From 93a3112fb7a9c9d181607b473fde1f051eea778b Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Sun, 11 Oct 2026 01:56:26 +0200 Subject: [PATCH] docs(16.3-01): advance STATE and ROADMAP after plan 01 Co-authored-by: Cursor --- .planning/ROADMAP.md | 4 ++-- .planning/STATE.md | 28 ++++++++++++++++------------ .planning/state.json | 4 ++-- 3 files changed, 20 insertions(+), 16 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index c2c2c93..3b4ca92 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1044,11 +1044,11 @@ Plans: 5. Module READMEs and `docs/` cover the token API, scopes and CLI commands. 6. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 4 plans +**Plans:** 1/4 plans executed Plans: **Wave 1** -- [ ] 16.3-01-PLAN.md — Framework (summercms.go): pact.HasTokenScopes, bouncer scope limit, Allows rewrite (scope before the superuser shortcut), backend_api_tokens migration, composite backend guard, interactive-only marker, route gates, published cabana.ResolveBackend, account token API with OpenAPI and inventories, admin:token:* CLI with party.Activated and summer delegates, READMEs and docs +- [x] 16.3-01-PLAN.md — Framework (summercms.go): pact.HasTokenScopes, bouncer scope limit, Allows rewrite (scope before the superuser shortcut), backend_api_tokens migration, composite backend guard, interactive-only marker, route gates, published cabana.ResolveBackend, account token API with OpenAPI and inventories, admin:token:* CLI with party.Activated and summer delegates, READMEs and docs **Wave 2** *(blocked on Wave 1 completion)* - [ ] 16.3-02-PLAN.md — Admin SPA API tokens card on My account per UI-SPEC: list states, two-step create with show-once plaintext and copy, revoke, phrase keys, dist, docs diff --git a/.planning/STATE.md b/.planning/STATE.md index 7d6b3c1..bbec9b3 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,16 +4,16 @@ milestone: v1.0 current_phase: "16.3" current_phase_name: Backend admin personal API tokens with scopes status: executing -stopped_at: Phase 16.3 UI-SPEC approved -last_updated: "2026-10-10T23:05:48.336Z" -last_activity: 2026-10-10 -last_activity_desc: Phase 16.2 complete, next Phase 16.3 -state_head: 1821f92bee51a8cb6d9db54eaff098c9f7e7f8ab +stopped_at: Completed 16.3-01-PLAN.md +last_updated: "2026-10-10T23:56:19.615Z" +last_activity: 2026-10-11 +last_activity_desc: Completed 16.3-01 framework personal API tokens +state_head: 3019ab188bc3d5a1d1cce3b16bbdd8af19debe55 progress: total_phases: 40 completed_phases: 13 total_plans: 162 - completed_plans: 154 + completed_plans: 155 gsd_state_version: "1.0" milestone_name: milestone --- @@ -29,10 +29,10 @@ See: .planning/PROJECT.md (updated 2026-09-16) ## Current Position -Phase: 16.3 (Backend admin personal API tokens with scopes) — READY TO EXECUTE -Plan: Not started +Phase: 16.3 (Backend admin personal API tokens with scopes) — EXECUTING +Plan: 2 of 4 Status: Ready to execute -Last activity: 2026-10-10 — Phase 16.2 complete, next Phase 16.3 +Last activity: 2026-10-11 — Completed 16.3-01 (framework personal API tokens) Progress: [█████░░░░░] 48% @@ -209,6 +209,7 @@ Progress: [█████░░░░░] 48% | Phase 16.2 P04 | 50 min | 3 tasks | 15 files | | Phase 16.2 P05 | 25 min | 3 tasks | 7 files | | Phase 16.2 P06 | 43min | 3 tasks | - files | +| Phase 16.3 P01 | 95 | 4 tasks | 43 files | ## Accumulated Context @@ -683,6 +684,9 @@ Recent decisions affecting current work: - [Phase 16.2]: 16.2-04: vue-journal-layer v0.2.0 published (tag 042b65d0 -> 759e684e, human reply "push"); vue-grzybyfunkcjonalne-app main 465286a pins it; a defect gets v0.2.1 - [Phase 16.2]: 16.2-05: summercms v0.1.18 released (human: release v0.1.18); a later defect gets v0.1.19 - [Phase 16.2]: 16.2-05: UAT Nuxt rollback copy is nuxt/.output.prev; the site-ok log check reads /var/log/supervisor/grzybyfunkcjonalne-go.log from the restart River anchor (supervisorctl tail fails on UAT) +- [Phase 16.3]: D-03 literal: one method-allowed scope must match every required code; ScopeLimit keeps per-scope pattern slices — Locked CONTEXT reading; multi-code lists are stricter than a union +- [Phase 16.3]: CLI uses party.Activated at Run time; cabana.RuntimeCommands(app) signature unchanged (Option A) — User-confirmed Option A so host apps only bump versions +- [Phase 16.3]: ResolveBackend is Bearer-only (cookie-less JWT guard) — Plugin write routes have no CSRF; cookie auth must not drive them ### Pending Todos @@ -755,6 +759,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-10T22:05:21.929Z -Stopped at: Phase 16.3 UI-SPEC approved -Resume file: .planning/phases/16.3-backend-admin-personal-api-tokens-with-scopes/16.3-UI-SPEC.md +Last session: 2026-10-10T23:56:11.103Z +Stopped at: Completed 16.3-01-PLAN.md +Resume file: None diff --git a/.planning/state.json b/.planning/state.json index 18ada2e..e6b5589 100644 --- a/.planning/state.json +++ b/.planning/state.json @@ -165,9 +165,9 @@ } ], "next": { - "command": "/msd:progress --next", + "command": "/msd-progress --next", "label": "Advance to the next step", "reason": "Phase 16.3 of 40 · executing" }, - "updated_at": "2026-10-10T23:05:48.398Z" + "updated_at": "2026-10-10T23:55:35.505Z" }