- Extend the hand-written wristband with an OIDC flavour; reject zitadel/oidc v3 (D-06, D-09, D-14) - golang-jwt/jwt/v5 v5.3.1 signs id_tokens; JWKs encoded with the standard library - go-oidc v3.21.0 and x/oauth2 v0.37.0 test-only in sm-oauthserver-plugin - STACK.md zitadel/oidc row marked superseded