docs: capture todo - Record PHP OIDC parity against WavePath before the OIDC cutover

.planning/STATE.md

@@ -887,20 +887,27 @@ Recent decisions affecting current work:
 
 - [2026-10-01] [docs] Benchmark Płytarium on WinterCMS vs SummerCMS and publish a measured table — [todo file](.planning/todos/pending/2026-10-01-benchmark-the-application-on-wintercms-vs-summercms.md)
 - [2026-10-07] [sm-translate-plugin] Translate Messages as a Nuxt i18n JSON editor — [todo file](.planning/todos/pending/2026-10-07-translate-messages-as-nuxt-i18n-json-editor.md)
-- [unknown] [summercms.go admin auth] Backend admin personal API tokens (deferred Apparatus PersonalApiToken) — [todo file](.planning/todos/pending/backend-admin-api-tokens.md)
+- [2026-10-10] [framework] Prompt open admin and site tabs to reload when a new version is deployed — [todo file](.planning/todos/pending/2026-10-11-reload-open-apps-when-a-new-version-is-deployed.md) — Needs TBD. Ideas:.
+- [2026-10-11] [lagoon/attach, fonoteka.go uploads] Uploads keep the client file extension, so a valid image can be served as HTML (stored XSS) — [todo file](.planning/todos/pending/2026-10-11-uploads-keep-client-extension-stored-xss.md)
+- [unknown] [sm-user-plugin / cabana] Verified link between a frontend user and a backend user — [todo file](.planning/todos/pending/2026-10-17-frontend-backend-account-link.md)
+- [unknown] [sm-user-plugin / pact] Plugins register their frontend permission codes in Go — [todo file](.planning/todos/pending/2026-10-17-plugin-registered-frontend-permissions.md)
+- [2026-10-19] [sm-oauthserver-plugin] Record PHP OIDC parity against WavePath before the OIDC cutover — [todo file](.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md)
+- [unknown] [cabana / admin] Audit-log admin action runs with the admin id (toolbar actions) — [todo file](.planning/todos/pending/admin-action-audit-log.md)
 - [unknown] [summercms.go bonfire] Reject duplicate console command names in bonfire.NewRoot — [todo file](.planning/todos/pending/bonfire-duplicate-command-names.md)
+- [unknown] [sm-faq-plugin] Port the FAQ plugin as sm-faq-plugin so FAQs become editable — [todo file](.planning/todos/pending/faq-plugin-port.md)
+- [2026-10-09] [plugins] Expose author subtitle, description and avatar on the Journal author API — [todo file](.planning/todos/pending/journal-author-profile-fields.md)
 - [unknown] [summercms.go lagoon] lagoon README registers an after-commit GORM callback that can sort after the flush — [todo file](.planning/todos/pending/lagoon-readme-after-commit-callback-order.md)
 - [unknown] [sm-user-plugin mail] Port MailBlocker and the block-mail checkbox with the mailing work — [todo file](.planning/todos/pending/mailblocker-with-mailing.md)
-- [unknown] [summercms.go] Nest framework packages under modules/ — same beach names — [todo file](.planning/todos/pending/nest-framework-packages-under-modules.md)
-- [unknown] [summercms.go/modules] Short README.md per modules/* after the nest — [todo file](.planning/todos/pending/per-module-readmes-after-nest.md)
+- [unknown] [sm-menu-plugin] Port the menu plugin as sm-menu-plugin so blog menus become editable — [todo file](.planning/todos/pending/menu-plugin-port.md)
 - [unknown] [summercms.go/modules/*/README.md, internal/docsite] Convert module README Go code blocks to compiled src= references — [todo file](.planning/todos/pending/readme-go-fences-src.md)
 - [unknown] [../fonoteka.go/README.md] Refresh fonoteka.go README — short status plus migrate/serve/login — [todo file](.planning/todos/pending/refresh-fonoteka-readme.md)
-- [unknown] [summercms.go/README.md] Rewrite summercms.go README — onboard, recreate login, honest cutover — [todo file](.planning/todos/pending/rewrite-summercms-readme.md)
 - [unknown] [summercms.go internal/build] make:admin-controller output does not boot and names the model after the controller — [todo file](.planning/todos/pending/scaffold-admin-controller-incomplete.md)
 - [unknown] [summercms.go internal/build] Scaffolded files carry a DO NOT EDIT header, and make:command cannot reach the application — [todo file](.planning/todos/pending/scaffold-generated-header-and-command-deps.md)
 - [unknown] [summercms.go internal/build] make:model and make:migration in the same second produce migrations that run out of order — [todo file](.planning/todos/pending/scaffold-same-second-migration-order.md)
+- [2026-10-12] [framework] Purge the Nuxt site cache on menu and FAQ admin saves (framework-level purge service) — [todo file](.planning/todos/pending/site-cache-purge-for-menu-and-faq.md)
 - [unknown] [sm-sitemap-plugin] Port the sitemap plugin 1:1 as sm-sitemap-plugin for the next blog project — [todo file](.planning/todos/pending/sitemap-plugin-port.md)
-- [unknown] [summercms.go wristband] Neutral default resource URL in wristband.DefaultOptions — [todo file](.planning/todos/pending/wristband-neutral-resource-default.md)
+- [unknown] [sm-sitemap-plugin] Sitemap - replace the browser XSLT view before Chromium drops XSLT — [todo file](.planning/todos/pending/sitemap-xslt-browser-deprecation.md)
+- [unknown] [sm-user-plugin] Let the sm-user-plugin console commands open their own database — [todo file](.planning/todos/pending/user-plugin-commands-open-database.md)
 
 ### Blockers/Concerns
 

.planning/todos/pending/2026-10-19-record-php-oidc-parity-against-wavepath.md

@@ -0,0 +1,41 @@
+---
+created: 2026-10-19T18:07:20.071Z
+title: Record PHP OIDC parity against WavePath before the OIDC cutover
+area: sm-oauthserver-plugin
+severity: major
+files:
+  - ../sm-oauthserver-plugin/testdata/parity/README.md
+  - ../sm-oauthserver-plugin/testdata/parity/flows/
+  - ../sm-oauthserver-plugin/testdata/parity/deviations.yaml
+  - ../sm-oauthserver-plugin/parity_test.go
+  - ../sm-oauthserver-plugin/scripts/winter-export.sql
+g15office: govfaqir
+---
+
+## Problem
+
+Phase 19.4 shipped the tide record/replay harness for the OIDC provider in sm-oauthserver-plugin, but the PHP side was never recorded: at the 19.4-03 Task 5 checkpoint the user chose `skip-parity` (2026-10-19). So D-14 ("relying parties notice no difference from the PHP Golem15.OAuthServer plugin") is proven only for the Go side. `TestPHPParityReplay` and `TestIDTokenShapeParity` skip with "no PHP recordings", and they fail when `PHASE194_REQUIRE_PARITY=1` is set.
+
+The user decided that Phase 19.4 passes without the recording. Recording becomes a **preliminary task of the future WavePath cutover phase** (the WavePath work in the Phase 31+ series, not yet planned). WavePath's OIDC provider must not move to the Go plugin until this replay is green.
+
+## Solution
+
+Follow the runbook in `../sm-oauthserver-plugin/testdata/parity/README.md`:
+
+1. Start WavePath locally (`/media/nvme/dev/jz/wavepath.org`, MariaDB, Golem15.OAuthServer enabled) so that `{base_url}/.well-known/openid-configuration` answers 200.
+2. In its backend, create a dedicated parity user and an OIDC client "Parity RP":
+   - redirect URI `https://rp.example.test/callback`
+   - scopes openid, profile and email
+   - active, not a development client, not yet authorized by the parity user
+3. Log in as the parity user in a browser and copy the `token` cookie.
+4. Export with `scripts/winter-export.sql` to `~/.config/summercms/parity-oauthserver.jsonl`.
+5. Write `~/.config/summercms/parity-oauthserver.vars` (mode 0600) with:
+   - base_url, issuer, client_id, client_secret, session_token
+   - the runbook's PKCE pair
+6. Run `summer parity:record` for all ten spec flows. Do not pass `--rules`.
+7. Delete PHP's Set-Cookie headers from the fixtures. `TestParityFixturesHoldNoSecrets` fails while any remain.
+8. Write `seed.json`, `winter-export.jsonl` (hashes only) and `id_token_shape.json`.
+9. Settle every replay difference with a fix, or with a `deviations.yaml` entry whose reason cites a D-number. Known open items:
+   - Cache-Control on OIDC redirects: Go sends `no-store, private`, PHP sends `no-cache, private`.
+   - id_token header member order is not compared.
+10. The test is done when `PHASE194_REQUIRE_PARITY=1 go test -run '^(TestPHPParityReplay|TestIDTokenShapeParity)$' ./...` passes in sm-oauthserver-plugin.