docs(16.3-01): advance STATE and ROADMAP after plan 01

Co-authored-by: Cursor <cursoragent@cursor.com>

.planning/ROADMAP.md

@@ -1044,11 +1044,11 @@ Plans:
   5. Module READMEs and `docs/` cover the token API, scopes and CLI commands.
   6. The new code has unit tests, delivered in the phase's last plan.
 
-**Plans:** 4 plans
+**Plans:** 1/4 plans executed
 
 Plans:
 **Wave 1**
-- [ ] 16.3-01-PLAN.md — Framework (summercms.go): pact.HasTokenScopes, bouncer scope limit, Allows rewrite (scope before the superuser shortcut), backend_api_tokens migration, composite backend guard, interactive-only marker, route gates, published cabana.ResolveBackend, account token API with OpenAPI and inventories, admin:token:* CLI with party.Activated and summer delegates, READMEs and docs
+- [x] 16.3-01-PLAN.md — Framework (summercms.go): pact.HasTokenScopes, bouncer scope limit, Allows rewrite (scope before the superuser shortcut), backend_api_tokens migration, composite backend guard, interactive-only marker, route gates, published cabana.ResolveBackend, account token API with OpenAPI and inventories, admin:token:* CLI with party.Activated and summer delegates, READMEs and docs
 
 **Wave 2** *(blocked on Wave 1 completion)*
 - [ ] 16.3-02-PLAN.md — Admin SPA API tokens card on My account per UI-SPEC: list states, two-step create with show-once plaintext and copy, revoke, phrase keys, dist, docs

.planning/STATE.md

@@ -4,16 +4,16 @@ milestone: v1.0
 current_phase: "16.3"
 current_phase_name: Backend admin personal API tokens with scopes
 status: executing
-stopped_at: Phase 16.3 UI-SPEC approved
-last_updated: "2026-10-10T23:05:48.336Z"
-last_activity: 2026-10-10
-last_activity_desc: Phase 16.2 complete, next Phase 16.3
-state_head: 1821f92bee51a8cb6d9db54eaff098c9f7e7f8ab
+stopped_at: Completed 16.3-01-PLAN.md
+last_updated: "2026-10-10T23:56:19.615Z"
+last_activity: 2026-10-11
+last_activity_desc: Completed 16.3-01 framework personal API tokens
+state_head: 3019ab188bc3d5a1d1cce3b16bbdd8af19debe55
 progress:
   total_phases: 40
   completed_phases: 13
   total_plans: 162
-  completed_plans: 154
+  completed_plans: 155
 gsd_state_version: "1.0"
 milestone_name: milestone
 ---
@@ -29,10 +29,10 @@ See: .planning/PROJECT.md (updated 2026-09-16)
 
 ## Current Position
 
-Phase: 16.3 (Backend admin personal API tokens with scopes) — READY TO EXECUTE
-Plan: Not started
+Phase: 16.3 (Backend admin personal API tokens with scopes) — EXECUTING
+Plan: 2 of 4
 Status: Ready to execute
-Last activity: 2026-10-10 — Phase 16.2 complete, next Phase 16.3
+Last activity: 2026-10-11 — Completed 16.3-01 (framework personal API tokens)
 
 Progress: [█████░░░░░] 48%
 
@@ -209,6 +209,7 @@ Progress: [█████░░░░░] 48%
 | Phase 16.2 P04 | 50 min | 3 tasks | 15 files |
 | Phase 16.2 P05 | 25 min | 3 tasks | 7 files |
 | Phase 16.2 P06 | 43min | 3 tasks | - files |
+| Phase 16.3 P01 | 95 | 4 tasks | 43 files |
 
 ## Accumulated Context
 
@@ -683,6 +684,9 @@ Recent decisions affecting current work:
 - [Phase 16.2]: 16.2-04: vue-journal-layer v0.2.0 published (tag 042b65d0 -> 759e684e, human reply "push"); vue-grzybyfunkcjonalne-app main 465286a pins it; a defect gets v0.2.1
 - [Phase 16.2]: 16.2-05: summercms v0.1.18 released (human: release v0.1.18); a later defect gets v0.1.19
 - [Phase 16.2]: 16.2-05: UAT Nuxt rollback copy is nuxt/.output.prev; the site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart River anchor (supervisorctl tail fails on UAT)
+- [Phase 16.3]: D-03 literal: one method-allowed scope must match every required code; ScopeLimit keeps per-scope pattern slices — Locked CONTEXT reading; multi-code lists are stricter than a union
+- [Phase 16.3]: CLI uses party.Activated at Run time; cabana.RuntimeCommands(app) signature unchanged (Option A) — User-confirmed Option A so host apps only bump versions
+- [Phase 16.3]: ResolveBackend is Bearer-only (cookie-less JWT guard) — Plugin write routes have no CSRF; cookie auth must not drive them
 
 ### Pending Todos
 
@@ -755,6 +759,6 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-10T22:05:21.929Z
-Stopped at: Phase 16.3 UI-SPEC approved
-Resume file: .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-UI-SPEC.md
+Last session: 2026-10-10T23:56:11.103Z
+Stopped at: Completed 16.3-01-PLAN.md
+Resume file: None

.planning/state.json

@@ -165,9 +165,9 @@
     }
   ],
   "next": {
-    "command": "/msd:progress --next",
+    "command": "/msd-progress --next",
     "label": "Advance to the next step",
     "reason": "Phase 16.3 of 40 · executing"
   },
-  "updated_at": "2026-10-10T23:05:48.398Z"
+  "updated_at": "2026-10-10T23:55:35.505Z"
 }