{
  "planPath": "archreview/plans/PLAN-07-ui-management-security.md",
  "tasks": [
    {
      "id": 1,
      "subject": "Task 1: DisableLoginGuard \u2014 refuse the flag outside Development",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 2,
      "subject": "Task 2: Wire the guard at the Host composition root + doc",
      "status": "completed",
      "blockedBy": [
        1
      ]
    },
    {
      "id": 3,
      "subject": "Task 3: Scrub deploy/wonder-app-vd03 \u2014 remove DisableLogin: true (on-disk only; deploy/ is gitignored)",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 4,
      "subject": "Task 4: ArtifactDeploymentService.DeployToSiteAsync",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 5,
      "subject": "Task 5: HandleDeployArtifacts honors SiteId + site-scope enforcement + docs",
      "status": "completed",
      "blockedBy": [
        4
      ]
    },
    {
      "id": 6,
      "subject": "Task 6: ConfigSecretScrubber \u2014 JSON secret elision + sentinel merge",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 7,
      "subject": "Task 7: DataConnection List/Get/audit secret elision + sentinel-preserving update",
      "status": "completed",
      "blockedBy": [
        6
      ]
    },
    {
      "id": 8,
      "subject": "Task 8: ExternalSystem AuthConfiguration elision + preserve-if-null update",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 9,
      "subject": "Task 9: DatabaseConnection ConnectionString elision + preserve-if-null update",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 10,
      "subject": "Task 10: GetRequiredRoles any-of refactor + gate ListSecuredWrites",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Reconcile the area-management role gate (code + three docs)",
      "status": "completed",
      "blockedBy": [
        10
      ]
    },
    {
      "id": 12,
      "subject": "Task 12: Canonicalize role-mapping casing at the write path",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 13,
      "subject": "Task 13: GetRequiredRoles matrix test \u2014 freeze the authorization table",
      "status": "completed",
      "blockedBy": [
        10,
        11,
        22,
        23
      ]
    },
    {
      "id": 14,
      "subject": "Task 14: SecuredWrite repository \u2014 TryMarkExpiredAsync + CountAsync",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 15,
      "subject": "Task 15: Server-side secured-write TTL \u2014 enforce at approve/reject",
      "status": "completed",
      "blockedBy": [
        14
      ]
    },
    {
      "id": 16,
      "subject": "Task 16: Opportunistic expiry sweep in HandleListSecuredWrites",
      "status": "completed",
      "blockedBy": [
        15
      ]
    },
    {
      "id": 17,
      "subject": "Task 17: Secured-write list paging \u2014 command, handler, CLI",
      "status": "completed",
      "blockedBy": [
        14
      ]
    },
    {
      "id": 18,
      "subject": "Task 18: SecuredWrites page \u2014 history pager + age in approve dialog + docs",
      "status": "completed",
      "blockedBy": [
        17
      ]
    },
    {
      "id": 19,
      "subject": "Task 19: Per-command long-running Ask timeout",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 20,
      "subject": "Task 20: Ship ManagementService timeout config + doc",
      "status": "completed",
      "blockedBy": [
        19
      ]
    },
    {
      "id": 21,
      "subject": "Task 21: Browse/Verify/Cert commands gain optional SiteIdentifier",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 22,
      "subject": "Task 22: Actor handlers \u2014 BrowseNode / SearchAddressSpace / VerifyEndpoint",
      "status": "completed",
      "blockedBy": [
        10,
        21
      ]
    },
    {
      "id": 23,
      "subject": "Task 23: Actor handlers \u2014 TrustServerCert / RemoveServerCert / ListServerCerts (Admin)",
      "status": "completed",
      "blockedBy": [
        10,
        21
      ]
    },
    {
      "id": 24,
      "subject": "Task 24: Dispatch-coverage test \u2014 every registered command reaches a handler",
      "status": "completed",
      "blockedBy": [
        22,
        23
      ]
    },
    {
      "id": 25,
      "subject": "Task 25: CLI parity \u2014 browse / search / verify-endpoint / certs commands",
      "status": "completed",
      "blockedBy": [
        22,
        23
      ]
    },
    {
      "id": 26,
      "subject": "Task 26: LoginThrottle \u2014 fixed-window LDAP-bind failure lockout",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 27,
      "subject": "Task 27: Wire the throttle \u2014 ManagementAuthenticator + auth endpoints + doc",
      "status": "completed",
      "blockedBy": [
        26
      ]
    },
    {
      "id": 28,
      "subject": "Task 28: Additive paging for ListTemplates / ListInstances",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 29,
      "subject": "Task 29: PollGate \u2014 non-reentrant poll timers on Health + Alarm Summary",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 30,
      "subject": "Task 30: Transport single-flight + base64 copy elimination",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 31,
      "subject": "Task 31: Low cleanup A \u2014 hub send fault logging, event-log filter comment, stale CLAUDE.md note",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 32,
      "subject": "Task 32: Low cleanup B \u2014 AlarmSummary memoization + sortable-header a11y",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 33,
      "subject": "Task 33: Add CLI.Tests to the slnx + retire the gotcha",
      "status": "skipped-duplicate",
      "blockedBy": []
    }
  ],
  "lastUpdated": "2026-07-10"
}