diff --git a/docs/reference/baseline/admin-1440.png b/docs/reference/baseline/admin-1440.png index 6d7615e..aa3ba41 100644 Binary files a/docs/reference/baseline/admin-1440.png and b/docs/reference/baseline/admin-1440.png differ diff --git a/docs/reference/baseline/admin-390.png b/docs/reference/baseline/admin-390.png index 81ab325..a5d4e4c 100644 Binary files a/docs/reference/baseline/admin-390.png and b/docs/reference/baseline/admin-390.png differ diff --git a/docs/reference/baseline/creator-1440.png b/docs/reference/baseline/creator-1440.png index 8599fd7..97da56d 100644 Binary files a/docs/reference/baseline/creator-1440.png and b/docs/reference/baseline/creator-1440.png differ diff --git a/docs/reference/baseline/creator-390.png b/docs/reference/baseline/creator-390.png index 353a7df..7f8b12a 100644 Binary files a/docs/reference/baseline/creator-390.png and b/docs/reference/baseline/creator-390.png differ diff --git a/docs/reference/baseline/field-1440.png b/docs/reference/baseline/field-1440.png index fc67b7f..61586fb 100644 Binary files a/docs/reference/baseline/field-1440.png and b/docs/reference/baseline/field-1440.png differ diff --git a/docs/reference/baseline/field-390.png b/docs/reference/baseline/field-390.png index 9114635..40a87e4 100644 Binary files a/docs/reference/baseline/field-390.png and b/docs/reference/baseline/field-390.png differ diff --git a/docs/reference/baseline/launcher-1440.png b/docs/reference/baseline/launcher-1440.png index df01432..c99e209 100644 Binary files a/docs/reference/baseline/launcher-1440.png and b/docs/reference/baseline/launcher-1440.png differ diff --git a/docs/reference/baseline/launcher-390.png b/docs/reference/baseline/launcher-390.png index fdc17eb..ffeac9e 100644 Binary files a/docs/reference/baseline/launcher-390.png and b/docs/reference/baseline/launcher-390.png differ diff --git a/docs/reference/baseline/login-1440.png b/docs/reference/baseline/login-1440.png index 474e5b0..d80353d 100644 Binary files a/docs/reference/baseline/login-1440.png and b/docs/reference/baseline/login-1440.png differ diff --git a/docs/reference/baseline/login-390.png b/docs/reference/baseline/login-390.png index f1d2996..b1f7268 100644 Binary files a/docs/reference/baseline/login-390.png and b/docs/reference/baseline/login-390.png differ diff --git a/docs/reference/baseline/sop-1440.png b/docs/reference/baseline/sop-1440.png index 2d69ed6..49fdcca 100644 Binary files a/docs/reference/baseline/sop-1440.png and b/docs/reference/baseline/sop-1440.png differ diff --git a/docs/reference/baseline/sop-390.png b/docs/reference/baseline/sop-390.png index 907ac80..d4adcb2 100644 Binary files a/docs/reference/baseline/sop-390.png and b/docs/reference/baseline/sop-390.png differ diff --git a/docs/reference/baseline/users-1440.png b/docs/reference/baseline/users-1440.png index ee09237..0517197 100644 Binary files a/docs/reference/baseline/users-1440.png and b/docs/reference/baseline/users-1440.png differ diff --git a/docs/reference/baseline/users-390.png b/docs/reference/baseline/users-390.png index 6210a30..1ce1996 100644 Binary files a/docs/reference/baseline/users-390.png and b/docs/reference/baseline/users-390.png differ diff --git a/docs/waves/backlog.md b/docs/waves/backlog.md index dab74d2..e28f292 100644 --- a/docs/waves/backlog.md +++ b/docs/waves/backlog.md @@ -626,6 +626,28 @@ deliberately deferred. - **Suggested wave or follow-up:** next housekeeping pass, alongside any other post-cutover schema tidy-up. +### BL-031 — A raw `rgba()` shadow survives in the creator's stylesheet + +- **Found during:** T10.8 (the full suite could finally run through Docker; the + dev sandbox never had a headless browser to run it in before) +- **Where:** `html/wp-creation-styles.css:929`, `.asset-results { ... box-shadow:0 + 8px 24px rgba(20,30,50,.18); }` +- **What:** `generalinfo_check.py` asserts the whole file carries no raw colour + literal (comments excluded) as part of its CR-003 priority-colour check, and + this one line fails it: 48/49. Confirmed via `git show HEAD` that the literal + is already committed, byte-identical, unrelated to wave 10 — it is the Micron + asset picker's dropdown shadow, which arrived with the `origin/Micron-Assets` + merge (D11, 2026-08-20) and was never swept by `C4`'s token pass (`T9.9` + closed before D11 merged). The fix is a straight swap: + `theme-light.css:217` already declares `--wp-shadow-menu: 0 8px 24px + rgba(20, 30, 50, .18)`, the identical value — this line should read + `box-shadow:var(--wp-shadow-menu);`. +- **Why not now:** unrelated to the Okta wave; fixing a D11-era CSS literal + inside T10.8 (auth verification) is exactly the drive-by `CLAUDE.md` forbids. +- **Suggested wave or follow-up:** next housekeeping pass, with `C4`'s other + leftovers. One-line fix, `generalinfo_check.py` already pins it (49/49 once + fixed). + ### BL-030 — `DEPLOY-login-portal.md` is fully stale - **Found during:** T10.9 diff --git a/docs/waves/wave-10.md b/docs/waves/wave-10.md index 158328c..96223eb 100644 --- a/docs/waves/wave-10.md +++ b/docs/waves/wave-10.md @@ -120,6 +120,42 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other - **T10.8 — Verification.** 390px and 1440px, full suite, done-when checks per task, matching the rigor D13 was held to. + Done-when checks per task, verified against the actual code rather than + re-reading this file's own claims: T10.1 (Authlib pinned, the four env vars, + `is_configured()`/`describe()`), T10.2 (the login/callback routes, no + app-side group or claim gate layered on Okta's own), T10.3 (identity-claim + matching, JIT at the lowest role, local deprovisioning still enforced after + Okta approves), T10.4 (zero remaining references to `bcrypt` / + `password_hash` / `hash_password` / `verify_password` anywhere in `.py` or + `.js`, `manage_users.py promote`, `smoketest.py` / `seed_demo.py` / + `browser_check.py` / `launcher_check.py` all minting via `create_token()`), + T10.5 (`login.html` is one Okta link, no password field). All matched what + this file already claimed — no drift found. + + Full suite, run through the Docker test runner (all 41 files in `tests/`, + bare invocation): 39 passed clean. `tests/token_check.py` "failed" at exit 2, + but that is a harness mismatch, not a check failure — it is a two-step + snapshot/diff tool (`--out` to capture, `--compare A B` to diff) and prints + usage + exits 2 when run with no arguments, which is what a bare full-suite + pass does to every file. `tests/generalinfo_check.py` scored 48/49 — the one + failure is a raw `rgba()` shadow literal in `wp-creation-styles.css`, + confirmed via `git show HEAD` to already be committed and unrelated to this + wave (it is the Micron asset picker's dropdown shadow from the `D11` merge, + 2026-08-20, predating this wave by two weeks). Logged as `BL-031` rather than + fixed here — an unrelated CSS token-rule violation is not this wave's to fix. + `tests/okta_auth_check.py` re-run fresh (no browser needed): 22/22. + + 390px and 1440px: `tests/baseline_shots.py` captured all fourteen shots + (login, launcher, sop, creator, admin, users, field × two widths) into + `docs/reference/baseline/`. `login-390.png`/`login-1440.png` and + `users-390.png`/`users-1440.png` visually confirmed: the login page is a + single "Sign in with Okta" button with no username/password form at either + width, and the User Directory's table and "Add a user" form both carry no + password column and no reset-password action anywhere, at either width. + + Wave 10 is complete. The three items in "Still open" below are external + (security team / Okta admin), not blocked on any task in this wave. + - **T10.9 — Rollback-aware deploy runbook.** Raised after hazard review found `DEPLOY-runbook-2026-08-04.md`'s Rollback section has no case for a migration whose `downgrade()` cannot restore the data it drops — see `D17`. `T10.4`'s