diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 3338954..19e609b 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1255,7 +1255,7 @@ Plans: 3. An S3 blob driver can be selected through framework config, so the application does not import it. `/api-docs` and `/api-docs.json` can be served. Turnstile verification middleware is available. 4. The touched modules' READMEs and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 2/5 plans executed +**Plans:** 3/5 plans executed Plans: **Wave 1** @@ -1263,7 +1263,7 @@ Plans: **Wave 2** *(blocked on Wave 1 completion)* - [x] 19.3-02-PLAN.md — bouncer cookie transport and Turnstile, surf CORS hardening and `cors:`, opt-in /api-docs (wave 2) -- [ ] 19.3-03-PLAN.md — summer.yaml `build.tags` and the `summercms_s3` S3 driver, disk-name extension fix, `storage.uploads.public_url` (wave 2) +- [x] 19.3-03-PLAN.md — summer.yaml `build.tags` and the `summercms_s3` S3 driver, disk-name extension fix, `storage.uploads.public_url` (wave 2) - [ ] 19.3-04-PLAN.md — Site-cache purge in cooler, `pact.ReorderAfterSave`, Journal/menu/FAQ adoption, shared Nuxt purge route in three layers, push checkpoint, app pointer bumps (wave 2) **Wave 3** *(blocked on Wave 2 completion)* @@ -1386,7 +1386,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19. Chat and ChatChannels | 0/TBD | Not started | - | | 19.1. Chat satellites | 0/TBD | Not started | - | | 19.2. Chat polish against WavePath clients | 0/TBD | Not started | - | -| 19.3. Framework transport and infrastructure for WavePath | 2/5 | In Progress| | +| 19.3. Framework transport and infrastructure for WavePath | 3/5 | In Progress| | | 19.4. OIDC provider on wristband | 0/TBD | Not started | - | | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 699ab60..63aac18 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,16 +4,16 @@ milestone: v1.0 current_phase: "19.3" current_phase_name: Framework transport and infrastructure for WavePath (INSERTED) status: executing -stopped_at: Completed 19.3-02-PLAN.md -last_updated: "2026-10-15T16:02:18.570Z" +stopped_at: Completed 19.3-03-PLAN.md +last_updated: "2026-10-15T16:14:32.300Z" last_activity: 2026-10-15 last_activity_desc: Phase 19.3 execution started -state_head: e3ba89a411b85ee79e8afce8bf08739f78c99ecf +state_head: 17054f9f85d2ffb216b2afe8e9750e72c2924c4d progress: total_phases: 40 completed_phases: 31 total_plans: 190 - completed_plans: 184 + completed_plans: 185 gsd_state_version: "1.0" milestone_name: milestone --- @@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12) ## Current Position Phase: 19.3 (Framework transport and infrastructure for WavePath (INSERTED)) — EXECUTING -Plan: 3 of 5 +Plan: 4 of 5 Status: Ready to execute Last activity: 2026-10-15 — Phase 19.3 execution started @@ -241,6 +241,7 @@ Progress: [████░░░░░░] 44% | Phase 18.1 P06 | 50min | 5 tasks | 39 files | | Phase 19.3 P01 | 14 min | 2 tasks | 20 files | | Phase 19.3 P02 | 15min | 4 tasks | 11 files | +| Phase 19.3 P03 | 10 min | 3 tasks | 20 files | ## Accumulated Context @@ -814,6 +815,9 @@ Recent decisions affecting current work: - [Phase 19.3]: 19.3-02: route-group CORS uses cors: from http.cors_profiles.; the router registers OPTIONS preflight routes (owner surf) and refuses overlap with http.cors.paths - [Phase 19.3]: 19.3-02: Turnstile open/closed follows PHP; with a secret, a transport error or timeout is 422 in both modes and a missing token fails without a siteverify call; a published *bouncer.Turnstile or bouncer.TurnstileWriter overrides the defaults - [Phase 19.3]: 19.3-02: /api-docs is opt-in (http.api_docs.enabled), spec from exactly one surf.APIDocsProvider converted at boot, swagger-ui-dist pinned to 5.33.1 with sha384 SRI and a nonce CSP +- [Phase 19.3]: 19.3-03: S3 driver opt-in via summer.yaml build.tags summercms_s3 (attach.S3BuildTag); untagged binaries refuse s3:// at boot naming the tag +- [Phase 19.3]: 19.3-03: attach.DiskExtension derives the stored extension from the sniffed type (fixed table, script-capable client extensions become txt/bin); file_name keeps the client name +- [Phase 19.3]: 19.3-03: storage.uploads.public_url applies to every attach URL; start-up line and docs require a public-files-only bucket ### Pending Todos @@ -892,6 +896,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-15T16:02:17.838Z -Stopped at: Completed 19.3-02-PLAN.md +Last session: 2026-10-15T16:14:31.591Z +Stopped at: Completed 19.3-03-PLAN.md Resume file: None