Project Control — doc-control

Continue prompt

{
  "project": "doc-control",
  "mission": "Maintain and operate the live production Document Control web application (PocketBase 0.23 + rclone rcd sidecar on port 3002 with public Tailscale Funnel endpoint) and prepare for future decoupled Phase 4 project-registry integration with sms-finance.",
  "read_first": [
    "/data/vault/wiki/projects/doc-control.md",
    "/data/vault/wiki/patterns/PocketBase JSVM Patterns.md",
    "/data/vault/wiki/hot.md",
    "/data/vault/wiki/log.md",
    "/data/vault/wiki/projects/sms-finance-prd.md",
    "output/census-latest.json"
  ],
  "verification_anchor": {
    "command": "curl -s http://192.168.1.201:3002/api/health && echo '' && docker ps --filter \"name=doc-control\" --format \"table {{.Names}}\t{{.Status}}\t{{.Ports}}\"",
    "expect": "{\"message\":\"API is healthy.\",\"code\":200,\"data\":{}} and 3 active containers: doc-control (Up on port 3002->8090), doc-control-rclone (Up), and ts-doc-control (Up, Tailscale Funnel at https://doc-control.tail7c7b6e.ts.net)"
  },
  "project_context": {
    "what_it_is": "Doc-Control is an internal document approval workflow web application for SMS IT projects, running on VM101 via PocketBase 0.23 with a Vite/React SPA frontend, rclone rcd sidecar, and Microsoft Graph / OneDrive Personal cloud storage.",
    "domain_notes": "Implements a multi-tier approval chain requiring approval from 2 users + 1 PM, or admin/BoD bypass. Approvals attach to document_versions (not documents), and revisions reset status to pending_approval. Upon threshold approval, a PocketBase JS hook transfers files to OneDrive (/DocControl/<project>/submit/) via Microsoft Graph API device-code flow, with all state changes logged to audit_log. VM101 stores zero file binaries long-term (short transit only); SQLite on host holds metadata only. The app is publicly exposed via Tailscale Funnel at https://doc-control.tail7c7b6e.ts.net and internally at http://192.168.1.201:3002."
  },
  "tech_stack": {
    "runtime": "PocketBase 0.23 (Go binary with Goja JSVM runtime for server-side hooks), SQLite",
    "frontend": "Vite + React SPA (built into pb_public/ and served directly by PocketBase)",
    "storage_sync": "Microsoft Graph API (OneDrive Personal/Family via device-code flow) + rclone rcd sidecar container (with Cloudflare R2 / Backblaze B2 as S3 fallback)",
    "auth": "PocketBase email/password authentication (roles: user, pm, admin, bod) with graph_connection collection for token storage",
    "infrastructure": "Docker (containers: doc-control, doc-control-rclone, ts-doc-control), Tailscale Funnel (https://doc-control.tail7c7b6e.ts.net)"
  },
  "current_state": {
    "summary": "Production system is FULLY WORKING and actively serving since 2026-07-20 (smoke test 6/6 passed). All 3 containers (doc-control, doc-control-rclone, ts-doc-control) are healthy on VM101. Active WAL writes logged on 2026-08-25T03:00:01Z at /opt/doc-control/data/data.db-wal. Public access established on 2026-08-25 via Tailscale Funnel. Codebase hosted in Gitea repo SINERGI/doc-control-clean (updated 2026-08-19).",
    "source_of_this_status": "output/census-latest.json (containers, opt_deployments, gitea_repos) + vault pages /data/vault/wiki/projects/doc-control.md, /data/vault/wiki/hot.md, and /data/vault/wiki/log.md (§2026-08-25)"
  },
  "repo_locations": {
    "gitea_remote": "http://localhost:3001/SINERGI/doc-control-clean.git (internal Gitea repo, 1,277 KB, default branch main, updated 2026-08-19T18:45:52Z; historical URL http://10.241.131.219:3000)",
    "vm101_deployment": "/opt/doc-control (untracked production deployment directory on VM101 host containing data/ SQLite metadata and PocketBase runtime)",
    "local_clone": "none (no working tree clone exists currently in /data/project or sandbox shared mount; clone from Gitea if codebase modifications are needed)",
    "windows_local_config": "C:\\Users\\dimas\\OneDrive - Business\\SMS\\Internal\\server\\doc-control\\"
  },
  "key_files": {
    "doc-control/architecture_plan.md": "Master architecture document covering complete schema, Microsoft Graph API endpoints, PB JS hook specs, and development plan",
    "doc-control/docker-compose.yml": "Docker Compose definition for doc-control PocketBase service and rclone sidecar on port 3002",
    "doc-control/.env": "Environment configuration file containing GRAPH_CLIENT_ID for personal MSA OAuth",
    "/data/vault/wiki/projects/doc-control.md": "Obsidian project wiki page detailing system architecture, OneDrive setup, approval workflow, and operational status",
    "/data/vault/wiki/patterns/PocketBase JSVM Patterns.md": "Pattern documentation for PocketBase Goja JSVM hook gotchas (naming rules, callback scope, rclone parameters)",
    "/opt/doc-control/data/data.db": "Production SQLite database on VM101 storing collection records, audit logs, and graph_connection tokens",
    "C:\\pjt2-scada\\doc_control_deploy_hooks.py": "Windows deployment automation script used to deploy PocketBase JavaScript hooks to VM101"
  },
  "next_steps": [
    "Monitor continuous production health across doc-control, doc-control-rclone, and ts-doc-control containers on VM101.",
    "Ensure proactive token refreshes for the Microsoft Graph OneDrive integration via the nightly PocketBase cron job.",
    "Track progress on sms-finance Phases 1-3 to prepare for the decoupled Phase 4 doc-control integration (adding project_id dropdown wired to sms-finance project API).",
    "If local development or hook modification is required, clone SINERGI/doc-control-clean from Gitea into /data/project/doc-control and follow PocketBase JSVM patterns (*.pb.js naming, local helper scoping)."
  ],
  "constraints": [
    "Never run `docker prune` on VM101 — 13 production SCADA and service containers are co-tenant on the host.",
    "Zero local file storage invariant on VM101: all document binary payload files must reside in OneDrive (or fallback S3/R2/B2); VM101 only holds SQLite metadata and transient transit bytes.",
    "Tailscale Funnel rule: `ts-doc-control` must proxy to the host LAN IP `http://192.168.1.201:3002` (never localhost/127.0.0.1 within the container).",
    "Public Funnel policy: The PocketBase admin UI (`/_/`) is intentionally left exposed on `https://doc-control.tail7c7b6e.ts.net` per explicit user decision (2026-08-25) — do not attempt to block or modify funnel paths.",
    "Do not delete or overwrite the Tailscale funnel serve configuration on `ts-doc-control` (shared mutable infrastructure across sandboxes).",
    "Decoupled integration boundary: Do not modify doc-control for sms-finance project registry integration until sms-finance Phases 1-3 are verified and stable in production (Phase 4 is strictly decoupled).",
    "PocketBase JSVM constraints: Hooks must be named `*.pb.js`, helper functions must be scoped within each callback (Goja fresh runtime per hook), and `$security.base64Encode` / `btoa` are not supported."
  ],
  "known_staleness_warning": "The doc-control.md vault page contains an outdated Web UI reference to ZeroTier IP http://10.241.131.219:3002 (Proxmox host IP), which was superseded on 2026-08-25 by VM101 LAN IP http://192.168.1.201:3002 and the live Tailscale Funnel endpoint https://doc-control.tail7c7b6e.ts.net. Additionally, older sections mention Gitea on port 3000 (currently mapped to port 3001 on the VM101 host).",
  "handoff_metadata": {
    "created": "2026-08-25",
    "created_by": "project-control automated continue-prompt generator",
    "all_facts_sourced_from": "census-latest.json + /data/vault/wiki/projects/doc-control.md + /data/vault/wiki/patterns/PocketBase JSVM Patterns.md + /data/vault/wiki/hot.md + /data/vault/wiki/log.md + /data/vault/wiki/projects/sms-finance-prd.md"
  }
}

Detail

Observed Signals

Containers: doc-control (spectado/pocketbase:latest, Up 6 days, port 0.0.0.0:3002->8090/tcp), doc-control-rclone (rclone/rclone:latest, Up 6 days), ts-doc-control (tailscale/tailscale:latest, Up 2 hours).
Deployments: /opt/doc-control (last_touched_iso: 2026-08-25T03:00:01.206594+00:00, active file: data/data.db-wal).
Git Repos & Local Clones: Remote Gitea repository SINERGI/doc-control-clean (1,277 KB, updated_at: 2026-08-19T18:45:52Z). No local clone on VM101 shared disk.
Vault Documentation: doc-control.md (status: active, updated 2026-08-25).

1. What's Left

Ongoing production operation of document approval workflows, maintaining automated OneDrive synchronization via Microsoft Graph device-code flow and rclone rcd sidecar, and preparing for future decoupled Phase 4 project registry integration with sms-finance. Specific feature backlog cannot be observed from commits due to absence of a local git tracking clone on VM101.

2. Continue / Drop Suggestion

Continue — Stable production deployment in active daily operational use with same-day database WAL activity, healthy cloud sync containers, and updated documentation.

3. Dynamic Milestone Estimate

Delivery Window: 1–2 weeks (early September 2026) for routine operational sync verification and token refresh maintenance.
Confidence: Medium (controller estimate, revised 2026-08-25; active production deployment and vault update today, but no local git commit stream).