Approve the Capstone Boundary Before Building

Pilot approves the capstone plan. Create a feature branch and implement the approved local authentication, session, and authorization core before building the full interface.

Hash synthetic demonstration passwords using Node's built-in crypto capability with unique salts and an appropriate work factor. Use server-generated session identifiers, HTTP-only SameSite cookies, bounded expiration, logout invalidation, generic login failures, and no credentials in logs or Git.

Enforce authorization in server-side handlers. Reject role values supplied by the client as authority. Add direct-route and direct-request tests proving anonymous denial, employee isolation, coordinator scope, administrator access, invalid-session denial, logout, expired sessions, and unchanged data after denied writes.

Run the tests and report allowed and denied counts. Do not stage, commit, push, or add the remaining business workflow yet.