# Agent tasks

Self-contained instructions for fixes that came out of a code review of commit `a55cc4f`.
Each file says why, what the owner decided, the design, the tests, and when it is done.
The numbers are the review's item numbers.

| File | What |
|---|---|
| `01-web-authentication.md` | Password login, once per browser for a year, in front of the whole `/api` (including the Home Assistant proxy). |
| `04-one-input-policy.md` | Podcast next/previous seeks 30 s from every input; mute restores the previous volume; three separate volume steps in parent mode. |
| `05-firmware-serial-frames.md` | Stop RFID frames interleaving with button frames on the serial link. |
| `06-podcast-kind.md` | `"podcast"` as an album kind instead of comparing the `Kinderpodcasts` folder name. |
| `07-backend-and-frontend-cleanups.md` | Eight independent cleanups: library races, cache invalidation, double LED off-animation, a config owner, generated API types, shared helpers, injected time, splitting the largest files. |

Order: `06` before `04` (04's podcast check uses 06's kind; it says how to proceed if
06 has not landed). `07 D` is easier after `01`. The rest are independent.

For every task: one commit per logical change, `scripts/check.sh` passing before each
commit, no pushing. When a task is done, delete its file in the same commit, so this
folder only ever lists open work.