---
title: private-ops Phase 0 — Complete
type: project
tags: [private-ops, phase-0, milestone]
date: 2026-05-14
status: complete
related: [[CONTEXT]], [[features-map]], [[infrastructure-decisions]]
description: Phase 0 abgeschlossen 2026-05-14. 3 PRs gemerged. Foundation steht. Phase 1 Account-Setup-Pre-Reqs für Kais.
---

# private-ops — Phase 0 Complete (2026-05-14)

## Was steht

**3 PRs gemerged in 2 Stunden:**

| PR | Branch | Inhalt | Commit |
|---|---|---|---|
| #1 | `feat/scaffold-and-tooling` | pnpm workspace + Next 16.2.6 + Vitest + ESLint + Prettier + dependabot + 8 CI-Workflow-Bug-Fixes | `31c260b` |
| #9 | `spec/fix-drifts-and-features` | 8 Spec-Drift-Fixes + 11-FEATURES.md intake + Q-31..38 in 10-OPEN-QUESTIONS | `d633a15` |
| #10 | `feat/persons-rls-foundation` | persons table + 5 RLS Helper functions + 42 strukturelle Vitest-Assertions | `05b5de9` |

**CI-Status:** alle 9 Jobs grün auf jedem PR (1 SBOM skip = correct).

**Linear:**
- KAR-196, KAR-197, KAR-198 alle Done
- KAR-195 Master-Tracker mit Phase-0-Complete-Kommentar
- Project "private-ops (Aseckzai OS)" mit 13 Issues angelegt

## Was im Repo ist

```
private-ops/
├── apps/web/                         Next 16.2.6 + React 19 + TS 5 strict, page.tsx scaffold
├── packages/
│   ├── rls/                          rls-check.ts CI-Lint + 42 strukturelle Tests
│   └── shared/                       APP_NAME, APP_PHASE constants + smoke test
├── supabase/
│   ├── config.toml                   Minimal Supabase CLI config
│   └── migrations/
│       └── 20260514180000_helpers_and_persons_with_rls.sql
├── docs/
│   ├── 01-ARCHITECTURE.md           Phase plan auf 11-FEATURES.md §7 nachgezogen
│   ├── 02-SECURITY.md               Tier-4 Wording an 03 angeglichen
│   ├── 03..08-*.md                  Specs unverändert
│   ├── 09-STOP-CRITERIA.md          unverändert
│   ├── 10-OPEN-QUESTIONS.md         +Q-31..Q-38
│   └── 11-FEATURES.md               NEU (Kais's Feature-Spec)
├── adr/0000-template.md + 0001..0004
├── .github/
│   ├── CODEOWNERS                   unverändert
│   ├── dependabot.yml               NEU
│   └── workflows/security-checks.yml  Setup-Order + gitleaks-CLI fix
├── CLAUDE.md                         "5 Module" → "9 sensible Pfade"
├── README.md                         Lese-Order +11-FEATURES
└── package.json + pnpm-workspace.yaml + tsconfig.base.json + ...
```

**Migration-Datenmodell (PR #3):**
- `tenants` → `households` + `businesses`
- `persons` (Tier 4 default; encrypted columns BYTEA placeholder)
- `person_tenants` (M:N Junction)
- `person_roles` (12-Rollen-CHECK incl. `restaurant_staff`)
- `breakglass_contexts` (append-only)
- 5 Helper-Functions: `current_person_id()`, `current_tenant_id()`, `has_role()`, `breakglass_active()`, `is_in_same_household()`

Alle SECURITY DEFINER + pinned `search_path` (Anti-Injection).

## Phase 1 Pre-Requisites (Kais Action)

**Erst nach Account-Setup kann Phase 1 starten.** Konkrete Anleitung:

### 1. Supabase EU Frankfurt Project
- Neues Project anlegen: `private-ops-prod`
- Plan: Pro (€25/mo) — verlangt AVV, anhaken bei Anlage
- Region: **Frankfurt erzwingen** (EU)
- Nach Anlage 3 Keys in `/root/aria/.env` (chmod 600) via SSH:
  ```
  NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co
  NEXT_PUBLIC_SUPABASE_ANON_KEY=<anon>
  SUPABASE_SERVICE_ROLE_KEY=<service_role>
  ```
- Telegram-Notify "Supabase Keys in env" → Aria pickt's auf

### 2. Vercel Project
- Neues Project, verbunden mit GitHub-Repo `KADiCon/private-ops`
- EU-Region erzwingen für Functions
- Production-Branch = `main`
- Auto-Deploy via Git-Push (kein Token nötig wenn Aria nicht CLI-Deploys macht)
- Optional `VERCEL_TOKEN` nur falls Aria Vercel-CLI nutzt

### 3. Anthropic Org-Account
- Neuer Org-scoped API-Key (NICHT Kais's persönlicher Max-Plan-Key)
- ZDR-Antrag: formlose Email an `support@anthropic.com`
- EU-Endpoint nutzen
- Key in `/root/aria/.env` als `ANTHROPIC_API_KEY_ASECKZAI=`

### 4. Sentry EU
- Account anlegen, EU-Region
- Project erstellen
- DSN in `/root/aria/.env` als `SENTRY_DSN=`

### 5. Better Stack (oder Logflare)
- Account anlegen
- Source erstellen
- Token in `/root/aria/.env` als `BETTER_STACK_INGEST_TOKEN=`

## Phase 1 PR-Plan (5-7 PRs, ~Wochen 3-6)

| PR | Inhalt | Plan-Mode? |
|---|---|---|
| #4 | Vercel + Supabase wiring + supabase typegen + lib/supabase client | Ja (lib/auth touches incoming) |
| #5 | Auth-Routes + 2FA-Setup mit WebAuthn | Ja |
| #6 | audit_log table + SECURITY DEFINER writer | Ja (audit-log) |
| #7 | spaces + space_members (cleanup persons RLS auf space-aware) | Ja (rls-policies) |
| #8 | Encryption helpers (pgsodium DEK/KEK envelope) | Ja (encryption) |
| #9 | Capability-Tokens scaffolding (signing, verification, allowlist) | Ja (capability-tokens) |
| #10 | RLS-behavior tests (Postgres in CI via docker-compose) | Plan-mode-empfohlen |

## Was Phase 0 NICHT erreicht hat

- Keine real-Daten-Tests (RLS-Behavior in Postgres) — Phase 1
- Keine pgsodium-Field-Encryption — Phase 1 PR #8
- Keine Auth-Flow — Phase 1 PR #5
- Keine echten Integrationen (Supabase Cloud, Vercel, Sentry) — wartet auf Kais's Account-Setup

## Brain-Notes verwandt

- [[CONTEXT]] — Vision + Boundaries + Phasen-Map
- [[features-map]] — 8 Cluster + Sub-Features
- [[infrastructure-decisions]] — Stack + Encryption + Cost-Floor