docs(19.4-04): complete unit tests, PHP method map and phase gate plan
This commit is contained in:
@@ -0,0 +1,312 @@
|
||||
---
|
||||
phase: 19.4-oidc-provider-on-wristband
|
||||
plan: 04
|
||||
subsystem: testing
|
||||
tags: [oidc, oauth, wristband, unit-tests, gate, php-parity, testcontainers, postgres]
|
||||
|
||||
requires:
|
||||
- phase: 19.4-01
|
||||
provides: wristband OIDC flavour, memory fakes (memoryOIDCBackend, memoryKeyStore, fakeOIDCHost) and smoke tests
|
||||
- phase: 19.4-02
|
||||
provides: sm-oauthserver-plugin, its Postgres harness (bootOAuth, freshDB) and the sm-user-plugin additions
|
||||
- phase: 19.4-03
|
||||
provides: import, admin, rotate/prune, the parity harness and the security review (T-19.4-35 left for this gate)
|
||||
provides:
|
||||
- scripts/check-phase19.4.sh, a fail-closed gate across summercms.go, sm-oauthserver-plugin, sm-user-plugin and the application's OAuth suites
|
||||
- 25 wristband unit tests (six PHP protocol ports, nineteen Go-only)
|
||||
- 13 Postgres ports of the PHP feature and security suites plus TestConsentRedirectMode in the plugin
|
||||
- plugin internals tests and the complete PHP method map (171 methods, TestPHPMethodMap)
|
||||
- sm-user-plugin tests for RequestUser, EndRequestSession, AvatarURL and user.Deactivating
|
||||
- 19.4-VALIDATION.md filled, nyquist_compliant
|
||||
affects: [wavepath-cutover, 19.7, fonoteka, release]
|
||||
|
||||
actuals:
|
||||
tokens: 104500 # chars/4 over the added lines: summercms.go 143668 (gate + wristband tests), plugin 242698, sm-user-plugin 21660, VALIDATION.md ~10000
|
||||
tasks: 5
|
||||
commits: 11 # measured: summercms.go rev-list 6d7193c..HEAD = 7 before this SUMMARY; sm-oauthserver-plugin f8eaf70..HEAD = 3; sm-user-plugin 80b436d..HEAD = 1
|
||||
plan_head_before: "summercms.go 6d7193c9a54669e585628c93876401df85c51da8; sm-oauthserver-plugin f8eaf70; sm-user-plugin 80b436d"
|
||||
plan_head_after: "summercms.go 86bd5c4 (before this SUMMARY commit); sm-oauthserver-plugin 1651ba0; sm-user-plugin 9335e80"
|
||||
|
||||
tech-stack:
|
||||
added: []
|
||||
patterns:
|
||||
- "One Go test per PHP test file, one subtest per PHP method (the method name without test_), so the map is one row per method"
|
||||
- "Gate NOT RUN rules proven behaviourally: --self-test runs the docker gate with a fake docker binary and the parity stage on a plugin tree without recordings"
|
||||
- "Map entries are checked against the test sources of the repository they name (plugin, or wristband through SUMMERCMS_ROOT)"
|
||||
|
||||
key-files:
|
||||
created:
|
||||
- scripts/check-phase19.4.sh
|
||||
- modules/wristband/oidc_discovery_test.go
|
||||
- modules/wristband/oidc_keys_test.go
|
||||
- modules/wristband/oidc_authorize_test.go
|
||||
- modules/wristband/oidc_consent_test.go
|
||||
- modules/wristband/oidc_token_test.go
|
||||
- modules/wristband/oidc_userinfo_test.go
|
||||
- modules/wristband/oidc_subject_test.go
|
||||
- modules/wristband/oidc_redirect_test.go
|
||||
- modules/wristband/oidc_refresh_test.go
|
||||
- modules/wristband/oidc_flavour_test.go
|
||||
- ../sm-oauthserver-plugin/authorize_test.go
|
||||
- ../sm-oauthserver-plugin/consent_test.go
|
||||
- ../sm-oauthserver-plugin/token_test.go
|
||||
- ../sm-oauthserver-plugin/userinfo_test.go
|
||||
- ../sm-oauthserver-plugin/discovery_test.go
|
||||
- ../sm-oauthserver-plugin/authorizations_test.go
|
||||
- ../sm-oauthserver-plugin/route_guard_test.go
|
||||
- ../sm-oauthserver-plugin/cascade_test.go
|
||||
- ../sm-oauthserver-plugin/clients_admin_test.go
|
||||
- ../sm-oauthserver-plugin/claims_test.go
|
||||
- ../sm-oauthserver-plugin/keyring_test.go
|
||||
- ../sm-oauthserver-plugin/prune_test.go
|
||||
- ../sm-oauthserver-plugin/subject_test.go
|
||||
- ../sm-oauthserver-plugin/branding_test.go
|
||||
- ../sm-oauthserver-plugin/buckets_test.go
|
||||
- ../sm-oauthserver-plugin/mcp_store_test.go
|
||||
- ../sm-oauthserver-plugin/import_winter_test.go
|
||||
- ../sm-oauthserver-plugin/commands_test.go
|
||||
- ../sm-oauthserver-plugin/zero_edit_test.go
|
||||
- ../sm-oauthserver-plugin/php_method_map_test.go
|
||||
- ../sm-oauthserver-plugin/testdata/PHP_METHOD_MAP.md
|
||||
- ../sm-oauthserver-plugin/testdata/php_methods.txt
|
||||
- ../fonoteka.go/plugins/golem15/user/session_user_test.go
|
||||
- ../fonoteka.go/plugins/golem15/user/avatar_url_test.go
|
||||
- ../fonoteka.go/plugins/golem15/user/deactivating_event_test.go
|
||||
modified:
|
||||
- ../sm-oauthserver-plugin/harness_test.go
|
||||
- ../sm-oauthserver-plugin/parity_test.go
|
||||
- ../sm-oauthserver-plugin/testdata/parity/README.md
|
||||
- .planning/phases/19.4-oidc-provider-on-wristband/19.4-VALIDATION.md
|
||||
- .planning/phases/19.4-oidc-provider-on-wristband/deferred-items.md
|
||||
|
||||
key-decisions:
|
||||
- "Gate stage split by Docker need: the application's OAuth suites that start Postgres run in the docker stage, the three Docker-free metadata suites in the fonoteka stage; its unrelated TestPhase09SecurityRoutes failure stays outside the gate and is recorded in deferred-items.md"
|
||||
- "Parity stage: NOT RUN without recordings, pointing to the WavePath cutover todo (D-14 amended); PHASE194_REQUIRE_PARITY=1 fails; with recordings it replays under PHASE194_REQUIRE_PARITY=1"
|
||||
- "PHP method map: 146 ported, 25 adapted (each with a reason), none not-applicable; the GDPR scheduled-deletion case maps to the user plugin's admin bulk delete, the only other hard-delete path"
|
||||
- "The parity runbook and the replay skip message say 'the PHP site' instead of the reference site's name, so the plugin names no consuming application"
|
||||
|
||||
patterns-established:
|
||||
- "Phase gates prove their own NOT RUN rules on a faked host instead of grepping for the variable name"
|
||||
|
||||
requirements-completed: [SC-1, SC-2, SC-3, SC-4, SC-5, D-02, D-03, D-05, D-07, D-08, D-09, D-10, D-11, D-12, D-13, D-14, D-15, D-17, D-18, D-19]
|
||||
|
||||
coverage:
|
||||
- id: D1
|
||||
description: "scripts/check-phase19.4.sh fails closed (fail, skip, zero tests, missing name; NOT RUN only for docker and parity and only without the REQUIRE variables) and --all is green across the four repositories"
|
||||
requirement: SC-5
|
||||
verification:
|
||||
- kind: other
|
||||
ref: "bash scripts/check-phase19.4.sh --self-test"
|
||||
status: pass
|
||||
- kind: integration
|
||||
ref: "bash scripts/check-phase19.4.sh --all (Docker host: docker PASS, parity NOT RUN)"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D2
|
||||
description: "wristband's OIDC flavour pinned by 25 named unit tests: PKCE, redirect matching, token issuance, code lifecycle, replay, consent CSRF, discovery, JWKS, keys, rings, validation order, PHP encoding, resume, switch account, JSON consent, client auth, userinfo 401, pairwise, refresh, kind isolation, flavour dispatch, MCP refuses openid"
|
||||
requirement: SC-5
|
||||
verification:
|
||||
- kind: unit
|
||||
ref: "bash scripts/check-phase19.4.sh go"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D3
|
||||
description: "The plugin's relying-party, browser and admin behaviour ported case by case from the PHP feature and security suites on Postgres, plus the redirect consent mode"
|
||||
requirement: D-14
|
||||
verification:
|
||||
- kind: integration
|
||||
ref: "bash scripts/check-phase19.4.sh docker (TestAuthorizeStart .. TestUserDeleteCascade, TestConsentRedirectMode)"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D4
|
||||
description: "Plugin internals (claims, key ring incl. multi-instance race and previous app keys, subjects, prune, branding, buckets, MCP stores, import, commands, schedule) and the complete PHP method map"
|
||||
requirement: D-14
|
||||
verification:
|
||||
- kind: unit
|
||||
ref: "../sm-oauthserver-plugin/php_method_map_test.go#TestPHPMethodMap"
|
||||
status: pass
|
||||
- kind: integration
|
||||
ref: "bash scripts/check-phase19.4.sh docker"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D5
|
||||
description: "sm-user-plugin additions tested and additive since c077029 (D-05)"
|
||||
requirement: D-05
|
||||
verification:
|
||||
- kind: unit
|
||||
ref: "bash scripts/check-phase19.4.sh userplugin (TestEndRequestSession, additive check)"
|
||||
status: pass
|
||||
- kind: integration
|
||||
ref: "go -C ../fonoteka.go test -run '^(TestRequestUser|TestAvatarURL|TestDeactivatingEvent)$' ./plugins/golem15/user"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D6
|
||||
description: "MCP flavour and the application's OAuth suites unchanged (D-07, D-09)"
|
||||
requirement: D-09
|
||||
verification:
|
||||
- kind: integration
|
||||
ref: "bash scripts/check-phase19.4.sh fonoteka and docker (37 application OAuth tests incl. TestOAuthResourceExplicit); wristband TestPhase08Coverage, TestMCPRefusesOpenID"
|
||||
status: pass
|
||||
human_judgment: false
|
||||
- id: D7
|
||||
description: "D-14 relying-party parity against recorded PHP responses"
|
||||
requirement: D-14
|
||||
verification: []
|
||||
human_judgment: true
|
||||
rationale: "No PHP recordings: deferred by the D-14 amendment (2026-10-19) to the WavePath cutover phase (todo 2026-10-19-record-php-oidc-parity-against-wavepath); the gate reports NOT RUN parity and this does not hold the phase verdict"
|
||||
|
||||
duration: 65min
|
||||
completed: 2026-10-19
|
||||
status: complete
|
||||
---
|
||||
|
||||
# Phase 19.4 Plan 04: Unit tests, PHP method map and the phase gate Summary
|
||||
|
||||
**Every new piece of the OIDC phase now has named unit tests (25 in wristband, 31 in the plugin, 4 in sm-user-plugin), all 171 PHP test methods are mapped to Go tests that `TestPHPMethodMap` checks by name, and `scripts/check-phase19.4.sh --all` is green on a Docker host across summercms.go, sm-oauthserver-plugin, sm-user-plugin and the application's OAuth suites, with parity reported NOT RUN (deferred to the WavePath cutover).**
|
||||
|
||||
## Performance
|
||||
|
||||
- **Duration:** 65 min
|
||||
- **Started:** 2026-10-19T18:43:54Z
|
||||
- **Completed:** 2026-10-19T19:49:16Z
|
||||
- **Tasks:** 5
|
||||
- **Files:** 11 in summercms.go (gate, 10 test files) plus 2 planning docs; 26 in sm-oauthserver-plugin; 3 in sm-user-plugin
|
||||
|
||||
## Accomplishments
|
||||
|
||||
- `scripts/check-phase19.4.sh` with stages go, plugin, userplugin, fonoteka, docker, parity, docs, `--self-test` and `--all`. The go test -json detector refuses a fail, a skip (subtests included), zero tests, "no tests to run" and a missing name (a subtest never counts for its parent). `--self-test` proves the detector on planted streams, the docker and parity NOT RUN rules on a faked host (a docker binary that never answers, a plugin tree without recordings) and the additive check on planted diffs (T-19.4-35).
|
||||
- wristband: `TestPKCEVerifier` (9), `TestRedirectURIMatch` (11), `TestTokenIssuer` (10), `TestAuthCodeLifecycle` (5), `TestPKCEAndReplay` (6), `TestConsentCSRF` (cases 1-5) and nineteen Go-only tests, all over the memory fakes.
|
||||
- Plugin on Postgres: the PHP feature and security suites (AuthorizeStart, ClientRegistry through the cabana admin API, ConsentOnce, DiscoveryEndpoint, IncrementalConsent, RelyingPartyFlow, RevokeAuthorization, TokenEndpoint, UnconfiguredSite, UserInfoEndpoint, ConsentPageSecurity, RouteGuard, UserDeleteCascade through the user plugin's admin actions), the PHP unit suites (ClaimBuilder, DiscoveryDocument, KeyRing, PruneExpired, SubjectStability, ZeroEditAdditivity) and the Go-only internals.
|
||||
- `testdata/php_methods.txt` (171 lines, extracted from the PHP tree) and `testdata/PHP_METHOD_MAP.md` (one row each: 146 ported, 25 adapted, 0 not-applicable). `TestPHPMethodMap` fails on a missing, unknown or extra method, a row whose Go test or subtest does not exist in the repository it names, and a subtest name that is not the PHP method name; mutation checks (renamed subtest, missing function, deleted row, wrong repository) all failed it as expected.
|
||||
- sm-user-plugin: `TestRequestUser`, `TestEndRequestSession`, `TestAvatarURL`, `TestDeactivatingEvent`.
|
||||
- 19.4-VALIDATION.md: all 21 tasks of plans 01-04 with commands and status, Wave 0 ticked, `nyquist_compliant: true`, `wave_0_complete: true`.
|
||||
|
||||
## Gate output (`bash scripts/check-phase19.4.sh --all`, Docker host)
|
||||
|
||||
| Stage | Result |
|
||||
|-------|--------|
|
||||
| self-test | PASS |
|
||||
| go | PASS (vet, `go test -short ./...`, 42 wristband names, tide) |
|
||||
| plugin | PASS (vet, short suite, 8 Docker-free names incl. TestPHPMethodMap) |
|
||||
| userplugin | PASS (vet, short suite, TestEndRequestSession, additive since c077029: 9 declarations added, none removed) |
|
||||
| fonoteka | PASS (vet, short suite of the domain plugin, 3 Docker-free OAuth suites) |
|
||||
| docs | PASS (decision note names golang-jwt/jwt/v5, coreos/go-oidc/v3, zitadel; TestDocsTree; docs:build --check; 106 files name no consuming application) |
|
||||
| docker | PASS (41 plugin tests, 3 sm-user-plugin tests, 37 application OAuth tests) |
|
||||
| parity | NOT RUN parity: D-14 unproven (no PHP recordings; deferred to the WavePath cutover todo) |
|
||||
|
||||
Also run on the Docker host: `go test ./...` in summercms.go green; `go -C ../sm-oauthserver-plugin test ./...` green (77 s); `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/... ./plugins/golem15/user/...` green except the known `TestPhase09SecurityRoutes` (unrelated cabana routes, deferred-items.md, outside the gate on purpose).
|
||||
|
||||
Acceptance checks recorded: renaming `TestOIDCSubjectIsRandomSmoke` locally made the go stage fail with "required tests did not pass" (restored, not committed); `nosuchstage` exits 2 with the usage line; every acceptance grep of Tasks 1-5 meets its bound.
|
||||
|
||||
## Human verification pending
|
||||
|
||||
D-14 parity is not proven: the PHP side was never recorded. By the user's amendment of D-14 (2026-10-19) this is a preliminary task of the WavePath cutover phase and does not hold this phase's verdict. The item, carried from 19.4-03-SUMMARY.md: start the PHP site locally, record the ten spec flows per `../sm-oauthserver-plugin/testdata/parity/README.md` (never pass `--rules`; delete PHP's Set-Cookie headers from the fixtures), write `seed.json`, `winter-export.jsonl` (hashes only) and `id_token_shape.json`, then `PHASE194_REQUIRE_PARITY=1 bash scripts/check-phase19.4.sh parity` must pass; settle the redirect Cache-Control difference (`no-store, private` vs `no-cache, private`) with a fix or a deviation citing a D-number. Tracked in `.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md` (g15office govfaqir).
|
||||
|
||||
The visual checks of plans 02 and 03 stay for the end-of-phase UAT (consent and error pages against PHP; the Clients and Branding screens in the admin SPA).
|
||||
|
||||
## Not-applicable map rows
|
||||
|
||||
None. The three cases the plan expected might become not-applicable were adapted instead: `test_the_gdpr_scheduled_deletion_path_cascades` (the user plugin has no scheduled GDPR deletion; its admin bulk delete, the other hard-delete path, is checked), `test_shared_plugins_are_unedited` (the additive check since c077029) and `test_private_key_file_is_not_world_readable` (the private key is encrypted at rest and never serialised).
|
||||
|
||||
## Task Commits
|
||||
|
||||
summercms.go:
|
||||
1. **Task 1 (tracer):** `028e8da` test(19.4-04): fail-closed phase gate across the four repositories
|
||||
2. **Task 2:** `dd16746` test(19.4-04): unit tests for wristband's OIDC flavour
|
||||
3. **Task 3:** `e1696be` test(19.4-04): gate requires the plugin's PHP feature and security ports
|
||||
4. **Task 4:** `29b3a3a` test(19.4-04): gate requires the PHP method map and the plugin internals
|
||||
5. **Task 5:** `533d1a9` test(19.4-04): gate requires the sm-user-plugin additions' tests; `86bd5c4` one sm-user-plugin test name per line; `31cca1a` docs(19.4): validation map filled, Nyquist compliant (planning doc, alone)
|
||||
|
||||
sm-oauthserver-plugin (`../sm-oauthserver-plugin`):
|
||||
1. **Task 1 (fix):** `6e84212` docs: parity runbook names no consuming application
|
||||
2. **Task 3:** `34c124a` test: port the PHP feature and security suites on Postgres
|
||||
3. **Task 4:** `1651ba0` test: plugin internals and the complete PHP method map
|
||||
|
||||
sm-user-plugin (`../fonoteka.go/plugins/golem15/user`, its own repository; the fonoteka.go pointer was not staged):
|
||||
1. **Task 5:** `9335e80` test: RequestUser, EndRequestSession, AvatarURL and user.Deactivating
|
||||
|
||||
**Plan metadata:** this SUMMARY commit, then the state and roadmap commit.
|
||||
|
||||
## Files Created/Modified
|
||||
|
||||
- `scripts/check-phase19.4.sh`: the phase gate
|
||||
- `modules/wristband/oidc_{discovery,keys,authorize,consent,token,userinfo,subject,redirect,refresh,flavour}_test.go`: wristband unit tests
|
||||
- `../sm-oauthserver-plugin/*_test.go` (23 new files, `harness_test.go` gained `tryBootOAuth`): Postgres and Docker-free plugin tests
|
||||
- `../sm-oauthserver-plugin/testdata/{php_methods.txt,PHP_METHOD_MAP.md}`: the D-14 map
|
||||
- `../sm-oauthserver-plugin/parity_test.go`, `testdata/parity/README.md`: neutral wording (no site name)
|
||||
- `../fonoteka.go/plugins/golem15/user/{session_user,avatar_url,deactivating_event}_test.go`: sm-user-plugin tests
|
||||
- `.planning/phases/19.4-oidc-provider-on-wristband/19.4-VALIDATION.md`, `deferred-items.md`
|
||||
|
||||
## Decisions Made
|
||||
|
||||
See `key-decisions` in the frontmatter.
|
||||
|
||||
## Deviations from Plan
|
||||
|
||||
### Auto-fixed Issues
|
||||
|
||||
**1. [Rule 1 - Bug] The plugin's parity runbook and replay skip message named the reference site**
|
||||
- **Found during:** Task 1 (docs stage)
|
||||
- **Issue:** `testdata/parity/README.md` and the skip message in `parity_test.go` named the WinterCMS site by name; the docs stage and `TestZeroEditAdditivity` require that no plugin file names a consuming application.
|
||||
- **Fix:** "the PHP site" / "the WinterCMS site whose provider moves to this plugin" instead. No behaviour change.
|
||||
- **Files modified:** ../sm-oauthserver-plugin/parity_test.go, ../sm-oauthserver-plugin/testdata/parity/README.md
|
||||
- **Verification:** gate docs stage, TestZeroEditAdditivity
|
||||
- **Committed in:** sm-oauthserver-plugin 6e84212
|
||||
|
||||
**2. [Rule 3 - Blocking] The application's OAuth suites need Postgres**
|
||||
- **Found during:** Task 1
|
||||
- **Issue:** The plan put the application's OAuth tests by name in the fonoteka stage; all but three skip under `-short` (TestMain starts Postgres), which the detector rightly refuses.
|
||||
- **Fix:** The fonoteka stage requires the three Docker-free metadata suites; the docker stage requires the 37 Postgres OAuth suites, TestOAuthResourceExplicit included.
|
||||
- **Committed in:** 028e8da
|
||||
|
||||
**3. [Rule 3 - Blocking] Test locations follow the existing harnesses**
|
||||
- **Found during:** Tasks 4 and 5
|
||||
- **Issue:** The plan placed the import and command tests in `console/` and the sm-user-plugin tests in `classes/`. Neither package has a booted-application harness: the plugin's Postgres harness (`bootOAuth`) and the user plugin's admin harness (plugin boot with the Postgres blacklist, cookie config and controllers) live in the root packages, and a second harness would start a container per test.
|
||||
- **Fix:** `import_winter_test.go`, `commands_test.go` (plugin root) and `session_user_test.go`, `avatar_url_test.go`, `deactivating_event_test.go` (user plugin root), as the existing smokes do. The gate requires them in those packages. `TestImportKeyDirErrors` needs the database for its PKCS#1 and `--force` cases, so it runs in the docker stage.
|
||||
- **Committed in:** 1651ba0, 9335e80, 29b3a3a, 533d1a9
|
||||
|
||||
**4. [Rule 3 - Blocking] The plugin harness could not report a boot error**
|
||||
- **Found during:** Task 3 (TestConsentRedirectMode)
|
||||
- **Fix:** `tryBootOAuth` returns the activation error; `bootOAuthWith` calls it and fails the test as before.
|
||||
- **Committed in:** 34c124a
|
||||
|
||||
### Plan details
|
||||
|
||||
5. **Adapted PHP cases** carry their reason in the map (25 rows), for example: ServeMux has no route names, so RouteGuard asserts which handler answered; cabana partials answer as a node tree, so the regenerated secret is the text of a code element; the settings colour column holds 32 characters, so the hostile colour is 31 characters; the PHP "duplicate kid" manifest case became an unparsable manifest plus the kid already held by the ring (Go's JSON decoder, like PHP's json_decode, keeps the last of two equal keys).
|
||||
6. **Concurrent rotations:** in `TestKeyRingMultiInstanceRace` some racing `Rotate` calls lose with the fixed error (the partial unique index refuses a second active key); the test pins the invariant (one active key, no leaked details), not that every racer succeeds.
|
||||
7. **Gate environment:** `PHASE194_USER_BASE` (default c077029) added next to the planned overrides; the plugin stage passes `SUMMERCMS_ROOT` and `USER_PLUGIN` to the map and zero-edit tests.
|
||||
|
||||
---
|
||||
|
||||
**Total deviations:** 4 auto-fixed (1 bug in wording, 3 blocking) plus 3 plan details. **Impact:** no production behaviour changed; the only non-test change is the neutral wording of the parity runbook and skip message.
|
||||
|
||||
## Issues Encountered
|
||||
|
||||
- **Docker-backed tests run:** the gate's docker stage (plugin, sm-user-plugin, application OAuth suites), the full plugin suite, the full framework `go test ./...` and the application's domain plugin and user plugin trees, all on the local Docker daemon without sudo.
|
||||
- **Known failure outside the gate:** `TestPhase09SecurityRoutes` in the application (cabana admin routes from other phases missing from its allowlist), noted again in deferred-items.md.
|
||||
- **g15office:** not updated by this executor; the orchestrator handles it.
|
||||
|
||||
## Release steps waiting for the user's go-ahead
|
||||
|
||||
Nothing is pushed, tagged or deployed.
|
||||
1. Reconcile sm-user-plugin with its origin (`master` is ahead 7, behind 1 of `origin/master`), then push its commits (b82d85f, ee47440, 80b436d, 9335e80) and tag a new sm-user-plugin version.
|
||||
2. Create the `golem15/sm-oauthserver-plugin` repository on git.golem15.com and push it (13 commits, origin already configured).
|
||||
3. Tag a framework release `vX.Y.Z` on summercms.go master and post the changelog the same day (`../sm-summercmsio-app` `scripts/changelog-post.py`).
|
||||
4. Bump the plugin's `git.golem15.com/golem15/summercms` require (now v0.2.4 with a local replace) and its sm-user-plugin require to the new tags, then bump the application pointers (fonoteka.go and any app that mounts the plugins) in separate commits.
|
||||
|
||||
## User Setup Required
|
||||
|
||||
None - no external service configuration required.
|
||||
|
||||
## Next Phase Readiness
|
||||
|
||||
- Phase 19.4 is ready for `/msd-verify-work` and `/msd-validate-phase`: the gate is green, VALIDATION.md is filled.
|
||||
- The WavePath cutover phase starts with the PHP parity recording (see "Human verification pending").
|
||||
|
||||
---
|
||||
*Phase: 19.4-oidc-provider-on-wristband*
|
||||
*Completed: 2026-10-19*
|
||||
|
||||
## Self-Check: PASSED
|
||||
|
||||
All key files exist; commits 028e8da, dd16746, e1696be, 29b3a3a, 533d1a9, 86bd5c4, 31cca1a (summercms.go), 6e84212, 34c124a, 1651ba0 (sm-oauthserver-plugin) and 9335e80 (sm-user-plugin) exist. `bash scripts/check-phase19.4.sh --all` exited 0 with no FAIL line (docker PASS, parity NOT RUN); every task's acceptance check re-ran green.
|
||||
@@ -4,6 +4,7 @@
|
||||
status: open
|
||||
**What:** `go test ./plugins/golem15/fonoteka/...` in `../fonoteka.go` (Docker-backed, not `-short`) reports "unexpected admin routes" for cabana routes other phases added: `GET`/`PUT /plytadmin/api/v1/account/preferences`, `GET`/`POST .../{controller}/reorder` and `GET .../{controller}/singleton`. The test's admin route allowlist predates them. Nothing in wristband or the OAuth wiring is involved; every OAuth test in that package passes.
|
||||
**Where:** `../fonoteka.go/plugins/golem15/fonoteka/admin_phase09_security_test.go:52`.
|
||||
**19.4-04:** still the only failure of `go -C ../fonoteka.go test ./plugins/golem15/fonoteka/... ./plugins/golem15/user/...` on Docker (same five cabana routes). `scripts/check-phase19.4.sh` runs the application's Docker-free OAuth suites in its fonoteka stage and the Postgres OAuth suites by name in its docker stage, so this test is outside the gate on purpose; it is not masked.
|
||||
|
||||
- tide test files are not gofmt-clean (found by 19.4-03, outside its scope)
|
||||
status: open
|
||||
|
||||
Reference in New Issue
Block a user