📝 docs: STATUS.md project snapshot 2026-05-05

documentation/STATUS.md

@@ -0,0 +1,49 @@
+# Project Status Snapshot
+
+Last updated 2026-05-05 evening.
+
+---
+
+## Active Features
+
+- Magic-link passwordless auth (POST /api/v1/auth/magic-link/request + GET /consume) — production-ready, ADR-0028 Phase A complete
+- OIDC client + HTTP handlers (GET /api/v1/auth/oidc/{provider}/start + /callback with PKCE) — production-ready code, BDD coverage TODO. ADR-0028 Phase B (B.1, B.3, B.4 + tests done ; B.5 BDD scenarios TODO).
+- Username + password auth — legacy (ADR-0018), kept during migration. To be decommissioned in Phase C.
+- Versioned API, JWT, OpenTelemetry, Swagger, BDD
+
+---
+
+## What's In Progress / Next
+
+- Phase B.5 BDD scenarios for OIDC (1 PR Mistral expected)
+- Phase C decommission password auth (separate ADR)
+
+---
+
+## Project Structure Highlights
+
+```
+adr/ : ADRs
+pkg/ : packages (auth, config, server, user, etc.)
+features/ : BDD scenarios
+documentation/ : docs index
+scripts/ : build + CI
+```
+
+---
+
+## Key Documentation Entry Points
+
+- README.md : quick start
+- AGENTS.md : agent + automation conventions
+- documentation/AUTH.md : auth system synthesis
+- documentation/MISTRAL-AUTONOMOUS-PATTERN.md : how Mistral PRs are shipped
+- documentation/PHASE_B_ROADMAP.md : remaining auth migration work
+- documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md : the autonomous session highlights
+- adr/ : architecture decisions
+
+---
+
+## Today's Milestone (2026-05-05)
+
+27 PRs merged in 1 day via the Mistral autonomous multi-process pattern. ADR-0028 (passwordless auth migration) essentially complete except Phase B.5 BDD.