From 33920ed558f19cda2b380340033b5fb95848dcb9 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 26 Oct 2026 10:50:20 +0100 Subject: [PATCH] docs(19.6-01): mark plan 01 complete in the roadmap --- .planning/ROADMAP.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index a240387e..1e654b63 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1396,11 +1396,11 @@ Plans: 3. Device authorization (`devices/initiate`, `devices/status/{token}`, `devices/authorize`, and the device list and revoke) works on the `DeviceAuthSession` model. 4. The models TwoFactorMethod, TwoFactorChallenge, TwoFactorRecoveryCode, TrustedDevice, WebAuthnCredential and DeviceAuthSession and their migrations are ported. The phase gets a security review. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 4 plans +**Plans:** 1/4 plans executed Plans: **Wave 1** -- [ ] 19.6-01-PLAN.md — Foundations: decision note for pquerna/otp, go-webauthn and boombuler/barcode, sm-user-plugin seams (login gates in Login with the restore after the gate, login and password-changed events, reset-2FA slot and permission), device authorization flow with the JTI followed through refresh, human package check (wave 1) +- [x] 19.6-01-PLAN.md — Foundations: decision note for pquerna/otp, go-webauthn and boombuler/barcode, sm-user-plugin seams (login gates in Login with the restore after the gate, login and password-changed events, reset-2FA slot and permission), device authorization flow with the JTI followed through refresh, human package check (wave 1) **Wave 2** *(blocked on Wave 1 completion)* - [ ] 19.6-02-PLAN.md — New repo sm-mfa-plugin: TOTP tracer through the challenge, recovery and email codes with the D-18 hardening, trusted devices, settings screen, revocation on password change, admin reset service (wave 2) @@ -1582,6 +1582,7 @@ Plans: - 301/302/410 redirects, the 404 log, URL normalisation and strict URLs; - the robots.txt editor, AI bot switches, verification files; - MCP tools for all of it, with batch dry-run, CSV import/export and history with undo. + **Mode:** mvp **Depends on:** Phase 17 (signpost, sitemap plugin), Phase 19.7 (pier MCP) **Repos:** `summercms.go` (pact, cabana, signpost seams; framework release tag at the end), new `sm-seo-plugin`, `sm-journal-plugin` (signpost descriptors), the apps that mount the plugin @@ -1610,6 +1611,7 @@ Plans: - the crawler and issue report; - internal linking, auto-links and the orphan report; - media SEO (alt, file names, formats). + **Mode:** mvp **Planning:** exception to the lean-planning rule approved by Jakub on 2026-10-25: about 12–15 smaller plans instead of a few large ones. **Depends on:** Phase 32 @@ -1673,7 +1675,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19.4. OIDC provider on wristband | 4/4 | Complete | 2026-10-20 | | 19.4.1. Early public demo on demo.summercms.io | 5/5 | In Progress| | | 19.5. Social login in sm-user-plugin | 5/5 | Complete | 2026-10-21 | -| 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | +| 19.6. Two-factor auth and device flow in sm-user-plugin | 1/4 | In Progress| | | 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete | 2026-10-22 | | 19.7. Generic MCP module | 9/9 | In Progress| | | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress| |