messages",
+                json={"text": "drive-by"},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/rfcs/ohm/discussion/threads/1/resolve"
+            ).status_code == 401
+        )
+
+
+def test_anonymous_admin_writes_refused(app_with_fake_gitea):
+    """Admin surfaces — role, mute, allowlist — refuse anonymous.
+    The auth check runs before the require_admin role check, so the
+    response is 401."""
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/admin/users/1/role", json={"role": "admin"}
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/admin/users/1/mute", json={"muted": True}
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/admin/allowlist", json={"email": "x@y.z"}
+            ).status_code == 401
+        )
+        assert (
+            client.delete("/api/admin/allowlist/x@y.z").status_code == 401
+        )
+        # Admin reads also gated.
+        assert client.get("/api/admin/users").status_code == 401
+        assert client.get("/api/admin/audit").status_code == 401
+        assert client.get("/api/admin/permission-events").status_code == 401
+        assert client.get("/api/admin/graduation-queue").status_code == 401
+        assert client.get("/api/admin/allowlist").status_code == 401
+
+
+def test_anonymous_notification_writes_refused(app_with_fake_gitea):
+    """Notification preference / watch / mark-read / user-mute writes —
+    all per-user surfaces, all require an authenticated viewer."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/users/me/notification-preferences",
+                json={"email_personal_direct": False},
+            ).status_code == 401
+        )
+        assert (
+            client.post(
+                "/api/users/me/quiet-hours",
+                json={"start": None, "end": None, "timezone": None},
+            ).status_code == 401
+        )
+        assert (
+            client.post("/api/rfcs/ohm/watch", json={"state": "watching"}).status_code
+            == 401
+        )
+        assert client.post("/api/notifications/1/read").status_code == 401
+        assert (
+            client.post("/api/notifications/read", json={}).status_code == 401
+        )
+        assert client.post("/api/users/1/notification-mute").status_code == 401
+        assert client.delete("/api/users/1/notification-mute").status_code == 401
+
+
+def test_anonymous_funder_writes_refused(app_with_fake_gitea):
+    """§6.7 funder credential + consent writes — registering a key,
+    consenting to fund — all refuse anonymous callers."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/users/me/funder/credentials",
+                json={"provider": "anthropic", "api_key": "sk-test"},
+            ).status_code == 401
+        )
+        assert (
+            client.delete(
+                "/api/users/me/funder/credentials/anthropic"
+            ).status_code == 401
+        )
+        assert (
+            client.post("/api/rfcs/ohm/funder/consent").status_code == 401
+        )
+        assert (
+            client.delete("/api/rfcs/ohm/funder/consent").status_code == 401
+        )
+
+
+def test_anonymous_graduation_writes_refused(app_with_fake_gitea):
+    """§13 graduation: the POST kickoff and POST claim both refuse
+    anonymous. The progress SSE was gated to require_user in v0.6.0
+    (item #4) since it surfaces admin-internal step detail."""
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        client.cookies.clear()
+        assert (
+            client.post(
+                "/api/rfcs/anything/graduate",
+                json={
+                    "rfc_id": "RFC-0001",
+                    "repo_name": "rfc-0001-x",
+                    "owners": ["alice"],
+                },
+            ).status_code == 401
+        )
+        assert client.post("/api/rfcs/anything/claim").status_code == 401
+        # v0.6.0 tightening: progress SSE now requires require_user.
+        # No graduation is in flight, but the auth check runs first.
+        assert (
+            client.get("/api/rfcs/anything/graduate/progress").status_code == 401
+        )
+
+
+def test_anonymous_can_read_published_pr_view(app_with_fake_gitea):
+    """The PR review page is §11.3 universal-public — once a PR is
+    open, anonymous viewers can read it. This guards against a
+    regression where the read endpoint accidentally grows an auth
+    gate."""
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        # Seed an open PR row directly — the cache shape is enough for
+        # the read endpoint; the live Gitea fetch falls back gracefully.
+        db.conn().execute(
+            """
+            INSERT INTO cached_prs
+                (rfc_slug, pr_kind, repo, pr_number, title, description, state,
+                 opened_by, opened_at, head_branch, base_branch, head_sha)
+            VALUES ('ohm', 'rfc_branch', 'wiggleverse/rfc-0001-ohm', 7, 't', 'd',
+                    'open', 'alice', datetime('now'), 'feature-x', 'main', 'sha7')
+            """
+        )
+        client.cookies.clear()
+        # Anonymous read on an open PR: should be 200. The endpoint may
+        # surface a partial response (the FakeGitea won't have the head
+        # branch's RFC.md, so branch_body falls back to empty) but the
+        # auth gate must let the read through.
+        r = client.get("/api/rfcs/ohm/prs/7")
+        assert r.status_code == 200
+        body = r.json()
+        assert body["capabilities"]["is_anonymous"] is True
+        assert body["capabilities"]["can_merge"] is False
+        assert body["capabilities"]["can_post_review"] is False

backend/tests/test_cookie_consent_vertical.py

@@ -0,0 +1,205 @@
+"""End-to-end tests for v0.13.0 / roadmap item #11 — cookie / privacy consent.
+
+Covers the §17 endpoints (`GET` / `PUT /api/users/me/cookie-consent`) and
+the §14.5 storage contract:
+
+  * GET on a fresh user returns no-choice-yet (recorded_at is None,
+    essential=True, analytics=False, other=False).
+  * PUT writes a row, stamps recorded_at, and the choice survives.
+  * PUT with `analytics=true, other=false` round-trips faithfully.
+  * `essential` is permanently true at the API surface — a PUT that
+    requests essential=false is still persisted with essential=true.
+  * The endpoint requires authentication (401 for anon).
+  * A second PUT updates the existing row in place (single row per
+    user, recorded_at re-stamps).
+  * Choice persists across sign-out / sign-in.
+"""
+from __future__ import annotations
+
+import pytest
+
+from test_propose_vertical import (  # noqa: F401
+    FakeGitea,
+    app_with_fake_gitea,
+    provision_user_row,
+    sign_in_as,
+    tmp_env,
+)
+
+
+def test_get_cookie_consent_fresh_user_has_no_choice(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+
+        r = client.get("/api/users/me/cookie-consent")
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert body["essential"] is True
+        assert body["analytics"] is False
+        assert body["other"] is False
+        assert body["recorded_at"] is None
+
+
+def test_put_cookie_consent_records_choice(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+
+        r = client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": True, "other": False},
+        )
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert body["ok"] is True
+        assert body["essential"] is True
+        assert body["analytics"] is True
+        assert body["other"] is False
+        assert body["recorded_at"] is not None
+
+        # Round-trip the read endpoint.
+        r = client.get("/api/users/me/cookie-consent")
+        body = r.json()
+        assert body["essential"] is True
+        assert body["analytics"] is True
+        assert body["other"] is False
+        assert body["recorded_at"] is not None
+
+
+def test_put_cookie_consent_forces_essential_true(app_with_fake_gitea):
+    """§14.5: `essential` is permanently true at the API surface. A
+    request that sets it to false is accepted (for symmetry with the
+    other two flags) but persisted as true.
+    """
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+
+        r = client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": False, "analytics": False, "other": False},
+        )
+        assert r.status_code == 200, r.text
+        assert r.json()["essential"] is True
+
+        # Confirm at the schema layer too — the persisted row has essential=1.
+        row = db.conn().execute(
+            "SELECT essential FROM cookie_consent WHERE user_id = ?",
+            (2,),
+        ).fetchone()
+        assert row["essential"] == 1
+
+
+def test_cookie_consent_requires_auth(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        r = client.get("/api/users/me/cookie-consent")
+        assert r.status_code == 401, r.text
+        r = client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": True, "other": True},
+        )
+        assert r.status_code == 401, r.text
+
+
+def test_put_cookie_consent_upserts_in_place(app_with_fake_gitea):
+    """A second PUT updates the existing row rather than inserting a new
+    one. Verifies the §14.5 single-row-per-user shape.
+    """
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+
+        client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": True, "other": False},
+        )
+        client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": False, "other": True},
+        )
+
+        rows = db.conn().execute(
+            "SELECT analytics, other_cookies FROM cookie_consent WHERE user_id = ?",
+            (2,),
+        ).fetchall()
+        assert len(rows) == 1
+        assert rows[0]["analytics"] == 0
+        assert rows[0]["other_cookies"] == 1
+
+
+def test_cookie_consent_persists_across_sign_out_in(app_with_fake_gitea):
+    """§14.5 precedence: the server row survives sign-out / sign-in.
+    """
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+
+        client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": True, "other": True},
+        )
+
+        # Simulate sign-out by clearing the session cookie.
+        client.cookies.clear()
+
+        # Anonymous viewer cannot read.
+        r = client.get("/api/users/me/cookie-consent")
+        assert r.status_code == 401
+
+        # Sign back in as Alice. The server row is still there.
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+        r = client.get("/api/users/me/cookie-consent")
+        body = r.json()
+        assert body["analytics"] is True
+        assert body["other"] is True
+        assert body["recorded_at"] is not None
+
+
+def test_two_users_have_independent_rows(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        provision_user_row(user_id=3, login="bob", role="contributor")
+
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+        client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": True, "other": False},
+        )
+
+        sign_in_as(client, user_id=3, gitea_login="bob", display_name="Bob", role="contributor")
+        client.put(
+            "/api/users/me/cookie-consent",
+            json={"essential": True, "analytics": False, "other": False},
+        )
+
+        # Each user reads their own row.
+        r = client.get("/api/users/me/cookie-consent").json()
+        assert r["analytics"] is False  # Bob's
+
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+        r = client.get("/api/users/me/cookie-consent").json()
+        assert r["analytics"] is True  # Alice's

backend/tests/test_discussion_vertical.py

@@ -0,0 +1,237 @@
+"""End-to-end integration tests for the v0.5.0 PR-less discussion
+surface — roadmap item #3, "discussion without PR; contribution requires
+PR."
+
+The vertical: an active RFC exists; the discussion endpoints under
+`/api/rfcs/<slug>/discussion/...` open threads with
+`threads.branch_name IS NULL`, post messages into them, and surface
+them on subsequent reads. Branch-scoped threads (the §8.12 surface)
+remain segregated. Anonymous viewers can read; only signed-in
+contributors can write.
+"""
+from __future__ import annotations
+
+import pytest
+
+# Reuse the harness from Slice 1 / Slice 2.
+from test_propose_vertical import (  # noqa: F401 — fixtures land via import
+    FakeGitea,
+    app_with_fake_gitea,
+    provision_user_row,
+    sign_in_as,
+    tmp_env,
+)
+from test_rfc_view_vertical import seed_active_rfc, SEED_BODY
+
+
+# ---------------------------------------------------------------------------
+# Tests
+# ---------------------------------------------------------------------------
+
+
+def test_create_and_post_to_pr_less_discussion_thread(app_with_fake_gitea):
+    """The vertical: signed-in contributor opens a thread on the RFC's
+    discussion surface, posts a message, and the thread + message
+    surface on subsequent reads with branch_name IS NULL."""
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=1, login="alice", role="contributor")
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        sign_in_as(client, user_id=1, gitea_login="alice", display_name="Alice", role="contributor")
+
+        # Listing materializes the default whole-doc thread.
+        r = client.get("/api/rfcs/ohm/discussion/threads")
+        assert r.status_code == 200, r.text
+        items = r.json()["items"]
+        assert len(items) == 1
+        default_thread_id = items[0]["id"]
+        assert items[0]["anchor_kind"] == "whole-doc"
+        assert items[0]["thread_kind"] == "chat"
+
+        # Open an additional discussion thread with a first message.
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"label": "Question about §3", "message": "Is consent baked into the trait model?"},
+        )
+        assert r.status_code == 200, r.text
+        payload = r.json()
+        thread_id = payload["thread_id"]
+        message_id = payload["message_id"]
+        assert thread_id is not None and message_id is not None
+
+        # Confirm the row carries branch_name IS NULL (the PR-less shape).
+        row = db.conn().execute(
+            "SELECT rfc_slug, branch_name, thread_kind, anchor_kind, created_by FROM threads WHERE id = ?",
+            (thread_id,),
+        ).fetchone()
+        assert row["rfc_slug"] == "ohm"
+        assert row["branch_name"] is None
+        assert row["thread_kind"] == "chat"
+        assert row["anchor_kind"] == "whole-doc"
+        assert row["created_by"] == 1
+
+        # The thread surfaces on the list endpoint alongside the default.
+        r = client.get("/api/rfcs/ohm/discussion/threads")
+        ids = [t["id"] for t in r.json()["items"]]
+        assert default_thread_id in ids
+        assert thread_id in ids
+
+        # Posting a reply on the new thread persists and returns the id.
+        r = client.post(
+            f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages",
+            json={"text": "Following up — see §3.2."},
+        )
+        assert r.status_code == 200, r.text
+        reply_id = r.json()["message_id"]
+
+        # The messages read endpoint returns both messages in order.
+        r = client.get(f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages")
+        assert r.status_code == 200
+        messages = r.json()["messages"]
+        assert [m["id"] for m in messages] == [message_id, reply_id]
+        assert messages[0]["author_login"] == "alice"
+        assert messages[0]["text"].startswith("Is consent")
+
+
+def test_anonymous_can_read_but_cannot_post_discussion(app_with_fake_gitea):
+    """Per the v0.3.0 anonymous-read contract: reads on the discussion
+    surface are open; write attempts return 401. v0.6.0 (item #4) will
+    tighten the read gate — v0.5.0 holds the write line so there is no
+    open window between releases."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=2, login="alice", role="contributor")
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+
+        # Seed the discussion thread + first message as Alice.
+        sign_in_as(client, user_id=2, gitea_login="alice", display_name="Alice", role="contributor")
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"message": "First."},
+        )
+        assert r.status_code == 200
+        thread_id = r.json()["thread_id"]
+
+        # Drop the session — viewer is anonymous now.
+        client.cookies.clear()
+
+        # Reads are open.
+        r = client.get("/api/rfcs/ohm/discussion/threads")
+        assert r.status_code == 200
+        assert any(t["id"] == thread_id for t in r.json()["items"])
+
+        r = client.get(f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages")
+        assert r.status_code == 200
+        assert len(r.json()["messages"]) >= 1
+
+        # Writes refuse 401.
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"message": "Drive-by."},
+        )
+        assert r.status_code == 401
+
+        r = client.post(
+            f"/api/rfcs/ohm/discussion/threads/{thread_id}/messages",
+            json={"text": "Drive-by reply."},
+        )
+        assert r.status_code == 401
+
+
+def test_discussion_threads_and_branch_threads_are_segregated(app_with_fake_gitea):
+    """A branch-scoped thread (the §8.12 surface, branch_name='main' or a
+    feature branch) MUST NOT surface on the discussion endpoint, which
+    is keyed on branch_name IS NULL. The two surfaces share a table; the
+    null-filter is what segregates them."""
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=3, login="alice", role="contributor")
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+        sign_in_as(client, user_id=3, gitea_login="alice", display_name="Alice", role="contributor")
+
+        # Manually materialize a branch-scoped thread on a feature branch.
+        db.conn().execute(
+            """
+            INSERT INTO threads
+                (rfc_slug, branch_name, anchor_kind, thread_kind, label, created_by)
+            VALUES ('ohm', 'alice-draft-aa00', 'whole-doc', 'chat', NULL, 3)
+            """
+        )
+        # And one on the discussion surface.
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"message": "Discussion-surface message."},
+        )
+        assert r.status_code == 200
+        discussion_thread_id = r.json()["thread_id"]
+
+        # The discussion list contains the null-branch thread (plus the
+        # default whole-doc) and excludes the feature-branch thread.
+        r = client.get("/api/rfcs/ohm/discussion/threads")
+        assert r.status_code == 200
+        ids = [t["id"] for t in r.json()["items"]]
+        assert discussion_thread_id in ids
+        # Feature-branch thread MUST NOT surface.
+        branch_thread_row = db.conn().execute(
+            "SELECT id FROM threads WHERE branch_name = 'alice-draft-aa00'"
+        ).fetchone()
+        assert branch_thread_row is not None
+        assert branch_thread_row["id"] not in ids
+
+
+def test_discussion_thread_resolve_permissions(app_with_fake_gitea):
+    """A thread's creator can resolve it; an unrelated contributor cannot;
+    an admin / owner / RFC-owner can. Mirrors §8.12's resolution rule for
+    branch-scoped threads."""
+    from fastapi.testclient import TestClient
+
+    app, fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=4, login="alice", role="contributor")
+        provision_user_row(user_id=5, login="bob", role="contributor")
+        provision_user_row(user_id=6, login="ben", role="owner")
+        seed_active_rfc(fake, slug="ohm", title="OHM", body=SEED_BODY)
+
+        sign_in_as(client, user_id=4, gitea_login="alice", display_name="Alice", role="contributor")
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"label": "Alice's thread", "message": "..."},
+        )
+        thread_id = r.json()["thread_id"]
+
+        # Unrelated contributor refused.
+        sign_in_as(client, user_id=5, gitea_login="bob", display_name="Bob", role="contributor")
+        r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id}/resolve")
+        assert r.status_code == 403
+
+        # Creator allowed.
+        sign_in_as(client, user_id=4, gitea_login="alice", display_name="Alice", role="contributor")
+        r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id}/resolve")
+        assert r.status_code == 200
+
+        # Open another thread, resolve it as the owner.
+        r = client.post(
+            "/api/rfcs/ohm/discussion/threads",
+            json={"label": "Another thread", "message": "..."},
+        )
+        thread_id2 = r.json()["thread_id"]
+        sign_in_as(client, user_id=6, gitea_login="ben", display_name="Ben", role="owner")
+        r = client.post(f"/api/rfcs/ohm/discussion/threads/{thread_id2}/resolve")
+        assert r.status_code == 200
+
+
+def test_discussion_404_on_unknown_rfc(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        r = client.get("/api/rfcs/nonexistent/discussion/threads")
+        assert r.status_code == 404

backend/tests/test_otc_vertical.py

@@ -0,0 +1,333 @@
+"""End-to-end integration tests for the v0.7.0 email/OTC sign-in
+vertical (§6.2).
+
+The release replaces the Gitea OAuth gesture as the primary human
+sign-in path. The tests prove:
+
+  * `/auth/otc/request` is rate-limited per-email — back-to-back
+    requests inside `OTC_REQUEST_COOLDOWN_SECONDS` are refused with
+    429 (the loud-failure shape the spec calls out).
+  * The happy path: request → code lands in the outbound buffer →
+    verify with the code → session cookie surfaces an authenticated
+    user via `/api/auth/me`.
+  * Expired codes refuse with 400.
+  * Already-consumed codes refuse with 400 on re-use.
+  * Wrong codes refuse with 400.
+  * Allowlist gate: when `allowed_emails` is populated and the email
+    isn't on it, the response is still 202 (no leak), but no email
+    lands in the outbound buffer and verify finds no matching code.
+  * Migration link: an existing OAuth-era user (with a `users.email`
+    row) is linked by email on first OTC sign-in — `gitea_id` is
+    preserved.
+  * Provisioning path: an unrecognized email creates a fresh
+    contributor row with `gitea_id = NULL`.
+
+The Gitea bot user + token are still required at process construction
+(every test harness sets the same `GITEA_*` env vars); the OTC flow
+itself never reaches Gitea. The fakes from `test_propose_vertical`
+remain in scope so the rest of the app boots cleanly.
+"""
+from __future__ import annotations
+
+import pytest
+
+from test_propose_vertical import (  # noqa: F401
+    FakeGitea,
+    app_with_fake_gitea,
+    provision_user_row,
+    tmp_env,
+)
+
+
+def _reset_outbound():
+    from app import email as email_mod
+    email_mod.reset_sent_envelopes()
+
+
+def _outbound_otc_codes(to_address: str | None = None) -> list[str]:
+    """Pluck the `code` line out of every OTC email in the test buffer.
+
+    The OTC mailer stamps `kind='otc'` on the envelope so the §15.4
+    notification mailer's envelopes (the unsubscribe-footer shape)
+    don't accidentally satisfy the assertion. Each envelope's body
+    carries the code on its own indented line; this helper extracts
+    just that token so the test reads the same way the user would
+    read the email.
+    """
+    from app import email as email_mod
+    out = []
+    for env in email_mod.sent_envelopes():
+        if env.get("kind") != "otc":
+            continue
+        if to_address is not None and env["to"] != to_address:
+            continue
+        for line in env["body"].splitlines():
+            tok = line.strip()
+            if tok.isdigit() and len(tok) == 6:
+                out.append(tok)
+                break
+    return out
+
+
+# ---------------------------------------------------------------------------
+# Happy path
+# ---------------------------------------------------------------------------
+
+
+def test_otc_request_then_verify_signs_in_a_fresh_user(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+
+        # Request: 202 + a single OTC envelope to the requested address.
+        r = client.post("/auth/otc/request", json={"email": "newcomer@example.com"})
+        assert r.status_code == 200, r.text
+        codes = _outbound_otc_codes("newcomer@example.com")
+        assert len(codes) == 1
+        code = codes[0]
+
+        # Verify: 200 + session cookie + me-shape now reads authenticated.
+        r = client.post("/auth/otc/verify", json={"email": "newcomer@example.com", "code": code})
+        assert r.status_code == 200, r.text
+        me = client.get("/api/auth/me").json()
+        assert me["authenticated"] is True
+        assert me["user"]["email"] == "newcomer@example.com"
+        # Fresh provisioning: no gitea linker. The display name is the
+        # local part of the email per §6.2.
+        assert me["user"]["role"] == "contributor"
+        assert me["user"]["display_name"] == "newcomer"
+
+        # The `users` row reflects the same: gitea_id NULL, email set.
+        from app import db
+        row = db.conn().execute(
+            "SELECT gitea_id, email FROM users WHERE email = ? COLLATE NOCASE",
+            ("newcomer@example.com",),
+        ).fetchone()
+        assert row is not None
+        assert row["gitea_id"] is None
+        assert row["email"] == "newcomer@example.com"
+
+
+# ---------------------------------------------------------------------------
+# Failure modes on verify
+# ---------------------------------------------------------------------------
+
+
+def test_otc_verify_refuses_wrong_code(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": "000000"})
+        assert r.status_code == 400
+
+
+def test_otc_verify_refuses_consumed_code(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        code = _outbound_otc_codes("alice@example.com")[-1]
+        # First verify succeeds.
+        r1 = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
+        assert r1.status_code == 200
+        # Drop the session cookie so the re-verify reads as fresh.
+        client.cookies.clear()
+        # Second verify with the same code is refused — `consumed_at`
+        # stamped on the row blocks the replay.
+        r2 = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
+        assert r2.status_code == 400
+
+
+def test_otc_verify_refuses_expired_code(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        code = _outbound_otc_codes("alice@example.com")[-1]
+        # Backdate the row's expires_at to the past. The TTL setting is
+        # an env var (default 10 min); rather than waiting, the test
+        # rewrites the row.
+        db.conn().execute(
+            "UPDATE otc_codes SET expires_at = datetime('now', '-1 minute') WHERE email = ?",
+            ("alice@example.com",),
+        )
+        r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": code})
+        assert r.status_code == 400
+
+
+# ---------------------------------------------------------------------------
+# Rate limiting
+# ---------------------------------------------------------------------------
+
+
+def test_otc_request_rate_limited_per_email(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        r1 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        assert r1.status_code == 200
+        # Cooldown defaults to 60s; the second back-to-back call is
+        # refused with a loud 429.
+        r2 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        assert r2.status_code == 429
+        # The buffer still has exactly one envelope — the rate-limited
+        # call didn't double-send.
+        assert len(_outbound_otc_codes("alice@example.com")) == 1
+
+
+def test_otc_request_cooldown_is_per_email_not_global(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        r1 = client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        assert r1.status_code == 200
+        # Different email, fresh cooldown.
+        r2 = client.post("/auth/otc/request", json={"email": "bob@example.com"})
+        assert r2.status_code == 200
+
+
+# ---------------------------------------------------------------------------
+# Allowlist gate
+# ---------------------------------------------------------------------------
+
+
+def test_otc_request_silently_drops_when_email_not_on_allowlist(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        # Populate the allowlist so the gate turns on.
+        db.conn().execute("INSERT INTO allowed_emails (email) VALUES (?)", ("invited@example.com",))
+
+        r = client.post("/auth/otc/request", json={"email": "stranger@example.com"})
+        # Still 202 — the allowlist's state is not leaked to callers.
+        assert r.status_code == 200
+        # But no email was sent, and no row landed in otc_codes.
+        assert _outbound_otc_codes("stranger@example.com") == []
+        row = db.conn().execute(
+            "SELECT 1 FROM otc_codes WHERE email = ?",
+            ("stranger@example.com",),
+        ).fetchone()
+        assert row is None
+
+
+def test_otc_request_admits_allowlisted_email(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        db.conn().execute("INSERT INTO allowed_emails (email) VALUES (?)", ("invited@example.com",))
+        r = client.post("/auth/otc/request", json={"email": "invited@example.com"})
+        assert r.status_code == 200
+        assert len(_outbound_otc_codes("invited@example.com")) == 1
+
+
+# ---------------------------------------------------------------------------
+# Migration path — link by email to an OAuth-era user
+# ---------------------------------------------------------------------------
+
+
+def test_otc_links_to_existing_oauth_user_by_email(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        # Seed an OAuth-era row. `provision_user_row` writes
+        # email=<login>@test, so we sign in via OTC with the matching
+        # email and expect the same `users.id` to come back.
+        provision_user_row(user_id=42, login="legacyuser", role="contributor")
+        existing = db.conn().execute(
+            "SELECT id, gitea_id FROM users WHERE id = ?", (42,)
+        ).fetchone()
+        assert existing["gitea_id"] == 42  # OAuth linker is set.
+
+        r = client.post("/auth/otc/request", json={"email": "legacyuser@test"})
+        assert r.status_code == 200
+        code = _outbound_otc_codes("legacyuser@test")[-1]
+        r = client.post("/auth/otc/verify", json={"email": "legacyuser@test", "code": code})
+        assert r.status_code == 200
+
+        # /api/auth/me reports the linked user — same id, original role.
+        me = client.get("/api/auth/me").json()
+        assert me["authenticated"] is True
+        assert me["user"]["id"] == 42
+        assert me["user"]["role"] == "contributor"
+
+        # gitea_id is preserved on the linked row — the migration path
+        # doesn't disturb the OAuth linker.
+        row = db.conn().execute(
+            "SELECT gitea_id FROM users WHERE id = ?", (42,)
+        ).fetchone()
+        assert row["gitea_id"] == 42
+
+
+def test_otc_provisions_fresh_user_when_email_matches_no_one(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        r = client.post("/auth/otc/request", json={"email": "newperson@example.com"})
+        assert r.status_code == 200
+        code = _outbound_otc_codes("newperson@example.com")[-1]
+        r = client.post("/auth/otc/verify", json={"email": "newperson@example.com", "code": code})
+        assert r.status_code == 200
+
+        # A fresh row landed with NULL gitea_id (no OAuth linker).
+        row = db.conn().execute(
+            "SELECT id, gitea_id, gitea_login, role FROM users WHERE email = ? COLLATE NOCASE",
+            ("newperson@example.com",),
+        ).fetchone()
+        assert row is not None
+        assert row["gitea_id"] is None
+        assert row["gitea_login"] is None
+        assert row["role"] == "contributor"
+
+
+# ---------------------------------------------------------------------------
+# Re-request invalidates prior code
+# ---------------------------------------------------------------------------
+
+
+def test_otc_re_request_invalidates_prior_unused_code(app_with_fake_gitea, monkeypatch):
+    from fastapi.testclient import TestClient
+
+    # Drop the cooldown so the second request lands instead of 429ing.
+    monkeypatch.setenv("OTC_REQUEST_COOLDOWN_SECONDS", "0")
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        first = _outbound_otc_codes("alice@example.com")[-1]
+        client.post("/auth/otc/request", json={"email": "alice@example.com"})
+        second = _outbound_otc_codes("alice@example.com")[-1]
+        assert first != second
+
+        # The old code is invalidated — verify with `first` now refuses.
+        r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": first})
+        assert r.status_code == 400
+
+        # The new code still works.
+        r = client.post("/auth/otc/verify", json={"email": "alice@example.com", "code": second})
+        assert r.status_code == 200

backend/tests/test_passcode_vertical.py

@@ -0,0 +1,532 @@
+"""End-to-end integration tests for the v0.10.0 user-set passcode
+vertical (§6.2, roadmap item #8).
+
+After a successful OTC sign-in the user can set a passcode and use
+email + passcode for subsequent sign-ins. OTC remains the structural
+fallback — these tests prove:
+
+  * `/auth/passcode/set` requires an active session.
+  * `/auth/passcode/check` returns `has_passcode` without leaking the
+    hash, the set-at stamp, or the lockout state.
+  * Happy path: OTC sign-in → set passcode → sign out → email +
+    passcode signs in (no OTC roundtrip).
+  * Wrong passcode increments the failure counter without locking.
+  * Five consecutive failures lock the passcode path (HTTP 423) and
+    persist `passcode_locked_until` on the user row.
+  * The lockout expires after `passcode_locked_until`; a verify
+    attempt past the window succeeds again and clears the counter.
+  * The OTC path is unaffected by the passcode lockout — a user
+    whose passcode is locked can still request and verify a fresh
+    OTC to sign in.
+  * Clearing the passcode wipes the hash; subsequent verify refuses
+    with the no-passcode failure shape.
+  * Setting a new passcode replaces the prior one (and resets the
+    failure counter / lockout state).
+  * `passcode_set_at` updates on every set call.
+  * The validation denylist refuses obvious patterns (e.g. `0000`,
+    `1234`).
+  * Passcode length is enforced (4-20).
+
+The fakes from `test_propose_vertical` give us a working app harness.
+The OTC envelope buffer from `test_otc_vertical` is reused for the
+OTC roundtrips this suite needs.
+"""
+from __future__ import annotations
+
+import pytest
+
+from test_propose_vertical import (  # noqa: F401
+    FakeGitea,
+    app_with_fake_gitea,
+    provision_user_row,
+    tmp_env,
+)
+
+
+# ---------------------------------------------------------------------------
+# Helpers — mirror the OTC suite's outbound-buffer helpers.
+# ---------------------------------------------------------------------------
+
+
+def _reset_outbound():
+    from app import email as email_mod
+    email_mod.reset_sent_envelopes()
+
+
+def _outbound_otc_codes(to_address: str | None = None) -> list[str]:
+    from app import email as email_mod
+    out = []
+    for env in email_mod.sent_envelopes():
+        if env.get("kind") != "otc":
+            continue
+        if to_address is not None and env["to"] != to_address:
+            continue
+        for line in env["body"].splitlines():
+            tok = line.strip()
+            if tok.isdigit() and len(tok) == 6:
+                out.append(tok)
+                break
+    return out
+
+
+def _sign_in_via_otc(client, email: str) -> None:
+    """Run an OTC request+verify so the client carries an authenticated
+    session. The cooldown is irrelevant on a fresh email; we don't
+    need to drop it."""
+    r = client.post("/auth/otc/request", json={"email": email})
+    assert r.status_code == 200, r.text
+    code = _outbound_otc_codes(email)[-1]
+    r = client.post("/auth/otc/verify", json={"email": email, "code": code})
+    assert r.status_code == 200, r.text
+
+
+# ---------------------------------------------------------------------------
+# Set passcode — auth-required, happy path
+# ---------------------------------------------------------------------------
+
+
+def test_set_passcode_requires_session(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        r = client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        assert r.status_code == 401
+
+
+def test_set_passcode_after_otc_landing_persists_hash(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "alice@example.com")
+
+        r = client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        assert r.status_code == 200, r.text
+
+        row = db.conn().execute(
+            "SELECT passcode_hash, passcode_set_at FROM users WHERE email = ? COLLATE NOCASE",
+            ("alice@example.com",),
+        ).fetchone()
+        assert row is not None
+        assert row["passcode_hash"] is not None
+        # Not the plaintext.
+        assert row["passcode_hash"] != "secret123"
+        assert row["passcode_set_at"] is not None
+
+
+# ---------------------------------------------------------------------------
+# Check endpoint — leak-free shape
+# ---------------------------------------------------------------------------
+
+
+def test_check_endpoint_returns_false_for_unknown_email(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        r = client.get("/auth/passcode/check", params={"email": "nobody@example.com"})
+        assert r.status_code == 200
+        assert r.json() == {"has_passcode": False}
+
+
+def test_check_endpoint_returns_false_for_user_without_passcode(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "bob@example.com")
+
+        r = client.get("/auth/passcode/check", params={"email": "bob@example.com"})
+        assert r.status_code == 200
+        assert r.json() == {"has_passcode": False}
+
+
+def test_check_endpoint_returns_true_after_set(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "carol@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "letmein9"})
+
+        # Drop the session so the check is read in the anonymous shape.
+        client.cookies.clear()
+        r = client.get("/auth/passcode/check", params={"email": "carol@example.com"})
+        assert r.status_code == 200
+        assert r.json() == {"has_passcode": True}
+        # The response carries ONLY the boolean — no hash, no stamp.
+        assert set(r.json().keys()) == {"has_passcode"}
+
+
+# ---------------------------------------------------------------------------
+# Verify path — happy path
+# ---------------------------------------------------------------------------
+
+
+def test_verify_passcode_signs_in_user(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "dave@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        client.cookies.clear()
+
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "dave@example.com", "passcode": "secret123"},
+        )
+        assert r.status_code == 200, r.text
+        me = client.get("/api/auth/me").json()
+        assert me["authenticated"] is True
+        assert me["user"]["email"] == "dave@example.com"
+        assert me["user"]["has_passcode"] is True
+
+
+# ---------------------------------------------------------------------------
+# Verify path — failure modes
+# ---------------------------------------------------------------------------
+
+
+def test_verify_passcode_wrong_increments_counter_without_locking(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "erin@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        client.cookies.clear()
+
+        # Three bad attempts — under the lockout threshold.
+        for _ in range(3):
+            r = client.post(
+                "/auth/passcode/verify",
+                json={"email": "erin@example.com", "passcode": "wrongwrong"},
+            )
+            assert r.status_code == 400
+
+        row = db.conn().execute(
+            "SELECT passcode_failed_attempts, passcode_locked_until FROM users WHERE email = ?",
+            ("erin@example.com",),
+        ).fetchone()
+        assert row["passcode_failed_attempts"] == 3
+        assert row["passcode_locked_until"] is None
+
+
+def test_verify_passcode_locks_after_five_failures(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "frank@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        client.cookies.clear()
+
+        # Five bad attempts — the last crosses the threshold and the
+        # response shape flips to 423.
+        statuses = []
+        for _ in range(5):
+            r = client.post(
+                "/auth/passcode/verify",
+                json={"email": "frank@example.com", "passcode": "wrongwrong"},
+            )
+            statuses.append(r.status_code)
+        # First four are 400, the fifth (threshold-crossing) is 423.
+        assert statuses == [400, 400, 400, 400, 423]
+
+        row = db.conn().execute(
+            "SELECT passcode_failed_attempts, passcode_locked_until FROM users WHERE email = ?",
+            ("frank@example.com",),
+        ).fetchone()
+        assert row["passcode_failed_attempts"] >= 5
+        assert row["passcode_locked_until"] is not None
+
+        # Sixth attempt — still locked, still 423, even with the correct
+        # passcode (lockout overrides the verify).
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "frank@example.com", "passcode": "secret123"},
+        )
+        assert r.status_code == 423
+
+
+def test_verify_passcode_lockout_expires(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "gina@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        client.cookies.clear()
+
+        for _ in range(5):
+            client.post(
+                "/auth/passcode/verify",
+                json={"email": "gina@example.com", "passcode": "wrongwrong"},
+            )
+
+        # Backdate the lockout to the past so the next attempt clears it.
+        db.conn().execute(
+            """
+            UPDATE users
+               SET passcode_locked_until = datetime('now', '-1 minute')
+             WHERE email = ?
+            """,
+            ("gina@example.com",),
+        )
+
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "gina@example.com", "passcode": "secret123"},
+        )
+        assert r.status_code == 200, r.text
+
+        # Lockout cleared, counter reset.
+        row = db.conn().execute(
+            "SELECT passcode_failed_attempts, passcode_locked_until FROM users WHERE email = ?",
+            ("gina@example.com",),
+        ).fetchone()
+        assert row["passcode_failed_attempts"] == 0
+        assert row["passcode_locked_until"] is None
+
+
+def test_otc_path_unaffected_by_passcode_lockout(app_with_fake_gitea, monkeypatch):
+    from fastapi.testclient import TestClient
+
+    # Drop the OTC cooldown so the second request lands without a 429.
+    # The cooldown is re-read from env on every `request_code` call so
+    # this takes effect mid-process.
+    monkeypatch.setenv("OTC_REQUEST_COOLDOWN_SECONDS", "0")
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "harvey@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        client.cookies.clear()
+
+        # Lock the passcode path.
+        for _ in range(5):
+            client.post(
+                "/auth/passcode/verify",
+                json={"email": "harvey@example.com", "passcode": "wrongwrong"},
+            )
+
+        # The OTC path is unaffected by the passcode lockout: the user
+        # can still request and verify a fresh code to sign in.
+        r = client.post("/auth/otc/request", json={"email": "harvey@example.com"})
+        assert r.status_code == 200
+        code = _outbound_otc_codes("harvey@example.com")[-1]
+        r = client.post("/auth/otc/verify", json={"email": "harvey@example.com", "code": code})
+        assert r.status_code == 200
+
+        # The user is now signed in via OTC even though the passcode
+        # path is locked. The /api/auth/me payload reflects this.
+        me = client.get("/api/auth/me").json()
+        assert me["authenticated"] is True
+        assert me["user"]["email"] == "harvey@example.com"
+
+
+# ---------------------------------------------------------------------------
+# Clear + replace
+# ---------------------------------------------------------------------------
+
+
+def test_clear_passcode_wipes_the_hash(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "ivy@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+
+        r = client.delete("/auth/passcode")
+        assert r.status_code == 200
+
+        row = db.conn().execute(
+            "SELECT passcode_hash, passcode_set_at FROM users WHERE email = ?",
+            ("ivy@example.com",),
+        ).fetchone()
+        assert row["passcode_hash"] is None
+        assert row["passcode_set_at"] is None
+
+        # Verify against the cleared passcode refuses (no-passcode shape
+        # collapses to a generic 400).
+        client.cookies.clear()
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "ivy@example.com", "passcode": "secret123"},
+        )
+        assert r.status_code == 400
+
+
+def test_setting_new_passcode_replaces_old(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "jane@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        # Replace.
+        r = client.post("/auth/passcode/set", json={"passcode": "newsecret9"})
+        assert r.status_code == 200
+
+        client.cookies.clear()
+
+        # Old passcode refuses.
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "jane@example.com", "passcode": "secret123"},
+        )
+        assert r.status_code == 400
+
+        # New passcode signs in.
+        r = client.post(
+            "/auth/passcode/verify",
+            json={"email": "jane@example.com", "passcode": "newsecret9"},
+        )
+        assert r.status_code == 200
+
+
+def test_setting_new_passcode_resets_lockout(app_with_fake_gitea, monkeypatch):
+    from fastapi.testclient import TestClient
+    from app import db
+
+    monkeypatch.setenv("OTC_REQUEST_COOLDOWN_SECONDS", "0")
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "kate@example.com")
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+
+        # Lock the passcode path with bad attempts (drop session first).
+        client.cookies.clear()
+        for _ in range(5):
+            client.post(
+                "/auth/passcode/verify",
+                json={"email": "kate@example.com", "passcode": "wrongwrong"},
+            )
+
+        row = db.conn().execute(
+            "SELECT passcode_locked_until FROM users WHERE email = ?",
+            ("kate@example.com",),
+        ).fetchone()
+        assert row["passcode_locked_until"] is not None
+
+        # Sign back in via OTC and reset the passcode.
+        r = client.post("/auth/otc/request", json={"email": "kate@example.com"})
+        assert r.status_code == 200
+        code = _outbound_otc_codes("kate@example.com")[-1]
+        r = client.post("/auth/otc/verify", json={"email": "kate@example.com", "code": code})
+        assert r.status_code == 200
+
+        r = client.post("/auth/passcode/set", json={"passcode": "freshcode9"})
+        assert r.status_code == 200
+
+        # Lockout cleared on set.
+        row = db.conn().execute(
+            "SELECT passcode_locked_until, passcode_failed_attempts FROM users WHERE email = ?",
+            ("kate@example.com",),
+        ).fetchone()
+        assert row["passcode_locked_until"] is None
+        assert row["passcode_failed_attempts"] == 0
+
+
+def test_passcode_set_at_updates_on_each_set(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+    from app import db
+    import time
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "luke@example.com")
+
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        first_stamp = db.conn().execute(
+            "SELECT passcode_set_at FROM users WHERE email = ?",
+            ("luke@example.com",),
+        ).fetchone()["passcode_set_at"]
+        assert first_stamp is not None
+
+        # SQLite's datetime('now') has second precision; sleep so the
+        # stamp visibly advances on the next set.
+        time.sleep(1.1)
+
+        client.post("/auth/passcode/set", json={"passcode": "newcode99"})
+        second_stamp = db.conn().execute(
+            "SELECT passcode_set_at FROM users WHERE email = ?",
+            ("luke@example.com",),
+        ).fetchone()["passcode_set_at"]
+        assert second_stamp is not None
+        assert second_stamp >= first_stamp
+        # Lexicographic compare on ISO-8601 datetime strings works for
+        # the SQLite shape.
+        assert second_stamp > first_stamp
+
+
+# ---------------------------------------------------------------------------
+# Validation
+# ---------------------------------------------------------------------------
+
+
+def test_set_passcode_refuses_too_short(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "mia@example.com")
+        r = client.post("/auth/passcode/set", json={"passcode": "abc"})
+        assert r.status_code == 422
+
+
+def test_set_passcode_refuses_denylist_pattern(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "nick@example.com")
+        for bad in ["0000", "1234", "aaaa", "qwerty", "password"]:
+            r = client.post("/auth/passcode/set", json={"passcode": bad})
+            assert r.status_code == 422, f"expected 422 for {bad!r}, got {r.status_code}"
+
+
+# ---------------------------------------------------------------------------
+# Auth me payload
+# ---------------------------------------------------------------------------
+
+
+def test_auth_me_carries_has_passcode_flag(app_with_fake_gitea):
+    from fastapi.testclient import TestClient
+
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        _reset_outbound()
+        _sign_in_via_otc(client, "olga@example.com")
+
+        me = client.get("/api/auth/me").json()
+        assert me["user"]["has_passcode"] is False
+        assert me["user"]["passcode_set_at"] is None
+
+        client.post("/auth/passcode/set", json={"passcode": "secret123"})
+        me = client.get("/api/auth/me").json()
+        assert me["user"]["has_passcode"] is True
+        assert me["user"]["passcode_set_at"] is not None

backend/tests/test_propose_vertical.py

@@ -496,6 +496,11 @@ def test_propose_to_super_draft_vertical(app_with_fake_gitea):
         proposal = r.json()
         assert proposal["entry"]["title"] == "Open Human Model"
         assert proposal["entry"]["state"] == "super-draft"
+        # §9.2: the proposer is the implicit first owner at propose time.
+        # The owners field is a single-element list containing exactly the
+        # session user's gitea_login — no request-supplied owner field
+        # exists or is honored.
+        assert proposal["entry"]["owners"] == ["alice"]
         assert proposal["affordances"]["merge"] is True
 
         # Owner merges. The catalog picks up the new super-draft.
@@ -516,6 +521,10 @@ def test_propose_to_super_draft_vertical(app_with_fake_gitea):
         view = r.json()
         assert view["state"] == "super-draft"
         assert "shared definition" in view["body"]
+        # §9.2: the auto-set proposer-owner survives the meta-repo round-trip
+        # — it's in the file's frontmatter on main after merge, not just
+        # in the pending-PR view above.
+        assert view["owners"] == ["alice"]
 
         # The pending-ideas list no longer carries the merged proposal.
         r = client.get("/api/proposals")
@@ -568,6 +577,37 @@ def test_anonymous_cannot_propose(app_with_fake_gitea):
         assert r.status_code == 401
 
 
+def test_proposer_is_auto_owner_request_payload_ignored(app_with_fake_gitea):
+    """§9.2: the owners field on the new entry is always exactly
+    `[session.gitea_login]`. The propose endpoint never accepts an owner
+    from the client; a request payload that smuggles one in is ignored
+    by the Pydantic body model and the auto-set value lands instead.
+    """
+    from fastapi.testclient import TestClient
+    app, _fake = app_with_fake_gitea
+    with TestClient(app) as client:
+        provision_user_row(user_id=11, login="alice", role="contributor")
+        sign_in_as(client, user_id=11, gitea_login="alice", display_name="Alice", role="contributor")
+        # Extra unknown fields like `owners` are dropped by the
+        # ProposeBody model; the session user is the only source of truth.
+        r = client.post("/api/rfcs/propose", json={
+            "title": "Spoof attempt",
+            "slug": "spoof-attempt",
+            "pitch": "p",
+            "tags": [],
+            "owners": ["mallory", "eve"],
+            "proposed_by": "mallory@test",
+        })
+        assert r.status_code == 200, r.text
+        pr_number = r.json()["pr_number"]
+        r = client.get(f"/api/proposals/{pr_number}")
+        assert r.status_code == 200, r.text
+        entry = r.json()["entry"]
+        assert entry["owners"] == ["alice"]
+        # proposed_by also comes from the session, never the body.
+        assert entry["proposed_by"] in ("alice@test", "alice")
+
+
 def test_withdraw_by_proposer_works(app_with_fake_gitea):
     from fastapi.testclient import TestClient
     app, _fake = app_with_fake_gitea

deploy/DEPLOY-NEW-SESSION-PROMPT.md

@@ -1,7 +1,7 @@
 # RFC App — Deployment Reference & New-Session Prompt
 
 Use this document as:
-1. A reference for the current `rfc.wiggleverse.org` deployment
+1. A reference for the current `ohm.wiggleverse.org` deployment
 2. A prompt to paste into a new Claude session to deploy a new version
 
 ---
@@ -36,10 +36,10 @@ For reference, the separate Gitea VM is `wiggleverse` project / `gitea` VM / 34.
 
 | Record | Type | Value | Proxy |
 |--------|------|-------|-------|
-| `rfc.wiggleverse.org` | A | 34.132.29.41 | DNS-only (gray cloud) |
+| `ohm.wiggleverse.org` | A | 34.132.29.41 | DNS-only (gray cloud) |
 | `_dmarc.wiggleverse.org` | TXT | `v=DMARC1; p=none; rua=mailto:ben@wiggleverse.org` | n/a |
 
-> Note: `rfc.wiggleverse.org` uses **Let's Encrypt via certbot** directly on the VM. Keep the A record **DNS only (gray cloud)** — Cloudflare Flexible SSL would conflict with certbot.
+> Note: `ohm.wiggleverse.org` uses **Let's Encrypt via certbot** directly on the VM. Keep the A record **DNS only (gray cloud)** — Cloudflare Flexible SSL would conflict with certbot.
 
 SPF (`v=spf1 include:_spf.google.com ~all`) and DKIM (`google._domainkey`) for `wiggleverse.org` are already in place via Workspace.
 
@@ -64,7 +64,7 @@ SPF (`v=spf1 include:_spf.google.com ~all`) and DKIM (`google._domainkey`) for `
 | `/opt/rfc-app/backend/.env` | All secrets and config (mode 0600) |
 | `/opt/rfc-app/backend/data/rfc-app.db` | SQLite database |
 | `/opt/rfc-app/frontend/dist/` | Built React SPA (served by nginx) |
-| `/etc/nginx/sites-available/rfc.wiggleverse.org` | nginx vhost config |
+| `/etc/nginx/sites-available/ohm.wiggleverse.org` | nginx vhost config |
 | `/etc/systemd/system/rfc-app.service` | systemd unit |
 
 ---
@@ -79,7 +79,7 @@ SPF (`v=spf1 include:_spf.google.com ~all`) and DKIM (`google._domainkey`) for `
 
 ## Gitea Setup (one-time)
 
-These are already done for `rfc.wiggleverse.org`. Document here for replication.
+These are already done for `ohm.wiggleverse.org`. Document here for replication.
 
 ### Bot service account
 
@@ -91,13 +91,13 @@ Created in Gitea as `rfc-bot`. Token scopes: `write:repository`, `write:user`, `
 
 ### Meta repo
 
-`wiggleverse/meta` — seeded by `scripts/seed_meta_repo.py`. Contains `PHILOSOPHY.md`, `README.md`, `CONTRIBUTING.md`, and `rfcs/` directory. Gitea webhook registered to `https://rfc.wiggleverse.org/api/webhooks/gitea`.
+`wiggleverse/meta` — seeded by `scripts/seed_meta_repo.py`. Contains `PHILOSOPHY.md`, `README.md`, `CONTRIBUTING.md`, and `rfcs/` directory. Gitea webhook registered to `https://ohm.wiggleverse.org/api/webhooks/gitea`.
 
 ### OAuth2 app
 
 Registered in Gitea Site Administration → Integrations → OAuth2 Applications:
 - Name: `RFC App`
-- Redirect URI: `https://rfc.wiggleverse.org/auth/callback`
+- Redirect URI: `https://ohm.wiggleverse.org/auth/callback`
 - Client ID and secret stored in `.env`
 
 ---
@@ -133,7 +133,7 @@ OAUTH_CLIENT_ID=<from Gitea OAuth app>
 OAUTH_CLIENT_SECRET=<from Gitea OAuth app>
 
 # App
-APP_URL=https://rfc.wiggleverse.org
+APP_URL=https://ohm.wiggleverse.org
 SECRET_KEY=<openssl rand -hex 32>
 DATABASE_PATH=/opt/rfc-app/backend/data/rfc-app.db
 OWNER_GITEA_LOGIN=ben.stull
@@ -182,10 +182,16 @@ sudo systemctl restart rfc-app
 
 For frontend changes, build on the VM directly (Node 20+ is already there):
 ```bash
-cd /opt/rfc-app/frontend && sudo -u rfc-app npm install
+cd /opt/rfc-app/frontend && sudo -u rfc-app npm ci
 sudo -u rfc-app npm run build
 ```
 
+`npm ci` installs strictly from the committed `package-lock.json` and
+will not regenerate it. Using `npm install` here causes the VM's npm
+to rewrite the lockfile in place (notably stripping `libc` fields on
+optional rollup native packages), which then conflicts with `git
+checkout <tag>` on the next deploy.
+
 The output lands in `/opt/rfc-app/frontend/dist/` owned by `rfc-app` — nginx serves it directly, no copy step needed.
 
 (Building locally and `gcloud compute scp`-ing the dist also works. Plain `rsync -e ssh` from the Mac fails because OS Login uses short-lived SSH certs that only the gcloud wrapper can mint interactively.)
@@ -197,7 +203,7 @@ Schema migrations run automatically on restart (append-only, safe to re-run).
 ## First-Time Deployment (new server)
 
 ### 1. Add DNS record
-Add `rfc.wiggleverse.org` → 34.132.29.41 as an A record in Cloudflare, **DNS only (gray cloud)**. Do not proxy — certbot needs to reach the VM directly.
+Add `ohm.wiggleverse.org` → 34.132.29.41 as an A record in Cloudflare, **DNS only (gray cloud)**. Do not proxy — certbot needs to reach the VM directly.
 
 ### 2. Host prep
 ```bash
@@ -230,15 +236,15 @@ sudo -u rfc-app -H bash -c \
 
 ### 6. Build the frontend (on the VM)
 ```bash
-cd /opt/rfc-app/frontend && sudo -u rfc-app npm install
+cd /opt/rfc-app/frontend && sudo -u rfc-app npm ci
 sudo -u rfc-app npm run build
 ```
 
 ### 7. nginx
 ```bash
-sudo cp /opt/rfc-app/deploy/nginx/rfc.wiggleverse.org.conf \
-    /etc/nginx/sites-available/rfc.wiggleverse.org
-sudo ln -s /etc/nginx/sites-available/rfc.wiggleverse.org \
+sudo cp /opt/rfc-app/deploy/nginx/ohm.wiggleverse.org.conf \
+    /etc/nginx/sites-available/ohm.wiggleverse.org
+sudo ln -s /etc/nginx/sites-available/ohm.wiggleverse.org \
     /etc/nginx/sites-enabled/
 sudo usermod -a -G rfc-app www-data
 sudo chmod -R g+rX /opt/rfc-app/frontend/dist
@@ -247,7 +253,7 @@ sudo nginx -t && sudo systemctl reload nginx
 
 ### 8. Let's Encrypt
 ```bash
-sudo certbot --nginx -d rfc.wiggleverse.org
+sudo certbot --nginx -d ohm.wiggleverse.org
 ```
 
 ### 9. systemd
@@ -259,7 +265,7 @@ sudo systemctl status rfc-app
 ```
 
 ### 10. Smoke test
-Visit `https://rfc.wiggleverse.org`:
+Visit `https://ohm.wiggleverse.org`:
 1. Landing page renders with sign-in button
 2. Sign in with Gitea OAuth → catalog loads
 3. `+ Propose New RFC` opens the propose modal
@@ -301,7 +307,7 @@ Paste the following into a new Claude session to continue development:
 
 ---
 
-> I'm working on the **Wiggleverse RFC App** — a FastAPI + SQLite + React + Vite application deployed at `rfc.wiggleverse.org` on a GCP e2-small VM (`rfc-app` in the `wiggleverse-rfc` project; separate from the `gitea` VM in `wiggleverse` that runs Gitea at `git.wiggleverse.org`). The app is the primary interface for the Open Human Model (OHM) RFC working group.
+> I'm working on the **Wiggleverse RFC App** — a FastAPI + SQLite + React + Vite application deployed at `ohm.wiggleverse.org` on a GCP e2-small VM (`rfc-app` in the `wiggleverse-rfc` project; separate from the `gitea` VM in `wiggleverse` that runs Gitea at `git.wiggleverse.org`). The app is the primary interface for the Open Human Model (OHM) RFC working group.
 >
 > **Stack:**
 > - Backend: Python 3.11, FastAPI, uvicorn (single process), SQLite WAL mode

deploy/RUNBOOK.md

@@ -1,6 +1,6 @@
 # Runbook
 
-Single-host deployment of the RFC app at `rfc.wiggleverse.org`, sharing
+Single-host deployment of the RFC app at `ohm.wiggleverse.org`, sharing
 infrastructure with `git.wiggleverse.org` (same Gitea instance, same nginx,
 same Let's Encrypt). The shape matches §4.2: one process, one SQLite file,
 no separate worker.
@@ -18,7 +18,7 @@ recover from a partial install is safe.
 
 - Ubuntu/Debian-style host with nginx and certbot already serving
   `git.wiggleverse.org` over HTTPS.
-- DNS: an `A` record for `rfc.wiggleverse.org` pointing at the same IP as
+- DNS: an `A` record for `ohm.wiggleverse.org` pointing at the same IP as
   `git.wiggleverse.org`.
 - Python 3.11+ available system-wide (the project has no `requires-python`
   pin; the current production VM runs 3.11 on Debian bookworm). Node 20+
@@ -75,7 +75,7 @@ Invite → rfc-bot → Owner**.
 Integrations → OAuth2 Applications → Create Application**:
 
 - Name: `RFC App`
-- Redirect URI: `https://rfc.wiggleverse.org/auth/callback`
+- Redirect URI: `https://ohm.wiggleverse.org/auth/callback`
 
 Copy the client ID and client secret. They go into `.env`.
 
@@ -93,7 +93,7 @@ sudo -u rfc-app /opt/rfc-app/backend/.venv/bin/pip install \
 
 ```sh
 # On your laptop:
-cd frontend && npm install && npm run build
+cd frontend && npm ci && npm run build
 rsync -a dist/ ben.stull@<host>:/tmp/rfc-app-dist/
 # On the host:
 sudo -u rfc-app mkdir -p /opt/rfc-app/frontend/dist
@@ -104,10 +104,16 @@ sudo chown -R rfc-app:rfc-app /opt/rfc-app/frontend/dist
 Or build on the host directly if Node is installed there:
 
 ```sh
-cd /opt/rfc-app/frontend && sudo -u rfc-app npm install
+cd /opt/rfc-app/frontend && sudo -u rfc-app npm ci
 sudo -u rfc-app npm run build
 ```
 
+`npm ci` installs strictly from the committed `package-lock.json` and
+refuses to mutate it. `npm install` was previously used here but can
+regenerate the lockfile in place (e.g. stripping `libc` fields from
+optional rollup native packages), which then collides with `git
+checkout <tag>` on the next deploy.
+
 **1.3.3 Write `.env`.**
 
 ```sh
@@ -128,7 +134,7 @@ META_REPO=meta
 OAUTH_CLIENT_ID=<from 1.2.3>
 OAUTH_CLIENT_SECRET=<from 1.2.3>
 
-APP_URL=https://rfc.wiggleverse.org
+APP_URL=https://ohm.wiggleverse.org
 SECRET_KEY=<openssl rand -hex 32>
 OWNER_GITEA_LOGIN=ben.stull
 GITEA_WEBHOOK_SECRET=<openssl rand -hex 32>
@@ -182,9 +188,9 @@ Re-running is safe; every step is upsert-shaped.
 **1.4.1 nginx vhost.**
 
 ```sh
-sudo cp /opt/rfc-app/deploy/nginx/rfc.wiggleverse.org.conf \
-    /etc/nginx/sites-available/rfc.wiggleverse.org
-sudo ln -s /etc/nginx/sites-available/rfc.wiggleverse.org \
+sudo cp /opt/rfc-app/deploy/nginx/ohm.wiggleverse.org.conf \
+    /etc/nginx/sites-available/ohm.wiggleverse.org
+sudo ln -s /etc/nginx/sites-available/ohm.wiggleverse.org \
     /etc/nginx/sites-enabled/
 sudo nginx -t && sudo systemctl reload nginx
 ```
@@ -200,7 +206,7 @@ sudo systemctl reload nginx
 **1.4.2 Let's Encrypt cert.**
 
 ```sh
-sudo certbot --nginx -d rfc.wiggleverse.org
+sudo certbot --nginx -d ohm.wiggleverse.org
 ```
 
 ### 1.5 systemd
@@ -226,7 +232,7 @@ RFC app started — meta repo wiggleverse/meta
 
 ### 1.6 Smoke test
 
-In a browser at `https://rfc.wiggleverse.org`:
+In a browser at `https://ohm.wiggleverse.org`:
 
 1. The landing page renders (§14.1 — title, pitch, three-item deck,
    sign-in affordance).
@@ -384,7 +390,7 @@ say), restore from the most recent backup per §2.2.
   `rfc-app`.
 - **OAuth callback returns "Invalid state".** The redirect URI in Gitea
   must match `APP_URL/auth/callback` exactly. Confirm it's
-  `https://rfc.wiggleverse.org/auth/callback`.
+  `https://ohm.wiggleverse.org/auth/callback`.
 - **The catalog stays empty after a merge.** Check the webhook:
   `journalctl -u rfc-app | grep webhook`. Gitea's **Settings → Webhooks
   → Recent Deliveries** on the meta repo shows the delivery status; the

deploy/nginx/ohm.wiggleverse.org.conf

@@ -2,21 +2,21 @@
 # frontend served as static files from the Vite build output.
 #
 # Install:
-#   sudo cp deploy/nginx/rfc.wiggleverse.org.conf \
-#       /etc/nginx/sites-available/rfc.wiggleverse.org
-#   sudo ln -s /etc/nginx/sites-available/rfc.wiggleverse.org \
+#   sudo cp deploy/nginx/ohm.wiggleverse.org.conf \
+#       /etc/nginx/sites-available/ohm.wiggleverse.org
+#   sudo ln -s /etc/nginx/sites-available/ohm.wiggleverse.org \
 #       /etc/nginx/sites-enabled/
 #   sudo nginx -t && sudo systemctl reload nginx
 #
 # Then add the Let's Encrypt cert:
-#   sudo certbot --nginx -d rfc.wiggleverse.org
+#   sudo certbot --nginx -d ohm.wiggleverse.org
 # Certbot will rewrite this file to add the 443 listener and certificate
 # directives; the rest of the config below stays as written.
 
 server {
     listen 80;
     listen [::]:80;
-    server_name rfc.wiggleverse.org;
+    server_name ohm.wiggleverse.org;
 
     # Static SPA assets live in the Vite build output. The systemd unit
     # runs as user `rfc-app`; make sure nginx (usually `www-data`) can

docs/DEPLOYMENTS.md

@@ -69,7 +69,7 @@ The shortest path from scratch:
    any deployment-identifying value; if a required variable is
    missing, the build fails loudly.
 
-6. **Build and run.** `cd frontend && npm install && npm run
+6. **Build and run.** `cd frontend && npm ci && npm run
    build`, then start the backend per `deploy/RUNBOOK.md`. The
    first sign-in is the OWNER login from `backend/.env`.
 
@@ -166,7 +166,7 @@ The mechanics in practice:
 5. **Check out the framework at the target version.** `git
    fetch && git checkout <tag>`.
 
-6. **Rebuild.** `npm install && npm run build` for the frontend;
+6. **Rebuild.** `npm ci && npm run build` for the frontend;
    restart the backend.
 
 7. **Smoke-test.** Sign in, check the brand reflects your
@@ -240,6 +240,35 @@ The deployment repo does **not** hold:
   edit a framework file, the right move is to file a change against
   the framework, get a release, and pin to it.
 
+## Private-beta gate
+
+From `0.3.0` onward, every deployment ships with an opt-in email
+allowlist. The default state is **off**: an empty `allowed_emails`
+table behaves exactly like 0.2.x — any successful Gitea OAuth
+provisions a user.
+
+To run a closed beta:
+
+1. Sign in once as the deployment operator so your `users` row exists
+   (you will be grandfathered by `gitea_id` thereafter — adding the
+   first allowlist row does **not** lock you out).
+2. Open `/admin/allowlist` and add the first invited email. As soon as
+   any row exists, sign-in is restricted to listed emails plus
+   grandfathered users.
+3. Optionally set `VITE_BETA_CONTACT` in `frontend/.env` (an email
+   address, a URL, or a short instruction). It is shown to rejected
+   sign-ins on the `/beta-pending` page so visitors know how to
+   request an invitation.
+
+To re-open the deployment, remove all rows from `allowed_emails` (the
+admin tab has a Remove button per row) — the gate flips off as soon
+as the last row is gone.
+
+Anonymous viewers see the full app in read-only mode regardless of
+allowlist state. Write affordances (Propose, chat, Contribute, Open
+PR) are hidden behind a sign-in CTA, and the public read endpoints
+behave the same in both states.
+
 ## When something goes wrong
 
 If a framework behavior is wrong for your deployment, file it as a

frontend/.env.example

@@ -13,3 +13,39 @@
 #   VITE_APP_NAME=Wiggleverse RFC
 #   VITE_APP_NAME=Wiggleverse Open Human Model
 VITE_APP_NAME=
+
+# Optional contact line shown on the /beta-pending page when a deployment
+# is in private-beta mode (i.e. the backend's `allowed_emails` table has
+# rows). Free-text — an email address, a URL, or a one-line instruction
+# tells visitors how to request an invitation. If unset, the page falls
+# back to a generic "contact the deployment operator" line.
+#
+# Examples:
+#   VITE_BETA_CONTACT=ben@wiggleverse.org
+#   VITE_BETA_CONTACT=DM @ben on Matrix
+VITE_BETA_CONTACT=
+
+# Optional URL to the deployment's privacy policy (v0.13.0+, SPEC §14.5).
+# The framework ships a minimal default privacy policy at `/privacy`
+# that describes the framework's stance and lists the cookies the
+# framework sets. When this var is set to an http(s) URL, the page
+# renders the framework's stub above a link to the configured URL —
+# deployments use this to layer their own policy content on top
+# without forking the framework. Unset is OK; the stub is sufficient
+# for a deployment that has nothing specific to add.
+#
+# Examples:
+#   VITE_PRIVACY_POLICY_URL=https://wiggleverse.org/privacy
+VITE_PRIVACY_POLICY_URL=
+
+# Optional URL to the deployment's cookies policy (v0.13.0+, SPEC §14.6).
+# Same shape as VITE_PRIVACY_POLICY_URL. The framework's default
+# `/cookies` page lists exactly which cookies the framework sets
+# (rfc_session, the consent-choice localStorage entry); a deployment
+# that adds its own cookies (analytics SDK once #13 lands, third-party
+# embeds) points this var at a page that documents the full list.
+# Unset is OK; the stub is sufficient for a default-config deployment.
+#
+# Examples:
+#   VITE_COOKIES_POLICY_URL=https://wiggleverse.org/cookies
+VITE_COOKIES_POLICY_URL=

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "rfc-app-frontend",
-  "version": "0.2.1",
+  "version": "0.10.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "rfc-app-frontend",
-      "version": "0.2.1",
+      "version": "0.10.0",
       "dependencies": {
         "@codemirror/commands": "^6.10.3",
         "@codemirror/lang-markdown": "^6.5.0",

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rfc-app-frontend",
   "private": true,
-  "version": "0.2.3",
+  "version": "0.10.0",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/App.css

@@ -5,7 +5,16 @@
   height: 100vh; color: #888; font-size: 14px;
 }
 
-.app { height: 100vh; display: flex; flex-direction: column; }
+/* `100dvh` is the dynamic viewport height — adjusts as iOS Safari's
+   URL bar shows/hides. Without it, `100vh` measures the URL-bar-hidden
+   ("largest") viewport, so the app overflows what's actually visible.
+   Combined with `body { overflow: hidden }` in index.css, the result
+   on iOS is that single-finger touches get consumed by the (blocked)
+   page-level scroll attempt and never reach the nested .chrome-pane;
+   two-finger touches bypass that and one-finger works thereafter.
+   The 100vh line stays as a fallback for browsers older than iOS
+   15.4 / Chrome 108 (early 2022) that don't understand dvh. */
+.app { height: 100vh; height: 100dvh; display: flex; flex-direction: column; }
 
 .app-header {
   height: 48px; flex-shrink: 0;
@@ -33,6 +42,31 @@
 }
 .btn-link:hover { background: rgba(255,255,255,0.25); }
 
+.btn-signin-header {
+  color: #fff; text-decoration: none;
+  background: rgba(255,255,255,0.15);
+  border-radius: 6px; padding: 4px 10px;
+  font-size: 13px;
+  display: inline-flex; align-items: center; gap: 6px;
+}
+.btn-signin-header:hover { background: rgba(255,255,255,0.25); }
+
+/* Beta chip — small uppercase tag sitting alongside a button label or
+ * link. Renders well on both dark headers and light surfaces. */
+.beta-chip {
+  font-size: 9px; font-weight: 700;
+  text-transform: uppercase; letter-spacing: 0.08em;
+  padding: 1px 5px; border-radius: 3px;
+  background: #b45309; color: #fff;
+  line-height: 1.5;
+  vertical-align: middle;
+}
+.btn-link .beta-chip,
+.btn-mode-toggle .beta-chip,
+.btn-start-contribution-header .beta-chip {
+  margin-left: 5px;
+}
+
 .app-body { flex: 1; display: flex; overflow: hidden; }
 
 /* --- Catalog (left pane, §7) --- */
@@ -318,6 +352,120 @@
 }
 .landing .secondary-link:hover { color: #1a1a1a; text-decoration: underline; }
 
+/* --- v0.7.0: email + one-time-code sign-in (§6.2) --- */
+
+.otc-login {
+  flex: 1;
+  display: flex; align-items: center; justify-content: center;
+  padding: 40px 24px;
+}
+.otc-login-inner {
+  max-width: 360px;
+  width: 100%;
+  display: flex; flex-direction: column;
+  gap: 14px;
+}
+.otc-login h1 {
+  font-size: 22px;
+  font-weight: 600;
+  margin: 0 0 4px;
+}
+.otc-login .otc-hint {
+  color: #555;
+  font-size: 14px;
+  line-height: 1.5;
+  margin: 0;
+}
+.otc-login input {
+  width: 100%;
+  padding: 10px 12px;
+  font-size: 15px;
+  border: 1px solid #ddd;
+  border-radius: 6px;
+  box-sizing: border-box;
+}
+.otc-login input:focus {
+  outline: none;
+  border-color: #1a1a1a;
+}
+.otc-login button[type="submit"] {
+  background: #1a1a1a; color: #fff;
+  border: none; border-radius: 6px;
+  padding: 10px 18px;
+  font-size: 14px; font-weight: 600;
+  cursor: pointer;
+}
+.otc-login button[type="submit"]:hover:not(:disabled) { background: #333; }
+.otc-login button[type="submit"]:disabled { opacity: 0.5; cursor: not-allowed; }
+.otc-login form {
+  display: flex; flex-direction: column;
+  gap: 10px;
+}
+.otc-actions {
+  display: flex; align-items: center; gap: 12px;
+}
+.otc-login .btn-link-quiet {
+  background: none; border: none;
+  color: #666; font-size: 13px;
+  cursor: pointer; padding: 0;
+}
+.otc-login .btn-link-quiet:hover { color: #1a1a1a; text-decoration: underline; }
+.otc-shortcut-hint {
+  color: #888; font-size: 12px; margin: 4px 0 0;
+}
+.otc-shortcut-hint kbd {
+  background: #f0f0ee; border: 1px solid #ddd; border-radius: 3px;
+  padding: 1px 5px; font-size: 11px; font-family: inherit;
+}
+.otc-status {
+  color: #555; font-size: 13px;
+  background: #f7f6f0;
+  border-left: 3px solid #cfc8a8;
+  padding: 8px 12px;
+  margin: 4px 0 0;
+}
+.otc-fallback {
+  font-size: 12px; color: #777;
+  margin: 16px 0 0;
+  display: flex; gap: 8px; align-items: center; flex-wrap: wrap;
+}
+.otc-fallback a, .otc-fallback .otc-fallback-link {
+  color: #666; text-decoration: none;
+}
+.otc-fallback a:hover { color: #1a1a1a; text-decoration: underline; }
+.otc-fallback-sep { color: #ccc; }
+
+/* --- Beta-pending page (post-OAuth-rejection) --- */
+
+.beta-pending {
+  min-height: 100vh;
+  display: flex; align-items: center; justify-content: center;
+  padding: 40px 20px;
+}
+.beta-pending-inner {
+  max-width: 560px;
+  text-align: center;
+}
+.beta-pending h1 { font-size: 24px; margin: 0 0 16px; }
+.beta-pending p { font-size: 15px; line-height: 1.6; color: #333; margin: 0 0 14px; }
+.beta-pending-contact {
+  background: #fafafa; border: 1px solid #eee; border-radius: 8px;
+  padding: 14px 18px;
+  color: #444;
+}
+.beta-pending-actions {
+  margin-top: 24px;
+  display: flex; gap: 18px; justify-content: center; align-items: center;
+}
+.beta-pending-actions .btn-primary {
+  background: #1a1a1a; color: #fff;
+  border-radius: 8px; padding: 9px 18px;
+  font-size: 14px; font-weight: 600; text-decoration: none;
+}
+.beta-pending-actions .btn-primary:hover { background: #333; }
+.btn-link-quiet { color: #666; text-decoration: none; font-size: 13px; }
+.btn-link-quiet:hover { color: #1a1a1a; text-decoration: underline; }
+
 /* ── §8 RFC view: three-column shape ─────────────────────────────────── */
 
 .main-pane {
@@ -1678,6 +1826,27 @@
   padding: 1px 5px; border-radius: 3px;
 }
 
+.allowlist-add {
+  display: flex; gap: 8px; margin-bottom: 22px; flex-wrap: wrap;
+  align-items: center;
+}
+.allowlist-add input[type="email"] {
+  border: 1px solid #d1d5db; border-radius: 6px;
+  padding: 6px 10px; font-size: 13px; min-width: 240px;
+}
+.allowlist-add input[type="text"] {
+  border: 1px solid #d1d5db; border-radius: 6px;
+  padding: 6px 10px; font-size: 13px; flex: 1; min-width: 200px;
+}
+.allowlist-add .btn-primary {
+  background: #1a1a1a; color: #fff;
+  border: none; border-radius: 6px;
+  padding: 6px 14px; font-size: 13px; font-weight: 600;
+  cursor: pointer;
+}
+.allowlist-add .btn-primary:hover:not(:disabled) { background: #333; }
+.allowlist-add .btn-primary:disabled { opacity: 0.5; cursor: not-allowed; }
+
 .user-cell { display: flex; flex-direction: column; gap: 1px; }
 .user-handle { font-weight: 500; color: #111; }
 .mute-toggle {
@@ -1690,3 +1859,194 @@
 .grad-queue-link:hover strong { text-decoration: underline; }
 .muted { color: #6b7280; }
 .error { color: #b91c1c; }
+
+/* v0.5.0 — PR-less per-RFC discussion panel (RFCDiscussionPanel.jsx).
+   Visual neighbor of .chat-panel but distinct: discussion lives on the
+   RFC, branch chat lives on the branch. Same flex column shape so it
+   slots cleanly into the existing .right-panel container.
+*/
+.discussion-panel {
+  flex: 1; display: flex; flex-direction: column;
+  overflow: hidden; min-height: 0;
+}
+.discussion-header {
+  padding: 10px 14px;
+  border-bottom: 1px solid #f0f0ee;
+  background: #fafafa;
+  display: flex; flex-direction: column; gap: 4px;
+}
+.discussion-header-title { font-size: 12px; color: #555; font-weight: 600; }
+.discussion-header-meta { font-size: 11px; color: #888; }
+.discussion-thread-tabs {
+  display: flex; gap: 4px; flex-wrap: wrap;
+  padding: 6px 14px;
+  border-bottom: 1px solid #f0f0ee;
+  background: #fcfcfb;
+}
+.discussion-thread-tab {
+  background: #fff; border: 1px solid #e5e5e0; cursor: pointer;
+  font-size: 11px; color: #555;
+  padding: 3px 8px; border-radius: 999px;
+}
+.discussion-thread-tab.active {
+  background: #eef2ff; border-color: #5b5bd6; color: #3737a0;
+}
+.discussion-thread-tab.resolved { opacity: 0.6; }
+.discussion-messages {
+  flex: 1; overflow-y: auto;
+  padding: 14px;
+  display: flex; flex-direction: column; gap: 10px;
+}
+.discussion-empty {
+  flex: 1; display: flex; align-items: center; justify-content: center;
+  text-align: center; padding: 24px;
+}
+.discussion-empty p {
+  font-size: 13px; color: #999; line-height: 1.6; max-width: 280px;
+}
+.discussion-error {
+  background: #fee; border: 1px solid #fcc; color: #b91c1c;
+  padding: 8px 10px; border-radius: 4px; font-size: 12px;
+}
+.discussion-message { display: flex; flex-direction: column; gap: 3px; }
+.discussion-message-meta {
+  display: flex; gap: 8px; font-size: 11px; color: #888;
+}
+.discussion-message-author { color: #5b5bd6; font-weight: 500; }
+.discussion-message-quote {
+  font-size: 11px; color: #666; font-style: italic;
+  border-left: 2px solid #ddd; padding-left: 8px; margin-bottom: 2px;
+}
+.discussion-message-body {
+  font-size: 13px; color: #222; line-height: 1.5;
+  white-space: pre-wrap; word-wrap: break-word;
+  background: #f7f7f5; padding: 8px 10px; border-radius: 6px;
+}
+.discussion-message.system .discussion-system-bubble {
+  font-size: 12px; color: #888; font-style: italic;
+  text-align: center; padding: 4px 0;
+}
+.discussion-composer {
+  border-top: 1px solid #f0f0ee;
+  padding: 10px 14px;
+  background: #fafafa;
+  display: flex; flex-direction: column; gap: 6px;
+}
+.discussion-composer-textarea {
+  width: 100%; resize: vertical; min-height: 60px;
+  font-family: inherit; font-size: 13px;
+  border: 1px solid #ddd; border-radius: 4px;
+  padding: 6px 8px;
+}
+.discussion-composer-textarea:focus {
+  outline: none; border-color: #5b5bd6;
+}
+.discussion-composer-actions {
+  display: flex; gap: 8px; align-items: center; justify-content: flex-end;
+}
+.discussion-readonly {
+  font-size: 12px; color: #666; padding: 4px 0;
+}
+
+/* §14.5 — cookie consent banner (v0.13.0) */
+.cookie-consent-banner {
+  position: fixed;
+  left: 0; right: 0; bottom: 0;
+  z-index: 1000;
+  background: #fff;
+  border-top: 1px solid #d1d5db;
+  box-shadow: 0 -8px 24px rgba(0, 0, 0, 0.08);
+  padding: 20px 24px;
+}
+.cookie-consent-body {
+  max-width: 880px; margin: 0 auto;
+  display: flex; flex-direction: column; gap: 12px;
+}
+.cookie-consent-title {
+  margin: 0; font-size: 16px; font-weight: 700; color: #111;
+}
+.cookie-consent-intro {
+  margin: 0; font-size: 13px; color: #4b5563; line-height: 1.5;
+}
+.cookie-consent-choices {
+  border: none; padding: 0; margin: 0;
+  display: flex; flex-direction: column; gap: 6px;
+}
+.cookie-consent-choice {
+  display: flex; gap: 10px; align-items: flex-start;
+  padding: 10px 12px; border-radius: 6px;
+  border: 1px solid #e5e7eb;
+  cursor: pointer;
+}
+.cookie-consent-choice.is-selected {
+  border-color: #111; background: #f9fafb;
+}
+.cookie-consent-choice input[type=radio] { margin-top: 3px; }
+.cookie-consent-choice-text {
+  display: flex; flex-direction: column; gap: 2px;
+}
+.cookie-consent-choice-label {
+  font-size: 13px; font-weight: 600; color: #111;
+}
+.cookie-consent-choice-desc {
+  font-size: 12px; color: #6b7280; line-height: 1.5;
+}
+.cookie-consent-links {
+  margin: 0; font-size: 12px; color: #6b7280;
+}
+.cookie-consent-links a { color: #111; text-decoration: underline; }
+.cookie-consent-error {
+  margin: 0; font-size: 12px; color: #b91c1c;
+}
+.cookie-consent-actions {
+  display: flex; gap: 8px; justify-content: flex-end;
+}
+.visually-hidden {
+  position: absolute; width: 1px; height: 1px;
+  padding: 0; margin: -1px; overflow: hidden;
+  clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0;
+}
+
+/* §14.5 / §14.6 — privacy + cookies policy pages */
+.policy-page {
+  max-width: 720px; margin: 0 auto;
+  padding: 0 32px 80px;
+}
+.policy-header {
+  display: flex; align-items: center; gap: 12px;
+  padding: 20px 0; border-bottom: 1px solid #f3f4f6;
+  margin-bottom: 24px;
+}
+.policy-back {
+  background: none; border: none; cursor: pointer;
+  color: #6b7280; font-size: 13px; padding: 4px 8px;
+}
+.policy-back:hover { color: #111; }
+.policy-title { font-size: 13px; font-weight: 600; color: #6b7280; }
+.policy-body { line-height: 1.7; color: #111; }
+.policy-body h1 { font-size: 26px; margin: 0 0 6px; font-weight: 700; }
+.policy-body .policy-subtitle { color: #6b7280; margin: 0 0 24px; font-size: 14px; }
+.policy-body h2 { font-size: 16px; margin: 28px 0 8px; font-weight: 600; }
+.policy-body p { margin: 0 0 12px; }
+.policy-body ul { margin: 0 0 16px; padding-left: 22px; }
+.policy-body li { margin-bottom: 6px; }
+.policy-body code {
+  background: #f3f4f6; padding: 1px 5px; border-radius: 3px;
+  font-family: ui-monospace, monospace; font-size: 12px;
+}
+.policy-body .policy-footnote {
+  margin-top: 24px; font-size: 12px; color: #6b7280;
+}
+.policy-table {
+  width: 100%; border-collapse: collapse;
+  font-size: 13px; margin: 8px 0 16px;
+}
+.policy-table th, .policy-table td {
+  text-align: left; padding: 8px 10px;
+  border-bottom: 1px solid #f3f4f6;
+  vertical-align: top;
+}
+.policy-table th {
+  font-size: 11px; text-transform: uppercase;
+  color: #6b7280; letter-spacing: 0.05em; font-weight: 600;
+}

frontend/src/App.jsx

@@ -8,10 +8,15 @@ import PRView from './components/PRView.jsx'
 import ProposalView from './components/ProposalView.jsx'
 import ProposeModal from './components/ProposeModal.jsx'
 import Landing from './components/Landing.jsx'
+import Login from './components/Login.jsx'
+import BetaPending from './components/BetaPending.jsx'
 import Philosophy from './components/Philosophy.jsx'
 import NotificationSettings from './components/NotificationSettings.jsx'
 import Admin from './components/Admin.jsx'
 import ToastHost, { showToast } from './components/ToastHost.jsx'
+import CookieConsentBanner from './components/CookieConsentBanner.jsx'
+import Privacy from './pages/Privacy.jsx'
+import Cookies from './pages/Cookies.jsx'
 import './App.css'
 
 export default function App() {
@@ -22,8 +27,19 @@ export default function App() {
   const [inboxOpen, setInboxOpen] = useState(false)
   const [unreadCount, setUnreadCount] = useState(0)
   const [inboxTick, setInboxTick] = useState(0)
+  // §14.5: a tick that, when bumped, asks <CookieConsentBanner> to
+  // re-open even if the user has already made a choice. The settings
+  // "Privacy & cookies" tab dispatches a `rfc-app:cookie-consent-reopen`
+  // event that bumps this.
+  const [consentReopenTick, setConsentReopenTick] = useState(0)
   const navigate = useNavigate()
 
+  useEffect(() => {
+    const handler = () => setConsentReopenTick(t => t + 1)
+    window.addEventListener('rfc-app:cookie-consent-reopen', handler)
+    return () => window.removeEventListener('rfc-app:cookie-consent-reopen', handler)
+  }, [])
+
   useEffect(() => {
     getMe()
       .then(setMe)
@@ -68,17 +84,14 @@ export default function App() {
     return <div className="boot">Loading…</div>
   }
 
-  // §14.2: the philosophy route is reachable by anonymous visitors too.
-  // Resolve it before the authentication gate so a signed-out reader
-  // who follows the §14.1 landing link does not get bounced to sign-in.
-  if (!me?.authenticated) {
-    return (
-      <Routes>
-        <Route path="/philosophy" element={<Philosophy authenticated={false} />} />
-        <Route path="*" element={<Landing />} />
-      </Routes>
-    )
-  }
+  // The deployment is in private beta: anonymous visitors get the full
+  // app in read-only mode (viewer = null is passed through to every
+  // component), and write affordances are hidden at the component
+  // level. /beta-pending is the post-OAuth-rejection page reachable by
+  // anyone. The original §14.1 Landing surface is retained for the
+  // `/welcome` URL only, in case a deployment wants to link to it.
+  const viewer = me?.authenticated ? me.user : null
+  const isAdmin = viewer && (viewer.role === 'owner' || viewer.role === 'admin')
 
   return (
     <div className="app">
@@ -88,60 +101,85 @@ export default function App() {
         </div>
         <div className="header-right">
           {/* §14.3: the persistent About link. One word, no badge, no
-              state — visible from every authenticated screen so a
-              contributor mid-PR who wonders why a conversation is
-              public can reach the answer in two clicks. */}
+              state — visible from every screen so a viewer mid-PR who
+              wonders why a conversation is public can reach the answer
+              in two clicks. Anonymous viewers see it too. */}
           <Link to="/philosophy" className="header-about" title="Why this exists (§14)">
             About
           </Link>
-          <Link to="/settings/notifications" className="header-settings" title="Notification settings (§15)">
-            Settings
-          </Link>
-          {(me.user.role === 'owner' || me.user.role === 'admin') && (
+          {viewer && (
+            <Link to="/settings/notifications" className="header-settings" title="Notification settings (§15)">
+              Settings
+            </Link>
+          )}
+          {isAdmin && (
             <Link to="/admin" className="header-admin" title="Admin home base">
               Admin
             </Link>
           )}
-          <button
-            className="inbox-trigger"
-            onClick={() => setInboxOpen(o => !o)}
-            title="Notifications inbox (§15.2)"
-          >
-            <span aria-hidden>📮</span>
-            {unreadCount > 0 && (
-              <span className="badge">{unreadCount > 99 ? '99+' : unreadCount}</span>
-            )}
-          </button>
-          <span className="user-name">{me.user.display_name}</span>
-          <span className={`user-role-badge role-${me.user.role}`}>{me.user.role}</span>
-          <a className="btn-link" href="/auth/logout">Sign out</a>
+          {viewer && (
+            <button
+              className="inbox-trigger"
+              onClick={() => setInboxOpen(o => !o)}
+              title="Notifications inbox (§15.2)"
+            >
+              <span aria-hidden>📮</span>
+              {unreadCount > 0 && (
+                <span className="badge">{unreadCount > 99 ? '99+' : unreadCount}</span>
+              )}
+            </button>
+          )}
+          {viewer ? (
+            <>
+              <span className="user-name">{viewer.display_name}</span>
+              <span className={`user-role-badge role-${viewer.role}`}>{viewer.role}</span>
+              <a className="btn-link" href="/auth/logout">Sign out</a>
+            </>
+          ) : (
+            <Link className="btn-signin-header" to="/login" title="Private beta — only invited emails can sign in">
+              Sign in <span className="beta-chip">Beta</span>
+            </Link>
+          )}
         </div>
       </header>
       <div className="app-body">
         <Routes>
-          <Route path="/philosophy" element={<PhilosophyWithSidebar viewer={me.user} />} />
-          <Route path="/settings/notifications" element={<NotificationSettingsWithSidebar viewer={me.user} />} />
-          <Route path="/admin/*" element={<AdminWithSidebar viewer={me.user} />} />
+          <Route path="/welcome" element={<Landing />} />
+          <Route path="/login" element={<Login />} />
+          <Route path="/beta-pending" element={<BetaPending />} />
+          <Route path="/philosophy" element={<PhilosophyWithSidebar viewer={viewer} />} />
+          {/* §14.5 / §14.6: cookie-consent companions to /philosophy.
+              Available to anonymous and authenticated viewers alike. */}
+          <Route path="/privacy" element={<PolicyShell><Privacy /></PolicyShell>} />
+          <Route path="/cookies" element={<PolicyShell><Cookies /></PolicyShell>} />
+          {viewer && (
+            <Route path="/settings/notifications" element={<NotificationSettingsWithSidebar viewer={viewer} />} />
+          )}
+          {isAdmin && (
+            <Route path="/admin/*" element={<AdminWithSidebar viewer={viewer} />} />
+          )}
           <Route path="*" element={
             <>
               <Catalog
+                viewer={viewer}
                 onProposeRFC={() => setProposeOpen(true)}
                 version={catalogVersion}
               />
               <main className="main-pane">
                 <Routes>
-                  <Route path="/" element={<Welcome viewer={me.user} />} />
-                  <Route path="/rfc/:slug" element={<RFCView viewer={me.user} />} />
-                  <Route path="/rfc/:slug/pr/:prNumber" element={<PRView viewer={me.user} />} />
-                  <Route path="/proposals/:prNumber" element={<ProposalView viewer={me.user} onChange={() => setCatalogVersion(v => v + 1)} />} />
+                  <Route path="/" element={<Welcome viewer={viewer} />} />
+                  <Route path="/rfc/:slug" element={<RFCView viewer={viewer} />} />
+                  <Route path="/rfc/:slug/pr/:prNumber" element={<PRView viewer={viewer} />} />
+                  <Route path="/proposals/:prNumber" element={<ProposalView viewer={viewer} onChange={() => setCatalogVersion(v => v + 1)} />} />
                 </Routes>
               </main>
             </>
           } />
         </Routes>
       </div>
-      {proposeOpen && (
+      {proposeOpen && viewer && (
         <ProposeModal
+          viewer={viewer}
           onClose={() => setProposeOpen(false)}
           onSubmitted={({ pr_number }) => {
             setProposeOpen(false)
@@ -150,22 +188,30 @@ export default function App() {
           }}
         />
       )}
-      {inboxOpen && (
+      {inboxOpen && viewer && (
         <Inbox onClose={() => setInboxOpen(false)} lastChangeTick={inboxTick} />
       )}
       <ToastHost />
+      <CookieConsentBanner viewer={viewer} forceOpen={consentReopenTick} />
     </div>
   )
 }
 
-function PhilosophyWithSidebar() {
+function PolicyShell({ children }) {
+  // §14.5 / §14.6 policy pages reuse the chrome-pane shape so they
+  // render full-width without the catalog rail. The components inside
+  // carry their own back affordance per Philosophy.jsx's pattern.
+  return <main className="chrome-pane">{children}</main>
+}
+
+function PhilosophyWithSidebar({ viewer }) {
   // The chrome surfaces (§14.2 philosophy, §15 settings, §6/§17 admin)
   // all use the full app body — no catalog left pane, no propose modal.
   // The header carries the navigation back; the body is a single
   // reading surface.
   return (
     <main className="chrome-pane">
-      <Philosophy authenticated={true} />
+      <Philosophy authenticated={!!viewer} />
     </main>
   )
 }
@@ -187,6 +233,28 @@ function AdminWithSidebar({ viewer }) {
 }
 
 function Welcome({ viewer }) {
+  if (!viewer) {
+    return (
+      <div className="welcome">
+        <h1>Welcome.</h1>
+        <p>
+          The catalog on the left lists every super-draft and active RFC in the
+          framework. Open one to read the canonical body and the public
+          conversation behind each definition.
+        </p>
+        <p>
+          Discussion and contribution are in private <strong>Beta</strong> —
+          read freely, and <Link to="/login">sign in</Link> if your email has
+          been invited.
+        </p>
+        <p>
+          Wondering why a conversation is public, why graduation costs what it
+          does, or why the model is in the chat? <Link to="/philosophy">Read the
+          philosophy</Link>.
+        </p>
+      </div>
+    )
+  }
   return (
     <div className="welcome">
       <h1>Welcome, {viewer.display_name}.</h1>

frontend/src/api.js

@@ -25,6 +25,73 @@ export async function getMe() {
   return jsonOrThrow(res)
 }
 
+// ── v0.7.0: email + one-time-code sign-in (§6.2) ─────────────────────────
+//
+// The legacy /auth/login → /auth/callback OAuth flow remains during the
+// migration — the new UI just no longer points at it primarily. These
+// two helpers drive the Login.jsx surface.
+
+export async function requestOtc(email) {
+  const res = await fetch('/auth/otc/request', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email }),
+  })
+  return jsonOrThrow(res)
+}
+
+export async function verifyOtc(email, code) {
+  const res = await fetch('/auth/otc/verify', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, code }),
+  })
+  return jsonOrThrow(res)
+}
+
+// ── v0.10.0: user-set passcodes after OTC (§6.2, roadmap item #8) ─────────
+//
+// After a successful OTC sign-in, a contributor may set a passcode and
+// use email + passcode for subsequent sign-ins. OTC remains the
+// forgot-passcode fallback — 5 consecutive verify failures locks the
+// passcode path for 15 minutes (HTTP 423); the OTC path is unaffected.
+
+export async function checkPasscode(email) {
+  // Anonymous endpoint. Returns `{has_passcode: boolean}` so the
+  // Login.jsx flow can decide whether to render a passcode input or
+  // fall back to OTC. We URL-encode the email so addresses with '+'
+  // round-trip cleanly.
+  const params = new URLSearchParams({ email })
+  const res = await fetch(`/auth/passcode/check?${params}`)
+  return jsonOrThrow(res)
+}
+
+export async function verifyPasscode(email, passcode) {
+  const res = await fetch('/auth/passcode/verify', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, passcode }),
+  })
+  return jsonOrThrow(res)
+}
+
+export async function setPasscode(passcode) {
+  // Requires an active session — the server returns 401 if not signed
+  // in. The signed-in user is the implicit subject; the body carries
+  // only the new passcode.
+  const res = await fetch('/auth/passcode/set', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ passcode }),
+  })
+  return jsonOrThrow(res)
+}
+
+export async function clearPasscode() {
+  const res = await fetch('/auth/passcode', { method: 'DELETE' })
+  return jsonOrThrow(res)
+}
+
 export async function listRFCs() {
   return jsonOrThrow(await fetch('/api/rfcs'))
 }
@@ -197,6 +264,52 @@ export async function resolveThread(slug, branch, threadId) {
   return jsonOrThrow(res)
 }
 
+// ── v0.5.0: PR-less per-RFC discussion (§5 / §10) ────────────────────────
+//
+// The substrate is `threads.branch_name IS NULL` — the same threads
+// table the branch chat uses, with a null branch the schema already
+// supported. Contribution still requires a PR (api_prs / openPR), so
+// these endpoints are read+write for discussion only.
+
+export async function listDiscussionThreads(slug) {
+  return jsonOrThrow(await fetch(`/api/rfcs/${slug}/discussion/threads`))
+}
+
+export async function createDiscussionThread(slug, { label = null, message = null } = {}) {
+  const res = await fetch(`/api/rfcs/${slug}/discussion/threads`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ label, message }),
+  })
+  return jsonOrThrow(res)
+}
+
+export async function getDiscussionThreadMessages(slug, threadId) {
+  return jsonOrThrow(await fetch(
+    `/api/rfcs/${slug}/discussion/threads/${threadId}/messages`,
+  ))
+}
+
+export async function postDiscussionMessage(slug, threadId, { text, quote = null }) {
+  const res = await fetch(
+    `/api/rfcs/${slug}/discussion/threads/${threadId}/messages`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text, quote }),
+    },
+  )
+  return jsonOrThrow(res)
+}
+
+export async function resolveDiscussionThread(slug, threadId) {
+  const res = await fetch(
+    `/api/rfcs/${slug}/discussion/threads/${threadId}/resolve`,
+    { method: 'POST' },
+  )
+  return jsonOrThrow(res)
+}
+
 // ── Slice 4: super-draft body editing (§9.5) ─────────────────────────────
 
 export async function startEditBranch(slug, body = {}) {
@@ -462,6 +575,23 @@ export async function setQuietHours({ start, end, timezone } = {}) {
   }))
 }
 
+// v0.13.0 / roadmap item #11: cookie consent (SPEC §14.5).
+export async function getCookieConsent() {
+  return jsonOrThrow(await fetch('/api/users/me/cookie-consent'))
+}
+
+export async function setCookieConsent({ analytics, other } = {}) {
+  return jsonOrThrow(await fetch('/api/users/me/cookie-consent', {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      essential: true,
+      analytics: !!analytics,
+      other: !!other,
+    }),
+  }))
+}
+
 export async function muteUser(userId) {
   return jsonOrThrow(await fetch(`/api/users/${userId}/notification-mute`, { method: 'POST' }))
 }
@@ -534,6 +664,24 @@ export async function listGraduationQueue() {
   return jsonOrThrow(await fetch('/api/admin/graduation-queue'))
 }
 
+export async function listAllowlist() {
+  return jsonOrThrow(await fetch('/api/admin/allowlist'))
+}
+
+export async function addAllowlistEmail(email, note) {
+  return jsonOrThrow(await fetch('/api/admin/allowlist', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ email, note: note || null }),
+  }))
+}
+
+export async function removeAllowlistEmail(email) {
+  return jsonOrThrow(await fetch(`/api/admin/allowlist/${encodeURIComponent(email)}`, {
+    method: 'DELETE',
+  }))
+}
+
 export async function searchUsers(q) {
   const params = new URLSearchParams()
   if (q) params.set('q', q)

frontend/src/components/Admin.jsx

@@ -19,10 +19,14 @@ import {
   listAuditLog,
   listPermissionEvents,
   listGraduationQueue,
+  listAllowlist,
+  addAllowlistEmail,
+  removeAllowlistEmail,
 } from '../api.js'
 
 const TABS = [
   { path: 'users', label: 'Users' },
+  { path: 'allowlist', label: 'Allowlist' },
   { path: 'graduation', label: 'Graduation queue' },
   { path: 'audit', label: 'Audit log' },
   { path: 'permissions', label: 'Permission events' },
@@ -54,6 +58,7 @@ export default function Admin({ viewer }) {
         <Routes>
           <Route index element={<UsersTab />} />
           <Route path="users" element={<UsersTab />} />
+          <Route path="allowlist" element={<AllowlistTab />} />
           <Route path="graduation" element={<GraduationTab />} />
           <Route path="audit" element={<AuditTab />} />
           <Route path="permissions" element={<PermissionsTab />} />
@@ -174,6 +179,140 @@ function UsersTab() {
   )
 }
 
+// ── Private-beta allowlist (`migrations/011_allowlist.sql`) ────────────────
+
+function AllowlistTab() {
+  const [data, setData] = useState(null)
+  const [error, setError] = useState(null)
+  const [draftEmail, setDraftEmail] = useState('')
+  const [draftNote, setDraftNote] = useState('')
+  const [busy, setBusy] = useState(false)
+
+  async function refresh() {
+    setError(null)
+    try {
+      setData(await listAllowlist())
+    } catch (e) {
+      setError(e.message)
+    }
+  }
+
+  useEffect(() => { refresh() }, [])
+
+  async function handleAdd(event) {
+    event.preventDefault()
+    const email = draftEmail.trim()
+    if (!email) return
+    setBusy(true); setError(null)
+    try {
+      await addAllowlistEmail(email, draftNote.trim() || null)
+      setDraftEmail(''); setDraftNote('')
+      await refresh()
+    } catch (e) {
+      setError(e.message)
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  async function handleRemove(email) {
+    if (!confirm(`Remove ${email} from the allowlist?`)) return
+    setBusy(true); setError(null)
+    try {
+      await removeAllowlistEmail(email)
+      await refresh()
+    } catch (e) {
+      setError(e.message)
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  if (data == null && !error) return <p className="muted">Loading allowlist…</p>
+
+  return (
+    <div className="admin-tab">
+      <header className="admin-tab-header">
+        <h2>Allowlist</h2>
+        <p className="muted">
+          When this list has any rows, OAuth sign-in is restricted: only emails
+          here (case-insensitive) may sign in. Already-provisioned users are
+          grandfathered by their Gitea ID and never re-checked. An empty list
+          turns the gate off entirely.
+        </p>
+        <p className="muted">
+          Status:{' '}
+          <strong>{data?.active ? 'Private beta — gate active' : 'Open — anyone can sign in'}</strong>
+        </p>
+      </header>
+      {error && <p className="settings-note warning">{error}</p>}
+
+      <form className="allowlist-add" onSubmit={handleAdd}>
+        <input
+          type="email"
+          placeholder="email@example.com"
+          value={draftEmail}
+          onChange={e => setDraftEmail(e.target.value)}
+          required
+          disabled={busy}
+        />
+        <input
+          type="text"
+          placeholder="Note (optional)"
+          value={draftNote}
+          onChange={e => setDraftNote(e.target.value)}
+          maxLength={200}
+          disabled={busy}
+        />
+        <button type="submit" className="btn-primary" disabled={busy || !draftEmail.trim()}>
+          Add to allowlist
+        </button>
+      </form>
+
+      {data?.items?.length > 0 ? (
+        <table className="admin-table">
+          <thead>
+            <tr>
+              <th>Email</th>
+              <th>Note</th>
+              <th>Added by</th>
+              <th>Added at</th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            {data.items.map(r => (
+              <tr key={r.email}>
+                <td><code>{r.email}</code></td>
+                <td>{r.note || <span className="muted">—</span>}</td>
+                <td>
+                  {r.added_by_login
+                    ? <span>@{r.added_by_login}</span>
+                    : <span className="muted">—</span>}
+                </td>
+                <td className="muted">{r.created_at}</td>
+                <td>
+                  <button
+                    type="button"
+                    className="btn-link-quiet"
+                    onClick={() => handleRemove(r.email)}
+                    disabled={busy}
+                  >Remove</button>
+                </td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      ) : (
+        <p className="muted">
+          No allow-listed emails yet. Add the first one to put the deployment
+          into private-beta mode.
+        </p>
+      )}
+    </div>
+  )
+}
+
 // ── Graduation-readiness queue (§13.2) ─────────────────────────────────────
 
 function GraduationTab() {

frontend/src/components/BetaPending.jsx

@@ -0,0 +1,41 @@
+// BetaPending.jsx — the post-OAuth-rejection page.
+//
+// When a deployment is in private-beta mode (i.e. its `allowed_emails`
+// table has any rows), the OAuth callback redirects unrecognised users
+// here instead of provisioning them. The framework cannot know the
+// deployment operator's preferred contact channel — so the deployment
+// supplies one via VITE_BETA_CONTACT (an email, URL, or short
+// instruction). If unset, we render a generic ask-the-operator line.
+
+import { Link } from 'react-router-dom'
+
+export default function BetaPending() {
+  const contact = import.meta.env.VITE_BETA_CONTACT || ''
+  return (
+    <div className="beta-pending">
+      <div className="beta-pending-inner">
+        <h1>{import.meta.env.VITE_APP_NAME} is in private Beta.</h1>
+        <p>
+          Discussion and contribution are gated to invited emails for now.
+          Reading is open — every super-draft, every active RFC, and every
+          public conversation is visible without signing in.
+        </p>
+        {contact ? (
+          <p className="beta-pending-contact">
+            To request access, contact <strong>{contact}</strong> with the
+            email address you'd like to sign in with.
+          </p>
+        ) : (
+          <p className="beta-pending-contact">
+            To request access, contact the deployment operator with the email
+            address you'd like to sign in with.
+          </p>
+        )}
+        <div className="beta-pending-actions">
+          <Link className="btn-primary" to="/">Browse as a guest</Link>
+          <Link className="btn-link-quiet" to="/philosophy">Read the philosophy →</Link>
+        </div>
+      </div>
+    </div>
+  )
+}

frontend/src/components/Catalog.jsx

@@ -22,7 +22,7 @@ const SORT_OPTIONS = [
   { id: 'state',   label: 'State' },
 ]
 
-export default function Catalog({ onProposeRFC, version }) {
+export default function Catalog({ viewer, onProposeRFC, version }) {
   const [rfcs, setRfcs] = useState([])
   const [proposals, setProposals] = useState([])
   const [search, setSearch] = useState('')
@@ -93,7 +93,7 @@ export default function Catalog({ onProposeRFC, version }) {
         {filtered.length === 0 ? (
           <div style={{ padding: '24px 14px', color: '#999', fontSize: 13 }}>
             {rfcs.length === 0
-              ? 'No RFCs in the catalog yet. Propose one below.'
+              ? (viewer ? 'No RFCs in the catalog yet. Propose one below.' : 'No RFCs in the catalog yet.')
               : 'No matches.'}
           </div>
         ) : (
@@ -148,7 +148,13 @@ export default function Catalog({ onProposeRFC, version }) {
       </div>
 
       <div className="catalog-footer">
-        <button className="btn-propose" onClick={onProposeRFC}>+ Propose New RFC</button>
+        {viewer ? (
+          <button className="btn-propose" onClick={onProposeRFC}>+ Propose New RFC</button>
+        ) : (
+          <a className="btn-propose" href="/auth/login" title="Private beta — only invited emails can propose">
+            Sign in to propose <span className="beta-chip">Beta</span>
+          </a>
+        )}
       </div>
     </aside>
   )

frontend/src/components/CookieConsentBanner.jsx

@@ -0,0 +1,164 @@
+// CookieConsentBanner.jsx — v0.13.0 / roadmap item #11 / SPEC §14.5.
+//
+// A non-modal bottom-of-page banner that asks the user once which
+// categories of cookies they accept. The framework's strictly-necessary
+// cookies (session, signed payloads) are always on; the user can opt in
+// or out of analytics (which gates the §13 SDK landing in v0.15.0) and
+// "other" (third-party embeds, social widgets if a deployment adds any).
+//
+// Visible until the user makes a choice. Hides itself once the choice
+// is recorded. The /settings/notifications "Privacy & cookies" tab
+// surfaces the current choice and re-opens the banner via `forceOpen`.
+
+import { useEffect, useState } from 'react'
+import { Link } from 'react-router-dom'
+import { getConsent, setConsent, hasChosen, hydrateFromServer } from '../lib/consent.js'
+import { getCookieConsent, setCookieConsent } from '../api.js'
+
+const CATEGORIES = [
+  {
+    key: 'essential-only',
+    label: 'Essential only',
+    description: 'Just the cookies the app needs to keep you signed in and protect submissions. (Sign-in session, signed payloads.)',
+    flags: { analytics: false, other: false },
+  },
+  {
+    key: 'essential-analytics',
+    label: 'Essential + analytics',
+    description: 'Adds anonymous usage analytics so the framework can see which surfaces get used. No third-party scripts beyond the analytics SDK.',
+    flags: { analytics: true, other: false },
+  },
+  {
+    key: 'essential-analytics-other',
+    label: 'Essential + analytics + other',
+    description: 'Adds analytics plus any third-party embeds the deployment configures (e.g. social widgets). Choose this if you want the full surface.',
+    flags: { analytics: true, other: true },
+  },
+]
+
+function selectionKeyFor(consent) {
+  if (consent.analytics && consent.other) return 'essential-analytics-other'
+  if (consent.analytics && !consent.other) return 'essential-analytics'
+  return 'essential-only'
+}
+
+export default function CookieConsentBanner({ viewer, forceOpen, onClosed }) {
+  const [open, setOpen] = useState(() => forceOpen || !hasChosen())
+  const [choice, setChoice] = useState(() => selectionKeyFor(getConsent()))
+  const [saving, setSaving] = useState(false)
+  const [error, setError] = useState(null)
+
+  // When forceOpen flips (settings "Change" affordance), re-render the
+  // banner and pre-select the user's current choice.
+  useEffect(() => {
+    if (forceOpen) {
+      setOpen(true)
+      setChoice(selectionKeyFor(getConsent()))
+    }
+  }, [forceOpen])
+
+  // Server-side hydrate for authenticated viewers per the v0.13.0
+  // precedence rule: a server row overrides local; absent server row,
+  // upload the local choice.
+  useEffect(() => {
+    if (!viewer?.user_id) return
+    let cancelled = false
+    getCookieConsent()
+      .then(record => {
+        if (cancelled) return
+        if (record.recorded_at) {
+          // Server is authoritative — adopt + hide the banner unless
+          // the settings page forced it open.
+          hydrateFromServer(record)
+          setChoice(selectionKeyFor(record))
+          if (!forceOpen) setOpen(false)
+        } else if (hasChosen()) {
+          // Local has a choice the server doesn't know about yet — push.
+          const local = getConsent()
+          setCookieConsent({ analytics: local.analytics, other: local.other })
+            .then(r => hydrateFromServer(r))
+            .catch(() => {})
+        }
+      })
+      .catch(() => {
+        // Network or auth error — leave the local-only path in place.
+      })
+    return () => { cancelled = true }
+  }, [viewer?.user_id])  // eslint-disable-line react-hooks/exhaustive-deps
+
+  if (!open) return null
+
+  async function save() {
+    setSaving(true)
+    setError(null)
+    const picked = CATEGORIES.find(c => c.key === choice) || CATEGORIES[0]
+    try {
+      setConsent(picked.flags)
+      if (viewer?.user_id) {
+        // Best-effort server persistence. A failure here doesn't
+        // invalidate the local choice; the banner still hides because
+        // the user expressed their preference. The server can catch up
+        // on the next sign-in via the hydrate path above.
+        try {
+          const r = await setCookieConsent(picked.flags)
+          hydrateFromServer(r)
+        } catch (e) {
+          setError(`Saved locally; server sync failed (${e.message}).`)
+        }
+      }
+      setOpen(false)
+      onClosed?.()
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  return (
+    <div className="cookie-consent-banner" role="region" aria-label="Cookie consent">
+      <div className="cookie-consent-body">
+        <h2 className="cookie-consent-title">Cookies &amp; privacy</h2>
+        <p className="cookie-consent-intro">
+          This site uses cookies. Essential cookies keep you signed in and
+          protect your submissions; analytics and other cookies are
+          optional. Choose what you allow — you can change this any time
+          from <Link to="/settings/notifications">Settings &rarr; Privacy &amp; cookies</Link>.
+        </p>
+        <fieldset className="cookie-consent-choices">
+          <legend className="visually-hidden">Cookie categories</legend>
+          {CATEGORIES.map(c => (
+            <label key={c.key} className={`cookie-consent-choice ${choice === c.key ? 'is-selected' : ''}`}>
+              <input
+                type="radio"
+                name="cookie-consent-choice"
+                value={c.key}
+                checked={choice === c.key}
+                onChange={() => setChoice(c.key)}
+                disabled={saving}
+              />
+              <span className="cookie-consent-choice-text">
+                <span className="cookie-consent-choice-label">{c.label}</span>
+                <span className="cookie-consent-choice-desc">{c.description}</span>
+              </span>
+            </label>
+          ))}
+        </fieldset>
+        <p className="cookie-consent-links">
+          <Link to="/cookies">Cookies policy</Link>
+          <span aria-hidden> &middot; </span>
+          <Link to="/privacy">Privacy policy</Link>
+        </p>
+        {error && <p className="cookie-consent-error">{error}</p>}
+        <div className="cookie-consent-actions">
+          <button
+            type="button"
+            className="btn-primary"
+            onClick={save}
+            disabled={saving}
+          >
+            {saving ? 'Saving…' : 'Save choice'}
+          </button>
+        </div>
+      </div>
+    </div>
+  )
+}

frontend/src/components/Landing.jsx

@@ -28,7 +28,7 @@ export default function Landing() {
           first RFC defining <em>human</em>. Build the dictionary first.
         </p>
 
-        <a className="btn-signin" href="/auth/login">Sign in with Gitea</a>
+        <Link className="btn-signin" to="/login">Sign in</Link>
         <Link className="secondary-link" to="/philosophy">Read the full philosophy →</Link>
 
         <ul className="landing-deck">

frontend/src/components/Login.jsx

@@ -0,0 +1,399 @@
+// Login.jsx — v0.7.0's email + OTC sign-in surface (§6.2), extended
+// in v0.10.0 with passcode sign-in (roadmap item #8).
+//
+// Three-to-five-step flow:
+//   1. Enter email → GET /auth/passcode/check.
+//      * If `has_passcode`: advance to step 'passcode'.
+//      * Otherwise: POST /auth/otc/request, advance to step 'code'.
+//   2a. Step 'passcode': enter passcode → POST /auth/passcode/verify.
+//       * On 200: redirect to /.
+//       * On 423: passcode is locked (5 consecutive failures); the
+//         UI auto-falls back to OTC by requesting a fresh code.
+//       * On 400: wrong passcode; the user can retry or click
+//         "Use a code instead" to fall back to OTC manually.
+//   2b. Step 'code' (the v0.7.0 path): enter the six-digit code →
+//       POST /auth/otc/verify → on 200, the server has signed in the
+//       user. If the user has no passcode set, we show step
+//       'offer-passcode' inviting them to set one for faster sign-in
+//       next time. Dismiss skips to /; "Set passcode" advances to
+//       step 'set-passcode'.
+//   3. Step 'set-passcode': enter a passcode → POST /auth/passcode/set
+//      → redirect to /. The user can also "Skip for now".
+//
+// Server-side, /auth/otc/request always returns 202 for an unrecognized
+// email (so the allowlist gate doesn't leak), so this surface never
+// distinguishes "we couldn't reach you" from "we don't know you". The
+// check endpoint also returns `has_passcode: false` for an unknown
+// email — so an unknown email always lands in the OTC path, no
+// account-enumeration signal.
+//
+// The legacy Gitea OAuth callback remains at /auth/login → /auth/callback
+// during the v0.7.0 migration; we surface a "Sign in with Gitea" link
+// as a fallback in the footer so users with active OAuth sessions or
+// older invite emails still have a path.
+
+import { useEffect, useRef, useState } from 'react'
+import { useNavigate, Link } from 'react-router-dom'
+import {
+  requestOtc,
+  verifyOtc,
+  checkPasscode,
+  verifyPasscode,
+  setPasscode as apiSetPasscode,
+} from '../api'
+
+export default function Login() {
+  // Steps: 'email' → 'passcode' or 'code' → (after OTC verify) optional
+  // 'offer-passcode' → optional 'set-passcode'. The latter two only
+  // appear on the OTC path for accounts that don't yet have a passcode.
+  const [step, setStep] = useState('email')
+  const [email, setEmail] = useState('')
+  const [code, setCode] = useState('')
+  const [passcode, setPasscode] = useState('')
+  const [newPasscode, setNewPasscode] = useState('')
+  const [status, setStatus] = useState('')
+  const [busy, setBusy] = useState(false)
+  const emailRef = useRef(null)
+  const codeRef = useRef(null)
+  const passcodeRef = useRef(null)
+  const newPasscodeRef = useRef(null)
+  const navigate = useNavigate()
+
+  useEffect(() => {
+    if (step === 'email') emailRef.current?.focus()
+    else if (step === 'code') codeRef.current?.focus()
+    else if (step === 'passcode') passcodeRef.current?.focus()
+    else if (step === 'set-passcode') newPasscodeRef.current?.focus()
+  }, [step])
+
+  async function submitEmail(e) {
+    e.preventDefault()
+    if (!email.trim() || !email.includes('@')) {
+      setStatus('Enter a valid email address.')
+      return
+    }
+    setBusy(true)
+    setStatus('')
+    try {
+      const { has_passcode } = await checkPasscode(email.trim())
+      if (has_passcode) {
+        setStep('passcode')
+        setStatus('')
+      } else {
+        await requestOtc(email.trim())
+        setStep('code')
+        setStatus('Check your inbox — a six-digit code is on the way.')
+      }
+    } catch (err) {
+      if (err.status === 429) {
+        setStatus('Slow down — wait a minute before requesting another code.')
+      } else {
+        setStatus(err.message || 'Could not start sign-in. Try again.')
+      }
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  async function submitPasscode(e) {
+    if (e) e.preventDefault()
+    if (!passcode.trim()) {
+      setStatus('Enter your passcode.')
+      return
+    }
+    setBusy(true)
+    setStatus('')
+    try {
+      await verifyPasscode(email.trim(), passcode.trim())
+      window.location.assign('/')
+    } catch (err) {
+      if (err.status === 423) {
+        // Lockout — auto-fall back to OTC. The OTC request endpoint
+        // is independent of the passcode lockout, so this lands a
+        // fresh code in the user's inbox immediately.
+        setPasscode('')
+        try {
+          await requestOtc(email.trim())
+          setStep('code')
+          setStatus(
+            'Too many failed attempts. We sent a one-time code to your email — use it to sign in.',
+          )
+        } catch (e2) {
+          if (e2.status === 429) {
+            setStep('code')
+            setStatus(
+              'Too many failed attempts. Wait a minute, then request a one-time code to sign in.',
+            )
+          } else {
+            setStatus(
+              'Too many failed attempts. Use the "Use a code instead" link to sign in via email.',
+            )
+          }
+        }
+      } else {
+        setStatus('Wrong passcode. Try again, or use a one-time code instead.')
+      }
+      setBusy(false)
+    }
+  }
+
+  async function submitCode(e) {
+    if (e) e.preventDefault()
+    if (!code.trim() || code.trim().length !== 6) {
+      setStatus('Enter the six-digit code from your email.')
+      return
+    }
+    setBusy(true)
+    setStatus('')
+    try {
+      await verifyOtc(email.trim(), code.trim())
+      // OTC verified. If the user has no passcode, offer to set one
+      // before redirecting. We re-read `has_passcode` from the server
+      // rather than caching the step-1 result because the user could
+      // have set a passcode in another tab between then and now.
+      const { has_passcode } = await checkPasscode(email.trim())
+      if (has_passcode) {
+        window.location.assign('/')
+      } else {
+        setStep('offer-passcode')
+        setBusy(false)
+      }
+    } catch (err) {
+      setStatus('That code is invalid or expired. Try again, or request a new code.')
+      setBusy(false)
+    }
+  }
+
+  async function submitNewPasscode(e) {
+    if (e) e.preventDefault()
+    const pc = newPasscode.trim()
+    if (pc.length < 4) {
+      setStatus('Passcode must be at least 4 characters.')
+      return
+    }
+    setBusy(true)
+    setStatus('')
+    try {
+      await apiSetPasscode(pc)
+      window.location.assign('/')
+    } catch (err) {
+      // 422 carries the validation message verbatim (denylist /
+      // length); surface it as-is so the user knows what to change.
+      setStatus(err.message || 'Could not set passcode. Try a different one.')
+      setBusy(false)
+    }
+  }
+
+  function onCodeKey(e) {
+    // §6.2 ergonomic: Cmd/Ctrl+Enter submits from the code field.
+    if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
+      submitCode(e)
+    }
+  }
+
+  function onPasscodeKey(e) {
+    if ((e.metaKey || e.ctrlKey) && e.key === 'Enter') {
+      submitPasscode(e)
+    }
+  }
+
+  function backToEmail() {
+    setStep('email')
+    setCode('')
+    setPasscode('')
+    setStatus('')
+  }
+
+  async function fallbackToOtc() {
+    // Manual "Use a code instead" from the passcode step. Same shape
+    // as the email-step OTC dispatch.
+    setBusy(true)
+    setStatus('')
+    try {
+      await requestOtc(email.trim())
+      setPasscode('')
+      setStep('code')
+      setStatus('Check your inbox — a six-digit code is on the way.')
+    } catch (err) {
+      if (err.status === 429) {
+        setStatus('Slow down — wait a minute before requesting another code.')
+      } else {
+        setStatus(err.message || 'Could not request a code. Try again.')
+      }
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  function skipPasscodeOffer() {
+    window.location.assign('/')
+  }
+
+  return (
+    <div className="otc-login">
+      <div className="otc-login-inner">
+        <h1>Sign in</h1>
+        {step === 'email' && (
+          <form onSubmit={submitEmail}>
+            <p className="otc-hint">
+              Enter your email. If you've set a passcode, you'll enter that
+              next; otherwise we'll send a one-time code.
+            </p>
+            <input
+              ref={emailRef}
+              type="email"
+              autoComplete="email"
+              value={email}
+              onChange={e => setEmail(e.target.value)}
+              placeholder="you@example.com"
+              required
+              disabled={busy}
+            />
+            <button type="submit" disabled={busy || !email.trim()}>
+              {busy ? 'Checking…' : 'Continue'}
+            </button>
+          </form>
+        )}
+        {step === 'passcode' && (
+          <form onSubmit={submitPasscode}>
+            <p className="otc-hint">
+              Enter the passcode for <strong>{email}</strong>.
+            </p>
+            <input
+              ref={passcodeRef}
+              type="password"
+              autoComplete="current-password"
+              value={passcode}
+              onChange={e => setPasscode(e.target.value)}
+              onKeyDown={onPasscodeKey}
+              placeholder="Your passcode"
+              required
+              disabled={busy}
+            />
+            <div className="otc-actions">
+              <button type="submit" disabled={busy || !passcode.trim()}>
+                {busy ? 'Signing in…' : 'Sign in'}
+              </button>
+              <button
+                type="button"
+                className="btn-link-quiet"
+                onClick={fallbackToOtc}
+                disabled={busy}
+              >
+                Use a code instead
+              </button>
+              <button
+                type="button"
+                className="btn-link-quiet"
+                onClick={backToEmail}
+                disabled={busy}
+              >
+                Use a different email
+              </button>
+            </div>
+          </form>
+        )}
+        {step === 'code' && (
+          <form onSubmit={submitCode}>
+            <p className="otc-hint">
+              Enter the six-digit code we sent to <strong>{email}</strong>.
+            </p>
+            <input
+              ref={codeRef}
+              type="text"
+              inputMode="numeric"
+              pattern="[0-9]*"
+              autoComplete="one-time-code"
+              maxLength={6}
+              value={code}
+              onChange={e => setCode(e.target.value.replace(/\D/g, ''))}
+              onKeyDown={onCodeKey}
+              placeholder="123456"
+              required
+              disabled={busy}
+            />
+            <div className="otc-actions">
+              <button type="submit" disabled={busy || code.length !== 6}>
+                {busy ? 'Signing in…' : 'Sign in'}
+              </button>
+              <button
+                type="button"
+                className="btn-link-quiet"
+                onClick={backToEmail}
+                disabled={busy}
+              >
+                Use a different email
+              </button>
+            </div>
+            <p className="otc-shortcut-hint">
+              Tip: <kbd>⌘</kbd>+<kbd>Enter</kbd> (or <kbd>Ctrl</kbd>+<kbd>Enter</kbd>) to sign in.
+            </p>
+          </form>
+        )}
+        {step === 'offer-passcode' && (
+          <div className="otc-offer-passcode">
+            <p className="otc-hint">
+              You're signed in. Want to set a passcode for faster sign-in
+              next time? You can always use a one-time code instead — and
+              you can change or remove the passcode from your settings.
+            </p>
+            <div className="otc-actions">
+              <button
+                type="button"
+                onClick={() => { setStep('set-passcode'); setStatus('') }}
+              >
+                Set a passcode
+              </button>
+              <button
+                type="button"
+                className="btn-link-quiet"
+                onClick={skipPasscodeOffer}
+              >
+                Skip for now
+              </button>
+            </div>
+          </div>
+        )}
+        {step === 'set-passcode' && (
+          <form onSubmit={submitNewPasscode}>
+            <p className="otc-hint">
+              Pick a passcode (4–20 characters). You'll use it with your
+              email to sign in next time.
+            </p>
+            <input
+              ref={newPasscodeRef}
+              type="password"
+              autoComplete="new-password"
+              value={newPasscode}
+              onChange={e => setNewPasscode(e.target.value)}
+              placeholder="New passcode"
+              required
+              disabled={busy}
+              minLength={4}
+              maxLength={20}
+            />
+            <div className="otc-actions">
+              <button type="submit" disabled={busy || newPasscode.trim().length < 4}>
+                {busy ? 'Saving…' : 'Save passcode'}
+              </button>
+              <button
+                type="button"
+                className="btn-link-quiet"
+                onClick={skipPasscodeOffer}
+                disabled={busy}
+              >
+                Skip for now
+              </button>
+            </div>
+          </form>
+        )}
+        {status && <p className="otc-status">{status}</p>}
+        <p className="otc-fallback">
+          <Link to="/philosophy">Read the philosophy →</Link>
+          <span className="otc-fallback-sep">·</span>
+          <a href="/auth/login">Sign in with Gitea (fallback)</a>
+        </p>
+      </div>
+    </div>
+  )
+}

frontend/src/components/NotificationSettings.jsx

@@ -28,7 +28,12 @@ import {
   unmuteUser,
   muteUser,
   searchUsers,
+  getCookieConsent,
+  getMe,
+  setPasscode,
+  clearPasscode,
 } from '../api.js'
+import { getConsent, onConsentChange, hydrateFromServer } from '../lib/consent.js'
 
 const CHURN_REFUSAL = 'Per-commit and per-message email is intentionally not offered. The digest aggregates this activity weekly.'
 
@@ -48,10 +53,223 @@ export default function NotificationSettings({ viewer }) {
       <QuietHoursSection />
       <WatchesSection />
       <MutesSection viewer={viewer} />
+      <SignInSection />
+      <PrivacyCookiesSection />
     </div>
   )
 }
 
+// ── §6.2 sign-in (v0.10.0 / roadmap item #8): passcode management ──────────
+
+function SignInSection() {
+  // Source of truth for `has_passcode` and `passcode_set_at` is the
+  // /api/auth/me payload (v0.10.0 added both fields). We re-read after
+  // every mutation so the surface reflects what just landed.
+  const [me, setMe] = useState(null)
+  const [error, setError] = useState(null)
+  const [mode, setMode] = useState('idle') // 'idle' | 'set' | 'change'
+  const [draft, setDraft] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [savedNote, setSavedNote] = useState('')
+
+  useEffect(() => {
+    getMe()
+      .then(payload => setMe(payload.user || null))
+      .catch(e => setError(e.message))
+  }, [])
+
+  async function refresh() {
+    const payload = await getMe()
+    setMe(payload.user || null)
+  }
+
+  async function save(e) {
+    if (e) e.preventDefault()
+    const pc = draft.trim()
+    if (pc.length < 4) {
+      setError('Passcode must be at least 4 characters.')
+      return
+    }
+    setBusy(true)
+    setError(null)
+    setSavedNote('')
+    try {
+      await setPasscode(pc)
+      setDraft('')
+      setMode('idle')
+      setSavedNote('Passcode saved.')
+      await refresh()
+    } catch (err) {
+      // 422 carries the validation message verbatim (denylist /
+      // length); surface it as-is so the user knows what to change.
+      setError(err.message || 'Could not save passcode. Try a different one.')
+    } finally {
+      setBusy(false)
+      setTimeout(() => setSavedNote(''), 2000)
+    }
+  }
+
+  async function remove() {
+    if (!confirm('Remove your passcode? You will sign in with a one-time code next time.')) {
+      return
+    }
+    setBusy(true)
+    setError(null)
+    setSavedNote('')
+    try {
+      await clearPasscode()
+      setSavedNote('Passcode removed.')
+      await refresh()
+    } catch (err) {
+      setError(err.message || 'Could not remove passcode.')
+    } finally {
+      setBusy(false)
+      setTimeout(() => setSavedNote(''), 2000)
+    }
+  }
+
+  if (!me) return <SectionShell title="Sign-in" subtitle={error || 'Loading…'} />
+
+  const hasPasscode = !!me.has_passcode
+
+  return (
+    <SectionShell
+      title="Sign-in"
+      subtitle="How you sign in. A passcode lets you skip the one-time-code email; the one-time-code path is always available as a fallback (and as the recovery path if you forget your passcode)."
+    >
+      <div className="settings-row">
+        <span className="settings-note">
+          <strong>Passcode:</strong>{' '}
+          {hasPasscode ? 'Set.' : 'Not set — you sign in with a one-time code each time.'}
+        </span>
+      </div>
+      {hasPasscode && me.passcode_set_at && (
+        <p className="settings-note muted">Set on {me.passcode_set_at}.</p>
+      )}
+
+      {mode === 'idle' && (
+        <div className="settings-row">
+          {hasPasscode ? (
+            <>
+              <button
+                className="btn-primary"
+                onClick={() => { setMode('change'); setDraft(''); setError(null) }}
+                disabled={busy}
+              >
+                Change passcode
+              </button>
+              <button
+                className="btn-link-muted"
+                onClick={remove}
+                disabled={busy}
+              >
+                Remove passcode
+              </button>
+            </>
+          ) : (
+            <button
+              className="btn-primary"
+              onClick={() => { setMode('set'); setDraft(''); setError(null) }}
+              disabled={busy}
+            >
+              Set passcode
+            </button>
+          )}
+        </div>
+      )}
+
+      {(mode === 'set' || mode === 'change') && (
+        <form className="settings-row" onSubmit={save}>
+          <label>
+            {mode === 'change' ? 'New passcode' : 'Passcode'}
+            <input
+              type="password"
+              autoComplete="new-password"
+              value={draft}
+              onChange={e => setDraft(e.target.value)}
+              placeholder="4–20 characters"
+              minLength={4}
+              maxLength={20}
+              required
+              disabled={busy}
+            />
+          </label>
+          <button className="btn-primary" type="submit" disabled={busy || draft.trim().length < 4}>
+            {busy ? 'Saving…' : 'Save'}
+          </button>
+          <button
+            type="button"
+            className="btn-link-muted"
+            onClick={() => { setMode('idle'); setDraft(''); setError(null) }}
+            disabled={busy}
+          >
+            Cancel
+          </button>
+        </form>
+      )}
+
+      {savedNote && <p className="settings-note">{savedNote}</p>}
+      {error && <p className="settings-note warning">{error}</p>}
+    </SectionShell>
+  )
+}
+
+// ── §14.5 cookie / privacy consent (v0.13.0 / roadmap item #11) ────────────
+
+function PrivacyCookiesSection() {
+  const [consent, setConsent] = useState(() => getConsent())
+
+  useEffect(() => {
+    // Pull the server-side row on mount; if it has a recorded_at the
+    // local snapshot is updated via hydrate.
+    getCookieConsent()
+      .then(record => { if (record.recorded_at) hydrateFromServer(record) })
+      .catch(() => {})
+    return onConsentChange(next => setConsent(next))
+  }, [])
+
+  function reopenBanner() {
+    // App.jsx listens for this event and bumps the forceOpen tick on
+    // <CookieConsentBanner>. The banner pre-selects the current choice
+    // from the snapshot, so the user can revise rather than restart.
+    window.dispatchEvent(new CustomEvent('rfc-app:cookie-consent-reopen'))
+  }
+
+  const summary = (() => {
+    if (!consent.recorded_at) {
+      return 'No choice recorded — the consent banner is being shown to you.'
+    }
+    if (consent.analytics && consent.other) {
+      return 'Essential + analytics + other.'
+    }
+    if (consent.analytics) {
+      return 'Essential + analytics.'
+    }
+    return 'Essential only.'
+  })()
+
+  return (
+    <SectionShell
+      title="Privacy & cookies"
+      subtitle="What categories of cookies you've allowed. Essential cookies are always on; analytics and other categories are opt-in."
+    >
+      <div className="settings-row">
+        <span className="settings-note"><strong>Current choice:</strong> {summary}</span>
+      </div>
+      {consent.recorded_at && (
+        <p className="settings-note muted">Recorded {consent.recorded_at}.</p>
+      )}
+      <div className="settings-row">
+        <button className="btn-primary" onClick={reopenBanner}>
+          Change
+        </button>
+        <Link to="/cookies" className="btn-link-muted">Cookies policy</Link>
+        <Link to="/privacy" className="btn-link-muted">Privacy policy</Link>
+      </div>
+    </SectionShell>
+  )
+}
+
 // ── §15.4 email category toggles ───────────────────────────────────────────
 
 function EmailPreferencesSection() {

frontend/src/components/ProposeModal.jsx

@@ -20,7 +20,7 @@ function slugify(title) {
     .replace(/^-+|-+$/g, '')
 }
 
-export default function ProposeModal({ onClose, onSubmitted }) {
+export default function ProposeModal({ viewer, onClose, onSubmitted }) {
   const [title, setTitle] = useState('')
   const [slug, setSlug] = useState('')
   const [slugEdited, setSlugEdited] = useState(false)
@@ -131,6 +131,12 @@ export default function ProposeModal({ onClose, onSubmitted }) {
               </div>
             )}
 
+            {viewer && (
+              <p className="field-help" style={{ marginTop: 14, marginBottom: 0 }}>
+                Owner: <strong>{viewer.display_name || viewer.gitea_login}</strong> — you'll be the first owner of this super-draft. Additional owners can claim later (§13.1).
+              </p>
+            )}
+
             {error && <p className="field-error">{error}</p>}
           </div>
           <div className="modal-actions">

frontend/src/components/RFCDiscussionPanel.jsx

@@ -0,0 +1,290 @@
+// RFCDiscussionPanel.jsx — v0.5.0's PR-less per-RFC discussion surface.
+//
+// Roadmap item #3: an RFC's main view now has a discussion surface
+// distinct from PR comments and from branch chat. The substrate is the
+// existing threads/thread_messages tables — rows with
+// `threads.branch_name IS NULL` scope to "the RFC, no branch yet."
+//
+// Reused as the right-column panel on `branchParam === 'main'`. Branch
+// chat (ChatPanel.jsx) keeps its existing role for branch-scoped work,
+// including PRs. Contribution remains gated behind opening a PR —
+// nothing here writes to the document.
+
+import { useCallback, useEffect, useRef, useState } from 'react'
+import {
+  createDiscussionThread,
+  getDiscussionThreadMessages,
+  listDiscussionThreads,
+  postDiscussionMessage,
+  resolveDiscussionThread,
+} from '../api'
+
+export default function RFCDiscussionPanel({ slug, viewer }) {
+  const [threads, setThreads] = useState([])
+  const [messagesByThread, setMessagesByThread] = useState({})
+  const [composer, setComposer] = useState('')
+  const [activeThreadId, setActiveThreadId] = useState(null)
+  const [error, setError] = useState(null)
+  const [sending, setSending] = useState(false)
+  const bottomRef = useRef(null)
+
+  // Pull threads + messages on mount / slug change.
+  useEffect(() => {
+    if (!slug) return
+    let cancelled = false
+    setError(null)
+    setThreads([])
+    setMessagesByThread({})
+    setActiveThreadId(null)
+    listDiscussionThreads(slug)
+      .then(async ({ items }) => {
+        if (cancelled) return
+        setThreads(items || [])
+        // Pre-load messages for each thread. The list is small (per-RFC,
+        // not per-branch) so a fan-out fetch is fine; §19.2 candidate
+        // for paging if a hot RFC accumulates lots of threads.
+        const collected = {}
+        for (const t of items || []) {
+          try {
+            const { messages } = await getDiscussionThreadMessages(slug, t.id)
+            collected[t.id] = messages
+          } catch {
+            collected[t.id] = []
+          }
+        }
+        if (!cancelled) {
+          setMessagesByThread(collected)
+          // Default the active thread to the system's lazy whole-doc
+          // default (the first row with anchor_kind='whole-doc' and
+          // no label) so the composer wires to a real id immediately.
+          const dflt = (items || []).find(
+            t => t.anchor_kind === 'whole-doc' && !t.label,
+          )
+          setActiveThreadId(dflt?.id || items?.[0]?.id || null)
+        }
+      })
+      .catch(err => { if (!cancelled) setError(err.message) })
+    return () => { cancelled = true }
+  }, [slug])
+
+  // Scroll to bottom when messages land in the active thread.
+  useEffect(() => {
+    bottomRef.current?.scrollIntoView({ behavior: 'smooth' })
+  }, [activeThreadId, messagesByThread[activeThreadId]?.length])
+
+  const handleSend = useCallback(async () => {
+    if (!viewer) { window.location.href = '/auth/login'; return }
+    const text = composer.trim()
+    if (!text || sending) return
+    setSending(true)
+    setError(null)
+    try {
+      // If no thread yet, mint one with the message as its first turn.
+      if (!activeThreadId) {
+        const { thread_id, message_id } = await createDiscussionThread(slug, { message: text })
+        // Re-pull authoritative state — the default whole-doc thread
+        // existed pre-this call (the GET creates it lazily), so we
+        // either get the existing default's id back from the new
+        // thread's row or the prior default; either way the list call
+        // is the source of truth.
+        const { items } = await listDiscussionThreads(slug)
+        setThreads(items || [])
+        const { messages } = await getDiscussionThreadMessages(slug, thread_id)
+        setMessagesByThread(prev => ({ ...prev, [thread_id]: messages }))
+        setActiveThreadId(thread_id)
+        void message_id
+      } else {
+        const { message_id } = await postDiscussionMessage(slug, activeThreadId, { text })
+        const { messages } = await getDiscussionThreadMessages(slug, activeThreadId)
+        setMessagesByThread(prev => ({ ...prev, [activeThreadId]: messages }))
+        void message_id
+      }
+      setComposer('')
+    } catch (err) {
+      setError(err.message)
+    } finally {
+      setSending(false)
+    }
+  }, [composer, sending, viewer, slug, activeThreadId])
+
+  const handleNewThread = useCallback(async () => {
+    if (!viewer) { window.location.href = '/auth/login'; return }
+    setError(null)
+    try {
+      const { thread_id } = await createDiscussionThread(slug, { label: null, message: null })
+      const { items } = await listDiscussionThreads(slug)
+      setThreads(items || [])
+      setActiveThreadId(thread_id)
+      setMessagesByThread(prev => ({ ...prev, [thread_id]: [] }))
+    } catch (err) {
+      setError(err.message)
+    }
+  }, [viewer, slug])
+
+  const handleResolve = useCallback(async (threadId) => {
+    if (!viewer) return
+    setError(null)
+    try {
+      await resolveDiscussionThread(slug, threadId)
+      const { items } = await listDiscussionThreads(slug)
+      setThreads(items || [])
+    } catch (err) {
+      setError(err.message)
+    }
+  }, [viewer, slug])
+
+  const onKeyDown = useCallback((e) => {
+    if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) {
+      e.preventDefault()
+      handleSend()
+    }
+  }, [handleSend])
+
+  const activeThread = threads.find(t => t.id === activeThreadId) || null
+  const activeMessages = messagesByThread[activeThreadId] || []
+  const openThreads = threads.filter(t => t.state === 'open')
+
+  return (
+    <div className="discussion-panel">
+      <div className="discussion-header">
+        <span className="discussion-header-title">
+          Discussion <span className="beta-chip">Beta</span>
+        </span>
+        <span className="discussion-header-meta">
+          {openThreads.length} open thread{openThreads.length === 1 ? '' : 's'}
+          {' · '}contribution requires a PR
+        </span>
+      </div>
+
+      {threads.length > 1 && (
+        <div className="discussion-thread-tabs">
+          {threads.map(t => (
+            <button
+              key={t.id}
+              type="button"
+              className={`discussion-thread-tab ${t.id === activeThreadId ? 'active' : ''} ${t.state === 'resolved' ? 'resolved' : ''}`}
+              onClick={() => setActiveThreadId(t.id)}
+              title={t.label || (t.id === activeThreadId ? 'Current thread' : 'Open thread')}
+            >
+              {t.label || (t.anchor_kind === 'whole-doc' && !t.label ? 'General' : `Thread ${t.id}`)}
+              {t.state === 'resolved' && ' ✓'}
+            </button>
+          ))}
+        </div>
+      )}
+
+      <div className="discussion-messages">
+        {error && <div className="discussion-error">{error}</div>}
+        {activeMessages.length === 0 && !error && (
+          <div className="discussion-empty">
+            <p>
+              {viewer
+                ? 'No discussion yet. Be the first to comment — discussion lives here without opening a PR. To propose an edit, use Start Contributing above.'
+                : 'No discussion yet. Sign in to comment. Discussion lives here without opening a PR; proposed edits still flow through PRs.'}
+            </p>
+          </div>
+        )}
+        {activeMessages.map(msg => (
+          <DiscussionMessage key={msg.id} message={msg} />
+        ))}
+        <div ref={bottomRef} />
+      </div>
+
+      <div className="discussion-composer">
+        {viewer ? (
+          <>
+            <textarea
+              className="discussion-composer-textarea"
+              value={composer}
+              onChange={e => setComposer(e.target.value)}
+              onKeyDown={onKeyDown}
+              placeholder={
+                activeThread?.label
+                  ? `Reply in "${activeThread.label}" — Cmd/Ctrl+Enter to send`
+                  : 'Discuss this RFC — Cmd/Ctrl+Enter to send'
+              }
+              disabled={sending}
+              rows={3}
+            />
+            <div className="discussion-composer-actions">
+              <button
+                type="button"
+                className="btn-secondary"
+                onClick={handleNewThread}
+                disabled={sending}
+                title="Open a fresh discussion thread on this RFC"
+              >
+                New thread
+              </button>
+              {activeThread
+                && activeThread.state === 'open'
+                && (activeThread.created_by === viewer.user_id
+                    || viewer.role === 'owner'
+                    || viewer.role === 'admin') && (
+                <button
+                  type="button"
+                  className="btn-link"
+                  onClick={() => handleResolve(activeThread.id)}
+                  disabled={sending}
+                  title="Mark this discussion thread resolved"
+                >
+                  Resolve
+                </button>
+              )}
+              <button
+                type="button"
+                className="btn-primary"
+                onClick={handleSend}
+                disabled={sending || !composer.trim()}
+              >
+                {sending ? 'Sending…' : 'Send'}
+              </button>
+            </div>
+          </>
+        ) : (
+          <div className="discussion-readonly">
+            Read-only — <a href="/auth/login">sign in</a> to join the discussion.
+            Discussion is in private <strong>Beta</strong>.
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+function DiscussionMessage({ message }) {
+  const isSystem = message.role === 'system'
+  if (isSystem) {
+    return (
+      <div className="discussion-message system">
+        <div className="discussion-system-bubble">{message.text}</div>
+      </div>
+    )
+  }
+  return (
+    <div className={`discussion-message ${message.role}`}>
+      <div className="discussion-message-meta">
+        <span className="discussion-message-author">
+          @{message.author_login || '—'}
+        </span>
+        <span className="discussion-message-time">
+          {formatTimestamp(message.created_at)}
+        </span>
+      </div>
+      {message.quote && (
+        <div className="discussion-message-quote">"{message.quote}"</div>
+      )}
+      <div className="discussion-message-body">{message.text}</div>
+    </div>
+  )
+}
+
+function formatTimestamp(ts) {
+  if (!ts) return ''
+  try {
+    const d = new Date(ts + (ts.endsWith('Z') ? '' : 'Z'))
+    return d.toLocaleString()
+  } catch {
+    return ts
+  }
+}

frontend/src/components/RFCView.jsx

@@ -39,6 +39,7 @@ import MarkdownPreview from './MarkdownPreview.jsx'
 import SelectionTooltip from './SelectionTooltip.jsx'
 import PromptBar from './PromptBar.jsx'
 import ChatPanel from './ChatPanel.jsx'
+import RFCDiscussionPanel from './RFCDiscussionPanel.jsx'
 import ChangePanel, { diffWords } from './ChangePanel.jsx'
 import PRModal from './PRModal.jsx'
 import GraduateDialog from './GraduateDialog.jsx'
@@ -535,9 +536,10 @@ export default function RFCView({ viewer }) {
               type="button"
               className={`btn-mode-toggle ${mode}`}
               onClick={() => setMode(mode === 'discuss' ? 'contribute' : 'discuss')}
-              title={mode === 'discuss' ? 'Flip into edit mode' : 'Flip back to read-only discuss'}
+              title={mode === 'discuss' ? 'Flip into edit mode (Beta)' : 'Flip back to read-only discuss (Beta)'}
             >
               {mode === 'discuss' ? 'Contribute' : 'Discuss'}
+              <span className="beta-chip">Beta</span>
             </button>
           )}
           {(branchParam === 'main' || !canContribute) && viewer && (
@@ -547,10 +549,13 @@ export default function RFCView({ viewer }) {
               onClick={handleStartContributing}
             >
               Start Contributing
+              <span className="beta-chip">Beta</span>
             </button>
           )}
           {!viewer && (
-            <a className="btn-link" href="/auth/login">Sign in</a>
+            <a className="btn-link" href="/auth/login" title="Private beta — only invited emails can sign in">
+              Sign in <span className="beta-chip">Beta</span>
+            </a>
           )}
           {canOpenPR && (
             <button
@@ -742,7 +747,8 @@ export default function RFCView({ viewer }) {
             />
           ) : (
             <div className="readonly-bar">
-              Read-only view. <a href="/auth/login">Sign in</a> to participate.
+              Read-only view. Discussion is in private <strong>Beta</strong> —{' '}
+              <a href="/auth/login">sign in</a> if your email has been invited.
             </div>
           )}
         </div>
@@ -754,17 +760,25 @@ export default function RFCView({ viewer }) {
           data-open={drawerOpen ? 'true' : 'false'}
         />
         <div className={`right-panel${drawerOpen ? ' drawer-open' : ''}`} role="complementary">
-          <ChatPanel
-            messages={messages}
-            threads={branchView.threads || []}
-            changes={changes}
-            branchName={branchParam}
-            isStreaming={isStreaming}
-            contributionMode={mode === 'contribute'}
-            onStartContribution={handleStartContributing}
-            onScrollToChange={setFocusedChangeId}
-            onResolveThread={handleResolveThread}
-          />
+          {/* v0.5.0 — on main, the right panel is the PR-less discussion
+            * surface (threads.branch_name IS NULL). Branches keep their
+            * existing branch-chat panel; contribution still requires
+            * opening a PR from a branch via the Open PR affordance above. */}
+          {branchParam === 'main' ? (
+            <RFCDiscussionPanel slug={slug} viewer={viewer} />
+          ) : (
+            <ChatPanel
+              messages={messages}
+              threads={branchView.threads || []}
+              changes={changes}
+              branchName={branchParam}
+              isStreaming={isStreaming}
+              contributionMode={mode === 'contribute'}
+              onStartContribution={handleStartContributing}
+              onScrollToChange={setFocusedChangeId}
+              onResolveThread={handleResolveThread}
+            />
+          )}
           {mode === 'contribute' && (changes.length > 0 || manualPending) && (
             <ChangePanel
               changes={changes}

frontend/src/lib/consent.js

@@ -0,0 +1,154 @@
+// consent.js — cookie / privacy consent state (v0.13.0, SPEC §14.5).
+//
+// The framework's analytics SDK gating (roadmap item #13, target v0.15.0)
+// will read from this module. v0.13.0 ships the storage + the banner +
+// the on-change pub/sub; no analytics SDK ships yet.
+//
+// Shape of a consent record:
+//
+//     { essential: true, analytics: bool, other: bool, recorded_at: string | null }
+//
+// `essential` is always true at the API surface; it's included for
+// symmetry. `recorded_at` is null when the user has not yet made a
+// choice — the banner is shown until it's non-null.
+//
+// Precedence:
+//   - Anonymous viewer: localStorage is the only source.
+//   - Authenticated viewer: on sign-in, the server row (if any) overrides
+//     local; if the server has no row, the local choice is uploaded.
+//
+// The fan-out is intentionally tiny — three flags. The banner writes
+// once; subscribers re-read on demand via `getConsent()` and can
+// register `onConsentChange(cb)` to be notified of subsequent updates.
+//
+// IMPORTANT: don't import this from analytics SDKs that themselves
+// set cookies on load. Read consent first, then conditionally `import()`
+// the SDK module — that's the contract item #13 will follow.
+
+const LS_KEY = 'rfc-app.cookie-consent.v1'
+
+const DEFAULT = Object.freeze({
+  essential: true,
+  analytics: false,
+  other: false,
+  recorded_at: null,
+})
+
+const listeners = new Set()
+
+function readLocal() {
+  try {
+    const raw = localStorage.getItem(LS_KEY)
+    if (!raw) return null
+    const parsed = JSON.parse(raw)
+    if (!parsed || typeof parsed !== 'object') return null
+    return normalize(parsed)
+  } catch {
+    return null
+  }
+}
+
+function writeLocal(record) {
+  try {
+    localStorage.setItem(LS_KEY, JSON.stringify(normalize(record)))
+  } catch {
+    // localStorage may be unavailable (private mode, disabled storage).
+    // In that case we behave as if no choice was ever made — the banner
+    // shows on every load. Acceptable per §14.5: the user can still
+    // refuse to consent on each visit.
+  }
+}
+
+function normalize(record) {
+  return {
+    essential: true,
+    analytics: !!record.analytics,
+    other: !!record.other,
+    recorded_at: record.recorded_at || null,
+  }
+}
+
+// In-memory snapshot. Initialised lazily on first read so the module
+// import order doesn't matter; refreshed by `setConsent` and
+// `hydrateFromServer`.
+let _snapshot = null
+
+function snapshot() {
+  if (_snapshot == null) {
+    _snapshot = readLocal() || { ...DEFAULT }
+  }
+  return _snapshot
+}
+
+function emit() {
+  for (const cb of listeners) {
+    try { cb(snapshot()) } catch {}
+  }
+}
+
+/** Read the current consent record. Always returns a normalized object;
+ *  `recorded_at: null` means the user has not yet chosen. */
+export function getConsent() {
+  return snapshot()
+}
+
+/** True if the user has made a choice. The banner uses this to decide
+ *  whether to render itself on load. */
+export function hasChosen() {
+  return snapshot().recorded_at != null
+}
+
+/** Subscribe to consent updates. Returns an unsubscribe function. */
+export function onConsentChange(cb) {
+  listeners.add(cb)
+  return () => listeners.delete(cb)
+}
+
+/** Write a new choice locally and emit. Returns the new snapshot. The
+ *  server-side persistence path is handled separately by the banner /
+ *  settings surface via the API client; this helper is for both anon
+ *  and authenticated callers because localStorage is the always-on
+ *  layer (the server row is a backup that survives sign-out). */
+export function setConsent({ analytics = false, other = false } = {}) {
+  const next = normalize({
+    analytics,
+    other,
+    recorded_at: new Date().toISOString(),
+  })
+  _snapshot = next
+  writeLocal(next)
+  emit()
+  return next
+}
+
+/** Adopt a server-side record as authoritative. Called by the banner /
+ *  settings surface after sign-in when the server returns a non-null
+ *  recorded_at. Updates local + memory + emits to subscribers. */
+export function hydrateFromServer(record) {
+  if (!record || !record.recorded_at) return snapshot()
+  const next = normalize(record)
+  _snapshot = next
+  writeLocal(next)
+  emit()
+  return next
+}
+
+/** Reset local state — used by the settings "Change" affordance to
+ *  re-prompt the banner. Does not touch the server row; the user must
+ *  re-confirm a choice and the banner uploads on save. */
+export function clearLocal() {
+  try { localStorage.removeItem(LS_KEY) } catch {}
+  _snapshot = { ...DEFAULT }
+  emit()
+  return _snapshot
+}
+
+// Cross-tab sync: if another tab writes the key, mirror the change here.
+// Wrapped in a guard so SSR / non-browser test contexts don't blow up.
+if (typeof window !== 'undefined' && typeof window.addEventListener === 'function') {
+  window.addEventListener('storage', e => {
+    if (e.key !== LS_KEY) return
+    _snapshot = readLocal() || { ...DEFAULT }
+    emit()
+  })
+}

frontend/src/pages/Cookies.jsx

@@ -0,0 +1,125 @@
+// Cookies.jsx — v0.13.0 / roadmap item #11 / SPEC §14.6.
+//
+// Lists the framework's cookies, by category, with each cookie's
+// purpose. Deployments override via `VITE_COOKIES_POLICY_URL` (linked
+// below the framework's stub list, same shape as the privacy page).
+//
+// Keeping the list in source makes the framework self-documenting:
+// when a future framework release adds or removes a cookie, this page
+// is the change-record. Item #13's analytics SDK will add its own row
+// to the analytics-category list in v0.15.0.
+
+import { useNavigate, Link } from 'react-router-dom'
+
+const COOKIES = [
+  {
+    name: 'rfc_session',
+    category: 'Essential',
+    purpose: "Signed session cookie that remembers who you're signed in as. itsdangerous-signed; HttpOnly; SameSite=Lax.",
+    lifetime: 'Session (cleared on sign-out).',
+  },
+  {
+    name: 'rfc-app.cookie-consent.v1',
+    category: 'Essential',
+    purpose: 'localStorage entry (not a cookie strictly, but tracked here for symmetry) that remembers your consent choice on this device. Cleared on browser data reset.',
+    lifetime: 'Until cleared.',
+  },
+]
+
+export default function Cookies() {
+  const navigate = useNavigate()
+  const deploymentUrl = (import.meta.env.VITE_COOKIES_POLICY_URL || '').trim()
+  const appName = import.meta.env.VITE_APP_NAME || 'this deployment'
+
+  return (
+    <div className="policy-page">
+      <header className="policy-header">
+        <button
+          className="policy-back"
+          onClick={() => (history.length > 1 ? navigate(-1) : navigate('/'))}
+        >
+          ← Back
+        </button>
+        <span className="policy-title">Cookies policy</span>
+      </header>
+      <article className="policy-body">
+        <h1>Cookies policy</h1>
+        <p className="policy-subtitle">
+          What {appName} stores in your browser, by category.
+        </p>
+
+        <h2>Categories</h2>
+        <ul>
+          <li>
+            <strong>Essential</strong> — required for the app to keep
+            you signed in, protect submissions, and remember your
+            consent choice. Cannot be switched off (without these the
+            app cannot function).
+          </li>
+          <li>
+            <strong>Analytics</strong> — optional anonymous usage
+            telemetry. Off by default; opt-in via the consent banner.
+            As of v0.13.0 no analytics SDK ships; roadmap item #13
+            (v0.15.0) adds one behind this gate.
+          </li>
+          <li>
+            <strong>Other</strong> — third-party embeds, social
+            widgets, or anything else the deployment chooses to enable.
+            Off by default; opt-in via the consent banner. The
+            framework ships no such cookies by default.
+          </li>
+        </ul>
+
+        <h2>Current cookies set by the framework</h2>
+        <table className="policy-table">
+          <thead>
+            <tr>
+              <th>Name</th>
+              <th>Category</th>
+              <th>Purpose</th>
+              <th>Lifetime</th>
+            </tr>
+          </thead>
+          <tbody>
+            {COOKIES.map(c => (
+              <tr key={c.name}>
+                <td><code>{c.name}</code></td>
+                <td>{c.category}</td>
+                <td>{c.purpose}</td>
+                <td>{c.lifetime}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+
+        <h2>Manage your choice</h2>
+        <p>
+          Change your consent any time from{' '}
+          <Link to="/settings/notifications">
+            Settings &rarr; Privacy &amp; cookies
+          </Link>. The "Change" affordance re-opens the consent banner
+          with your current selection pre-loaded.
+        </p>
+
+        {deploymentUrl ? (
+          <>
+            <h2>Deployment-specific cookies</h2>
+            <p>
+              This deployment may add additional cookies on top of the
+              framework's. See the full deployment policy at:
+            </p>
+            <p>
+              <a href={deploymentUrl} target="_blank" rel="noopener noreferrer">
+                {deploymentUrl}
+              </a>
+            </p>
+          </>
+        ) : null}
+
+        <p className="policy-footnote">
+          See also the <Link to="/privacy">privacy policy</Link>.
+        </p>
+      </article>
+    </div>
+  )
+}

frontend/src/pages/Privacy.jsx

@@ -0,0 +1,118 @@
+// Privacy.jsx — v0.13.0 / roadmap item #11 / SPEC §14.5.
+//
+// The framework's default privacy policy page. Reachable by anonymous
+// and authenticated viewers alike at `/privacy`. The text below is a
+// minimal stub that describes the framework's stance; deployments are
+// expected to override it via the `VITE_PRIVACY_POLICY_URL` env var.
+//
+// When `VITE_PRIVACY_POLICY_URL` is set:
+//   - http(s) URL → the page renders the framework's stub above a
+//     "Read the full deployment policy" link to the configured URL.
+//     We don't iframe-embed third-party policy hosts because their
+//     Content-Security-Policy frequently refuses framing; the link is
+//     the predictable affordance.
+//
+// The framework's stub is intentionally short — the rules that matter
+// to a user are: (1) what categories of cookies the app sets, (2) how
+// to change consent, (3) where to reach the deployment operator with a
+// complaint. Each deployment's content repo can carry a fuller version.
+
+import { useNavigate, Link } from 'react-router-dom'
+
+export default function Privacy() {
+  const navigate = useNavigate()
+  const deploymentUrl = (import.meta.env.VITE_PRIVACY_POLICY_URL || '').trim()
+  const appName = import.meta.env.VITE_APP_NAME || 'this deployment'
+
+  return (
+    <div className="policy-page">
+      <header className="policy-header">
+        <button
+          className="policy-back"
+          onClick={() => (history.length > 1 ? navigate(-1) : navigate('/'))}
+        >
+          ← Back
+        </button>
+        <span className="policy-title">Privacy policy</span>
+      </header>
+      <article className="policy-body">
+        <h1>Privacy policy</h1>
+        <p className="policy-subtitle">
+          What {appName} stores, why, and how to control it.
+        </p>
+
+        <h2>What we store</h2>
+        <p>
+          {appName} runs on the Wiggleverse RFC framework. The framework
+          stores the identity you sign in with (your Gitea login,
+          display name, email, and avatar URL), the proposals and edits
+          you author, the discussion threads you participate in, and
+          your notification preferences. Authoring is public by design —
+          this is a framework for public-async RFC work, and threads,
+          changes, and PRs are visible to anyone who reaches the
+          deployment. Settings (notification toggles, quiet hours, mute
+          list, cookie consent) are private to your account.
+        </p>
+
+        <h2>Cookies</h2>
+        <p>
+          The app sets a small set of cookies. The full list is on the{' '}
+          <Link to="/cookies">cookies policy page</Link>. You can choose
+          which categories you allow from the consent banner shown on
+          your first visit or from <Link to="/settings/notifications">
+          Settings &rarr; Privacy &amp; cookies</Link> any time
+          afterwards.
+        </p>
+
+        <h2>Analytics</h2>
+        <p>
+          The framework supports an optional anonymous analytics layer
+          gated behind your consent choice. As of v0.13.0 no analytics
+          SDK ships in the framework; deployments that enable analytics
+          do so via a later framework version (roadmap item #13). The
+          consent toggle exists today so the gate is already in place
+          when the SDK lands.
+        </p>
+
+        <h2>Your data, your control</h2>
+        <ul>
+          <li>Revoke cookie consent any time from settings.</li>
+          <li>
+            Edit notification preferences — including the global email
+            opt-out — from{' '}
+            <Link to="/settings/notifications">notification settings</Link>.
+          </li>
+          <li>
+            Your authored content (proposals, threads, edits) is public
+            and not retractable from the meta-repo's Git history. If you
+            need a redaction, reach the deployment operator directly.
+          </li>
+        </ul>
+
+        {deploymentUrl ? (
+          <>
+            <h2>Deployment-specific policy</h2>
+            <p>
+              This deployment may layer additional policy on top of the
+              framework's defaults. Read the full deployment policy at:
+            </p>
+            <p>
+              <a href={deploymentUrl} target="_blank" rel="noopener noreferrer">
+                {deploymentUrl}
+              </a>
+            </p>
+          </>
+        ) : (
+          <>
+            <h2>Deployment contact</h2>
+            <p>
+              For deployment-specific privacy questions — data subject
+              requests, redaction requests, complaints — contact the
+              operator of {appName}.
+            </p>
+          </>
+        )}
+      </article>
+    </div>
+  )
+}