summercms/.planning/notes/wavepath-framework-asks-division.md

title, date, context

title	date	context
How the WavePath framework asks divide between SummerCMS and WavePath	2026-10-11	/msd-explore on the WavePath hand-off list `/media/nvme/dev/jz/wavepath.org/.planning/notes/summercms-framework-asks-for-wavepath.md`. Seed `SEED-261007-0tb`.

How the WavePath framework asks divide between SummerCMS and WavePath

WavePath's agent wrote a list of what it needs from SummerCMS (section A) and what it will do itself (section B). Section B stays on the WavePath side as its migration milestone. Section A lands here as the 19.x phases, all before the Płytarium cutover (Phase 20).

Decisions

• The 19.x block comes before the cutover. Chat first, then chat polish, then the other framework and user-plugin asks. Phase 20 waits for 19 to 19.6. The WavePath migration milestone opens after Phase 20.
• Chat is ported from the WavePath copy, with root_id threading and thread_summaries. This settles the open chat-source question for Phase 19.
• The seed's trigger is now "Phase 20 complete". The WavePath milestone no longer waits for the Horoskopia port.

Where each ask lands

Ask	Where
A9: chat and chatchannels	Phase 19
A9: chatbots, chatvideo (LiveKit, reconcile job), forum, herald (web push), userfriends	Phase 19.1
Chat parity against WavePath's clients	Phase 19.2
A3 cookie refresh and CORS, A6 cache and Redis surf.Store, A8 S3 option, /api-docs, Turnstile	Phase 19.3 (summercms.go)
A1 OIDC provider	Phase 19.4 (wristband)
A2 social login	Phase 19.5 (sm-user-plugin)
A4 2FA, A5 device flow	Phase 19.6 (sm-user-plugin)
A7 summer import:winter	Phase 20 (D-02 runner), with the WavePath stress cases below

Corrections to the hand-off list

• The user plugin is already shared. sm-user-plugin (git.golem15.com/golem15/sm-user-plugin) is its own repo, checked out by both fonoteka.go and sm-bm-app. Phases 19.5 and 19.6 add to it directly. Both consuming apps must still build after each change.
• Plugin-registrable token scopes (A8) are dropped for now. sm-user-plugin already mints scoped tokens (MintAPIToken, HasScope). Its allowed list (read, write, ai) is a static package variable. WavePath's wave.scope.public:* scopes belong to its own wave_token guard and golem15_wavepath_api_tokens table, which section B ports on the WavePath side. Add a RegisterAPITokenScope hook only if WavePath confirms that its user-plugin tokens carry custom scopes.

import:winter stress cases from WavePath (for Phase 20)

• The source is MariaDB. That is the same MySQL wire protocol, but check type coercion.
• About 90 tables, including large chat and channel message tables. Batching must handle them.
• APP_KEY-encrypted columns go through the Laravel-decrypt hook.
• Zero-knowledge encryption-key blobs are copied byte for byte and never decoded.
• system_files across 16 attaching models, and 9 system_settings rows.

Scope reminder

The WavePath backend is about 350 routes, about 90 tables and 164 migrations across wavepath and its shared plugins. The PHP routes are not frozen, so re-count when the milestone opens.