From fdf7efdd5c3dd96809831f960455d3b8b963eef3 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Fri, 23 Oct 2026 17:13:30 +0200 Subject: [PATCH] docs(phase-19.7): update tracking after gap wave 3 --- .planning/ROADMAP.md | 6 +++--- .planning/STATE.md | 10 +++++----- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index a17701ab..4f636f0c 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1454,7 +1454,7 @@ Plans: 3. `tools/list` lists only the tools the session's principals may call (frontend permissions through the merged group/user permissions, backend permissions and token scope through cabana), and a call runs through the route's own middleware. 4. An editor signs in once through `wristband` OAuth as a frontend user; with a verified link to a backend user, backend-guarded tools such as Journal's run as that admin, and removing the link or the grant removes them. The phase gets a security review; the MCP SDK dependency has a decision note before code lands; unit tests are the last plan. -**Plans:** 7/9 plans executed +**Plans:** 8/9 plans executed Plans: **Wave 1** @@ -1481,7 +1481,7 @@ Gap closure (`19.7-REVIEW.md` findings, escalations E-1 and E-2; `19.7-GAP-INPUT - [x] 19.7-07-PLAN.md — Framework auth and admin (lane B): `auth_time` claim, `pact.HasFrontendTokenScopes` seam (E-2), token-specific revoke events, client address on the resolve path, My account URL and section isolation, hotkey fixes, OpenAPI and dist **Gap wave 3** *(blocked on 19.7-06 and 19.7-07)* -- [ ] 19.7-08-PLAN.md — Plugins and demo (lane C): link proof on `auth_time` with the code in the fragment, grant revocation on ban/reset and link changes, member token scopes (E-2), organisation logo (E-1), Journal prompt ceiling, nginx MCP body cap +- [x] 19.7-08-PLAN.md — Plugins and demo (lane C): link proof on `auth_time` with the code in the fragment, grant revocation on ban/reset and link changes, member token scopes (E-2), organisation logo (E-1), Journal prompt ceiling, nginx MCP body cap **Gap wave 4** *(blocked on 19.7-06, 19.7-07 and 19.7-08)* - [ ] 19.7-09-PLAN.md — Unit tests for every fix and both escalations, the extended gate (workspace check, unreleased-pin policy), validation rows, the corrected security review, deferred items @@ -1621,7 +1621,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19.5. Social login in sm-user-plugin | 5/5 | Complete | 2026-10-21 | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | | 19.6.1. Backend Administrators screen (INSERTED) | 5/5 | Complete | 2026-10-22 | -| 19.7. Generic MCP module | 7/9 | In Progress| | +| 19.7. Generic MCP module | 8/9 | In Progress| | | 19.8. Console commands overhaul (INSERTED) | 6/6 | In Progress| | | 20. Demo instance with every shared plugin | 0/TBD | Not started | - | | 30. Płytarium cutover | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 85e0afd6..d56447eb 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,11 +4,11 @@ milestone: v1.0 current_phase: "19.7" current_phase_name: Generic MCP module (INSERTED) status: executing -stopped_at: Completed 19.7-07-PLAN.md -last_updated: "2026-10-23T14:33:11.727Z" +stopped_at: Completed 19.7-08-PLAN.md; paused before 19.7-09 +last_updated: "2026-10-23T15:13:30.612Z" last_activity: 2026-10-23 -last_activity_desc: "Completed 19.7-07: auth_time, frontend token scopes seam, cabana and admin SPA gap closure" -state_head: d6c7fd5a2799feeaf15264842e0201826e0fcf5c +last_activity_desc: "Completed 19.7-08: plugin gap closure, E-1 logo, E-2 member token scopes; paused before 19.7-09" +state_head: 1e5d9d4f88b3f95fd4590bcee85178f8adceaa18 progress: total_phases: 45 completed_phases: 37 @@ -1068,5 +1068,5 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity Last session: 2026-10-22T22:22:57.128Z -Stopped at: Completed 19.7-07-PLAN.md +Stopped at: Completed 19.7-08-PLAN.md; paused before 19.7-09 Resume file: None