---
title: How the WavePath framework asks divide between SummerCMS and WavePath
date: 2026-10-11
context: /msd-explore on the WavePath hand-off list `/media/nvme/dev/jz/wavepath.org/.planning/notes/summercms-framework-asks-for-wavepath.md`. Seed `SEED-261007-0tb`.
---

# How the WavePath framework asks divide between SummerCMS and WavePath

WavePath's agent wrote a list of what it needs from SummerCMS (section A) and what it will do itself (section B). Section B stays on the WavePath side as its migration milestone. Section A lands here as the 19.x phases, all before the Płytarium cutover (Phase 20).

## Decisions

- **The 19.x block comes before the cutover.** Chat first, then chat polish, then the other framework and user-plugin asks. Phase 20 waits for 19 to 19.6. The WavePath migration milestone opens after Phase 20.
- **Chat is ported from the WavePath copy**, with `root_id` threading and `thread_summaries`. This settles the open chat-source question for Phase 19.
- **The seed's trigger is now "Phase 20 complete".** The WavePath milestone no longer waits for the Horoskopia port.

## Where each ask lands

| Ask | Where |
|---|---|
| A9: chat and chatchannels | Phase 19 |
| A9: chatbots, chatvideo (LiveKit, reconcile job), forum, herald (web push), userfriends | Phase 19.1 |
| Chat parity against WavePath's clients | Phase 19.2 |
| A3 cookie refresh and CORS, A6 cache and Redis `surf.Store`, A8 S3 option, `/api-docs`, Turnstile | Phase 19.3 (`summercms.go`) |
| A1 OIDC provider | Phase 19.4 (`wristband`) |
| A2 social login | Phase 19.5 (`sm-user-plugin`) |
| A4 2FA, A5 device flow | Phase 19.6 (`sm-user-plugin`) |
| A7 `summer import:winter` | Phase 20 (D-02 runner), with the WavePath stress cases below |

## Corrections to the hand-off list

- **The user plugin is already shared.** `sm-user-plugin` (`git.golem15.com/golem15/sm-user-plugin`) is its own repo, checked out by both fonoteka.go and sm-bm-app. Phases 19.5 and 19.6 add to it directly. Both consuming apps must still build after each change.
- **Plugin-registrable token scopes (A8) are dropped for now.** `sm-user-plugin` already mints scoped tokens (`MintAPIToken`, `HasScope`). Its allowed list (`read`, `write`, `ai`) is a static package variable. WavePath's `wave.scope.public:*` scopes belong to its own `wave_token` guard and `golem15_wavepath_api_tokens` table, which section B ports on the WavePath side. Add a `RegisterAPITokenScope` hook only if WavePath confirms that its user-plugin tokens carry custom scopes.

## `import:winter` stress cases from WavePath (for Phase 20)

- The source is MariaDB. That is the same MySQL wire protocol, but check type coercion.
- About 90 tables, including large chat and channel message tables. Batching must handle them.
- APP_KEY-encrypted columns go through the Laravel-decrypt hook.
- Zero-knowledge encryption-key blobs are copied byte for byte and never decoded.
- `system_files` across 16 attaching models, and 9 `system_settings` rows.

## Scope reminder

The WavePath backend is about 350 routes, about 90 tables and 164 migrations across `wavepath` and its shared plugins. The PHP routes are not frozen, so re-count when the milestone opens.