restoration-os — app slice 1

Skeleton only. Nothing here is a working field tool yet, and nothing on this box holds real data.

What is wired

Astro 7 SSR on the Node standalone adapter, one process.
Every write goes through an Astro Action, and every Action body runs insidewithTenant — one transaction, both context variables, setLOCAL.
Jobs: create, move through the early states, list.
Photos: ask for an upload, send the bytes, finish. The server re-hashes what arrived.
The drying log: readings, air readings, machines placed and picked up, a chamber closed.
The chat, which refuses every question on purpose — and now measures the emptiness it is refusing from, rather than assuming it.
The photo helper, which educates and can never reject, delete or stop anyone.
The process refuses to start if its database role is stronger than it should be.

What is switched off, and why

Sign in is built (Google for the office, passkeys for the crew; build wave 1, 2026-09-07) but not yet live. Five things are still missing, none of them code: the Google OAuth client, this app's origin, and its session/passkey secrets — all placed on the machine by Justin; 7 database changes written after this database's baseline (whether this one has them is not read here); and the office accounts themselves — nobody is auto-created, each person needs a row provisioned by hand. Until all five exist, every Action still answers "sign in first."
The real model. Keys are not in this repo; without one the chat gives the same refusal.
Real photo storage. Since 2026-09-07 the machine's identity can sign an upload link, but the app has not yet been switched from memory to the bucket, so it keeps them in memory and says so.
The procedure library. No password is set here, so nothing is read — and the answer is the same either way, which is the whole design.
QuickBooks and texting. Both are out of this slice, and neither has a place in the database to live yet.

Have a look

/jobs/<job>/capture — take a photo
/jobs/<job>/drying — the drying log
/auth/passkey/login — sign in (passkey for the crew; the office signs in with Google at /auth/google/start)
/auth/select-company — pick the company for this session
/office/new-job — open a new job: customer, address, job type; lands on the job's photo screen
/office/setup — labour classes and machines with their internal rates, and the owner's switch that lets a time entry save a location (owner and office)
/jobs/<job>/costs — hours worked, a machine's confirmed day with its photo, a receipt
/jobs/<job>/change-orders — a change to the job's price and why, whether the customer has signed, and that they were told (owner and office record; the crew reads)
/office/price-book — the price book and the work-step catalog, with break-even hours at a labour class's rate (owner and office)
/office/integrations — what is connected, mocked, waiting or failed, measured now
/office/day-pass — grant or end a guest day pass (owner, office, supervisor)
/office/job-profit — one job's margin, or UNKNOWN with the reasons (owner and owner-reporting only)
/office/carrier-estimate?jobId=<job> — put a claim on a job, upload the carrier's PDF, and read it: pages, lines, proven and needs-review (owner and office)
/office/schedule — the day's board, grouped by crew, and a form to assign someone to a job (owner, office, supervisor)
/office/consent — who has a monitoring notice on file, and recording or revoking one (owner and office)
/my-day — your own assignments, today through six days out
/account/devices — the passkey devices on your own account
/dev/explained-docs/… — the homeowner documents, rendered from a made-up job. Nothing here has been approved to send to anyone.

built 2026-09-08