Apricot opens up the real issue tracker. The one Orange doesn't know about. A keyboard shortcut brings up an automatically generated summary of all his ongoing work.
"Last week, we finished the remaining subtasks on cross-device authentication. We got QR-code, email magic link, passkey, SSO and plain old username-password with 2FA all working now. The login UI is still a bit ugly but fully functional and UX by itself is as good as it gets. Session revocation is also implemented, and also has bare-bones UI with just a list of devices and revoke buttons."
He reads the notes further.
"The email magic links are sent from a temporary address and sometimes go to junk mail. 2FA recovery code and password reset flows still need a bit of work. I need to think about the threat model for account recovery a bit more before I'm confident on actually implementing any of that."
mentally taps himself on the back That's a great excuse to take Wednesday off.
frown (a practiced one, and perhaps pretended too, he doesn't know anymore)
"Now that we have multidevice setup working, we need consider syncing between devices too. Ideally the user could control their PC from their phone, for instance."
A small pause, to see if anyone comments on that.