docs(plans): tick T1A.2 — central CentralControlService hosting + per-site auth (780bb9c3)

docs/plans/2026-07-22-clusterclient-to-grpc-plan.md.tasks.json

@@ -98,17 +98,18 @@
       "id": "T1A.2",
       "phase": "1A",
       "subject": "Central hosting: AddGrpc + per-site-PSK interceptor, CentralGrpcPort h2c listener, CentralControlGrpcService, readiness gate",
-      "status": "in_progress",
+      "status": "completed",
       "activeForm": "Hosting CentralControlService on central",
       "blockedBy": [
         "T1A.1"
-      ]
+      ],
+      "notes": "780bb9c3 on feat/grpc-central-control. NEW class CentralControlAuthInterceptor (one public ctor, 3-arg internal, pinned by reflection test) - central verifies per-site PSK via ISitePskProvider keyed by required x-scadabridge-site header, fail-closed on missing/blank/unknown/mismatch. CentralControlGrpcService Asks existing CentralCommunicationActor (0 handler changes), readiness via SetReady mirror, heartbeat Tell/never-gated, ingest reuses AuditIngestAskTimeout. Central branch had NO AddGrpc/Kestrel before - added h2c listener on CentralGrpcPort default 8083, :5000 untouched. Rig ports 9013/9014:8083 published. PLAN GAPS: (1) mappers throw on unset WKT fields - test DTOs must carry a timestamp (no prod impact); (2) plan gave no deadline for Submit/QueryNotification - used NotificationForwardTimeout, check T1A.3 client sets same. 17 CentralControl tests, Host.Tests 384, Communication.Tests 356."
     },
     {
       "id": "T1A.3",
       "phase": "1A",
       "subject": "ICentralTransport (Akka extract + Grpc impl), CentralChannelProvider, CentralTransport flag, CentralGrpcEndpoints option",
-      "status": "pending",
+      "status": "in_progress",
       "activeForm": "Building the site->central transport seam",
       "blockedBy": [
         "T1A.1"