sm-demo-app mounts golem15.mfa v0.1.0 at user v0.1.12, sociallogin v0.1.4
and the two-factor UI (0eb1f60..bb24207, pushed with the 19 earlier
commits as 18597e5..bb24207, not deployed). The summary records the
"proceed" reply, the push checks and the tests. deferred-items.md gains the
private sm-mfa-plugin repository's effect on the demo's release build, and
a pending todo tracks the demo's leftover journal and oauthserver moves.
- WebAuthn and passkeys committed in sm-mfa-plugin (2662252, 6c8916f),
demo two-factor UI in vue-demo-app (44a5229)
- sociallogin D-09 change kept as a patch: the checkout is jin's
- deferred items: sociallogin gofmt finding, no demo type check
SEO moves to sm-seo-plugin and sm-sitemap-plugin on three generic
framework seams (form extensions with field placement, record events,
signpost content descriptors), following the mpseo pattern. Phase 32 is
split into 32/33/34.
B-IN-05 (deferred, the shared confirm primitive), B-IN-06 (no fix
needed), the admin:token:revoke event, the OIDC decision (resolved), the
local go.work retarget, the demo pins, the release order with
PHASE197_RELEASED, the lenient link code parse and one offline-build
flake; the plan 05 test-commit entry is superseded by the release.
T-19.7-42..T-19.7-65 join the register, the eight corrected rows carry
their fix commits, the audit trail records the gap closure; threats_open
stays 0 (every high threat is fixed or verified).
Corrects the verdicts the code review disproved (T-19.7-22 first, then
T-19.7-03, -08, -17, -18, -23, -31, -35 and cross-cutting findings 1 and
6), adds the Method step that a high or critical control is verified only
by a test that fails without it, the revert-checks of the three critical
fixes, and the register rows T-19.7-42..T-19.7-65.
- 19.7-SECURITY-REVIEW.md: T-19.7-01..41 and T-19.7-SC with file, line and
pinning test; two production fixes (c49983d, 1111828); superuser reach
accepted as designed with audit and ceiling
- 19.7-SECURITY.md: threats_open 0, accepted risks AR-19.7-01..05
- the frontend permission and account link todos move to todos/done with
their closing notes
- SUMMARY with every deviation from the checkpoint report
- deferred items: sm-demo-app push and deploy wait for the user, release
builds on summercms v0.4.4 lack the cabana subject-event fix, Redis for a
second instance, the real-client check, the retracted mimetype
Plan 03 summary: verified account link, Administrators-screen link actions, plugin frontend permissions, user MCP guard and user_me in sm-user-plugin v0.1.10 (requires SummerCMS v0.4.4). deferred-items: cabana fires pact.MCPSubjectChanged as a value inside the transaction while pier listens for a pointer; fix before v0.5.0.
