# Current work

- Active feature: none (idle)
- Last closed: F-005 — Identity: register, login, sessions
- Next suggested: F-006 — Users: profile, addresses, RBAC (depends on F-005, satisfied)
- Runtime status: reset via scripts/agent_status.py
- verify.sh: green at close

## F-005 closure notes
- Identity module hexagonal: domain/application/infrastructure/api under src/modules/identity
- Sessions server-side: cookie carries opaque 512-bit token; identity_sessions stores only SHA-256 hash
- argon2id (OWASP params) behind PasswordHasher port; timing equalized 401 (no enumeration)
- Rate limit: 10 consecutive failures per email -> 429 + Retry-After (15 min cooldown), in-memory behind interface
- Cookie: HttpOnly + Secure (COOKIE_SECURE, default true) + SameSite=Lax
- Migration 002_identity reversible; integration suite updated for full revert (count:0)
- Gates: reviewer/security/qa APPROVED. Commits include specs, artifacts, code, docs.