Open research questions

From the core plugin port exploration (2026-10-07)

Does PaymentGateway need winter/location? It is installed in 19 projects. Check whether PaymentGateway shipping addresses, the shop or user profiles read its countries and states. If they do, Phase 18 needs a Go equivalent (a framework module or an sm-location-plugin). Phase: 18.
Does Horoskopia define the full Phase 18 acceptance contract? Which vue-horoskopia-app requests reach PaymentGateway or subscription code? Do they cover the order and refund paths, or only subscriptions? Are other order flows tested only through hand-written host tests? Phase: 18.
~~Which chat source should Phase 19 port?~~ Settled 2026-10-11: port the Wavepath copy, with root_id threading and thread_summaries. See .planning/notes/wavepath-framework-asks-division.md. Phase: 19.
Does any Płytarium route need userfriends? PHP fonoteka has golem15/userfriends, but fonoteka.go has no port, and Phase 14 reached 175/175 routes without one. Confirm before porting it for Wavepath in Phase 19.1, so there is one shared copy. Phase: 19.1.
How should Herald's Web Push be done in Go? Herald uses minishlink/web-push. Choose a Go Web Push/VAPID library (or a stdlib implementation) and record it in a decision note before Phase 19.1 code lands. Phase: 19.1.

Should the full OIDC provider extend the hand-written wristband server, or put zitadel/oidc v3 behind it? Phase 8 hand-wrote wristband on the standard library (.planning/notes/oauth2-wristband-direct-port.md). Phase 19.4 adds discovery, JWKS with RS256/ES256 rotation, id_token, userinfo, consent and pairwise subjects. That is protocol and security code where a maintained library is preferred, and zitadel/oidc v3 is already named in the stack. Settle it in a decision note before code lands. Phase: 19.4.
Do WavePath's user-plugin tokens carry custom scopes? If they do, sm-user-plugin needs a RegisterAPITokenScope hook in place of the static AllowedAPITokenScopes. Ask the WavePath side. Phase: 19.3 or the WavePath milestone.