{
  "planPath": "docs/plans/2026-08-07-secrets-grpc-hub-implementation.md",
  "tasks": [
    {"id": 1, "subject": "Task 1: Package scaffold + secrets_hub.v1 proto", "status": "completed", "classification": "standard", "parallelizableWith": [8], "note": "5fd7bf5 + cf6d19d (evolution-policy header) + cc95590 (test project scaffold); spec ✅, code review Approved"},
    {"id": 2, "subject": "Task 2: Server half — hub service + bearer auth + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [3], "note": "7fc77f2 + 353af72 (review fixes: GetSecrets batch cap, DI single-registration guard) merged ff into feat/secrets-grpc-hub; spec ✅ 16/16, code review Approved; 73 server tests"},
    {"id": 3, "subject": "Task 3: Client half — pull-only sweep service + DI", "status": "completed", "classification": "high-risk", "blockedBy": [1], "parallelizableWith": [2], "note": "c5ea3a7 + 1c31e6b (review Critical fix: per-row parse isolation, WireToDomain batch methods deleted, real-client CallInvoker tests) merged 55e0178; spec ✅ 8/8, code review Approved on re-review; merged suite 140/140"},
    {"id": 4, "subject": "Task 4: Integration tests + no-write-surface pin", "status": "completed", "classification": "standard", "blockedBy": [2, 3], "note": "3e3748b + 5f81e65 (harness drift-fix via internal validateEagerly seam); spec ✅ 6/6, code review Approved; Grpc suite 158, solution 436/0/15"},
    {"id": 5, "subject": "Task 5: Version bump + pack + publish 0.4.0", "status": "completed", "classification": "small", "blockedBy": [4], "note": "321ab22 = main, pushed; 6 packages @ 0.4.0 on dohertj2-gitea feed incl. new Replicator.Grpc, restore-verified from fresh cache; CHANGELOG.md created (backfilled 0.2.0–0.3.0)"},
    {"id": 6, "subject": "Task 6: ScadaBridge wiring — central hub + site sweep client", "status": "completed", "classification": "high-risk", "blockedBy": [5], "note": "ScadaBridge feat/secrets-grpc-hub 57f08c21+127ec254+c8e90daa+fc784b41 (predicate-sharing review fix); role is a method parameter (not config); mode key Secrets:Replication:Mode default SqlServer; 31/31 wiring pins; spec ✅ 8/8, code review Approved; residual: sweep dials single endpoint (no central-pair failover) — carry to closeout"},
    {"id": 7, "subject": "Task 7: ScadaBridge live gate (docker cluster)", "status": "completed", "classification": "high-risk", "blockedBy": [6], "parallelizableWith": [8], "note": "PASS 4/4 (check 4 on 2nd pass after 0.4.1 denial-warning fix, scadaproj c86cead); ScadaBridge main @ f6c3f7c5 merged+pushed; gate doc docs/plans/2026-08-07-secrets-grpc-hub-live-gate.md; residuals: central pair doesn't converge with itself + single-endpoint client = one design issue to file; delete-while-follower-offline untested"},
    {"id": 8, "subject": "Task 8: OtOpcUa Akka pair-local re-gate (three-mesh rig)", "status": "completed", "classification": "high-risk", "parallelizableWith": [1, 2, 3, 4, 5, 6, 7], "note": "PASS 4/4, OtOpcUa master @ 1bd79c8e pushed; gate doc docs/plans/2026-08-07-secrets-pair-local-live-gate.md; rig fix: Secrets__SqlitePath onto per-node volume; follow-up for Task 9: stale KNOWN-NON-FUNCTIONAL comment in OtOpcUa appsettings.json Secrets block"},
    {"id": 9, "subject": "Task 9: Closeout — issue #3, runbook, GAPS, index", "status": "completed", "classification": "small", "blockedBy": [7, 8], "note": "Runbook clustered-secrets.md Production-enablement + rotation fan-out updated (ScadaBridge = both central nodes + both nodes of every site pair); components/secrets/GAPS.md gained a 'gRPC hub delivered' section (0.4.0/0.4.1, both gates with SHAs, residual); CLAUDE.md Secrets row updated (lib 0.4.1, ScadaBridge pins 0.4.1, both gates PASS 4/4, default-off, residual). OtOpcUa stale appsettings _comment corrected: lmxopcua master @ 01256344, pushed. scadaproj#3 all 6 boxes checked with SHA annotations, closing comment posted, CLOSED. Residual filed as scadaproj#4 (central-pair convergence + client endpoint failover are one design question; plus delete-while-follower-offline untested and denial-warning alerting must sum per-window deltas)."}
  ],
  "lastUpdated": "2026-08-07"
}