From 7118e4f2800761938ae6bd1ef21665e315079eb8 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 21 Sep 2026 00:28:15 +0200 Subject: [PATCH] docs(06-10): update plan tracking --- .planning/ROADMAP.md | 4 ++-- .planning/STATE.md | 17 ++++++++++------- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index d2ba24e..63da015 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -252,7 +252,7 @@ Plans: - [x] 06-07-PLAN.md — Make limiter admission atomic and remove attacker-controlled Host from inline keys - [x] 06-08-PLAN.md — Reject private IPv4 embedded in NAT64 and 6to4 dial addresses - [x] 06-09-PLAN.md — Buffer route responses so partial-write panics yield clean raw/house 500s -- [ ] 06-10-PLAN.md — Restore exact no-newline InvScope 401/403 wire bodies +- [x] 06-10-PLAN.md — Restore exact no-newline InvScope 401/403 wire bodies **Wave 7** *(gap closure; blocked on 06-07..06-10)* @@ -425,7 +425,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 3. First vertical slice — genres end to end | 4/4 | Complete | 2026-09-17 | | 4. CLI scaffolding, i18n and mail | 4/4 | Complete | 2026-09-18 | | 5. Data layer full fidelity | 6/6 | Complete | 2026-09-18 | -| 6. HTTP routing, auth groups and rate limiting | 9/11 | In Progress| | +| 6. HTTP routing, auth groups and rate limiting | 10/11 | In Progress| | | 7. User plugin and authentication | 0/TBD | Not started | - | | 8. OAuth2.1 authorization server | 0/TBD | Not started | - | | 9. Backend admin authentication and schema pipeline | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index dbc0704..d3943bc 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -3,14 +3,14 @@ gsd_state_version: 1.0 milestone: v1.0 milestone_name: milestone status: executing -stopped_at: Completed 06-09-PLAN.md -last_updated: "2026-09-20T19:08:04.262Z" +stopped_at: Completed 06-10-PLAN.md +last_updated: "2026-09-20T22:28:10.242Z" last_activity: 2026-09-20 progress: total_phases: 15 completed_phases: 5 total_plans: 34 - completed_plans: 32 + completed_plans: 33 percent: 33 --- @@ -26,11 +26,11 @@ See: .planning/PROJECT.md (updated 2026-09-16) ## Current Position Phase: 06 (http-routing-auth-groups-and-rate-limiting) — EXECUTING -Plan: 4 of 11 +Plan: 5 of 11 Status: Ready to execute Last activity: 2026-09-20 -Progress: [█████████░] 94% +Progress: [██████████] 97% ## Performance Metrics @@ -78,6 +78,7 @@ Progress: [█████████░] 94% | Phase 06 P07 | 12 min | 1 tasks | 4 files | | Phase 06 P08 | 1h 20m | 1 tasks | 3 files | | Phase 06 P09 | 4 min | 1 tasks | 2 files | +| Phase 06 P10 | 3h 15m | 1 tasks | 2 files | ## Accumulated Context @@ -184,6 +185,8 @@ Recent decisions affecting current work: - [Phase 06]: Use one unexported bufferedResponse for house and raw recovery — A shared transactional writer keeps panic-before-write and panic-after-write behavior identical while preserving raw versus house fallback bodies. - [Phase 06]: Keep bufferedResponse Flush as a no-op — Recovery must never unwrap, hijack, flush, or otherwise expose the destination writer before handler success. - [Phase 06]: Success commit replaces only route-owned header keys — Unrelated headers already placed on the destination by outer wrappers such as path-scoped CORS must survive. +- [Phase 06]: Use wire.WriteJSON for both InvScope denial branches — The shared writer is the established PHP-compatible no-newline serialization path. +- [Phase 06]: Assert exact denial bytes before JSON shape checks — Whitespace normalization would hide response-contract regressions. ### Pending Todos @@ -205,6 +208,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-09-20T19:07:03.593Z -Stopped at: Completed 06-09-PLAN.md +Last session: 2026-09-20T22:27:07.576Z +Stopped at: Completed 06-10-PLAN.md Resume file: None