update ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md

ecomm/0022/SESSION-0022.0-TRANSCRIPT-2026-06-10T10-12--INPROGRESS.md

@@ -12,7 +12,34 @@
 
 ## Launch prompt
 
-_(launch prompt not captured at claim time)_
+`/goal Implement SLICE-2 (identity) of SD-0001 v0.3.0 — accounts domain (email +
+one-time-code request-code/verify per INV-2/INV-3, signed-cookie sessions,
+/api/auth/me + logout), platform/mailer port with LogMailer, Landing + Sign-in
+screens, entry routing with storefront hard-wired null — per SD-0001 §7.2 (SLICE-2)`
+
+## Plan
+
+> Anchor: design `wiggleverse-ecomm-content/specs/SD-0001-mvp-sign-up-and-single-storefront.md`
+> (v0.3.0, status `graduated` — R2a eligible; plan-eligibility gate passes).
+
+**SLICE-2 — Identity** (SD-0001 §7.2). Builds on the SLICE-1 walking skeleton
+(merged to `origin/main` @ 9373177). Branch: `slice-2-identity` off `main`.
+
+Ships:
+- `accounts` domain — request-code / verify / sessions / `/me` / logout
+  (§6.4–6.5), enforcing INV-2 (email canonical key) and INV-3 (OTC handled like
+  a secret: hashed, 10-min expiry, single-use, ≤5 attempts, 60s resend cooldown).
+- `platform/mailer` port (`send(to, subject, body)`) with `LogMailer` adapter.
+- `platform/session` — signed HTTP-only cookie sessions (server secret from
+  config, INV-8; no session table, §6.2).
+- REST BFF auth endpoints in `main.py`: `POST /api/auth/request-code`,
+  `POST /api/auth/verify`, `GET /api/auth/me`, `POST /api/auth/logout`.
+- Frontend: Landing + Sign-in (two-step) screens, entry-routing rule with
+  `storefront` hard-wired `null` (storefronts land in SLICE-3).
+
+DoD: BUC-1/BUC-2 acceptance end-to-end on localhost; scenario tests for
+14.01.0001–0004, 0009–0011, PUC-2a/b/c, PUC-9; INV-2/INV-3 invariant tests;
+no-enumeration uniform-204 asserted. `scripts/check.sh` green; merge + version bump.
 
 ## Deferred decisions