RFC Review: Centralized Web Session — Hub FE Integration with mekari-account-web-sdk

Executive Summary

Overall Score: 7.8/10
Rating: Strong
RFC Type: frontend
Sub-Type: enhancement
Assessment Confidence: High
Applied Caps/Gates: FMC capped <7.0 (no error-message catalog / UI failure states for company-sync and forced sign-out). CNT cap lifted (was <7.0 pending the event-contract contradiction, OQ-4; now resolved against the real SDK — R13). No hard overall cap triggered — no category <5.0 (NFS sits exactly at 5.0 on unrelated a11y/perf gaps), fewer than 3 categories <7.0.
Implementation Readiness Verdict: HOLD (narrower than before) — Chunks 1, 2, 3, 5, 7 are agent-executable today behind the OFF toggle; Chunk 6 remains blocked by OQ-1/OQ-2 (both genuine, non-SDK, Hub-BE dependencies).
Report Path: /Users/mekari/Documents/hub/rfc-review-report.md
RFC Author: Syafrizal Muhammad | Reviewed: 2026-06-28 | Re-verified: 2026-07-02 (latest review SDK-source reconciliation)

Re-verification note (2026-07-02, latest review): The original review (2026-06-28) praised this RFC's "anti-hallucination rigor" because every Hub-repo claim in §2.0 cited a real file:line — but the §2.0 Source Verification table never independently checked the SDK's own source (mekari-account-web-sdk v0.3.0). As a result, the entire SDK contract the RFC was built on — package name (@mekari/sdk), CDN loading (account.mekari.com/sm/sdk.js), constructor option (current_user), callback signature ((data, error)), an event enum that included a fictional switch_user status, a consumer-managed msli heuristic, and an activity-refresh method (session.refresh()) — was fabricated. That is a correctness BLOCKER, not the "pending dependency" the original review filed it under (OQ-3/OQ-4). This review has been re-run after hub-fe.md was reconciled against the real SDK source; the scores below reflect the corrected document.

The corrected RFC is smaller and safer than the original: switch_user is gone (an account switch now correctly surfaces as logged_out), server_down is a simple fail-open no-op (no consumer-side msli heuristic), the SDK is a bundled git dependency (no CDN/CSP-script-src/env plumbing to build), and the previously-dangling event contract (Decision 7) is fully resolved. Two genuine, non-SDK blockers remain: OQ-1 (Hub BE current_company endpoint) and OQ-2 (centralized_session org-payload flag) — both correctly still open. A new, real, upstream security finding was surfaced in the process: the SDK does not validate event.origin on its window message listener (OQ-9) — Hub cannot mitigate this and it must be tracked with Account & Launchpad, not treated as a Hub-side gap.

Quick Verdict

Why this RFC can be implemented agentically:

File-by-file scope is exact (§2.0 Repo Map + Existing Code Anchors + §4.C ordered chunks with acceptance criteria) — agent knows precisely where to write and what "done" means per chunk.
Decisions are closed and reuse existing primitives (doSignOut(), $auth.logout, middleware/login.js redirect) with ADRs — minimal architectural guessing.
Rollback is numbered and flag-first (§4.D); toggle-OFF = byte-for-byte current behaviour, so blast radius is contained.
The SDK event contract (Decision 7) is now fully resolved against the real mekari-account-web-sdk v0.3.0 source — three statuses, single-arg callback, no error param, no switch_user — removing the single biggest source of handler-wiring guesswork from the original draft.

Why this RFC will still cause agent guessing or rework:

No error-message catalog and no UI failure states for the surfaces that remain (forced sign-out interstitial copy, company-sync loading/error states) — agent invents copy / ships blank states.
Company-sync endpoint does not exist (OQ-1) and flag not in payload (OQ-2) — Chunk 6 is uncodeable; agent must not start it.
The new event.origin finding (OQ-9) needs an owner at Account & Launchpad; left unassigned it risks being silently dropped.

PRD → RFC Traceability Matrix

Source "PRD" = the Account & Launchpad source RFC (Confluence, linked in frontmatter). Hub RFC is the consuming-squad slice.

Standard format (source RFC exists)

PRD Element (source RFC section)	RFC Section	Coverage
Overview / web + FE-app session bugs	§1.1	Full — Hub-scoped to web session, two concrete bugs named
Success Criteria	§1.2	Full — Hub subset; periodic re-validation cadence now defined via the SDK's `interval` option (was deferred as OQ-7, now moot)
Out of Scope	§1.3	Full — inherited + Hub-specific exclusions
Dependencies (SDK, Session Mgr, Redis, Kong)	§1.6, §2.0, §2.10	Full — marked upstream/READ-ONLY, ownership table
SDK usage / contract / events	§2.4, §2.6	Full — resolved. Canonical event names + payload schema now verified against `mekari-account-web-sdk` v0.3.0 (was Partial/OQ-4)
Local Storage `msli`	§2.5, ADR-6	Full — correctly reassigned as SDK-internal; Hub explicitly does NOT read/write it (R7; the original draft incorrectly modeled it as a Hub-owned heuristic)
Cookies `_mekari_account`	§2.0, §2.5, §3	Full — corrected to SM-service-side only; not observable by the SDK's client code or by Hub
OAuth2 Authorization Code Flow	§2.6, ADR-3	Full — mapped to existing `sso-callback`/`login`
Web Session (client_credentials) flow	`n/a`	Full — explicitly rejected in ADR-3 with reversibility note
User Logout / Switch Account	§2.6, §2.7	Full — mapped to `doSignOut`; account switch correctly modeled as `logged_out` (R5), not a separate flow
Database Model (no change)	§2.8	Full — FE-only, no schema
HA & Security	§3	Partial — Hub-side CSP/referrer (host corrected to `sm.mekari.com`) + obs; whitelist mechanics deferred (OQ-5/OQ-6); a new upstream `event.origin` finding is now tracked (OQ-9)
Rollout Plan	§4	Full — Hub = step 5 consumer
current-company sync (RFC decision)	§2.4, §5 OQ-1	No verified PRD/BE driver — endpoint does not exist; flagged critical; explicitly decoupled from the SDK (R10)

Summary: Most source-RFC elements are now fully covered; the SDK-contract and success-criteria-cadence rows moved from Partial to Full after the SDK reconciliation. Remaining Partial: HA & Security whitelist mechanics (OQ-5/OQ-6) plus the new OQ-9 finding. current-company sync remains the one RFC decision with no verified BE driver (OQ-1) — correctly still surfaced as open, and now explicitly decoupled from the SDK rather than framed as SDK-driven (R10).

Scorecard

Frontend Scorecard (11 categories)

Category	Score	Evidence-Based Rationale
PRT — PRD Traceability	`8.5`	§1.4 maps every source-RFC section bidirectionally; §2.0 Source Verification table now cross-checks both Hub-repo claims AND the SDK's own source (`mekari-account-web-sdk` v0.3.0) — the latter check was absent in the original pass.
TDC — Technical Decisions	`8.5`	6 ADRs (§2.3) each with Context/Options/Decision/Rationale/Consequences/Reversibility. ADR-2 and ADR-6 were rewritten after the SDK reconciliation (previously built on a fabricated CDN option and a fabricated `msli` heuristic). Only soft gap: ADR-3 reversibility ("Medium") not fully costed.
CNT — Contract Specificity	`8.0`	SDK contract (§2.4) is now fully specified against the real SDK: exact 3-value `status` enum, single-arg payload, no ambiguity (was 6.0, capped by the now-resolved OQ-4 contradiction). Still capped below 9: company-sync request/response shape is absent (OQ-1) and there is no error-message catalog (shared cap with FMC). `msli`/cookie contract (§2.5) is now correctly specified as SDK-internal, not Hub-owned.
SCB — Scope Boundaries	`9.0`	§2.0 Repo Map + Existing Code Anchors name every file with read/modify/new tag; §2.9 Branch & Skip Catalog; §2.10 cross-squad boundary. Removing the `switch_user` chunk left no orphaned scope references.
DEP — Dependencies	`8.5`	Every dep named with status (§2.4 tables, §1.6). Two of the four original SDK-side blockers are now resolved (OQ-3 package distribution, OQ-4 event contract); only the two genuine Hub-BE cross-squad deps remain open (OQ-1, OQ-2).
FMC — Failure Mode Coverage	`6.5`	`server_down` (§2.6 failure diagram, ADR-6) is now a single, unambiguous fail-open branch — simpler and more failure-safe than the original dual-branch `msli` heuristic. `logged_out` (incl. account-switch) covered with a simplified state machine (§2.7). Still capped <7.0: no error-message catalog (rubric caps), no UI error/empty/partial states for company-sync, re-auth-failure path (sso-callback failure) untraced.
NFS — Non-Functional Specificity	`5.0`	§3.1 perf is still qualitative ("must not block first paint"), no LCP/INP/bundle-delta numbers, no browser-support matrix. Security is the strong sub-part (§3.2 table, host now correctly `sm.mekari.com`) but carries a new open finding (OQ-9). The accessibility sub-part has shrunk to near-zero since `switch_user`'s toast (the RFC's only new UI surface) was removed — no longer the weakest sub-part, but perf/browser-matrix gaps still cap NFS at 5.0.
TPS — Test Plan Specificity	`7.0`	§1.7 + §4.C give per-chunk acceptance criteria as testable assertions ("toggle OFF ⇒ 0 SDK calls", "`server_down` ⇒ no sign-out call"). Missing: a11y tests, named E2E scenarios.
ROL — Rollout & Rollback	`8.5`	§4.A compat, §4.C ordered chunks, §4.D numbered agent-executable rollback (flag-first, host corrected to `sm.mekari.com`), post-deploy signals defined. Docked: stop-condition thresholds qualitative ("≈0", "no regression").
OBS — Observability	`8.0`	§3.3 names exact emitters: RUM action `centralized_session.<status>`, Mixpanel v2 for forced sign-outs (`switch_user` tracking removed along with the status itself), alert on `server_down` spike. Tied to existing `plugins/datadog-rum.ts`. Docked: no alert threshold number.
CPA — Pattern Alignment	`9.0`	§2.0 Patterns-to-Follow table maps each concern to a reference file (`plugins/hotjar.js` boot-registration pattern, EventBus `$on/$off` + beforeDestroy leak rule, org-payload flag, `doSignOut` reuse). ADR-2's "bundled git dependency" pattern is now honestly described instead of an invented CDN/npm dichotomy.

Decision Closure Assessment

Decision Index

#	Decision	Status	Critical Gaps
1	Load SDK from `InitComponent.vue` boot under `layouts/hub.vue`	Resolved	—
2	SDK installed as a bundled git dependency (`mekari-account-web-sdk`) — no CDN alternative	Resolved	— (was Partial, blocked on a fabricated registry-publish requirement, OQ-3; resolved)
3	Hub follows OAuth2 Authorization-Code flow	Resolved	reversibility cost to client_credentials only sketched
4	Flag source = `organization.feature_flag.centralized_session`	Partial	flag not yet in org payload (OQ-2)
5	Reuse existing auth primitives for event handling	Resolved	—
6	`server_down` → fail-open (no action taken)	Resolved	— (was Resolved-but-wrong: the original `msli` heuristic required Hub to touch an SDK-internal key, R7)
7	SDK event contract (names + payload)	Resolved	— (was Dangling; resolved against `mekari-account-web-sdk` v0.3.0)

Aggregate: 6 Resolved, 1 Partial, 0 Dangling

Decision: 7 — SDK event contract (names + payload shape)

Status: Resolved

What was decided

The canonical SDK contract is verified against mekari-account-web-sdk v0.3.0 (session.ts, README.md): Status is EXACTLY logged_in | logged_out | server_down; the on('event', ...) callback is single-argument (data: EventData) with no second error parameter; there is no switch_user status — an account switch surfaces as logged_out and the incoming user's ssoId is never exposed to the consumer.

Alternatives considered

N/A — this is a verified fact about a third-party dependency, not a Hub design choice.

Grounding in existing code

Grounded directly in the SDK's own source rather than inference from the source RFC's self-contradictory sample code. §2.4 of hub-fe.md now cites this explicitly.

Interface specification

Complete: EventData = { status, sessionId? }; statuses enumerated; single-arg callback; no error object; no company data exposed by the SDK.

Failure handling

No longer an open question — there is no error branch to specify.

Challenge results

Scale: N/A (event-driven, one iframe per shell).
Reversibility: N/A — upstream fact, not a Hub decision.
Consistency: Internally consistent; matches §2.6/§2.7 after the rewrite.
Agent implementability: Yes — handlers can be written directly against the 3-value enum with no guessing.

Gaps and suggestions

Missing: nothing on the SDK-contract side. Remaining gap (unrelated to the SDK): no error-message/UI-copy catalog for the forced sign-out and company-sync loading/error states (see FMC, UI State Audit). Suggested resolution: none needed for the contract itself; see Priority Actions for the UI-copy gap. Open questions for the author: none — OQ-4 is resolved.

Decision: 2 — SDK installed as a bundled git dependency

Status: Resolved

What was decided

ADR-2 (rewritten): the SDK, mekari-account-web-sdk, is a bundled git dependency (npm install git+https://...#<version>) — there is no CDN, no npm-registry package, and therefore no real "npm vs CDN" choice to make. The original ADR-2 (npm import vs <script src> vs both) was based on a fabricated npm-registry package name and a fabricated CDN URL — both have been removed.

Alternatives considered

None — collapsed to the sole real distribution mechanism (R2). The original "(b) <script src>" and "(c) both" options no longer apply; there is nothing to allow-list in CSP script-src for the SDK itself.

Grounding in existing code

Grounded: plugins/hotjar.js:1-3 (boot-plugin pattern reused for registration only, not for loading the SDK itself), package.json:34-60 (SDK absent → confirmed new, now correctly named).

Interface specification

Import shape import { Session } from 'mekari-account-web-sdk'; constructor new Session({ currentUser }) — corrected from the fabricated current_user.

Failure handling

Dynamic-import failure (git/network) should still no-op behind the toggle — unchanged advice from the original review, now applied to a real dependency.

Challenge results

Scale: fine.
Reversibility: High.
Consistency: consistent with lazy-load discipline.
Agent implementability: Yes — no publish/registry blocker; add as a git dependency directly (previously blocked on a non-existent registry, OQ-3, now resolved).

Gaps and suggestions

Missing: version/tag pin for the git dependency; import-failure branch. Suggested resolution: Pin to a specific SDK version tag in package.json; wrap the dynamic import() in try/catch → RUM warn → treat as toggle-OFF. Open questions: none blocking (OQ-3 resolved).

Decision: 6 — `server_down` fallback

Status: Resolved

What was decided

ADR-6 (rewritten): fail-open. On server_down, Hub takes no action — no sign-out, no company change. The original ADR-6 (msli heuristic then sign-out) required Hub to read/write the SDK's own internally-owned msli key, which would corrupt the SDK's own fallback (R7) — that was a correctness blocker, not a refinement, and has been removed.

Alternatives considered

(a) immediate sign-out; (b) consumer-side msli heuristic then sign-out (the original, now-removed decision); (c) fail-open (chosen). PRD constraint 6.10 mandates fail-open directly.

Grounding in existing code

No Hub-side helper is needed; the SDK owns msli and its own checkTimeout-based (default 2000ms) internal fallback before ever emitting server_down.

Interface specification

Fully specified — a no-op branch requires no further contract.

Failure handling

This decision is the failure handling — a single branch, no state to validate.

Challenge results

Reversibility: High.
Consistency: consistent with the simplified state machine §2.7 (self-loop on server_down).
Agent implementability: Yes — simpler than the original (no qontak._token.hub validity predicate needed).

Gaps and suggestions

Missing: nothing blocking. Suggested resolution: n/a. Open questions: none.

(ADR-1, ADR-3, ADR-4, ADR-5 assessed Resolved/Partial as in the Decision Index; abbreviated per >=7.0 optimization — ADR-1 additionally now documents the SDK's singleton destroy() teardown requirement, R11.)

UI State Audit

Behavioural FE change. Removing switch_user also removed the RFC's one bespoke user-visible surface (the "account changed" toast); the remaining surfaces reuse existing Hub UI.

Component / Surface	Loading	Empty	Error	Partial	Success	Assessment
Sign-out redirect (`logged_out`, incl. account-switch case)	n/a	n/a	missing	n/a	defined (§2.6)	reuses the existing `doSignOut()` interstitial (unchanged from today's behaviour) — no new copy needed since no new UI surface is introduced
`server_down` fail-open	n/a	n/a	n/a	n/a	defined (no-op, §2.6)	trivially covered — the "state" is simply no visible change
Company-sync on `logged_in`	missing	missing	missing	missing	partial (§2.6)	blocked by OQ-1; states undefined

Summary: Removing switch_user genuinely shrinks the UI-state gap (no more toast copy / re-auth-redirect interstitial to specify). Company-sync states remain undefined pending OQ-1.

Performance Budget Check

Metric	Target	Current Baseline	Source	Assessment
LCP / INP / CLS	not stated	not stated	—	missing — §3.1 only says "must not block first paint"
Bundle size delta	not stated	—	—	missing — `mekari-account-web-sdk` size impact not quantified
iframe load impact	"lazy after `$auth.loggedIn`"	—	§3.1	vague — qualitative only

NO NUMERIC PERFORMANCE BUDGET — acceptable-ish for an enhancement (perf is not the goal) but bundle-delta of a new dependency should be bounded. Agent cannot assert a regression gate. (Unaffected by the SDK-contract correction.)

Accessibility Review

Aspect	Specified?	Details	Assessment
Keyboard navigation flow	n/a	no new UI surface — `switch_user` toast removed (R5)	n/a
Focus management	n/a	redirect-only, reuses existing `doSignOut()`	n/a
ARIA labels	n/a	—	n/a
Heading hierarchy	n/a	no new page	n/a
Color contrast	n/a	no new UI surface	n/a
Motion sensitivity	n/a	—	n/a
Screen reader behavior	no	forced sign-out reuses the existing `doSignOut()` redirect	unstated whether the existing flow announces itself — a pre-existing gap, not introduced by this RFC

A11y surface for this RFC has shrunk to near-zero now that the switch_user toast (the RFC's only new visible UI) is removed. This was previously the weakest non-functional sub-part; it no longer drives the NFS score, which remains capped by the unrelated perf/browser-matrix gaps.

Pattern Alignment Check

Pattern	RFC Approach	Assessment
Third-party SDK boot	follows `plugins/hotjar.js` registration pattern; SDK itself is a bundled git dependency, not a runtime script (ADR-2, corrected)	aligned (§2.0)
State management / flags	follows org-payload `feature_flag` getter, `v-if` not `v-show`	aligned (ADR-4, AGENTS.md)
Decoupled events	follows EventBus `$on/$off` + `beforeDestroy` cleanup	aligned, leak rule cited
Sign-out	reuses `doSignOut()` — no re-implement	aligned (ADR-5)
postMessage	intentionally NOT adding a wildcard listener; keeps separate from `sso-callback.js:24`	aligned + security-aware
Analytics	Mixpanel v2 mixin (not legacy)	aligned (AGENTS.md)
SDK lifecycle	singleton-aware teardown via `session.destroy()`, not `.off()` alone (R11)	aligned, newly documented in ADR-1

No parallel-system risk detected; strongest dimension of the RFC.

Agentic Readiness Deep-Dive

Vague Word Audit

#	Word/Phrase	Location	Impact	Concrete Replacement
1	"must not block first paint"	§3.1	agent has no measurable gate	"SDK `import()` deferred until after `$auth.loggedIn`; route render never awaits it (assert in test)"
2	"server_down rate ≈ 0"	§4.D	no alert threshold	">N events/5min for company → page on-call"
3	"token still valid" (ADR-6, historical)	—	now moot — ADR-6 is fail-open and no longer checks token validity	n/a — resolved by removing the check entirely

Total vague words remaining in spec sections: 2 (item 3 above is now resolved, not merely replaced).

Dangling Alternatives

Total dangling alternatives: 0 (the previous logout vs logged_out contradiction, §2.4/OQ-4, is resolved).

Task Decomposition Assessment

Chunk	Acceptance Criteria	Assessment
1 Toggle plumbing	getter returns false when flag absent	verifiable
2 SDK boot + mixin	ON+sso_id ⇒ `Session` constructed; OFF ⇒ 0 calls	verifiable — no longer blocked (OQ-3 resolved; plain git dependency)
3 Boot wire + logged_out/logged_in	`logged_out` ⇒ 1 emit; `logged_in` handled (no `msli` write, R7)	verifiable — event contract resolved (OQ-4)
5 server_down	fail-open — asserts no-op	verifiable, simpler than the original dual-branch design
6 company sync	sync action dispatched, sets company	blocked OQ-1/OQ-2 — not startable
7 observability	each event emits mocked RUM action	verifiable

Decomposition is explicit, ordered, and dependency-aware (§4.C order rationale) — removing the fictional switch_user chunk (previously #4) further reduces risk; the chunk-number gap is intentional (R5), not an error.

Strengths

Anti-hallucination rigor, corrected (§2.0 Source Verification): every Hub-repo structural claim is mapped to a file:line; after this reconciliation, the SDK contract itself is also grounded directly in the SDK's own source (mekari-account-web-sdk v0.3.0) rather than the source RFC's self-contradictory sample — the one blind spot in the original review is now closed.
Closed, reuse-first decisions (§2.3 ADRs + ADR-5): event handling routes through existing doSignOut()/$auth.logout/middleware/login redirect, minimizing new surface and leak risk; EventBus cleanup rule honored; ADR-1 now also documents the SDK's singleton destroy() teardown requirement (R11).
Executable rollout/rollback (§4.C/§4.D): ordered chunks with per-chunk acceptance criteria and a numbered flag-first rollback recipe; toggle-OFF = byte-for-byte current behaviour bounds blast radius.
Smaller, safer scope after correction: removing switch_user, session.refresh(), and consumer-side msli cut real implementation risk (net task-breakdown effort dropped) without losing any of the RFC's actual success criteria.

Biggest Gaps

~~SDK event contract unresolved (OQ-4)~~ RESOLVED — see Decision 7. Retained here only as a historical marker of the original review's blind spot.
Two remaining genuine upstream blockers (OQ-1 BE endpoint, OQ-2 org flag): without OQ-2 the feature is permanently inert; without OQ-1 Chunk 6 is uncodeable. RFC honestly flags these and they gate real execution.
New security finding (OQ-9): the SDK does not validate event.origin on its window message listener. This is an upstream Account & Launchpad issue Hub cannot fix client-side, but it must be tracked, not silently accepted.
Missing error-message catalog + a11y/perf numbers (§3.1/§3.2): no user-facing copy mapping for forced sign-out or company-sync states, no bundle-delta/LCP budget, no browser-support matrix → caps CNT ceiling and FMC; the a11y surface itself has shrunk since switch_user's toast was removed.

Priority Actions

OQ-1 / OQ-2 — Get written commitments + dates: BE current_company contract, centralized_session in org payload. Until then scope the first agent run to Chunks 1, 2, 3, 5, 7 and mark Chunk 6 "do not start".
§3.2 + FMC — Add an error-message catalog: for forced sign-out and company-sync loading/error states, give exact i18n keys/strings. Lifts FMC above 7.0.
OQ-9 — File the event.origin-validation gap with Account & Launchpad / Infosec as a tracked upstream security item (OWASP A08/A07); do not let it sit as an unassigned "confirm" question.
§3.1 NFS — Quantify a bundle-size delta budget for mekari-account-web-sdk and add a browser-support line.

Implementation Readiness Checklist

Unblocked (agent can proceed — Chunks 1, 2, 3, 5, 7 behind OFF toggle)

Blocked (must fix first)

OQ-2 — centralized_session in org payload (feature inert otherwise)
OQ-1 — Hub BE current-company endpoint contract (blocks Chunk 6)

Tracked, non-blocking for Hub

OQ-9 — event.origin validation gap needs an owner at Account & Launchpad (not Hub-fixable, but must not be dropped)

Verdict: Fix 2 blockers first (down from 4) — Chunks 1, 2, 3, 5, 7 implementable today; full enablement and Chunk 6 gated.

Task Manifest

Verifying the RFC's own §4.C decomposition. It is sound; reproduced with reviewer dependency annotations. The chunk-number gap at 4 is intentional — the switch_user chunk was removed per R5, not renumbered, to preserve traceability.

Order	Chunk	Files to Create/Modify	Acceptance Criteria	Dependencies
1	Toggle plumbing	`store/organization.js` (confirm getter), mixin computed	getter returns `false` when `centralized_session` absent	None
2	SDK boot plugin + mixin (TDD)	new `plugins/centralized-session.js`, `assets/mixins/session/centralizedSession.js` + `__test__/centralizedSession.spec.js`; modify `package.json`, `nuxt.config.js:84`	toggle ON+sso_id ⇒ `Session` constructed with `currentUser`; OFF ⇒ 0 calls	None (OQ-3 resolved — git dependency, no publish/registry needed)
3	Wire boot + logged_out/logged_in	modify `components/layouts/main/InitComponent.vue`	`logged_out` ⇒ 1× `EventBus.$emit('user-sign-out')`; `logged_in` handled (no `msli` write, R7)	Chunk 2
5	server_down fail-open	mixin handler	`server_down` ⇒ no `doSignOut`/`EventBus.$emit` call (assert no-op)	Chunk 3
6	company sync	`common/constants/endpoint.js` (register key), store action	`logged_in` ⇒ sync dispatched; sets company	BLOCKED OQ-1/OQ-2
7	observability	mixin RUM/Mixpanel calls	each event emits mocked RUM action	Chunks 3, 5

Dangling Decisions Log

#	Decision	Location	Owner	Deadline
1	current-company BE contract (`/me/current_company`)	§2.4 / OQ-1	Hub BE	before Chunk 6
2	`centralized_session` org-payload flag	ADR-4 / OQ-2	Hub BE	before enablement
3	`event.origin` validation gap (upstream infosec finding)	§3.2 / OQ-9	A&L / Infosec	before Infosec approval / full rollout

Open Questions

#	Question	Category	Severity
1	Confirmed BE current-company endpoint contract?	PRT/CNT	Blocking
2	When does `centralized_session` enter org payload?	ROL/DEP	Blocking
3	Hub prod domain(s) for SM (`sm.mekari.com`) frame-ancestors/referrer whitelist?	NFS (security)	Important
4	Hub current CSP source (header vs meta) + edit location for `sm.mekari.com`?	NFS (security)	Important
5	Infosec approver name + Slack discussion thread (metadata `[REQUIRED]`)?	Governance	Important
6	Who at Account & Launchpad owns remediation/acceptance of the `event.origin` validation gap (OQ-9)?	Security	Important

Evidence Notes

§2.0 Source Verification table — strong evidence for Hub-repo claims; the original pass did NOT include an independent SDK-source check, which is why the fabricated SDK contract went undetected (see re-verification note above). The table now includes an explicit mekari-account-web-sdk v0.3.0 verification row. Raised PRT, SCB, CPA.
§2.3 ADRs — closed decisions with reversibility; ADR-2 and ADR-6 were rewritten after the SDK reconciliation (previously based on fabricated CDN/msli-heuristic facts); TDC holds at 8.5, CNT raised to 8.0 now that Decision 7 (event contract) is Resolved.
§2.4 SDK contract — now fully specified against the real SDK source; the previous logout/logged_out self-contradiction is gone. Remaining CNT/FMC caps are due to the (unrelated) missing error-message catalog and the still-open company-sync contract (OQ-1).
§3 HA & Security — security sub-table solid and host-corrected (sm.mekari.com); a new tracked upstream finding (OQ-9) is now recorded instead of the false "SDK validates origin" claim. The a11y sub-part improved (smaller UI surface after switch_user removal) but absence of perf numbers and a browser matrix still pins NFS at 5.0.
§4.C/§4.D — per-chunk acceptance + numbered rollback; raised TPS, ROL, OBS.
§5 Open Questions + §7 gate — corroborates a narrower HOLD verdict: 2 blockers remain (OQ-1/OQ-2), down from the original 3 (OQ-1/OQ-2/OQ-3), and Chunks 1, 2, 3, 5, 7 are executable today.

Executive Summary​

Quick Verdict​

PRD → RFC Traceability Matrix​

Standard format (source RFC exists)​

Scorecard​

Frontend Scorecard (11 categories)​

Decision Closure Assessment​

Decision Index​

Decision: 7 — SDK event contract (names + payload shape)​

What was decided​

Alternatives considered​

Grounding in existing code​

Interface specification​

Failure handling​

Challenge results​

Gaps and suggestions​

Decision: 2 — SDK installed as a bundled git dependency​

What was decided​

Alternatives considered​

Grounding in existing code​

Interface specification​

Failure handling​

Challenge results​

Gaps and suggestions​

Decision: 6 — server_down fallback​

What was decided​

Alternatives considered​

Grounding in existing code​

Interface specification​

Failure handling​

Challenge results​

Gaps and suggestions​

UI State Audit​

Performance Budget Check​

Accessibility Review​

Pattern Alignment Check​

Agentic Readiness Deep-Dive​

Vague Word Audit​

Dangling Alternatives​

Task Decomposition Assessment​

Strengths​

Biggest Gaps​

Priority Actions​

Implementation Readiness Checklist​

Unblocked (agent can proceed — Chunks 1, 2, 3, 5, 7 behind OFF toggle)​

Blocked (must fix first)​

Tracked, non-blocking for Hub​

Task Manifest​

Dangling Decisions Log​

Open Questions​

Evidence Notes​

Executive Summary

Quick Verdict

PRD → RFC Traceability Matrix

Standard format (source RFC exists)

Scorecard

Frontend Scorecard (11 categories)

Decision Closure Assessment

Decision Index

Decision: 7 — SDK event contract (names + payload shape)

What was decided

Alternatives considered

Grounding in existing code

Interface specification

Failure handling

Challenge results

Gaps and suggestions

Decision: 2 — SDK installed as a bundled git dependency

What was decided

Alternatives considered

Grounding in existing code

Interface specification

Failure handling

Challenge results

Gaps and suggestions

Decision: 6 — `server_down` fallback

What was decided

Alternatives considered

Grounding in existing code

Interface specification

Failure handling

Challenge results

Gaps and suggestions

UI State Audit

Performance Budget Check

Accessibility Review

Pattern Alignment Check

Agentic Readiness Deep-Dive

Vague Word Audit

Dangling Alternatives

Task Decomposition Assessment

Strengths

Biggest Gaps

Priority Actions

Implementation Readiness Checklist

Unblocked (agent can proceed — Chunks 1, 2, 3, 5, 7 behind OFF toggle)

Blocked (must fix first)

Tracked, non-blocking for Hub

Task Manifest

Dangling Decisions Log

Open Questions

Evidence Notes