Open research questions

From the core plugin port exploration (2026-10-07)

Does PaymentGateway need winter/location? It is installed in 19 projects. Check whether PaymentGateway shipping addresses, the shop or user profiles read its countries and states. If they do, Phase 18 needs a Go equivalent (a framework module or an sm-location-plugin). Phase: 18.
Does Horoskopia define the full Phase 18 acceptance contract? Which vue-horoskopia-app requests reach PaymentGateway or subscription code? Do they cover the order and refund paths, or only subscriptions? Are other order flows tested only through hand-written host tests? Phase: 18.
~~Which chat source should Phase 19 port?~~ Settled 2026-10-11: port the Wavepath copy, with root_id threading and thread_summaries. See .planning/notes/wavepath-framework-asks-division.md. Phase: 19.
Does any Płytarium route need userfriends? PHP fonoteka has golem15/userfriends, but fonoteka.go has no port, and Phase 14 reached 175/175 routes without one. Confirm before porting it for Wavepath in Phase 19.1, so there is one shared copy. Phase: 19.1.
How should Herald's Web Push be done in Go? Herald uses minishlink/web-push. Choose a Go Web Push/VAPID library (or a stdlib implementation) and record it in a decision note before Phase 19.1 code lands. Phase: 19.1.

Should the full OIDC provider extend the hand-written wristband server, or put zitadel/oidc v3 behind it? Phase 8 hand-wrote wristband on the standard library (.planning/notes/oauth2-wristband-direct-port.md). Phase 19.4 adds discovery, JWKS with RS256/ES256 rotation, id_token, userinfo, consent and pairwise subjects. That is protocol and security code where a maintained library is preferred, and zitadel/oidc v3 is already named in the stack. Settle it in a decision note before code lands. Phase: 19.4.
Do WavePath's user-plugin tokens carry custom scopes? If they do, sm-user-plugin needs a RegisterAPITokenScope hook in place of the static AllowedAPITokenScopes. Ask the WavePath side. Phase: 19.3 or the WavePath milestone.

~~Is --module for git-URL installs worth supporting?~~ Answered 2026-10-29: not in v1. Git URLs install as submodules only (Phase 34, D-11; summer plugin:install <git-url> shipped in 34-04 without --module). Revisit only if submodule-only installs prove limiting; adding the flag later is additive. Original question: summer plugin:install <git-url> defaults to a submodule checkout. Installing a private repo as a Go module needs GOPRIVATE/GONOSUMDB and git insteadOf rules so go can authenticate, which is fragile across GitHub, GitLab and Gitea and across SSH and HTTPS tokens. Find out what the setup costs in practice, whether plugin:install can detect and explain a misconfiguration, and decide whether --module ships or git URLs stay submodule-only. See .planning/notes/2026-10-29-plugin-marketplace.md. Phase: plugin marketplace.