# Current work

- Active feature: none (idle)
- Last closed: F-006 — Users: profile, addresses, RBAC
- Next suggested: F-007 — check `backlog/features.json` for the first `pending` ticket whose dependencies are satisfied
- Runtime status: reset via scripts/agent_status.py
- verify.sh: green at close

## F-006 closure notes
- Users module hexagonal: profile + address CRUD behind use cases; tables `users_profiles`, `users_addresses`
- Roles customer/admin on `identity_users` (migration 003); role resolved from DB on every request
- Shared auth contract (`src/shared/auth.ts`): `Authenticate`, `requireRole`, `requireOwnerOrAdmin` — users never imports identity; composition root injects the authenticator
- Authorization runs before existence checks (403 first, no enumeration); address SQL scoped by user_id
- `@fastify/cookie` registered once at app root (cross-module infrastructure)
- No new npm dependencies; README documents endpoint table, access rules, and new auth codes (UNAUTHORIZED/FORBIDDEN)
- Gates: reviewer/security/qa APPROVED. Tests: unit 52, integration 22 (PostgreSQL 16)