ThothII/.superpowers/sdd/progress.md

DWH REST per-installation authentication SDD progress

Plan: docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md Branch: feat/dwh-rest-installation-auth Worktree: /home/chirone/ThothII-next/.worktrees/dwh-rest-installation-auth Baseline: workspace docs PASS; Go unavailable on host (use containerized Go 1.26.5); default Compose pre-existing path-sensitive false positive under /home/chirone.

Task 1: complete (commits 3bc84b0..1e82fd3, review clean after bounded-digest fix wave). Task 1 plan note: the dotted-import grep was resolved by the exact module assertion in 09290a0; go list -m all confirms the DWH module only.

Task 2: complete (commits 541ef45, 971a0e6, e90a1a1; independent vet fix d2415b5; review clean after bounded-read, expiry/JSON, same-Store, and cross-Store synchronization fix waves).

Task 3: complete (commits ebb360f, 055dcab, b1079bd; independent review clean after CLI grammar, metadata validation, and ambiguous-publication cleanup fix waves).

Task 4: complete (commits 943f809, 419c344, 134dc19; independent review PASS after legacy multiplicity, fail-closed handler/socket, SGID 2750, O_RDONLY shared lock, OpenReadOnly, and safe socket-parent waves). Task 5 must precreate .writer.lock as 0640 root:dwh-auth; add a non-owner group/cross-process integration proof when packaging permits.

Task 5: complete (commits 87606c7, 62ec29f; independent review PASS after auth-subrequest header isolation and target-Nginx duplicate-header verification). No runtime installation or service/Nginx mutation performed.

Task 6: complete (commits 1b18a0f, d0f7e04; independent review PASS after regex/duplicate bypass, exact-PID TCP, and bounded-cleanup hardening). Minor for final review: remove or rename the redundant legacy negative_postgrest_bypass fixture and align the historical fixture-count prose if useful. No active Nginx/runtime mutation performed.

Task 7: complete (commits 7b9b8b3, 707c13d, f616aab, 7b86ea9, 7fe5316; Terra review PASS). Documentation and rollout-contract alignment completed; no runtime mutation performed.

Task 8: complete at frozen SHA 6499d24892b4383ac492579303e766cfb51fe44e (fix commits 09290a0, 6499d24; Terra review PASS). Focused, portability, scanner, DWH Go, and two full tools/tht matrix runs PASS; evidence recorded at .artifacts/dwh-auth/source-verification.md. Broad coupling remains BASELINE_RED debt; immutable paths remain unchanged.

Task 9: PASS at frozen SHA 0c4ff3750d3ecd3fc514e50e511cf7475fbe0446. Built and installed the exact local candidate, enabled and started dwh-auth, imported the protected legacy credential under public ID legacy-shared, and created psd-mac-primary with public key ID oNPdOfoH7ypLtVb1. Registry check, AF_UNIX-only listener, v1/legacy 204, random/missing 401, bounded journal scan, installed-file hashes, and nginx -t all PASS. Protected report: /root/dwh-auth-provision/gate9-20260821T054514Z.report.md, SHA-256 65ce1e0d8be5f74355eca2b1dca901da16f2864f68eafb7dede9d23ef36b82d5. Nginx was not changed or reloaded; the legacy key remains active; the old stack was not changed or stopped. Terra final review: PASS with no Critical or Important findings.

Task 10: NOT STARTED and requires a second explicit authorization. Public Nginx cutover, Mac-key delivery/configuration, and legacy revocation have not occurred. Activity 1 remains IN_DISCUSSION; external deployment remains SURVEY_NO_GO.

Final clarification (bookkeeping): initial authorization at 6499d24 stopped before installation because the protected legacy file was missing and a journal-scan finding remained. A secret-safe legacy file was prepared without emit/hash; Nginx metadata remained unchanged and nginx -t PASS. Fix commits 6fb4886, dee0f9c, 0c4ff37 received Terra PASS, followed by a detached complete re-freeze PASS at full 0c4ff3750d3ecd3fc514e50e511cf7475fbe0446. The owner then explicitly authorized Gate 9 at that exact SHA; Gate 9 completed as recorded above. Task 10 remains a separate gate.

Project A authentication runtime projection

Plan: docs/superpowers/plans/2026-08-21-project-a-server-auth-runtime-projection.md Plan commit: 64f46c7019e11a74dae35a7cdb447cd881e17061 Implementation baseline: 64f46c7019e11a74dae35a7cdb447cd881e17061 Runtime constraint: source, synthetic tests, and documentation only; Project A, /srv, Nginx, the legacy stack, and shared services remain untouched.

Task 1: complete (commits 8a8f2c2, f9e2950, de86760; independent Terra review PASS after descriptor-relative rewrite, full-history validation, crash recovery, destructive replacement guards, deterministic failure seams, and interrupted-retention recovery). Task 2: complete (commits 05f8615, da2f4a6, 1e2c4e6; independent review PASS after exact GID enforcement, bounded descriptor-bound namespace enumeration, strict trailing-slash parity, OIDC coverage, and complete one-retry CURRENT publication linearization). Task 3: complete (commit 903c0b4; independent Terra review PASS after retained-FD outer locking, cancellable runtime/canonical waits, public transaction-context propagation, deterministic swap/metadata/creator-race tests, and fail-closed pre/post-commit error handling). Task 4: complete (commit 3d9a9f0; independent Terra review PASS after moving the Linux/root restore gate before secret-bearing checkpoint creation). Exact focused Go, race, vet, Node 24 focused/full, TypeScript, projected Compose, secret-policy, Windows backup compile, and full serialized tools/tht gates PASS. Historical canonical/unified Compose failures were reproduced as baseline-only documentation/path coupling failures and were not weakened. Task 5: complete (commit ef7ae70; independent Terra review PASS after read-only Vitest gate repair, remote-Docker/context hardening, and adversarial canonical-mount/sudo printenv verifier fixes). All 14 cross-layer acceptance cases, documentation verifiers, shell syntax, full Go/race/vet, backend Node 24 Vitest/typecheck, projected Compose, and secret-policy gates PASS. The three known default/canonical/unified Compose policy failures were reproduced at a21e2c1 and remain unmodified baseline debt. Project A has not been started; applying the descriptor or any runtime root under /srv/thothii still requires a new explicit authorization. Final Project A source review: PASS for a21e2c1..ef7ae70; independent Terra review found no remaining Critical or Important issue after validating restore admission/order, backend path and identity controls, transaction cancellation, lifecycle gating, portability, dependency scope, and redaction. Pre-live stop boundary remains in force.