T10.8: verification (390px/1440px, full suite, per-task done-when)

Walked T10.1-T10.5's claims against the actual code (env vars, routes,
JIT provisioning, the password-removal sweep, login.html) rather than
re-trusting this file's own prose. No drift found.

Full suite via the Docker runner: 39/41 files clean. token_check.py's
exit 2 is a harness mismatch (needs --out/--compare, not a bare run),
not a failure. generalinfo_check.py is 48/49 - the one failure is a
pre-existing rgba() shadow literal from the D11 Micron-assets merge,
confirmed via git show HEAD to predate this wave; logged as BL-031,
not fixed here. okta_auth_check.py re-run fresh: 22/22.

390px/1440px: baseline_shots.py captured all fourteen shots. Visually
confirmed login.html and users.html show the Okta-only sign-in and the
password-free admin UI at both widths.

Wave 10 complete.

docs/waves/wave-10.md

@@ -120,6 +120,42 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other
 - **T10.8 — Verification.** 390px and 1440px, full suite, done-when checks per task,
   matching the rigor D13 was held to.
 
+  Done-when checks per task, verified against the actual code rather than
+  re-reading this file's own claims: T10.1 (Authlib pinned, the four env vars,
+  `is_configured()`/`describe()`), T10.2 (the login/callback routes, no
+  app-side group or claim gate layered on Okta's own), T10.3 (identity-claim
+  matching, JIT at the lowest role, local deprovisioning still enforced after
+  Okta approves), T10.4 (zero remaining references to `bcrypt` /
+  `password_hash` / `hash_password` / `verify_password` anywhere in `.py` or
+  `.js`, `manage_users.py promote`, `smoketest.py` / `seed_demo.py` /
+  `browser_check.py` / `launcher_check.py` all minting via `create_token()`),
+  T10.5 (`login.html` is one Okta link, no password field). All matched what
+  this file already claimed — no drift found.
+
+  Full suite, run through the Docker test runner (all 41 files in `tests/`,
+  bare invocation): 39 passed clean. `tests/token_check.py` "failed" at exit 2,
+  but that is a harness mismatch, not a check failure — it is a two-step
+  snapshot/diff tool (`--out` to capture, `--compare A B` to diff) and prints
+  usage + exits 2 when run with no arguments, which is what a bare full-suite
+  pass does to every file. `tests/generalinfo_check.py` scored 48/49 — the one
+  failure is a raw `rgba()` shadow literal in `wp-creation-styles.css`,
+  confirmed via `git show HEAD` to already be committed and unrelated to this
+  wave (it is the Micron asset picker's dropdown shadow from the `D11` merge,
+  2026-08-20, predating this wave by two weeks). Logged as `BL-031` rather than
+  fixed here — an unrelated CSS token-rule violation is not this wave's to fix.
+  `tests/okta_auth_check.py` re-run fresh (no browser needed): 22/22.
+
+  390px and 1440px: `tests/baseline_shots.py` captured all fourteen shots
+  (login, launcher, sop, creator, admin, users, field × two widths) into
+  `docs/reference/baseline/`. `login-390.png`/`login-1440.png` and
+  `users-390.png`/`users-1440.png` visually confirmed: the login page is a
+  single "Sign in with Okta" button with no username/password form at either
+  width, and the User Directory's table and "Add a user" form both carry no
+  password column and no reset-password action anywhere, at either width.
+
+  Wave 10 is complete. The three items in "Still open" below are external
+  (security team / Okta admin), not blocked on any task in this wave.
+
 - **T10.9 — Rollback-aware deploy runbook.** Raised after hazard review found
   `DEPLOY-runbook-2026-08-04.md`'s Rollback section has no case for a migration whose
   `downgrade()` cannot restore the data it drops — see `D17`. `T10.4`'s