diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 3476c11..3338954 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1255,14 +1255,14 @@ Plans: 3. An S3 blob driver can be selected through framework config, so the application does not import it. `/api-docs` and `/api-docs.json` can be served. Turnstile verification middleware is available. 4. The touched modules' READMEs and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 1/5 plans executed +**Plans:** 2/5 plans executed Plans: **Wave 1** - [x] 19.3-01-PLAN.md — Decision note, then the `cooler` module: Redis-backed rate-limit store wired by serve, memory (otter) and Redis cache drivers (wave 1) **Wave 2** *(blocked on Wave 1 completion)* -- [ ] 19.3-02-PLAN.md — bouncer cookie transport and Turnstile, surf CORS hardening and `cors:`, opt-in /api-docs (wave 2) +- [x] 19.3-02-PLAN.md — bouncer cookie transport and Turnstile, surf CORS hardening and `cors:`, opt-in /api-docs (wave 2) - [ ] 19.3-03-PLAN.md — summer.yaml `build.tags` and the `summercms_s3` S3 driver, disk-name extension fix, `storage.uploads.public_url` (wave 2) - [ ] 19.3-04-PLAN.md — Site-cache purge in cooler, `pact.ReorderAfterSave`, Journal/menu/FAQ adoption, shared Nuxt purge route in three layers, push checkpoint, app pointer bumps (wave 2) @@ -1386,7 +1386,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19. Chat and ChatChannels | 0/TBD | Not started | - | | 19.1. Chat satellites | 0/TBD | Not started | - | | 19.2. Chat polish against WavePath clients | 0/TBD | Not started | - | -| 19.3. Framework transport and infrastructure for WavePath | 1/5 | In Progress| | +| 19.3. Framework transport and infrastructure for WavePath | 2/5 | In Progress| | | 19.4. OIDC provider on wristband | 0/TBD | Not started | - | | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 642c362..699ab60 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,16 +4,16 @@ milestone: v1.0 current_phase: "19.3" current_phase_name: Framework transport and infrastructure for WavePath (INSERTED) status: executing -stopped_at: Completed 19.3-01-PLAN.md -last_updated: "2026-10-15T15:42:23.602Z" +stopped_at: Completed 19.3-02-PLAN.md +last_updated: "2026-10-15T16:02:18.570Z" last_activity: 2026-10-15 last_activity_desc: Phase 19.3 execution started -state_head: d86f27cc9cb98c361d1d67ab9fb43f1be628cdd2 +state_head: e3ba89a411b85ee79e8afce8bf08739f78c99ecf progress: total_phases: 40 completed_phases: 31 total_plans: 190 - completed_plans: 183 + completed_plans: 184 gsd_state_version: "1.0" milestone_name: milestone --- @@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12) ## Current Position Phase: 19.3 (Framework transport and infrastructure for WavePath (INSERTED)) — EXECUTING -Plan: 2 of 5 +Plan: 3 of 5 Status: Ready to execute Last activity: 2026-10-15 — Phase 19.3 execution started @@ -240,6 +240,7 @@ Progress: [████░░░░░░] 44% | Phase 18.1 P05 | 20 min | 3 tasks | 20 files | | Phase 18.1 P06 | 50min | 5 tasks | 39 files | | Phase 19.3 P01 | 14 min | 2 tasks | 20 files | +| Phase 19.3 P02 | 15min | 4 tasks | 11 files | ## Accumulated Context @@ -808,6 +809,11 @@ Recent decisions affecting current work: - [Phase 19.3]: 19.3-01: unreachable Redis at start-up is a warning; missing/malformed redis.url with a Redis driver is a boot error naming the key - [Phase 19.3]: 19.3-01: cooler key prefix = cache.prefix or slug(app.name)+':' (default summer:); cache keys cache:, limiter keys rl: - [Phase 19.3]: 19.3-01: Remember degrades on cache errors; Redis Flush is SCAN MATCH cache:* + UNLINK, never FLUSHDB +- [Phase 19.3]: 19.3-02: bouncer cookie transport reads auth.cookie.* through CookieConfigSource (compass satisfies it, bouncer imports no framework module); TokenCookie Max-Age is the guard's refresh window +- [Phase 19.3]: 19.3-02: credentialed CORS with a * origin, uncompilable or PHP-delimited origin patterns fail boot; dynamic CORS answers echo the exact origin with Vary: Origin; the non-credentialed * answer is unchanged +- [Phase 19.3]: 19.3-02: route-group CORS uses cors: from http.cors_profiles.; the router registers OPTIONS preflight routes (owner surf) and refuses overlap with http.cors.paths +- [Phase 19.3]: 19.3-02: Turnstile open/closed follows PHP; with a secret, a transport error or timeout is 422 in both modes and a missing token fails without a siteverify call; a published *bouncer.Turnstile or bouncer.TurnstileWriter overrides the defaults +- [Phase 19.3]: 19.3-02: /api-docs is opt-in (http.api_docs.enabled), spec from exactly one surf.APIDocsProvider converted at boot, swagger-ui-dist pinned to 5.33.1 with sha384 SRI and a nonce CSP ### Pending Todos @@ -886,6 +892,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-15T15:42:22.846Z -Stopped at: Completed 19.3-01-PLAN.md +Last session: 2026-10-15T16:02:17.838Z +Stopped at: Completed 19.3-02-PLAN.md Resume file: None