5. The new code has unit tests, delivered in the phase's last plan.
**Open questions (discuss-phase):** impersonate user in or out of scope (security-sensitive); a separate permission for granting the `admin` group (it makes a site admin); whether convert-guest is needed for the application's data.
**Plans:**4/5 plans executed
**Plans:**5/5 plans executed
Plans:
@@ -666,7 +666,7 @@ Plans:
- [x] 12.1-04-PLAN.md — User Groups and Organisations screens, the `members` relation manager, the privileged-group guard on every `users_groups` write path (T-12-18), and the application's parity allow-list entry and submodule pointer on framework v0.1.3
**Wave 5***(blocked on Wave 4 completion)*
- [] 12.1-05-PLAN.md — Unit tests last: full coverage in both repos, `scripts/check-phase12.1.sh`, the security review and the validation sign-off, then the plugin push (only when v0.1.3 is on origin)
- [x] 12.1-05-PLAN.md — Unit tests last: full coverage in both repos, `scripts/check-phase12.1.sh`, the security review and the validation sign-off, then the plugin push (only when v0.1.3 is on origin)
### Phase 12.2: Admin form fields: date, file upload, relation editing with deferred binding (INSERTED)
Last activity: 2026-10-04 — Phase 12.1 execution started
Status: All plans summarized; awaiting phase verification and human UAT
Last activity: 2026-10-05 — Plan 12.1-05 SUMMARY closed out
Progress: [██████░░░░] 60%
Progress: [██████████] 100%
## Performance Metrics
@@ -176,6 +176,7 @@ Progress: [██████░░░░] 60%
| Phase 12.1 P02 | 12h 43m | 6 tasks | 77 files |
| Phase 12.1 P03 | 46min | 4 tasks | 40 files |
| Phase 12.1 P04 | 32min | 4 tasks | 35 files |
| Phase 12.1 P05 | 103min | 3 tasks | 56 files |
## Accumulated Context
@@ -584,9 +585,7 @@ Recent decisions affecting current work:
- Phase 9 (admin schema pipeline / relation manager) is the least-precedented design surface in the research — plan with `--research-phase`.
- Phase 11 (River dual-driver split) is documented but unverified against a real build — plan with `--research-phase` and budget a timed-latency test.
- Phase 8 UI gate: scripts/check-phase8-ui.mjs --final-gate's real Playwright browser matrix (32 UI-SPEC scenarios) is unimplemented (deliberate fatal() at check-phase8-ui.mjs:458, never authored by 08-05); stage_ui_harness must keep failing closed until a Playwright spec is authored. User approved Phase 8 closure on 2026-09-24 with this gap carried forward -- see 08-10-SUMMARY.md and .planning/phases/08-oauth2-1-authorization-server/deferred-items.md.
-Push summercms.go master and tag v0.1.3 to origin (tag is local on df5cace by the user's tag-local choice); the sm-user-plugin push of plan 12.1-05 Task 3 waits until git ls-remote --tags origin v0.1.3 lists the tag
- fonoteka.go plugins/golem15/fonoteka: TestPhase09SecurityRoutes and TestPhase10ControllerCopy fail against framework v0.1.3 (fixed route and message-key lists lack the Phase 12.1 additions); see .planning/phases/12.1-user-plugin-admin-screens/deferred-items.md
- fonoteka.go: four more application tests pin lists the user plugin's admin work changes (TestAdminMetadataFiltering, TestHiddenNeverMarshals, parity TestMigrateSeedsCanonicalGenres and TestRollbackLastIsolatesFonoteka) and TestSchemaMatchesPHPSnapshot needs the frontend-permissions allow-list entry; plan 12.1-04 owns them (deferred-items.md)
-pending: push sm-user-plugin — 12.1-05 Task 3 condition (c) failed (`git ls-remote --tags origin v0.1.3` empty). Push summercms.go master and annotated tag v0.1.3 (local on df5cace) first, then the plugin, then fonoteka.go. Recorded in 12.1-05-SUMMARY.md.
- "Phase gate: go test -json detector refuses fail, skip, zero tests, non-JSON, missing named prefix; removal is anchor-exact mutate / assert-fail / cmp restore"
- "One TestPhase121Threats per repository, subtest named by threat id; high/critical threats also have a removal row"
- "Security review was self-performed by the executor (no reviewer agent on this runtime); threats_open 0; five findings_for_decision recorded, not closed silently"
- "No follow-up framework tag: git diff --name-only v0.1.3 HEAD -- modules cmd admin/src lists only Go tests and testdata"
- "Two plugin production fixes during tests (FX-1 clean statement, FX-2 group filter value); FX-3 is a test-only strengthening of T-12.1-24"
patterns-established:
- "Last plan of a phase: named threat tests, 80% coverage floor, removal harness, SECURITY-REVIEW, VALIDATION sign-off, then one plugin push point gated on a published framework tag"
requirements-completed: [SC-5]
coverage:
- id: D1
description: "Named threat tests in both repos and a fail-closed --security stage"
rationale: "End-of-phase visual walk of the three screens in light and dark mode, and the D-30 email/password/delete feel, cannot be asserted by unit tests (plan 05 Task 3 human-check)."
duration: 103min
completed: 2026-10-05
status: complete
---
# Phase 12.1: User plugin admin screens — Plan 05 Summary
**Fail-closed `scripts/check-phase12.1.sh`, named threat tests in both repos, SPA backstops, 80%+ coverage, security review with zero open threats, and validation signed off. Plugin push is pending because `v0.1.3` is not on origin.**
## Performance
- **Duration:** 103 min (executor 14:30–16:13 local). The previous session finished every production commit and died before this SUMMARY; this file closes that illegal partial-plan state.
- **Started:** 2026-10-05T12:30:31Z
- **Completed:** 2026-10-05T14:13:50Z (production commits); SUMMARY closed out 2026-10-05T15:00:00Z
- **Tasks:** 3 of 3
- **Files modified:** 37 in summercms.go, 17 in sm-user-plugin, 2 pointer bumps in fonoteka.go
## Accomplishments
- One named threat test per repository. Cabana `TestPhase121Threats` covers T-12.1-01 to T-12.1-15. Plugin `TestPhase121Threats` covers T-12.1-18 to T-12.1-25, 27 to 31, 34, 38 and 39, and cites T-12-18 by that id.
-`scripts/check-phase12.1.sh` is executable and fail-closed. `--all` passed in 11 min 47 s. `--removal` passed 27 rows in 6 min 29 s and left both trees clean.
- Five UI-SPEC backstops have named vitest cases (bulk-menu focus, preview URL mapping, unknown row state, permission-editor emission, locked relation options).
-`12.1-SECURITY-REVIEW.md`: 41 threat ids match the five plans, `threats_open: 0`, D-30 and T-12-18 sections present. `12.1-VALIDATION.md`: `nyquist_compliant: true`, no TBD row.
## Task Commits
### summercms.go
| Task | Commit | Subject |
|------|--------|---------|
| 1 | `c076b4c` | test(12.1-05): threat test for the Phase 12.1 framework contracts and the first gate stages |
| 2 | `2e94cbf` | test(12.1-05): unit tests for bulk and record actions, row state, forbidden, preview and the form seams |
| 3 | `84efdc0` | test(12.1-05): unit tests for the Phase 12.1 SPA components |
| 3 | `aced6c7` | test(12.1-05): unit tests for the list, form, preview and routing behaviours of Phase 12.1 in the SPA |
| 3 | `3190b1c` | test(12.1-05): complete the Phase 12.1 gate with the removal, coverage, app and evidence stages |
| 3 | `83feeef` | docs(12.1-05): state the limits of relation locks and locked permission codes |
| 3 | `93f0171` | docs(12.1-05): security review and validation sign-off for Phase 12.1 |
Framework head before `52f864e`, after `93f0171`. Tag `v0.1.3` (`df5cace`) is an ancestor. No production Go or SPA source under `modules`, `cmd`, or `admin/src` changed after the tag.
### sm-user-plugin
| Task | Commit | Subject |
|------|--------|---------|
| 1 | `ba43ad9` | test: pin every mitigated Phase 12.1 threat of the admin screens in TestPhase121Threats |
| 2 | `f496959` | fix: read privileged membership and the admin actions through a clean statement (T-12.1-38, T-12.1-39) |
| 2 | `43fabfa` | fix: a group filter value that is not a group id lists nobody (D-23) |
| 2 | `493a3ff` | test: unit tests for the admin class functions, the models and the admin registration |
| 2 | `a848aa1` | test: edge cases of the Users, User Groups and Organisations admin controllers |
| 2 | `7991b53` | test: extend the permission resolver table, the admin migration history and the API token refusals |
| 3 | `2b04cda` | test: T-12.1-24 also marshals a user with last_seen and permissions |
Plugin head before `4693155`, after `2b04cda`. Tree clean. 21 commits ahead of origin `0fe5b91`. Remote head was `0fe5b91` at the start of Task 2 and still `0fe5b91` at close-out: this plan pushed nothing.
### fonoteka.go
| Purpose | Commit | Subject |
|---------|--------|---------|
| Task 2 pointer | `ed78e6e` | build: bump sm-user-plugin (unit tests, the group filter value and the clean-statement fix) |
| Task 3 pointer | `93b8b75` | build: bump sm-user-plugin (T-12.1-24 marshals the user model) |
Application pointer equals plugin HEAD `2b04cda`. fonoteka.go was not pushed.
## Gate output (recorded 2026-10-05)
| Stage | Time | Result |
|-------|------|--------|
| `--self-test` | 2 s | PASS |
| `--go` | 87–130 s | PASS |
| `--security` | 84 s | PASS |
| `--coverage` | 111 s | PASS (numbers above) |
| `--spa` | 52 s | PASS (71 files, 1013 tests with typecheck) |
| `--openapi` | 11 s | PASS |
| `--dist` | 19–22 s | PASS |
| `--docs` | 8 s | PASS |
| `--hygiene` | <1 s | PASS |
| `--app` | 290–325 s | PASS |
| `--evidence` | <1 s | PASS |
| `--all` | 11 min 47 s | PASS |
| `--removal` | 6 min 29 s (27 rows) | PASS; both trees clean afterwards |
Renaming one named plugin test by hand made `--security` exit non-zero with `refuse: missing named test`; the rename was reverted (T-12.1-35).
## Publication (T-12.1-40)
Checked after the review and `--all` on the final heads. Plugin remote head noted at the start of step (5): `0fe5b91b632a0ab784f3cecd2d5cf168528062ac`.
| (c) `git ls-remote --tags origin v0.1.3` lists the tag | **no** | empty |
| (d) no framework production code after the tag | yes | `git diff --name-only v0.1.3 HEAD -- modules cmd admin/src` is tests and testdata only |
**pending: push sm-user-plugin** because (c) failed. Push framework `master` and annotated tag `v0.1.3` first (pending since plan 02). Then push sm-user-plugin master (never force). Then **push fonoteka.go** (user step). No follow-up framework tag is needed from this plan.
## Decisions Made
- Reviewer line is the executor self-review, matching 08-10 and Phase 12, because this runtime cannot spawn the security-review agent.
- H-01 and H-02 (relation-lock vs manager; locked permission value outside the mode) were documented in `docs/backend/relation-manager.md` and `docs/backend/forms.md` rather than changing tagged production code.
- Five findings left for the owner (FD-1 to FD-5): organisation_role on unlink, lock vs relation manager, boolean permission JSON, host `admin.jwt.secret`, and whether deactivate/ban should follow D-30.
## Deviations from Plan
### Auto-fixed Issues
**1. FX-1 — privileged membership read cloned a dirty statement**
- **Found during:** Task 2 / removal of T-12.1-38
- **Issue:** `classes.fresh` chained `WithContext` onto a lazy `NewDB` session and cloned the caller's conditions; `IsPrivilegedMember` could answer false for a privileged member
- **Fix:** build the empty statement first (`f496959`)
**3. FX-3 — T-12.1-24 removal survived on API payloads only**
- **Found during:** Task 3 `--removal` RC-18
- **Issue:** the subtest only read field-by-field API payloads, so removing `json:"-"` on `LastSeen` still passed
- **Fix:** also marshal the model (`2b04cda`)
- **Verification:** RC-18 and RC-27 now fail as required
- **Committed in:** `2b04cda`
---
**Total deviations:** 3 auto-fixed (2 production plugin fixes, 1 test strengthening). No framework production code. No scope creep.
## Issues Encountered
The first executor session completed every plan-05 production commit (`93f0171` last) and exhausted context before writing SUMMARY.md. Resume closed that gap instead of re-executing the 250k-token plan.
## User Setup Required
None - no external service configuration required.
Pending owner actions (not setup): push `v0.1.3` to origin, then sm-user-plugin, then fonoteka.go. Human visual UAT of the three screens is `/gsd-verify-work 12.1`.
## Next Phase Readiness
- Automated evidence for SC-5 is in place. Phase stays pending until human verification of the three screens.
- Plugin and application remain local-only until the framework tag is on origin.
- FD-1..FD-5 in the security review are owner decisions, not blockers for this plan.
## Self-Check: PASSED
- [x] All three tasks executed and committed
- [x] Gate `--all` and `--removal` recorded passing
- [x] Coverage floor met
- [x] Threat ids in the review match the five plans (41)
- [x] Publication recorded as pending with the failed condition
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Jakub Zych