{
  "planPath": "archreview/plans/R3-01-mesh-grpc-allowanonymous-plan.md",
  "lastUpdated": "2026-08-20",
  "tasks": [
    {
      "id": "T1",
      "subject": "Extract MapOtOpcUaMeshGrpcServices from Program.cs:743-784 (behaviour-preserving) + endpoint census scaffold (03/S14)",
      "status": "done",
      "blockedBy": []
    },
    {
      "id": "T2",
      "subject": "Census asserts IAllowAnonymous + scope/count guard-of-the-guard; .AllowAnonymous() on the four MapGrpcService maps",
      "status": "done",
      "blockedBy": [
        "T1"
      ]
    },
    {
      "id": "T3",
      "subject": "LocalDb sync endpoint anonymised via an empty-prefix MapGroup (MapZbLocalDbSync returns IEndpointRouteBuilder, not chainable)",
      "status": "done",
      "blockedBy": [
        "T2"
      ]
    },
    {
      "id": "T4",
      "subject": "MeshGrpcAuthStackTests: PSK-bearing calls succeed through the REAL AddOtOpcUaAuth + UseAuthentication/UseAuthorization stack, with an un-anonymised negative control",
      "status": "done",
      "blockedBy": [
        "T3"
      ]
    },
    {
      "id": "T5",
      "subject": "Status fidelity: a no-PSK call reports the interceptor's DETAIL string, not a cookie 401/302 (ConfigServe Unauthenticated collision makes status-only assertions vacuous)",
      "status": "done",
      "blockedBy": [
        "T4"
      ]
    },
    {
      "id": "T6",
      "subject": "MeshGrpcDriverOnlyPipelineTests: driver-only nodes carry no authorization middleware — pins the 03/S14 exemption",
      "status": "done",
      "blockedBy": [
        "T3"
      ]
    },
    {
      "id": "T7",
      "subject": "MeshGrpcMapConventionTests: Program.cs source scan — zero direct MapGrpcService/MapZbLocalDbSync sites, exactly one mapper call",
      "status": "done",
      "blockedBy": [
        "T1"
      ]
    },
    {
      "id": "T8",
      "subject": "docker-dev: Security__Auth__DisableLogin parameterised as ${OTOPCUA_DISABLE_LOGIN:-true} on central-1/central-2 + header docs",
      "status": "done",
      "blockedBy": []
    },
    {
      "id": "T9",
      "subject": "docs/security.md \"Mesh gRPC ingress is AllowAnonymous by design\" + cross-refs in docs/Configuration.md and docs/Telemetry.md",
      "status": "done",
      "blockedBy": []
    },
    {
      "id": "T10",
      "subject": "LIVE GATE: docker-dev with DisableLogin=false — step-0 falsification control MUST fail on the pre-fix build (Deployment.Status=4), then the fixed build seals Applied on all six nodes; restore DisableLogin=true",
      "status": "pending",
      "blockedBy": [
        "T3",
        "T4",
        "T5",
        "T6",
        "T7",
        "T8"
      ]
    }
  ]
}