---
gsd_state_version: 1.0
milestone: v1.0
milestone_name: milestone
status: In Progress — Plan 01-03 v3 written; plan-checker v3 needed
stopped_at: Plan 01-03 v3 committed (c7c785f); D-20 host swap formalized
last_updated: "2026-05-22T07:30:00.000Z"
last_activity: 2026-05-22 -- R-NEW-01 outcome (a) discovered → X4 chosen → D-20 + FND-02/03 v3 + plan 01-03 v3 written
progress:
  total_phases: 5
  completed_phases: 0
  total_plans: 5
  completed_plans: 2
  percent: 0
---

# Project State

## Project Reference

See: .planning/PROJECT.md (updated 2026-05-21)

**Core value:** Max can publish and update a webpage to a live `bigscreenvr.com/<path>` URL via a CLI + Claude Code skill — without Jenkins, without Builder.io, without breaking what's already online.
**Current focus:** Phase 01 — foundations-registry-oauth

## Current Position

Phase: 01 (foundations-registry-oauth) — IN PROGRESS
Plan: 3 of 5 (01-03 v3 written; plan-checker v3 needed before Tasks 2-6 execution)
Status: Replan v3 complete @ c7c785f; D-20 (api.bigscreencloud.com OAuth backend) formalized; Task 1 closed via D-20
Last activity: 2026-05-22 -- R-NEW-01 outcome (a) → X4 chosen → host swap → plan v3

Progress: [██░░░░░░░░] 20%

## Resolved Blockers (chronological)

**v1 → v2 (2026-05-22 earlier):** Arda V1 contradictions (FND-02 + FND-03 vs confidential-client UI) → D-13..D-19 lock dev-website OAuth backend; Plan 01-03 replanned v2; plan-check v2 PASS (af27b4d).

**v2 → v3 (2026-05-22 later):** R-NEW-01 outcome (a) discovered — dev-website is CRA SPA on CloudFront/S3, not a Node-capable host. User chose Option X4 → D-20 (api.bigscreencloud.com direct). FND-02 v3 + FND-03 v3 host-corrected. Plan 01-03 v3 written (c7c785f). Plan-checker v3 needed.

See `01-03-RESEARCH-DELTA.md`, `01-CONTEXT.md §D-20`, `VERIFICATION-MEMO.md §FND-02 v3 / FND-03 v3`.

## Next Actions

1. Run `gsd-plan-checker` against Plan 01-03 v3 @ c7c785f. Write `01-03-PLAN-CHECK-v3.md`. Verify the host swap did not regress BLOCKER/HIGH/MED resolutions from v2.
2. If PASS: execute Tasks 2 → 2.5 → 2.75 → 3 → 4 → 5 → 5b → 6 (Task 1 already closed via D-20).
3. open-q-egress (devops): surface apps/api outbound source IP(s) for Arda Server IPs field. Gates Task 6 registration only; Tasks 2-5 ship in parallel.

## Performance Metrics

**Velocity:**

- Total plans completed: 0
- Average duration: n/a
- Total execution time: 0 hours

**By Phase:**

| Phase | Plans | Total | Avg/Plan |
|-------|-------|-------|----------|
| - | - | - | - |

**Recent Trend:**

- Last 5 plans: n/a
- Trend: n/a

*Updated after each plan completion*

## Accumulated Context

### Decisions

Decisions are logged in PROJECT.md Key Decisions table.
Recent decisions affecting current work:

- Roadmap: 4 coarse phases bundling research's 9 fine-grained phases (FND+REG+AUTH | CLI+CDN | SPA+PAGE | CUT+SKILL)
- Roadmap: Phase 1 is non-negotiable — six external-system verification gaps must close before Phase 2 starts
- Roadmap: SKILL ships last so it documents real CLI behavior, not aspirational behavior
- Roadmap: Render-layer choice (iframe vs scoped-inject) deferred to Phase 1 prototype against `bigscreen10`

### Pending Todos

None yet.

### Blockers/Concerns

Phase 1 carries the milestone's open verification items:

- CloudFront distribution config lives outside `website` + `cloud` repos (devops repo / Terraform); source must be located
- `apps/admin_api` SG may not accept OAuth-bearer traffic from public IPs without modification
- Arda may not yet expose `/oauth/device_authorization`; PKCE-loopback is the likely fallback

## Deferred Items

Items acknowledged and carried forward from previous milestone close:

| Category | Item | Status | Deferred At |
|----------|------|--------|-------------|
| *(none)* | | | |

## Quick Tasks Completed

| ID | Slug | Date | Status | Description |
|----|------|------|--------|-------------|
| 260521-vlu | rename-oauth-scopes-site-to-website | 2026-05-22 | complete ✓ | Rename OAuth scopes `site:read/write/promote` → `website:*` across 18 planning docs + 3 cloud commits (D-17). Cloud `dev-web-publisher` rebased; backup tag `backup/pre-rename-D17`. Force-push deferred. |

## Session Continuity

Last session: 2026-05-22T05:40:25.594Z
Stopped at: Phase 01 re-discuss complete — D-13..D-19 lock dev-website OAuth backend; ARDA-V1-BLOCKER resolved (pending VERIFICATION-MEMO + Plan 01-03 frontmatter update)
Resume file: .planning/phases/01-foundations-registry-oauth/01-CONTEXT.md
Open carries:

  - Phase 2 must reflect FND-03 Option D: route prefixes mount on apps/api, not admin_api (annotated in 01-02-PLAN.md @ abce0bf)
  - Executor deviation: git stash used for TS baseline comparison; future executors should use git show HEAD:<path> + git diff HEAD instead

Resolved 2026-05-21:

  - website:promote scope split: SHIPPED on dev-web-publisher (cloud@fdc41c94); tracked here @ 7df6090
  - Backlog 999.1 placement: PROMOTED to active Phase 2.1 (between Phase 2 and Phase 3); commit 5f0dd54
  - Cloud branch policy locked: all cloud work on `dev-web-publisher` off `dev-gem`; PR target `dev-gem`. Recorded in .planning/config.json cross_repo.cloud. Original commits (05e11c62, 2687424e) cherry-picked → new SHAs (e60c71a9, 35f5b296). Branch pushed to origin; PR-ready at https://github.com/BigscreenVR/cloud/pull/new/dev-web-publisher