{
  "planPath": "docs/plans/2026-07-16-secrets-adoption-otopcua.md",
  "design": "docs/plans/2026-07-16-secrets-adoption-design.md",
  "app": "OtOpcUa",
  "gaps": ["G-2", "G-4", "G-5", "G-6"],
  "slices": {
    "1": {"desc": "Layer A (G-4) + UI (G-6) + plumbing + master-key (G-5)", "tasks": [1, 2, 3, 4, 5, 6]},
    "2": {"desc": "Layer B driver secrets (G-2)", "tasks": [7, 8, 9, 10]}
  },
  "tasks": [
    {"id": 1, "subject": "Package references + NuGet.config mapping", "status": "pending", "classification": "small", "slice": 1},
    {"id": 2, "subject": "Pre-host ${secret:} expander in Host/Program.cs (G-4 mechanism)", "status": "pending", "classification": "standard", "slice": 1, "blockedBy": [1]},
    {"id": 3, "subject": "Register AddZbSecrets on the runtime host UNCONDITIONALLY (surprise f)", "status": "pending", "classification": "high-risk", "slice": 1, "blockedBy": [2]},
    {"id": 4, "subject": "G-4: switch config secrets to ${secret:} + seed + boot smoke + negative control", "status": "pending", "classification": "standard", "slice": 1, "blockedBy": [3]},
    {"id": 5, "subject": "G-6: AddSecretsAuthorization() + mount /admin/secrets (both anchors)", "status": "pending", "classification": "standard", "slice": 1, "blockedBy": [3]},
    {"id": 6, "subject": "G-5: File master-key posture for clustered nodes (the fork)", "status": "pending", "classification": "small", "slice": 1, "blockedBy": [2]},
    {"id": 7, "subject": "G-2a: add secret: arm to GalaxySecretRef (Layer B)", "status": "pending", "classification": "high-risk", "slice": 2, "blockedBy": [3]},
    {"id": 8, "subject": "G-2b: ISecretResolver hook in OpcUaClient factory AND probe (both call sites)", "status": "pending", "classification": "high-risk", "slice": 2, "blockedBy": [3]},
    {"id": 9, "subject": "G-2c: AdminUI driver-config editor round-trip preserves secret: refs (surprise e)", "status": "pending", "classification": "standard", "slice": 2, "blockedBy": [7, 8]},
    {"id": 10, "subject": "Verification (Slice 2 gate)", "status": "pending", "classification": "standard", "slice": 2, "blockedBy": [1, 2, 3, 4, 5, 6, 7, 8, 9]}
  ],
  "lastUpdated": "2026-07-16"
}