From 4d5a09ae621032e5e9b9414d0fd8951c8fa6c031 Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@golem15.com>
Date: Fri, 23 Oct 2026 21:17:46 +0200
Subject: [PATCH] docs(19.7): defer the remaining lane C re-review items

---
 .../19.7-generic-mcp-module/deferred-items.md | 55 ++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

diff --git a/.planning/phases/19.7-generic-mcp-module/deferred-items.md b/.planning/phases/19.7-generic-mcp-module/deferred-items.md
index 4ac642d8..7b93bc7b 100644
--- a/.planning/phases/19.7-generic-mcp-module/deferred-items.md
+++ b/.planning/phases/19.7-generic-mcp-module/deferred-items.md
@@ -258,7 +258,7 @@ was changed by the plan that recorded it.
   5. then `PHASE197_RELEASED=1 bash scripts/check-phase19.7.sh --consumers`
      must pass (every demo pin on its tag, no drift).
 - `readLinkCode` accepts a valid code next to other fragment parameters (found during 19.7-09 Task 3)
-  status: open
+  status: resolved (gap-closure re-review: not a defect; vue-demo-app 9c247ab pins the lenient parse)
   **What:** plan 09 described "extra parameters give ''" for the link page's
   code reader. `readLinkCode` parses the fragment with URLSearchParams, so
   `#code=<64 hex>&next=/x` answers the code, while an extended or foreign
@@ -295,3 +295,56 @@ was changed by the plan that recorded it.
   are deliberately unpushed until the release order runs, so it would
   refuse every pre-release run. `PHASE197_RELEASED=1` after the tags is
   the release proof.
+- RC-CR-01 optional: base the session cutoff on `auth_time` (found in the gap-closure re-review, lane C)
+  status: open
+  **What:** the self-service password change now revokes every OAuth grant
+  as of the request (sm-user-plugin 30f7a01). The calling session's own
+  cutoff is still its `iat` second, so an attacker's frontend session JWT
+  refreshed after the victim's `iat` survives the change too. That predates
+  this phase; closing it means basing `tokens_valid_after` on the calling
+  token's `auth_time` and having `POST /refresh` and the jwt guard compare
+  `auth_time` with the cutoff, a change to session revocation in a core
+  plugin (and to how bouncer's refresh is checked) that needs its own
+  decision.
+- RC-IN-01 nginx: keep the deprecated link GET route's code out of access logs (found in the gap-closure re-review, lane C)
+  status: open
+  **What:** sm-user-plugin 92676ba makes the show and confirm POSTs ignore
+  a code in the query string. `GET /_user/api/v1/backend-link/{code}` stays
+  for compatibility (removed only in a major release), so nginx still logs
+  the code if a third-party client calls it. `access_log off;` (or a
+  `log_format` without `$request_uri`) for
+  `location ~ ^/_user/api/v1/backend-link/` in the demo's nginx config is a
+  deploy change, made with the next demo deploy; the shipped page never
+  calls the GET route.
+- RC-IN-06: the legacy MintAPIToken fallback is widened before the phrase-key check (found in the gap-closure re-review, lane C)
+  status: open
+  **What:** `classes.CompileAPITokenScopes` adds the declared names to the
+  process-wide fallback set before `bootAPITokenScopes` checks their phrase
+  keys, so a boot that fails on a missing key has already widened what
+  `MintAPIToken` accepts. Moving the add after the check needs a new
+  exported seam or a behaviour change of the exported
+  `CompileAPITokenScopes` in a core plugin; a failed boot ends the process,
+  so the widened set is never used in production. `MintAPIToken` is now
+  marked `Deprecated:` in favour of `MintAPITokenFor` (sm-user-plugin
+  9892404), which checks the application's own catalog.
+- RC-IN-07: sm-oauthserver-plugin builds only through its workspace file (found in the gap-closure re-review, lane C)
+  status: open (release-time)
+  **What:** the plugin uses `userclasses.AccessRevokedEvent`,
+  `FireSubjectEvent` and `FireSubjectEventAfterCommit`, which the required
+  sm-user-plugin v0.1.10 lacks, so `GOWORK=off go build ./...` fails. The
+  release checklist for the oauthserver tag must bump `sm-user-plugin` to
+  the new user plugin tag and pass `GOWORK=off go build ./...` before the
+  tag; the requires are not bumped before the user plugin is tagged.
+- Lane C re-review fixes moved the demo's oauthserver checkout (gap-closure re-review, lane C)
+  status: open
+  **What:** pier now gives a backend subject only to a grant that records
+  its consented administrator (`pact.MCPGrant.BackendUserID`, framework
+  c37c6ce), so the demo's e2e tests need the oauthserver commits that
+  record it. The working-tree checkout of sm-demo-app's
+  `plugins/golem15/oauthserver` was moved from 671513d to the canonical
+  b6a9586 (detached, fast-forward; the pointer stays uncommitted until the
+  plugin tag, as before). Canonical heads after the lane C fixes:
+  sm-user-plugin 9892404, sm-oauthserver-plugin 9813c1d,
+  vue-demo-app 9c247ab. `backend` grants issued before the oauthserver
+  migration `202610230001` record no administrator and stop acting as one
+  until the agent is connected again.