docs(phase-19.6.1): mark phase complete after UAT and security

.planning/PROJECT.md

@@ -67,6 +67,10 @@ Validated in Phase 19.5: Social login
 
 - [x] The new sm-sociallogin-plugin signs users in with Google, GitHub, Microsoft and Facebook through PHP's `/oauth/{provider}` paths, with a provider registry other plugins extend, the SPA one-time-code handoff, the pending-registration branch and linking through a one-time link ticket; a verified email auto-links only onto an account that proved its address (`users.email_verified_at` in sm-user-plugin, a deliberate divergence from PHP); `scripts/check-phase19.5.sh` is the fail-closed gate (UAT and security 2026-10-21). The email-proof fix (sm-user-plugin v0.1.5, sm-sociallogin-plugin v0.1.2) is released with the 19.8 release
 
+Validated in Phase 19.6.1: Backend Administrators screen
+
+- [x] Backend admin users and roles are managed in the admin SPA (Settings → System), WinterCMS-style, with `backend.manage_users` / `backend.manage_roles`, server-side privilege rules (superuser-only flag, ceilings, self-edit, outranking, last-superuser lock) and a generic record-action seam; `scripts/check-phase19.6.1.sh` is the fail-closed gate (UAT 26/26 and security 33/33 closed, 2026-10-22)
+
 ### Active
 
 Framework kernel
@@ -95,7 +99,7 @@ Background and integrations
 
 Admin
 
-- [ ] Backend admin users with roles, separate from frontend users, as in WinterCMS
+- (backend admin users and roles — moved to Validated in Phase 19.6.1)
 - [ ] `fields.yaml` and `columns.yaml` parsed (goccy/go-yaml) into a JSON form and list schema served per controller, with the field types Płytarium actually uses (text, textarea, checkbox, switch, dropdown with model-method options, relation with nameFrom/emptyOption) plus layout hints (span, tabs, context, attributes), and a first-class relation-manager schema replacing the one `partial` field
 - [ ] A minimal Vue 3 + TypeScript admin SPA that renders those schemas as lists and forms for the five Płytarium controllers (Albums, Artists, Collections, Genres, Styles), with types generated from the API's OpenAPI document
 
@@ -187,6 +191,7 @@ Validated in Phase 18.1: Payment Gateway Subscriptions
 | A soft (optional) plugin dependency still requires the provider module in `go.mod`; only `Requires()` omits it | A typed `Lookup` needs the package that declares the interface; optional means "skipped at Boot when absent", not "not compiled in" (`docs/plugins/extending.md`) | ✓ Good (Phase 19.1 UAT override, 2026-10-18) |
 | OIDC on wristband with golang-jwt v5, not zitadel/oidc (Phase 19.4, `notes/2026-10-19-oidc-on-wristband-golang-jwt.md`) | wristband already owned the OAuth flows and PHP-compatible encoding; zitadel's own storage and routing would fight both. go-oidc and x/oauth2 are test-only, for relying-party interop | ✓ Good (Phase 19.4 UAT, 2026-10-20) |
 | PHP OIDC parity is recorded at the WavePath cutover, not in Phase 19.4 (D-14 amended) | The harness ships and replays Go-side; recording needs the live PHP site, and WavePath's provider must not move until the replay is green | — Pending (todo `2026-10-19-record-php-oidc-parity-against-wavepath`) |
+| Administrators and Roles live in cabana as an internal pseudo-plugin; privilege rules run in the save transaction; contributed Administrators Runs are wrapped with `guardOutranked` | WinterCMS screens were missing and 19.7 needs the record-action seam; a delegated editor must not outrank the target or capture a code-declared role | ✓ Good (Phase 19.6.1 UAT 26/26, 2026-10-22) |
 
 ## Evolution
 
@@ -206,4 +211,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-10-21 after Phase 19.5 completion*
+*Last updated: 2026-10-22 after Phase 19.6.1 completion*

.planning/ROADMAP.md

@@ -41,7 +41,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [ ] **Phase 19.4.1: Early public demo on demo.summercms.io** - sm-demo-app with today's shared plugins on rome: open registration, guided tour, journal, bm's presentation system, quizzes, payments; backend by request
 - [x] **Phase 19.5: Social login in sm-user-plugin** - Google and Facebook login with the SPA one-time-code handoff (completed 2026-10-21)
 - [ ] **Phase 19.6: Two-factor auth and device flow in sm-user-plugin** - TOTP, WebAuthn, email and recovery codes, trusted devices, device authorization
-- [ ] **Phase 19.6.1: Backend Administrators screen** - Admins and roles CRUD in cabana, WinterCMS-style, with server-side privilege rules
+- [x] **Phase 19.6.1: Backend Administrators screen** - Admins and roles CRUD in cabana, WinterCMS-style, with server-side privilege rules (completed 2026-10-22)
 - [ ] **Phase 19.7: Generic MCP module** - Opt-in MCP endpoint, plugin-declared tools filtered by permissions, one connector per person via OAuth and a verified account link
 - [ ] **Phase 19.8: Console commands overhaul** - `diary` logging module, Artisan-grade global flags, help and `list` in `bonfire`, sweep of every command
 - [ ] **Phase 20: Demo instance with every shared plugin** - Add the chat family (chat, channels, video calls, chatbots, forum, herald, friends) to the live demo from Phase 19.4.1
@@ -1423,7 +1423,7 @@ Plans:
   2. Privilege rules hold on the server: only a superuser can create, edit or grant superuser; an admin cannot raise their own role or permissions; the last active superuser cannot be deactivated, demoted or deleted.
   3. The record-action seam on the Administrators list is usable by plugins (19.7's link action), and unit tests cover the privilege rules.
 
-**Plans:** 5/5 plans executed
+**Plans:** 5/5 plans complete
 
 Plans:
 - [x] 19.6.1-05-PLAN.md
@@ -1597,7 +1597,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19.4.1. Early public demo on demo.summercms.io | 5/5 | In Progress|  |
 | 19.5. Social login in sm-user-plugin | 5/5 | Complete    | 2026-10-21 |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
-| 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | In Progress|  |
+| 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete    | 2026-10-22 |
 | 19.7. Generic MCP module | 0/TBD | Not started | - |
 | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress|  |
 | 20. Demo instance with every shared plugin | 0/TBD | Not started | - |

.planning/STATE.md

@@ -1,17 +1,17 @@
 ---
 msd_state_version: "1.0"
 milestone: v1.0
-current_phase: 19.6.1
-current_phase_name: Backend Administrators screen (INSERTED)
-status: verifying
-stopped_at: Completed 19.6.1-05-PLAN.md
-last_updated: "2026-10-22T12:44:09.094Z"
+current_phase: "19.3"
+current_phase_name: Framework transport and infrastructure for WavePath
+status: planning
+stopped_at: Phase 19.6.1 complete, ready to plan Phase 19.3
+last_updated: "2026-10-22T13:36:21.249Z"
 last_activity: 2026-10-22
-last_activity_desc: Phase 19.6.1 execution started
-state_head: 1e3b006c5dface4668023bc3359c3b35e4f8de5d
+last_activity_desc: Phase 19.6.1 complete, transitioned to Phase 19.3
+state_head: b28800ad3931954e1b80b6b6af5bb9a5d64b559a
 progress:
   total_phases: 45
-  completed_phases: 36
+  completed_phases: 37
   total_plans: 238
   completed_plans: 229
 gsd_state_version: "1.0"
@@ -22,17 +22,17 @@ milestone_name: milestone
 
 ## Project Reference
 
-See: .planning/PROJECT.md (updated 2026-10-12)
+See: .planning/PROJECT.md (updated 2026-10-22)
 
 **Core value:** An existing WinterCMS-shaped app can be ported plugin by plugin to a single Go binary without its frontend noticing: the PHP version's API contract is the acceptance test.
-**Current focus:** Phase 19.6.1 — Backend Administrators screen (INSERTED)
+**Current focus:** Phase 19.3 — Framework transport and infrastructure for WavePath
 
 ## Current Position
 
-Phase: 19.6.1 (Backend Administrators screen (INSERTED)) — EXECUTING
-Plan: 5 of 5
-Status: Phase complete — ready for verification
-Last activity: 2026-10-22 — Phase 19.6.1 execution started
+Phase: 19.3 — Framework transport and infrastructure for WavePath
+Plan: Not started
+Status: Ready to plan
+Last activity: 2026-10-22 — Phase 19.6.1 complete, transitioned to Phase 19.3
 
 Progress: [████████░░] 82%
 
@@ -40,7 +40,7 @@ Progress: [████████░░] 82%
 
 **Velocity:**
 
-- Total plans completed: 110
+- Total plans completed: 115
 - Average duration: 21 min
 - Total execution time: 104 min
 
@@ -67,6 +67,7 @@ Progress: [████████░░] 82%
 | 19.1 | 6 | - | - |
 | 19.4 | 4 | - | - |
 | 19.5 | 5 | - | - |
+| 19.6.1 | 5 | - | - |
 
 **Recent Trend:**
 
@@ -940,6 +941,7 @@ Recent decisions affecting current work:
 - [Phase 19.6.1]: Roles create and update refuse any new code that rolePermissions attaches grants to, including when the editor is a superuser — D-16 stricter reading from the gap contract: a role never becomes a code-declared system role through the Roles screen
 - [Phase 19.6.1]: cabana wraps contributed Administrators Runs; guardOutranked stays unexported and contributors do not own the check — D-19 gap contract: wrap in cabana so a contribution to summercms.cabana.users cannot skip outranking
 - [Phase 19.6.1]: Persist picked relation labels on the form via FORM_REMEMBER_LABEL; keep the one-panel FormGrid (do not v-show inactive tabs) — UAT G-19.6.1-T2 is labeling only; v-show of inactive tabs would change trigger hide-tab, ML locale reset, and field mount cost
+- [Phase 19.6.1]: Administrators and Roles are cabana screens behind backend.manage_users / backend.manage_roles with no default role grant; privilege rules run in the save tx; last-superuser uses pg_advisory_xact_lock; contributed Administrators Runs are wrapped with guardOutranked.
 
 ### Pending Todos
 
@@ -1039,6 +1041,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-22T12:44:00.423Z
-Stopped at: Completed 19.6.1-05-PLAN.md
+Last session: 2026-10-22T13:36:16.546Z
+Stopped at: Phase 19.6.1 complete, ready to plan Phase 19.3
 Resume file: None