golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(phase-19.7): update tracking after gap wave 2

Browse Source
This commit is contained in:
Jakub Zych
2026-10-23 16:33:11 +02:00
parent d6c7fd5a27
commit 5aeea304d0
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.planning/ROADMAP.md
View File

@@ -1454,7 +1454,7 @@ Plans:
3. `tools/list` lists only the tools the session's principals may call (frontend permissions through the merged group/user permissions, backend permissions and token scope through cabana), and a call runs through the route's own middleware.
4. An editor signs in once through `wristband` OAuth as a frontend user; with a verified link to a backend user, backend-guarded tools such as Journal's run as that admin, and removing the link or the grant removes them. The phase gets a security review; the MCP SDK dependency has a decision note before code lands; unit tests are the last plan.
**Plans:** 6/9 plans executed
**Plans:** 7/9 plans executed
Plans:
**Wave 1**
@@ -1478,7 +1478,7 @@ Gap closure (`19.7-REVIEW.md` findings, escalations E-1 and E-2; `19.7-GAP-INPUT
- [x] 19.7-06-PLAN.md — pier hardening (lane A): session reaper, atomic per-binding reservation, no global lock across guard I/O, identity widening, Redis fan-out for stateless instances, listen re-check, path-value rules, fixed error text, prompt write ceiling
**Gap wave 2** *(blocked on 19.7-06: shared pier and pact files)*
- [ ] 19.7-07-PLAN.md — Framework auth and admin (lane B): `auth_time` claim, `pact.HasFrontendTokenScopes` seam (E-2), token-specific revoke events, client address on the resolve path, My account URL and section isolation, hotkey fixes, OpenAPI and dist
- [x] 19.7-07-PLAN.md — Framework auth and admin (lane B): `auth_time` claim, `pact.HasFrontendTokenScopes` seam (E-2), token-specific revoke events, client address on the resolve path, My account URL and section isolation, hotkey fixes, OpenAPI and dist
**Gap wave 3** *(blocked on 19.7-06 and 19.7-07)*
- [ ] 19.7-08-PLAN.md — Plugins and demo (lane C): link proof on `auth_time` with the code in the fragment, grant revocation on ban/reset and link changes, member token scopes (E-2), organisation logo (E-1), Journal prompt ceiling, nginx MCP body cap
@@ -1621,7 +1621,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
| 19.5. Social login in sm-user-plugin | 5/5 | Complete | 2026-10-21 |
| 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
| 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete | 2026-10-22 |
| 19.7. Generic MCP module | 6/9 | In Progress| |
| 19.7. Generic MCP module | 7/9 | In Progress| |
| 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress| |
| 20. Demo instance with every shared plugin | 0/TBD | Not started | - |
| 30. Płytarium cutover | 0/TBD | Not started | - |

10
.planning/STATE.md
View File

@@ -4,11 +4,11 @@ milestone: v1.0
current_phase: "19.7"
current_phase_name: Generic MCP module (INSERTED)
status: executing
stopped_at: Completed 19.7-06-PLAN.md
last_updated: "2026-10-23T14:11:17.304Z"
stopped_at: Completed 19.7-07-PLAN.md
last_updated: "2026-10-23T14:33:11.727Z"
last_activity: 2026-10-23
last_activity_desc: "Completed 19.7-06: pier gap closure (lane A review findings)"
state_head: 6ca9e1706d9a8b430c76705fe45ff13708c11b8b
last_activity_desc: "Completed 19.7-07: auth_time, frontend token scopes seam, cabana and admin SPA gap closure"
state_head: d6c7fd5a2799feeaf15264842e0201826e0fcf5c
progress:
total_phases: 45
completed_phases: 37
@@ -1068,5 +1068,5 @@ Items acknowledged and carried forward from previous milestone close:
## Session Continuity
Last session: 2026-10-22T22:22:57.128Z
Stopped at: Completed 19.7-06-PLAN.md
Stopped at: Completed 19.7-07-PLAN.md
Resume file: None