docs(19.4-03): record plan state and roadmap progress

.planning/ROADMAP.md

@@ -1299,7 +1299,7 @@ Plans:
   4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review.
   5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 2/4 plans executed
+**Plans:** 3/4 plans executed
 
 Plans:
 **Wave 1**
@@ -1309,7 +1309,7 @@ Plans:
 - [x] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2)
 
 **Wave 3** *(blocked on Wave 2 completion)*
-- [ ] 19.4-03-PLAN.md — Winter import with original kids, cabana Clients and Branding screens, rotate-keys, prune and schedule, tide parity against the PHP plugin, security review (wave 3)
+- [x] 19.4-03-PLAN.md — Winter import with original kids, cabana Clients and Branding screens, rotate-keys, prune and schedule, tide parity against the PHP plugin, security review (wave 3)
 
 **Wave 4** *(blocked on Wave 3 completion)*
 - [ ] 19.4-04-PLAN.md — Unit tests: PHP test map port plus Go-only cases, scripts/check-phase19.4.sh (wave 4)
@@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
 | 19. Chat and ChatChannels | 7/7 | Complete    | 2026-10-17 |
 | 19.1. Chat satellites | 6/6 | Complete    | 2026-10-18 |
 | 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress|  |
-| 19.4. OIDC provider on wristband | 2/4 | In Progress|  |
+| 19.4. OIDC provider on wristband | 3/4 | In Progress|  |
 | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - |
 | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - |
 | 19.7. Generic MCP module | 0/TBD | Not started | - |

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "19.4"
 current_phase_name: OIDC provider on wristband (INSERTED)
 status: executing
-stopped_at: Completed 19.4-02-PLAN.md
-last_updated: "2026-10-19T17:27:50.200Z"
+stopped_at: Completed 19.4-03-PLAN.md
+last_updated: "2026-10-19T18:41:39.960Z"
 last_activity: 2026-10-19
 last_activity_desc: Phase 19.4 execution started
-state_head: 8171eb25efc1ab4ad298338bbffd8598a7dc2c69
+state_head: 2ace6a2b9d2406bf85e0be9567ef68dca2a19549
 progress:
   total_phases: 42
   completed_phases: 34
   total_plans: 208
-  completed_plans: 206
+  completed_plans: 207
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12)
 ## Current Position
 
 Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING
-Plan: 3 of 4
+Plan: 4 of 4
 Status: Ready to execute
 Last activity: 2026-10-19 — Phase 19.4 execution started
 
@@ -260,6 +260,7 @@ Progress: [████████░░] 83%
 | Phase 19.1 P19.1-06 | 16 | 3 tasks | 46 files |
 | Phase 19.4 P01 | 28 min | 4 tasks | 34 files |
 | Phase 19.4 P02 | 50min | 5 tasks | 54 files |
+| Phase 19.4 P03 | 71 min | 7 tasks | 61 files |
 
 ## Accumulated Context
 
@@ -882,6 +883,10 @@ Recent decisions affecting current work:
 - [Phase 19.4]: 19.4-02: first signing key via INSERT ... ON CONFLICT (active) WHERE active DO NOTHING with a silent GORM logger so key ciphertext never reaches the log
 - [Phase 19.4]: 19.4-02: plugin-owned oauthserver.body.limit middleware on the token routes because surf ignores body.limit on GroupRaw routes
 - [Phase 19.4]: 19.4-02: SanitizeCustomCSS repeats tag-opener removal until stable (PHP single pass is bypassable)
+- [Phase 19.4]: 19.4-03: skip-parity at Task 5; per the user's D-14 amendment the PHP OIDC recording is a preliminary task of the WavePath cutover phase (todo 2026-10-19-record-php-oidc-parity-against-wavepath); the phase verdict is not held at human_needed
+- [Phase 19.4]: 19.4-03: admin redirect URIs are checked on save with wristband.RejectRedirectURI; http loopback only on development clients
+- [Phase 19.4]: 19.4-03: lagoon has no string/url/regex rules, so branding formats are checked in the branding controller and Rules() use only nullable|max:N
+- [Phase 19.4]: 19.4-03: security review pinned every T-19.4 mitigation with a test (summercms.go eaa545c, plugin b4223be, f8eaf70); T-19.4-36..39 accepted
 
 ### Pending Todos
 
@@ -976,6 +981,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-19T17:27:49.408Z
-Stopped at: Completed 19.4-02-PLAN.md
+Last session: 2026-10-19T18:41:28.084Z
+Stopped at: Completed 19.4-03-PLAN.md
 Resume file: None

.planning/phases/19.4-oidc-provider-on-wristband/19.4-03-SUMMARY.md

@@ -317,7 +317,7 @@ See `key-decisions` in the frontmatter.
 11. **Additive names:** root `Config.RotationInterval`, the plugin publishes its `*classes.KeyRing` for the commands; console `PruneMargin`, `WinterOptions.Settings`, `WinterOptions.UploadsDir`; classes `RevealTTL`; controllers `ActionRegenerateSecret`, `PermissionManageClients`, `PermissionManageSettings`, `SecretRevealView`, `AuthorizationsView`, `AuthorizationRow`; models.Client `RedirectURIsText`, `Fillable`, `Rules`, `SetPendingSecret`, `TakePendingSecret`.
 12. **Modules:** plugin go.mod moved gocloud.dev v0.46.0 and github.com/goccy/go-yaml v1.19.2 from indirect to direct at the same versions; no new module (T-19.4-SC holds).
 13. **Not created (skip-parity):** `testdata/parity/seed.json`, `winter-export.jsonl` and `id_token_shape.json` are written from a PHP recording, so they come with the deferred WavePath recording.
-14. **Task 6 action text:** it still describes a "Human verification pending" section after skip-parity; the amended must-have truth, acceptance criteria, done text and the user's decision supersede it, so this SUMMARY carries the `Deferred to the WavePath cutover` section instead.
+14. **Task 6 action text:** its body still asks for a human-verification item after skip-parity (pre-amendment wording); the amended must-have truth, acceptance criteria, done text and the user's decision supersede it, so this SUMMARY carries the `Deferred to the WavePath cutover` section instead.
 
 ---