docs(08-10): record the checkpoint decision and carry the Playwright UI matrix gap forward
scripts/check-phase8.sh's final gate ran once with every stage green except stage_ui_harness's Playwright browser matrix, a deliberate fatal() never authored by 08-05. The user approved closing Phase 8 with this gap carried forward; 08-VALIDATION.md flips 08-W0-07 green, marks 08-W0-08 partially verified, and sets nyquist_compliant: false honestly. deferred-items.md records what the follow-up spec needs to do.
This commit is contained in:
Jakub Zych
@@ -1,8 +1,8 @@
|
||||
---
|
||||
phase: 08
|
||||
slug: oauth2-1-authorization-server
|
||||
status: draft
|
||||
nyquist_compliant: true
|
||||
status: complete
|
||||
nyquist_compliant: false
|
||||
wave_0_complete: true
|
||||
created: 2026-09-23
|
||||
updated: 2026-09-24
|
||||
@@ -46,8 +46,8 @@ updated: 2026-09-24
|
||||
| 08-W0-04 | 08-05, 08-06, 08-10 | 5-6, 9 | AUTH-07 | T-08-SCOPE-CEILING / T-08-CROSS-USER | Consent, active-collection binding, connected-app ownership, list, and revoke semantics match PHP | Postgres integration | `cd ../fonoteka.go && go test ./plugins/golem15/fonoteka/controllers/... -run 'TestOAuth' -count=1` | ✅ W0 | ✅ green (2026-09-24; ownership/scope-ceiling coverage lives in the root `plugins/golem15/fonoteka` package's `TestOAuthConsent*`/`TestOAuthRevocation*`, exercised by 08-W0-03's command) |
|
||||
| 08-W0-05 | 08-09, 08-10 | 8-9 | AUTH-05, AUTH-06, AUTH-07 | T-08-REQUEST-LEAK / T-08-SURFACE | Nine manifest routes plus `mcp-lifecycle` replay exactly and every one of 103 PHP OAuth/security methods maps to a named Go test | parity/corpus | Focused `TestOAuthFlows`/map audits during tasks; full corpus only in `scripts/check-phase8.sh` at 08-10 Task 3 | ✅ W0 | ✅ green (2026-09-24; `parity/oauth_audit_test.go:TestPHPTestMap` confirms all 103 rows; full corpus gate is Task 3) |
|
||||
| 08-W0-06 | 08-08, 08-09 | 7-8 | AUTH-07 | T-08-SURFACE | Exact authenticated `/api/v1/fonoteka/me` lets the unchanged MCP process initialize without expanding the profile API surface | integration/e2e | `cd ../fonoteka.go && go test ./plugins/golem15/fonoteka/... -run 'TestMe|TestTokenSurface' -count=1` | ✅ W0 | ✅ green (2026-09-24) |
|
||||
| 08-W0-07 | 08-09, 08-10 | 8-9 | AUTH-05, AUTH-07 | All T-08 threats | 08-09 self-validates the gate contract; 08-10 final checkpoint alone runs real SDK discovery, DCR, PKCE, JWT consent, token, tool, refresh/replay, revoke, and post-revoke failure unchanged | e2e | `scripts/check-phase8.sh` only at 08-10 Task 3 | ✅ W0 | ⬜ pending (08-10 Task 3, not yet executed) |
|
||||
| 08-W0-08 | 08-05, 08-09, 08-10 | 5, 8-9 | AUTH-05, AUTH-07 | T-08-CROSS-USER / T-08-SURFACE | 08-05 self-validates scenario coverage; 08-10 final checkpoint alone executes invalid-handle, return-path, consent/apps, accessibility, mobile, and en/pl browser checks without Nuxt changes | browser/contract | Full `scripts/check-phase8-ui.mjs` plus Nuxt verifiers only inside final `scripts/check-phase8.sh` | ✅ W0 | ⬜ pending (08-10 Task 3, not yet executed) |
|
||||
| 08-W0-07 | 08-09, 08-10 | 8-9 | AUTH-05, AUTH-07 | All T-08 threats | 08-09 self-validates the gate contract; 08-10 final checkpoint alone runs real SDK discovery, DCR, PKCE, JWT consent, token, tool, refresh/replay, revoke, and post-revoke failure unchanged | e2e | `scripts/check-phase8.sh` only at 08-10 Task 3 | ✅ W0 | ✅ green (2026-09-24; 08-10 Task 3's sole real execution of `scripts/check-phase8.sh` -- docker preflight, Postgres, app boot, real unchanged fonoteka-mcp discovery/DCR/PKCE authorize/JWT consent/token/tool-call/refresh/replay/revoke/post-revoke-failure, both repos' vet/test/race, 169/169 parity corpus, secret scan, security-review gate, and unchanged-client diff all ran green; see checkpoint transcript and 08-10-SUMMARY.md) |
|
||||
| 08-W0-08 | 08-05, 08-09, 08-10 | 5, 8-9 | AUTH-05, AUTH-07 | T-08-CROSS-USER / T-08-SURFACE | 08-05 self-validates scenario coverage; 08-10 final checkpoint alone executes invalid-handle, return-path, consent/apps, accessibility, mobile, and en/pl browser checks without Nuxt changes | browser/contract | Full `scripts/check-phase8-ui.mjs` plus Nuxt verifiers only inside final `scripts/check-phase8.sh` | ✅ W0 | ⚠️ partially verified (2026-09-24; `verify:oauth-return-path` (6/6) and `verify:oauth-i18n` (74 keys) ran for real and are green, but `check-phase8-ui.mjs --final-gate`'s real Playwright browser matrix (32 UI-SPEC scenarios) is a deliberate `fatal()` at `scripts/check-phase8-ui.mjs:458`, never authored by 08-05. User approved closing Phase 8 with this gap carried forward -- see deferred-items.md's "Follow-up: Playwright UI matrix" entry. `stage_ui_harness` must keep failing closed until the spec exists.) |
|
||||
|
||||
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
|
||||
|
||||
@@ -55,9 +55,13 @@ updated: 2026-09-24
|
||||
commands were re-run during the security review and are green; their
|
||||
`File Exists` columns flip to ✅ now that 08-PHP-TEST-MAP.md,
|
||||
08-SECURITY-REVIEW.md and this file's own task IDs are finalized.
|
||||
08-W0-07/08-W0-08 stay `⬜ pending` until 08-10 Task 3 actually executes
|
||||
`scripts/check-phase8.sh` with no flags — that command has not run yet as
|
||||
of this update.
|
||||
**08-10 Task 3 update (2026-09-24):** `scripts/check-phase8.sh` ran with no
|
||||
flags for the first and sole time. 08-W0-07 is green (the real unchanged
|
||||
fonoteka-mcp lifecycle, both repos' vet/test/race, parity corpus, secret
|
||||
scan, security-review gate, and unchanged-client diff all passed). 08-W0-08
|
||||
is partially verified: the return-path and i18n checks are real and green,
|
||||
but the Playwright browser matrix was never authored by 08-05 and remains a
|
||||
deliberate `fatal()`; see the row above and deferred-items.md.
|
||||
|
||||
---
|
||||
|
||||
@@ -69,7 +73,7 @@ of this update.
|
||||
- [x] `../fonoteka.go/plugins/golem15/fonoteka/controllers/api/*oauth*_test.go` — exact raw/JWT endpoint bodies, headers, status codes, consent ownership, and connected-app behavior.
|
||||
- [x] `../fonoteka.go/plugins/golem15/fonoteka/controllers/api/*me*_test.go` — minimal `inv_token`-authenticated MCP bootstrap contract.
|
||||
- [x] `../fonoteka.go/parity/oauth_flow_test.go` and `mcp-lifecycle` fixture — projected existing flows and clean lifecycle/replay coverage.
|
||||
- [x] `scripts/check-phase8.sh` — two-repository vet/test/race, corpus, secret, security-review, and real-MCP gate. Stage bodies complete since 08-09; not yet executed end to end (08-10 Task 3).
|
||||
- [x] `scripts/check-phase8.sh` — two-repository vet/test/race, corpus, secret, security-review, and real-MCP gate. Stage bodies complete since 08-09; executed end to end by 08-10 Task 3 (2026-09-24) -- every stage green except `stage_ui_harness`'s Playwright matrix (carried-forward gap, see deferred-items.md).
|
||||
- [x] `scripts/check-phase8-ui.mjs` — read-only unchanged-Nuxt state, accessibility, return-path, i18n, and responsive contract gate.
|
||||
- [x] `scripts/check-phase8-red.sh` — machine-readable `go test -json` verifier requiring exact selected test/package/sentinel and zero unexpected fail actions, plus exact exit-86 stage/sentinel shell protocol.
|
||||
- [x] `08-SECURITY-REVIEW.md` — map every `T-08-*` threat to a failing-when-broken test and close all high-severity threats. `status: verified`, `threats_open: 0`, 11/11 closed (2026-09-24).
|
||||
@@ -89,9 +93,21 @@ All phase behaviors are automated. Live Claude, ChatGPT, and Grok connections ar
|
||||
- [x] Wave 0 covers every currently missing test/gate reference above.
|
||||
- [x] No watch-mode flags appear in validation commands.
|
||||
- [x] Task-level feedback is designed for ≤30 seconds; all complete suite/race/parity/UI/real-MCP work appears only in 08-10 Task 3.
|
||||
- [x] `nyquist_compliant: true` is set after task IDs are finalized and every mapping is implemented.
|
||||
- [ ] `nyquist_compliant: true` is set after task IDs are finalized and every mapping is implemented.
|
||||
**Not set.** 08-W0-08's Playwright browser matrix (32 UI-SPEC
|
||||
scenarios) is not implemented (`check-phase8-ui.mjs:458`'s deliberate
|
||||
`fatal()`), so this file's own definition of Nyquist compliance is not
|
||||
fully true. `nyquist_compliant: false` reflects that honestly; the flag
|
||||
should flip back to `true` only once the follow-up Playwright spec
|
||||
(deferred-items.md) exists and `--final-gate` runs it for real.
|
||||
|
||||
**Approval:** 08-10 Tasks 1-2 complete and green (2026-09-24). Task 3's
|
||||
`scripts/check-phase8.sh` full-gate execution and the blocking human
|
||||
security checkpoint are still outstanding -- this file's `status:` field
|
||||
stays `draft` until that checkpoint is approved.
|
||||
**Approval:** 08-10 Tasks 1-2 complete and green (2026-09-24). Task 3 ran
|
||||
`scripts/check-phase8.sh`'s full gate exactly once: every stage passed
|
||||
except `stage_ui_harness`'s Playwright browser matrix, which is a deliberate,
|
||||
never-authored `fatal()` inherited from 08-05's own scope boundary (not a
|
||||
regression introduced by this plan). Presented with that evidence, the user
|
||||
approved Phase 8 closure on 2026-09-24 with the Playwright gap explicitly
|
||||
carried forward as a named follow-up ("Approve, carry gap forward" --
|
||||
08-10 Task 3 checkpoint decision; see deferred-items.md and 08-10-SUMMARY.md).
|
||||
This file's `status:` field is `complete`; `nyquist_compliant` stays `false`
|
||||
until the follow-up closes.
|
||||
|
||||
Reference in New Issue
Block a user