---
id: workspace-dashboard/003
title: Authenticated control surface, separate from the public static build
epic: workspace-dashboard
state: backlog
priority: 2
blocked_by: ["workspace-dashboard/001"]
estimate: L
created: 2026-08-05
updated: 2026-08-05
claimed_by: null
claimed_at: null
delivers: []
review_artifact: null
---

## What to do

Build the authenticated surface for submitting tasks, editing status, and triggering agent runs — per `overview.md`'s constraint 1 (split read from write). Must be genuinely server-side auth; the current site is a static bundle with no such thing.

## Definition of done

A working control surface reachable only by Kris, entirely separate from the public static site. Default assumption for auth unless something concrete argues otherwise: GitHub OAuth restricted to Kris's own account — no new credential to create or leak, and GitHub is already this project's identity anchor. State whatever assumption is actually made explicitly.

## Where the work lands

`site/` in this workspace repo, likely needing something beyond static hosting.

## Docs to read first

`overview.md` constraints 1 and 3 (split read/write; files stay canonical — this surface still reads/writes the same markdown, it doesn't become a second data store).

> **Superseded (2026-09-03):** this intent now lives in `building-the-game` (sign-in: 003; agent kickoff: 005). Left in backlog as a record.

> **Superseded (2026-09-03):** this intent now lives in `building-the-game` (sign-in: 003; agent kickoff: 005). Left in backlog as a record.