From 1c0d22a216d074e77c1809740bcf6f8af9481a7d Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 19 Oct 2026 18:36:18 +0200 Subject: [PATCH] docs(19.4-01): record plan state and self-check --- .planning/ROADMAP.md | 6 ++-- .planning/STATE.md | 28 +++++++++++-------- .../19.4-01-SUMMARY.md | 4 +++ 3 files changed, 23 insertions(+), 15 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 7dd1544c..92f39c34 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1299,11 +1299,11 @@ Plans: 4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review. 5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 4 plans +**Plans:** 1/4 plans executed Plans: **Wave 1** -- [ ] 19.4-01-PLAN.md — Decision note (golang-jwt v5, zitadel rejected), then the wristband OIDC flavour: discovery, JWKS, resumable authorize with consent and switch account, token with id_token, userinfo, pairwise subjects, kinds, opt-in refresh; neutral Resource default; README and docs (wave 1) +- [x] 19.4-01-PLAN.md — Decision note (golang-jwt v5, zitadel rejected), then the wristband OIDC flavour: discovery, JWKS, resumable authorize with consent and switch account, token with id_token, userinfo, pairwise subjects, kinds, opt-in refresh; neutral Resource default; README and docs (wave 1) **Wave 2** *(blocked on Wave 1 completion)* - [ ] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2) @@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19. Chat and ChatChannels | 7/7 | Complete | 2026-10-17 | | 19.1. Chat satellites | 6/6 | Complete | 2026-10-18 | | 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress| | -| 19.4. OIDC provider on wristband | 0/4 | Planned | - | +| 19.4. OIDC provider on wristband | 1/4 | In Progress| | | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | | 19.7. Generic MCP module | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index c064bccf..9fe78b93 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -2,18 +2,18 @@ msd_state_version: "1.0" milestone: v1.0 current_phase: "19.4" -current_phase_name: OIDC provider on wristband +current_phase_name: OIDC provider on wristband (INSERTED) status: executing -stopped_at: Roadmap reordered 2026-10-18; ready to plan Phase 19.4 -last_updated: "2026-10-19T15:59:56.673Z" +stopped_at: Completed 19.4-01-PLAN.md +last_updated: "2026-10-19T16:36:07.503Z" last_activity: 2026-10-19 -last_activity_desc: "Completed quick task 261019-hgw: Translate hook ValidationError phrase keys in the request locale" -state_head: df0d8c1d55a88d3dd07fabf1c04cf9e5611621ca +last_activity_desc: Phase 19.4 execution started +state_head: 49e772afb8503401ecdd05731e92be52fb233dd1 progress: total_phases: 42 completed_phases: 34 total_plans: 208 - completed_plans: 204 + completed_plans: 205 gsd_state_version: "1.0" milestone_name: milestone --- @@ -25,14 +25,14 @@ milestone_name: milestone See: .planning/PROJECT.md (updated 2026-10-12) **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test. -**Current focus:** Phase 19.1 — Chat satellites +**Current focus:** Phase 19.4 — OIDC provider on wristband (INSERTED) ## Current Position -Phase: 19.4 (OIDC provider on wristband) — READY TO EXECUTE -Plan: Not started +Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING +Plan: 2 of 4 Status: Ready to execute -Last activity: 2026-10-19 - Completed quick task 261019-hgw: Translate hook ValidationError phrase keys in the request locale +Last activity: 2026-10-19 — Phase 19.4 execution started Progress: [████████░░] 83% @@ -258,6 +258,7 @@ Progress: [████████░░] 83% | Phase 19.1-chat-satellites P19.1-05 | 10min | 4 tasks | 37 files | | Phase 19.1 P19.1-02 | 9 min | 4 tasks | 36 files | | Phase 19.1 P19.1-06 | 16 | 3 tasks | 46 files | +| Phase 19.4 P01 | 28 min | 4 tasks | 34 files | ## Accumulated Context @@ -873,6 +874,9 @@ Recent decisions affecting current work: - [Phase 19.1]: Goldens from PHP fixtures; live capture NOT RUN — No live PHP Wavepath backend was reachable. - [Phase 19.1]: Execute should now run the security-review agent; this execute did not spawn it — Five APIs, push sender, token issuer, sanitizer boundary, and GDPR cascades now exist. - [Phase 19.1]: Gate named-short vs postgres split follows the skip detector — TestHTTPTracer and TestReconcileEmptyRoom skip under -short; a skip is refuse. +- [Phase 19.4]: D-16: extend the hand-written wristband with an OIDC flavour; golang-jwt/jwt/v5 v5.3.1 signs id_tokens via MapClaims; stdlib JWKs; zitadel/oidc v3 rejected; go-oidc and x/oauth2 test-only in sm-oauthserver-plugin +- [Phase 19.4]: 19.4-01: OIDC redirects send Cache-Control no-store, private (plan) while PHP sends no-cache, private; plan 03 tide replay settles it +- [Phase 19.4]: 19.4-01: wristband DefaultOptions().Resource is empty; host applications set their MCP resource explicitly (fonoteka 687e25a) ### Pending Todos @@ -960,6 +964,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-18T14:01:53.356Z -Stopped at: Roadmap reordered 2026-10-18; ready to plan Phase 19.4 +Last session: 2026-10-19T16:36:06.663Z +Stopped at: Completed 19.4-01-PLAN.md Resume file: None diff --git a/.planning/phases/19.4-oidc-provider-on-wristband/19.4-01-SUMMARY.md b/.planning/phases/19.4-oidc-provider-on-wristband/19.4-01-SUMMARY.md index a8d00ce0..5377a387 100644 --- a/.planning/phases/19.4-oidc-provider-on-wristband/19.4-01-SUMMARY.md +++ b/.planning/phases/19.4-oidc-provider-on-wristband/19.4-01-SUMMARY.md @@ -286,3 +286,7 @@ None - no external service configuration required. --- *Phase: 19.4-oidc-provider-on-wristband* *Completed: 2026-10-19* + +## Self-Check: PASSED + +All created files exist; commits 756a97c, 659b42a, dfa3c3e, e25e733, ddda59a, 8111242, 49e772a (summercms.go) and 687e25a (fonoteka.go) exist; must_haves artifact and key-link patterns found; go vet and the wristband suite green.