{
  "planPath": "docs/plans/2026-07-16-secrets-adoption-mxaccessgw.md",
  "design": "docs/plans/2026-07-16-secrets-adoption-design.md",
  "app": "MxAccessGateway",
  "gaps": ["G-4", "G-5", "G-6"],
  "tasks": [
    {"id": 1, "subject": "Package references + nuget.config packageSourceMapping", "status": "pending", "classification": "small"},
    {"id": 2, "subject": "Pre-host ${secret:} expander in GatewayApplication.CreateBuilder (G-4 mechanism)", "status": "pending", "classification": "standard", "blockedBy": [1]},
    {"id": 3, "subject": "Runtime AddZbSecrets registration on the host container", "status": "pending", "classification": "trivial", "blockedBy": [2]},
    {"id": 4, "subject": "Switch LDAP ServiceAccountPassword to ${secret:} + seed + remove hardcoded defaults (G-4)", "status": "pending", "classification": "standard", "blockedBy": [3]},
    {"id": 5, "subject": "(Optional) Galaxy connstr + API-key pepper to ${secret:}", "status": "pending", "classification": "small", "blockedBy": [4]},
    {"id": 6, "subject": "AddSecretsAuthorization + mount /admin/secrets in Router & endpoint (G-6)", "status": "pending", "classification": "standard", "blockedBy": [3]},
    {"id": 7, "subject": "Master-key provider config for the NSSM box (G-5, Environment) + operator note", "status": "pending", "classification": "small", "blockedBy": [2]},
    {"id": 8, "subject": "Verification gate: 0-warning build, UI reveal+audit, SignalR unaffected", "status": "pending", "classification": "standard", "blockedBy": [1, 2, 3, 4, 5, 6, 7]}
  ],
  "lastUpdated": "2026-07-16"
}