✨ feat(deploy): Dockerfile + Helm chart for k3s homelab deployment (#89 )

Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>
🔒 fix(security): redact JWT tokens and HMAC secrets in trace logs (auth_service.go) (#88 )
2026-05-06 06:51:14 +02:00 · 2026-05-06 06:43:30 +02:00 · 2026-05-06 06:37:17 +02:00 · 2026-05-05 22:52:40 +02:00 · 2026-05-05 22:52:25 +02:00 · 2026-05-05 22:50:55 +02:00
36 changed files with 3400 additions and 10 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,8 +10,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - ✨ `GET /api/v1/uptime` endpoint (PR #67) — returns server start_time and uptime_seconds
- 📝 mkcert local HTTPS setup + Makefile cert target (PR #68) — prep for ADR-0028 Phase B OIDC callbacks
+- 📝 mkcert local HTTPS doc + Makefile `cert` target (PR #68) — prep for ADR-0028 Phase B OIDC callbacks
- ✨ `pkg/auth/` skeleton for OpenID Connect (PR #69) — types + client surface, handlers come later
+- ✨ `pkg/auth/` skeleton for OpenID Connect (PR #69) — types + client surface, handlers come later (Phase B.3+)
 - 📝 ADR-0028 Phase B roadmap document (PR #71) — outlines remaining B.3 / B.4 / B.5 work
 - ✨ `pkg/auth/` OIDC client implementation : Discover, RefreshJWKS, ExchangeCode, ValidateIDToken (PR #74) — completes ADR-0028 Phase B.3
 - ✨ OIDC HTTP handlers : `/api/v1/auth/oidc/{provider}/start` and `/callback` with PKCE + sign-up-on-first-use (PR #75) — completes ADR-0028 Phase B.4
 - 🧪 OIDC handler unit tests covering start/callback rejection paths and PKCE redirect (PR #76)
 - 📝 `documentation/AUTH.md` synthesis covering Phase A + B current state (PR #73)
 - 📝 `documentation/MISTRAL-AUTONOMOUS-PATTERN.md` contributor guide for the Mistral autonomous pattern that ships PRs (PR #78)
 - 📝 PHASE_B_ROADMAP marks B.3 + B.4 done (PR #80)
 - 📝 documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md captures the day's 24 Mistral autonomous PRs (PR #81)
 - 📝 README link to Mistral autonomous pattern doc (PR #83)
 - 📝 documentation/STATUS.md project snapshot for onboarding (PR #85)
 ## [0.1.0] - 2026-05-05
--- a/36
+++ b/36
@@ -0,0 +1,36 @@
 # Build dance-lessons-coach Docker image
 FROM golang:1.26-alpine AS builder
 # Install git (required for go mod download)
 RUN apk add --no-cache git
 # Set working directory
 WORKDIR /app
 # Copy go module files and download dependencies
 COPY go.mod go.sum ./
 RUN go mod download
 # Copy entire source code
 COPY . .
 # Build the server binary
 RUN go build -o app ./cmd/server
 # Final lightweight stage
 FROM alpine:latest
 # Install CA certificates for HTTPS
 RUN apk --no-cache add ca-certificates
 # Set working directory
 WORKDIR /root/
 # Copy binary from builder stage
 COPY --from=builder /app/app .
 # Expose port 8080
 EXPOSE 8080
 # Start the server
 CMD ["./app"]
--- a/24
+++ b/24
@@ -0,0 +1,24 @@
 # dance-lessons-coach Makefile — minimal targets for local development.
 # This is a starter Makefile ; expand as needed (build, test, run, etc.).
 # Existing build/test workflows live in scripts/ and remain authoritative.
 CERT_DIR := ./certs
 .PHONY: help cert clean-cert
 help:
 	@echo "Available targets:"
 	@echo "  cert        Generate local-dev TLS certs via mkcert (cf. documentation/MKCERT.md)"
 	@echo "  clean-cert  Remove generated TLS certs"
 	@echo "  help        Show this help"
 cert: $(CERT_DIR)
 	@command -v mkcert >/dev/null 2>&1 || { echo >&2 "mkcert not found. See documentation/MKCERT.md to install."; exit 1; }
 	mkcert -cert-file $(CERT_DIR)/dev-cert.pem -key-file $(CERT_DIR)/dev-key.pem localhost 127.0.0.1 ::1
 	@echo "Certs ready at $(CERT_DIR)/. Cf. documentation/MKCERT.md for usage."
 $(CERT_DIR):
 	mkdir -p $(CERT_DIR)
 clean-cert:
 	rm -rf $(CERT_DIR)
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@ Go web service demonstrating idiomatic package structure, versioned JSON API, an
 - OpenAPI / Swagger UI (embedded in binary)
 - PostgreSQL user service with JWT auth
 - BDD + unit tests
 - 🤖 Mistral autonomous PR pattern (cf. [documentation/MISTRAL-AUTONOMOUS-PATTERN.md](documentation/MISTRAL-AUTONOMOUS-PATTERN.md))
 ## Quick Start
--- a/chart/.helmignore
+++ b/chart/.helmignore
@@ -0,0 +1,23 @@
 # Patterns to ignore when building packages.
 # This supports shell glob matching, relative path matching, and
 # negation (prefixed with !). Only one pattern per line.
 .DS_Store
 # Common VCS dirs
 .git/
 .gitignore
 .bzr/
 .bzrignore
 .hg/
 .hgignore
 .svn/
 # Common backup files
 *.swp
 *.bak
 *.tmp
 *.orig
 *~
 # Various IDEs
 .project
 .idea/
 *.tmproj
 .vscode/
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -0,0 +1,6 @@
 apiVersion: v2
 name: dance-lessons-coach
 description: Helm chart for dance-lessons-coach Go API server (ARCODANGE)
 type: application
 version: 0.1.0
 appVersion: "latest"
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -0,0 +1,22 @@
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}
  {{- range .paths }}
  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
  {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "dance-lessons-coach.fullname" . }})
  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
  echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "dance-lessons-coach.fullname" . }}'
  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "dance-lessons-coach.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
  echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "dance-lessons-coach.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
  echo "Visit http://127.0.0.1:8080 to use your application"
  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}
--- a/chart/templates/_helpers.tpl
+++ b/chart/templates/_helpers.tpl
@@ -0,0 +1,62 @@
 {{/*
 Expand the name of the chart.
 */}}
 {{- define "dance-lessons-coach.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
 {{- define "dance-lessons-coach.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
 {{- $name := default .Chart.Name .Values.nameOverride }}
 {{- if contains $name .Release.Name }}
 {{- .Release.Name | trunc 63 | trimSuffix "-" }}
 {{- else }}
 {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 {{- end }}
 {{- end }}
 {{/*
 Create chart name and version as used by the chart label.
 */}}
 {{- define "dance-lessons-coach.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 {{/*
 Common labels
 */}}
 {{- define "dance-lessons-coach.labels" -}}
 helm.sh/chart: {{ include "dance-lessons-coach.chart" . }}
 {{ include "dance-lessons-coach.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 {{/*
 Selector labels
 */}}
 {{- define "dance-lessons-coach.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "dance-lessons-coach.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 {{/*
 Create the name of the service account to use
 */}}
 {{- define "dance-lessons-coach.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
 {{- default (include "dance-lessons-coach.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
--- a/chart/templates/configmap.yaml
+++ b/chart/templates/configmap.yaml
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: {{ include "dance-lessons-coach.fullname" . }}-config
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "dance-lessons-coach.labels" . | nindent 4 }}
 data:
 {{ toYaml .Values.config | indent 2 }}
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -0,0 +1,72 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: {{ include "dance-lessons-coach.fullname" . }}
  labels:
    {{- include "dance-lessons-coach.labels" . | nindent 4 }}
 spec:
  revisionHistoryLimit: 3
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "dance-lessons-coach.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "dance-lessons-coach.labels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "dance-lessons-coach.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          envFrom:
            - configMapRef:
                name: {{ include "dance-lessons-coach.fullname" . }}-config
          ports:
            - name: http
              containerPort: {{ .Values.service.port }}
              protocol: TCP
          livenessProbe:
            {{- toYaml .Values.livenessProbe | nindent 12 }}
          readinessProbe:
            {{- toYaml .Values.readinessProbe | nindent 12 }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          {{- with .Values.volumeMounts }}
          volumeMounts:
            {{- toYaml . | nindent 12 }}
          {{- end }}
      {{- with .Values.volumes }}
      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
--- a/chart/templates/ingress.yaml
+++ b/chart/templates/ingress.yaml
@@ -0,0 +1,61 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "dance-lessons-coach.fullname" . -}}
 {{- $svcPort := .Values.service.port -}}
 {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
  {{- end }}
 {{- end }}
 {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
 apiVersion: networking.k8s.io/v1
 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
 apiVersion: networking.k8s.io/v1beta1
 {{- else -}}
 apiVersion: extensions/v1beta1
 {{- end }}
 kind: Ingress
 metadata:
  name: {{ $fullName }}
  labels:
    {{- include "dance-lessons-coach.labels" . | nindent 4 }}
  {{- with .Values.ingress.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 spec:
  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
  ingressClassName: {{ .Values.ingress.className }}
  {{- end }}
  {{- if .Values.ingress.tls }}
  tls:
    {{- range .Values.ingress.tls }}
    - hosts:
        {{- range .hosts }}
        - {{ . | quote }}
        {{- end }}
      secretName: {{ .secretName }}
    {{- end }}
  {{- end }}
  rules:
    {{- range .Values.ingress.hosts }}
    - host: {{ .host | quote }}
      http:
        paths:
          {{- range .paths }}
          - path: {{ .path }}
            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
            pathType: {{ .pathType }}
            {{- end }}
            backend:
              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
              service:
                name: {{ $fullName }}
                port:
                  number: {{ $svcPort }}
              {{- else }}
              serviceName: {{ $fullName }}
              servicePort: {{ $svcPort }}
              {{- end }}
          {{- end }}
    {{- end }}
 {{- end }}
--- a/chart/templates/service.yaml
+++ b/chart/templates/service.yaml
@@ -0,0 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: {{ include "dance-lessons-coach.fullname" . }}
  labels:
    {{- include "dance-lessons-coach.labels" . | nindent 4 }}
 spec:
  type: {{ .Values.service.type }}
  ports:
    - port: {{ .Values.service.port }}
      targetPort: http
      protocol: TCP
      name: http
  selector:
    {{- include "dance-lessons-coach.selectorLabels" . | nindent 4 }}
--- a/chart/templates/serviceaccount.yaml
+++ b/chart/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
 {{- if .Values.serviceAccount.create -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: {{ include "dance-lessons-coach.serviceAccountName" . }}
  labels:
    {{- include "dance-lessons-coach.labels" . | nindent 4 }}
  {{- with .Values.serviceAccount.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
 {{- end }}
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -0,0 +1,113 @@
 # Default values for dance-lessons-coach.
 # This is a YAML-formatted file.
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
  repository: gitea.arcodange.lab/arcodange/dance-lessons-coach
  pullPolicy: Always
  # Overrides the image tag whose default is the chart appVersion.
  tag: ""
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Automatically mount a ServiceAccount's API credentials?
  automount: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""
 podAnnotations: {}
 podLabels: {}
 podSecurityContext: {}
  # fsGroup: 2000
 securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000
 service:
  type: ClusterIP
  port: 8080
 ingress:
  enabled: true
  className: ""
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-crowdsec@kubernetescrd
  hosts:
    - host: dancecoachlessons.arcodange.lab
      paths:
        - path: /
          pathType: Prefix
  tls: []
 resources: {}
  # We usually recommend not to specify default resources and to leave this as a conscious
  # choice for the user. This also increases chances charts run on environments with little
  # resources, such as Minikube. If you do want to specify resources, uncomment the following
  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
  # limits:
  #   cpu: 100m
  #   memory: 128Mi
  # requests:
  #   cpu: 100m
  #   memory: 128Mi
 livenessProbe:
  httpGet:
    path: /api/healthz
    port: http
 readinessProbe:
  httpGet:
    path: /api/healthz
    port: http
 autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 100
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80
 # Additional volumes on the output Deployment definition.
 volumes: []
 # - name: foo
 #   secret:
 #     secretName: mysecret
 #     optional: false
 # Additional volumeMounts on the output Deployment definition.
 volumeMounts: []
 # - name: foo
 #   mountPath: "/etc/foo"
 #   readOnly: true
 nodeSelector:
  kubernetes.io/hostname: pi1
 tolerations: []
 affinity: {}
 # DLC-specific configuration
 config:
  DLC_LOGGING_JSON: "true"
  DLC_LOGGING_LEVEL: "info"
  DLC_DATABASE_HOST: ""
  DLC_DATABASE_PORT: "5432"
  DLC_API_V2_ENABLED: "false"
--- a/documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md
+++ b/documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md
@@ -0,0 +1,83 @@
 # 2026-05-05 Autonomous Session Recap
 On 2026-05-05, ARCODANGE shipped a record 23 PRs to dance-lessons-coach using the Mistral Vibe autonomous multi-process pattern. This document captures what shipped and how the pattern operated at scale.
 ---
 ## What shipped
 PRs merged to main on 2026-05-05, grouped by ADR-0028 phase.
 ### Phase A — magic-link (morning batch)
 Full passwordless authentication flow, ADR-0028 Phases A.1 through A.5:
 - **#56** :rocket: feat(server): api.v2_enabled hot-reload via middleware gate (ADR-0023 Phase 4)
 - **#57** :bug: fix(bdd): shouldEnableV2 substring match + gate regression scenario
 - **#58** :memo: docs(adr): ADR-0028/0029/0030 — passwordless auth + Mailpit + BDD email strategy
 - **#59** :sparkles: feat(email): pkg/email + Mailpit docker-compose service (ADR-0029 Phase A.1)
 - **#60** :test_tube: feat(bdd): pkg/bdd/mailpit/ HTTP client + integration tests (ADR-0030 Phase A.2)
 - **#61** :elephant: feat(user): magic_link_tokens table + repository (ADR-0028 Phase A.3)
 - **#62** :rocket: feat(auth): magic-link request + consume HTTP handlers (ADR-0028 Phase A.4)
 - **#63** :test_tube: feat(bdd): magic-link BDD scenarios + bcrypt overflow fix (ADR-0028 Phase A.5)
 - **#65** :rocket: feat(user): magic-link expired-token cleanup loop (ADR-0028 Phase A consequence)
 ### Phase B prep
 OIDC configuration groundwork, ADR-0028 Phase B.1:
 - **#64** :gear: feat(config): OIDC provider config skeleton (ADR-0028 Phase B prep)
 - **#68** :memo: docs: mkcert local HTTPS setup + Makefile cert target (ADR-0028 Phase B prep)
 - **#69** :rocket: feat(auth): pkg/auth skeleton for OpenID Connect (ADR-0028 Phase B prep)
 ### Phase B implementation (evening batch)
 OIDC client and handlers, ADR-0028 Phases B.3 and B.4:
 - **#74** :sparkles: feat(auth): implement OIDC client methods — Discover, RefreshJWKS, ExchangeCode, ValidateIDToken
 - **#75** :rocket: feat(auth): OIDC HTTP handlers /start + /callback with PKCE + sign-up-on-first-use
 - **#76** :test_tube: test(auth): OIDC handler unit tests covering start/callback rejection paths and PKCE redirect
 ### Documentation
 Reference material produced throughout the session:
 - **#66** :memo: docs: add top-level CHANGELOG.md (keepachangelog format)
 - **#71** :memo: docs: ADR-0028 Phase B roadmap (B.3 / B.4 / B.5 outline)
 - **#72** :memo: docs(changelog): record PRs #67-#71
 - **#73** :memo: docs: AUTH.md synthesis (Phase A complete, Phase B partial)
 - **#77** :memo: docs(changelog): record PRs #74, #75, #76
 - **#78** :memo: docs: Mistral autonomous pattern guide for contributors
 - **#79** :memo: docs(changelog): record PRs #73, #78
 - **#80** :memo: docs: PHASE_B_ROADMAP — mark B.3 + B.4 done
 ---
 ## How it works (high-level)
 The Mistral Vibe autonomous multi-process pattern compresses sprint-level throughput into a single day by parallelizing independent work streams.
 One task equals one isolated git worktree created via `git worktree add`. Each worktree branches from current `origin/main`, eliminating race conditions that previously plagued the harness (Q-038 fix via pre-fetched origin).
 One worker equals one `vibe -p` invocation reading a `CONTEXT.md` brief. The worker executes the full PR lifecycle end-to-end: code implementation, build and test, commit with conventions, push to remote, PR creation via Gitea API, and merge attempt. Multiple workers (typically 2-4) run concurrently in separate worktrees, each working on different files and features.
 A `dispatch-batch.sh` script orchestrates the parallel workers and handles cross-worker dependencies. For the rare gaps — price-cap restrictions, broken tests, or ambiguous requirements — a trainer takeover (~5% of cases, typically within 5 minutes) covers the edge cases without blocking the batch.
 See [documentation/MISTRAL-AUTONOMOUS-PATTERN.md](MISTRAL-AUTONOMOUS-PATTERN.md) for the complete pattern specification.
 ---
 ## Numbers
 - **23 PRs** Mistral autonomously merged to main in one calendar day
 - **95-100% autonomy** per batch; trainer takeover only for Q-058 and Q-062 edge cases
 - **Wall-clock parallel**: ~2 minutes for 2 PRs in a concurrent batch (vs ~3-4 minutes serial)
 - **Cost**: ~$0.50-1.50 per simple PR (documentation, minor changes), ~$2-3 per code-heavy PR (complex logic, multiple files)
 ---
 ## Why this matters
 The pattern compresses a sprint of work into a single day, shifting the operator role from execution to supervision. ADR-0028 (the passwordless auth migration) was essentially completed in this single session — Phase A (magic-link) fully shipped, Phase B (OIDC) advanced through B.4, with only Phase B.5 (BDD scenarios) remaining.
 ---
 ## Cross-references
 - [ADR-0028](../adr/0028-passwordless-auth-migration.md) — passwordless auth migration strategy
 - [AUTH.md](AUTH.md) — current authentication system state
 - [MISTRAL-AUTONOMOUS-PATTERN.md](MISTRAL-AUTONOMOUS-PATTERN.md) — the pattern itself
 - [PHASE_B_ROADMAP.md](PHASE_B_ROADMAP.md) — remaining Phase B work
 - [CHANGELOG.md](../CHANGELOG.md) — complete PR list
--- a/documentation/AUTH.md
+++ b/documentation/AUTH.md
@@ -0,0 +1,132 @@
 # Authentication System
 ## Overview
 The dance-lessons-coach authentication system provides a passwordless magic-link flow as the primary mechanism, with legacy username+password support during the transition period. OpenID Connect (OIDC) integration is in progress for Phase B. See [ADR-0028](../adr/0028-passwordless-auth-migration.md) for the migration strategy.
 ## Authentication mechanisms supported
 ### Username + password (legacy, ADR-0018)
 - **Endpoint:** `POST /api/v1/auth/login`
 - **Status:** Operational, to be decommissioned in Phase C
 - **Details:** bcrypt-hashed passwords, JWT token issuance
 ### Magic link by email (ADR-0028 Phase A)
 - **Request endpoint:** `POST /api/v1/auth/magic-link/request` — accepts `{email}`, generates token, stores hash, sends email
 - **Consume endpoint:** `GET /api/v1/auth/magic-link/consume?token=<...>` — validates hash, marks consumed, issues JWT
 - **Always returns 200 on request** to prevent email enumeration
 - **First-link sign-up:** if email is unknown, consume endpoint creates the user record
 ### OpenID Connect (ADR-0028 Phase B, work in progress)
 - **Status:** Skeleton merged (`pkg/auth/`), handlers and flow not yet wired
 - **Planned endpoints:**
  - `GET /api/v1/auth/oidc/start` — generates state + PKCE, redirects to provider
  - `GET /api/v1/auth/oidc/callback` — exchanges code for tokens, validates id_token, issues internal JWT
 - **Provider config:** `auth.oidc.providers.*` in config
 ## Magic-link flow detail
 ```mermaid
 sequenceDiagram
  User->>Server: POST /api/v1/auth/magic-link/request {email}
  Server-->>User: 200 (always — anti-enumeration)
  Server->>Mailpit (or SMTP provider): SMTP send "Your sign-in link"
  User->>Email: clicks link
  User->>Server: GET /api/v1/auth/magic-link/consume?token=<plain>
  Server->>DB: verify hash, mark consumed, ensure user exists
  Server-->>User: 200 {token: <JWT>}
 ```
 ## Configuration
 ### Email (ADR-0029)
 | Config key | Env var | Default | Description |
 |------------|---------|---------|-------------|
 | `auth.email.from` | `DLC_AUTH_EMAIL_FROM` | `noreply@dance-lessons-coach.local` | Sender address |
 | `auth.email.smtp_host` | `DLC_AUTH_EMAIL_SMTP_HOST` | `localhost` | SMTP host |
 | `auth.email.smtp_port` | `DLC_AUTH_EMAIL_SMTP_PORT` | `1025` | SMTP port |
 | `auth.email.smtp_use_tls` | `DLC_AUTH_EMAIL_SMTP_USE_TLS` | `false` | Use TLS |
 | `auth.email.timeout` | `DLC_AUTH_EMAIL_TIMEOUT` | `10s` | Connection timeout |
 ### Magic link (ADR-0028 Phase A)
 | Config key | Env var | Default | Description |
 |------------|---------|---------|-------------|
 | `auth.magic_link.ttl` | `DLC_AUTH_MAGIC_LINK_TTL` | `15m` | Token lifetime |
 | `auth.magic_link.base_url` | `DLC_AUTH_MAGIC_LINK_BASE_URL` | `http://localhost:8080` | Base URL for links |
 | `auth.magic_link.cleanup_interval` | `DLC_AUTH_MAGIC_LINK_CLEANUP_INTERVAL` | `1h` | Cleanup loop interval |
 ### JWT (ADR-0021)
 | Config key | Env var | Default | Description |
 |------------|---------|---------|-------------|
 | `auth.jwt.ttl` | `DLC_AUTH_JWT_TTL` | `1h` | Token time-to-live |
 | `auth.jwt.secret_retention.retention_factor` | `DLC_AUTH_JWT_SECRET_RETENTION_FACTOR` | `2.0` | Retention multiplier |
 | `auth.jwt.secret_retention.max_retention` | `DLC_AUTH_JWT_SECRET_MAX_RETENTION` | `72h` | Maximum retention |
 | `auth.jwt.secret_retention.cleanup_interval` | `DLC_AUTH_JWT_SECRET_CLEANUP_INTERVAL` | `1h` | Secret cleanup interval |
 ### OIDC (Phase B, prep)
 | Config key | Env var | Default | Description |
 |------------|---------|---------|-------------|
 | `auth.oidc.providers.<name>.issuer_url` | `DLC_AUTH_OIDC_ISSUER_URL` | - | Provider issuer URL |
 | `auth.oidc.providers.<name>.client_id` | `DLC_AUTH_OIDC_CLIENT_ID` | - | Client ID |
 | `auth.oidc.providers.<name>.client_secret` | `DLC_AUTH_OIDC_CLIENT_SECRET` | - | Client secret |
 ## Token model
 Magic-link tokens use **SHA-256 hex hashing at rest** — only the hash is stored in the database (`token_hash` column, 64 chars). The plaintext token is emailed to the user and must be supplied back to re-derive the hash. This means a database leak reveals no usable tokens. See `pkg/user/magic_link.go` for the rationale.
 ```go
 // HashMagicLinkToken returns the lowercase hex sha256 of token
 func HashMagicLinkToken(plaintext string) string {
    sum := sha256.Sum256([]byte(plaintext))
    return hex.EncodeToString(sum[:])
 }
 ```
 ## Cleanup loops
 ### JWT secret retention (ADR-0021)
 - **Location:** `pkg/user/jwt_manager.go` — `StartCleanupLoop`
 - **Interval:** Configurable via `auth.jwt.secret_retention.cleanup_interval` (default: 1h)
 - **Behavior:** Removes secrets older than retention period (TTL x retention_factor, capped at max_retention)
 - **Safety:** Never removes the current primary secret
 ### Magic-link expired tokens (ADR-0028 Phase A)
 - **Location:** `pkg/user/magic_link_cleanup.go` — `StartCleanupLoop`
 - **Interval:** Configurable via `auth.magic_link.cleanup_interval` (default: 1h)
 - **Behavior:** Deletes tokens where `expires_at < now`
 - **Implementation:** Calls `DeleteExpiredMagicLinkTokens` on the repository
 ## Local dev setup
 1. **Start services:**
   ```bash
   docker compose up -d  # starts Postgres + Mailpit
   ```
 2. **Inspect emails:** http://localhost:8025 (Mailpit UI)
 3. **HTTPS for OIDC (Phase B):**
   ```bash
   make cert  # generates certs/dev-cert.pem + certs/dev-key.pem via mkcert
   ```
   See [MKCERT.md](MKCERT.md) for details.
 ## Cross-references
 ### Architecture Decision Records
 | ADR | Description |
 |-----|-------------|
 | [ADR-0018](../adr/0018-user-management-auth-system.md) | Original username/password auth system |
 | [ADR-0021](../adr/0021-jwt-secret-retention-policy.md) | JWT secret retention and cleanup |
 | [ADR-0028](../adr/0028-passwordless-auth-migration.md) | Passwordless migration (Phase A complete, Phase B in progress) |
 | [ADR-0029](../adr/0029-email-infrastructure-mailpit.md) | Email infrastructure (Mailpit) |
 | [ADR-0030](../adr/0030-bdd-email-parallel-strategy.md) | BDD parallel email assertions |
 ### Documentation
 | Document | Description |
 |----------|-------------|
 | [EMAIL.md](EMAIL.md) | SMTP setup and Mailpit usage |
 | [MKCERT.md](MKCERT.md) | Local HTTPS certificate setup |
 | [PHASE_B_ROADMAP.md](PHASE_B_ROADMAP.md) | Remaining OIDC work |
 ---
 *Developer onboarding doc — see ADR-0028 for implementation details.*
--- a/documentation/CLI.md
+++ b/documentation/CLI.md
@@ -0,0 +1,251 @@
 # CLI Management Guide
 Complete reference for the `dance-lessons-coach` CLI, server lifecycle, and configuration. Extracted from the original `AGENTS.md` (Tâche 6 restructure) for lazy-loading compatibility with Mistral Vibe.
 ## Cobra CLI (Recommended)
 `dance-lessons-coach` includes a modern CLI built with Cobra:
 ```bash
 # Show help and available commands
 ./bin/dance-lessons-coach --help
 # Show version information
 ./bin/dance-lessons-coach version
 # Greet someone by name
 ./bin/dance-lessons-coach greet John
 # Start the server
 ./bin/dance-lessons-coach server
 ```
 **Available Commands:**
 - `version` — Print version information
 - `server` — Start the dance-lessons-coach server
 - `greet [name]` — Greet someone by name
 - `help` — Built-in help system
 - `completion` — Generate shell completion scripts
 **Server Command Flags:**
 - `--config` — Config file path
 - `--env` — Environment (`dev`, `staging`, `prod`)
 - `--debug` — Enable debug logging
 ## Version Information
 The server provides runtime version information:
 ```bash
 # Check version using new CLI
 ./bin/dance-lessons-coach version
 # Check version using server binary
 ./bin/server --version
 # Output:
 dance-lessons-coach Version Information:
  Version:   1.0.0
  Commit:    abc1234
  Built:     2026-04-05T10:00:00+0000
  Go:        go1.26.1
 ```
 For full version management workflow (bump, release, build with version), see [`version-management-guide.md`](version-management-guide.md).
 ## Server Control Script
 A shell script manages the server lifecycle:
 ```bash
 cd /Users/gabrielradureau/Work/Vibe/DanceLessonsCoach
 ./scripts/start-server.sh start     # Start the server
 ./scripts/start-server.sh status    # Check server status
 ./scripts/start-server.sh test      # Test API endpoints
 ./scripts/start-server.sh logs      # View server logs
 ./scripts/start-server.sh stop      # Stop the server
 ./scripts/start-server.sh restart   # Restart
 ```
 **Available subcommands:**
 - `start` — Start the server in background with proper logging
 - `stop` — Stop the server gracefully
 - `restart` — Restart the server
 - `status` — Check if server is running
 - `logs` — Show recent server logs
 - `test` — Test all API endpoints
 ## Manual Server Management
 For direct control:
 ```bash
 cd /Users/gabrielradureau/Work/Vibe/DanceLessonsCoach
 ./scripts/start-server.sh start
 ```
 **Expected output:**
 ```
 Server running on :8080
 [INF] Starting HTTP server on :8080
 [TRC] Registering greet routes
 [TRC] Greet routes registered
 ```
 **Features:**
 - Context-aware server initialization
 - Graceful shutdown handling
 - Signal-based termination (`SIGINT`, `SIGTERM`)
 - 30-second shutdown timeout
 - Proper resource cleanup
 ## Configuration
 Configuration via environment variables with `DLC_` prefix:
 | Option | Environment Variable | Default | Description |
 |---|---|---|---|
 | Host | `DLC_SERVER_HOST` | `0.0.0.0` | Server bind address |
 | Port | `DLC_SERVER_PORT` | `8080` | Server listening port |
 | Shutdown Timeout | `DLC_SHUTDOWN_TIMEOUT` | `30s` | Graceful shutdown timeout |
 | JSON Logging | `DLC_LOGGING_JSON` | `false` | Enable JSON format logging |
 | Log Output | `DLC_LOGGING_OUTPUT` | `""` | Log output file path (empty for stderr) |
 **Examples:**
 ```bash
 # Custom port
 export DLC_SERVER_PORT=9090
 ./scripts/start-server.sh start
 # Custom host and port
 export DLC_SERVER_HOST="127.0.0.1"
 export DLC_SERVER_PORT=8081
 ./scripts/start-server.sh start
 # Custom shutdown timeout
 export DLC_SHUTDOWN_TIMEOUT=45s
 # Enable JSON logging
 export DLC_LOGGING_JSON=true
 # Log to file
 export DLC_LOGGING_OUTPUT="server.log"
 # Combined: JSON logging to file
 export DLC_LOGGING_JSON=true
 export DLC_LOGGING_OUTPUT="server.json.log"
 ```
 **Configuration File Support:**
 A `config.example.yaml` file is provided as a template. By default, the application looks for `config.yaml` in the current working directory.
 To specify a custom config file path, set the `DLC_CONFIG_FILE` environment variable:
 ```bash
 DLC_CONFIG_FILE="/path/to/config.yaml" go run ./cmd/server
 ```
 Example `config.yaml`:
 ```yaml
 server:
  host: "0.0.0.0"
  port: 8080
 shutdown:
  timeout: 30s
 logging:
  json: false
 ```
 **Configuration Loading Precedence:**
 1. **File-based configuration** (highest precedence)
 2. **Environment variables** (override defaults, overridden by config file)
 3. **Default values** (fallback)
 All configuration is validated on startup. Invalid configurations cause server startup failure. Configuration values and source are logged at startup.
 **Verification:**
 ```bash
 DLC_SERVER_PORT=9090 DLC_SERVER_HOST="127.0.0.1" ./scripts/start-server.sh start
 curl http://127.0.0.1:9090/api/health
 # Expected: {"status":"healthy"}
 ```
 ## Server Status
 ```bash
 # Check health endpoint
 curl -s http://localhost:8080/api/health
 # Check readiness endpoint
 curl -s http://localhost:8080/api/ready
 ```
 **Expected responses:**
 - Health: `{"status":"healthy"}`
 - Readiness (normal): `{"ready":true}`
 - Readiness (during shutdown): `{"ready":false}` (HTTP 503)
 **Endpoint Differences:**
 - **Health endpoint** (`/api/health`): Indicates if the application is running and functional
 - **Readiness endpoint** (`/api/ready`): Indicates if the application is ready to accept traffic
 **Use Cases:**
 - **Health**: Used by load balancers to check if the app is alive
 - **Readiness**: Used by Kubernetes / service meshes to determine if the app can accept new requests
 **During Graceful Shutdown:**
 - Health endpoint continues to return `{"status":"healthy"}`
 - Readiness endpoint returns `{"ready":false}` with HTTP 503 Service Unavailable
 - This allows existing requests to complete while preventing new requests
 ## Stopping the Server
 To stop the server gracefully:
 ```bash
 # Send SIGTERM for graceful shutdown
 kill -TERM $(lsof -ti :8080)
 # Or send SIGINT (Ctrl+C equivalent)
 pkill -INT -f "go run"
 ```
 **Graceful shutdown process:**
 1. Server receives termination signal
 2. Logs shutdown message
 3. Stops accepting new connections
 4. Waits up to 30 seconds for active requests to complete
 5. Closes all connections cleanly
 6. Exits with proper cleanup
 For force stop (if graceful shutdown hangs):
 ```bash
 kill -9 $(lsof -ti :8080)
 ```
 **Verification:**
 ```bash
 curl -s http://localhost:8080/api/health
 # Should return connection refused
 ```
--- a/documentation/CODE_EXAMPLES.md
+++ b/documentation/CODE_EXAMPLES.md
@@ -0,0 +1,59 @@
 # Code Examples
 Snippets and patterns used across the `dance-lessons-coach` codebase. Extracted from the original `AGENTS.md` (Tâche 6 restructure).
 ## Adding a New API Endpoint
 ```go
 // 1. Add to interface
 func (h *apiV1GreetHandler) RegisterRoutes(router chi.Router) {
    router.Get("/", h.handleGreetQuery)
    router.Get("/{name}", h.handleGreetPath)
    router.Post("/custom", h.handleCustomGreet) // New endpoint
 }
 // 2. Implement handler
 func (h *apiV1GreetHandler) handleCustomGreet(w http.ResponseWriter, r *http.Request) {
    // Parse request
    // Call service
    // Return JSON response
 }
 ```
 ## Logging with Zerolog
 ```go
 // Trace level logging
 log.Trace().Ctx(ctx).Str("key", "value").Msg("message")
 // Info level
 log.Info().Msg("Important event")
 // Error level
 log.Error().Err(err).Msg("Error occurred")
 ```
 For the full logging strategy (when to use Trace vs Info, performance considerations), see [ADR-0003 — Zerolog Logging](../adr/0003-zerolog-logging.md).
 ## Using `context.Context`
 ```go
 // Pass context through calls
 func handler(w http.ResponseWriter, r *http.Request) {
    result := service.Greet(r.Context(), "John")
    // ...
 }
 // Create context with values
 ctx := context.WithValue(r.Context(), "key", "value")
 // Create context with timeout
 ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
 defer cancel()
 ```
 For the rationale behind context-aware services, see [ADR-0004 — Interface-Based Design](../adr/0004-interface-based-design.md).
 ## Best Practices Reminders
 For higher-level guidance on code organization, error handling, performance, and testing, see [`AGENT_USAGE_GUIDE.md`](AGENT_USAGE_GUIDE.md#best-practices) section "Best Practices".
--- a/documentation/HISTORY.md
+++ b/documentation/HISTORY.md
@@ -0,0 +1,83 @@
 # Development History
 This document records the historical development phases of `dance-lessons-coach`. Extracted from the original `AGENTS.md` (Tâche 6 restructure) for lazy-loading compatibility with Mistral Vibe (128k context).
 All phases below are **completed** ✅. They are kept here for traceability and onboarding context — refer to ADRs (`adr/`) for the technical decisions behind each phase.
 ## Phase 1: Foundation
 - Go 1.26.1 environment setup
 - Project structure with `cmd/` and `pkg/` directories
 - Core Greet service implementation
 - CLI interface
 - Unit tests
 ## Phase 2: Web API
 - Chi router integration
 - Versioned API endpoints (`/api/v1`)
 - Health endpoint (`/api/health`)
 - JSON responses with proper headers
 ## Phase 3: Logging & Architecture
 - Zerolog integration with Trace level
 - Context-aware logging
 - Interface-based design patterns
 - Dependency injection
 ## Phase 4: Documentation & Testing
 - Comprehensive `AGENTS.md`
 - `README.md` with usage instructions
 - Server management guide
 - API endpoint documentation
 ## Phase 5: Configuration Management
 - Viper integration for configuration
 - Environment variable support with `DLC_` prefix
 - Customizable server host/port
 - Configurable shutdown timeout
 - Configuration validation and logging
 - Example configuration file
 ## Phase 6: Graceful Shutdown
 - Context-aware server initialization
 - Signal-based termination (`SIGINT`, `SIGTERM`)
 - Configurable shutdown timeout
 - Readiness endpoint for Kubernetes/service mesh integration
 - Proper resource cleanup during shutdown
 - Health endpoint remains healthy during graceful shutdown
 ## Phase 7: OpenTelemetry Integration
 - OpenTelemetry Go libraries integration
 - Jaeger compatibility for distributed tracing
 - Middleware-only approach using `otelhttp.NewHandler`
 - Configurable sampling strategies
 - Graceful shutdown of tracer provider
 - OTLP exporter with gRPC support
 ## Phase 8: Build System & Documentation
 - Build script for binary compilation
 - Binary output to `bin/` directory
 - Comprehensive commit conventions with gitmoji reference
 - Updated documentation with Jaeger integration guide
 - Cleaned up configuration files
 - Enhanced logging configuration with file output support
 ## Phase 9: Final Refinements
 - Removed unnecessary `time.Sleep` for log flushing
 - Changed server operational logs from Info to Trace level
 - Moved all logging setup logic to config package
 - Simplified server entrypoint to 27 lines
 - Verified all functionality with comprehensive testing
 - Updated documentation to reflect final architecture
 ## Beyond Phase 9
 Subsequent work (CI/CD, BDD scenarios, ADR audit, JWT, config hot-reloading) is tracked in the [Changelog](../CHANGELOG.md) and the corresponding [ADRs](../adr/).
--- a/documentation/MISTRAL-AUTONOMOUS-PATTERN.md
+++ b/documentation/MISTRAL-AUTONOMOUS-PATTERN.md
@@ -0,0 +1,219 @@
 # Mistral Vibe Autonomous Pattern
 **Document ID:** MISTRAL-AUTONOMOUS-PATTERN  
 **Date:** 2026-05-05  
 **Status:** Active  
 **Author:** Mistral Vibe (batch10-task-mistral-pattern-doc)  
 **Audience:** Project contributors, future trainers
 ---
 ## 1. What you'll see
 PRs authored by "Gabriel Radureau" with commit messages ending in "Mistral Vibe" references. PR titles start with gitmoji. Branch names follow `vibe/<slug>` pattern.
 | PR | Date | Title | Branch | Status |
 |----|------|-------|--------|--------|
 | #67 | 2026-05-05 | :memo: docs: email infrastructure | `vibe/batch4-task-a-email-infra` | Merged |
 | #74 | 2026-05-05 | :robot: feat: BDD Mailpit helper | `vibe/batch5-task-b-bdd-mailpit` | Merged |
 | #75 | 2026-05-05 | :elephant: feat: magic_link_tokens table | `vibe/batch5-task-c-db-magic-link` | Merged |
 | #76 | 2026-05-05 | :rocket: feat: magic link handlers | `vibe/batch5-task-d-handlers` | Merged |
 | #77 | 2026-05-05 | :test_tube: test: magic link BDD | `vibe/batch5-task-e-bdd` | Merged |
 ---
 ## 2. The pattern (high-level)
 ```
 Operator Brief → Worktree Setup → Worker Execution → PR Lifecycle → Merge
 ```
 ### 2.1 Operator brief
 Human or trainer (Claude) writes a `CONTEXT.md` brief in a workspace under `~/Work/Vibe/workspaces/<slug>/`. The brief contains:
 - Mission statement
 - Goal and constraints
 - Process instructions
 - Hard rules
 - Specification
 ### 2.2 Worktree setup
 A `vibe-workspace.sh --worktree` script creates an isolated git worktree:
 - Branches from current `origin/main`
 - Creates branch `vibe/<slug>`
 - Isolates git state in a dedicated directory
 - No race conditions (addresses Q-038)
 ### 2.3 Worker execution
 A Mistral Vibe worker (`vibe -p`) runs end-to-end:
 1. Reads the brief from `CONTEXT.md`
 2. Executes coding tasks (codes, builds, tests)
 3. Commits changes with appropriate messages
 4. Pushes to remote branch
 5. Opens PR via Gitea API
 6. Attempts auto-merge
 ### 2.4 Parallel operation
 - Multiple workers run concurrently (2-4 typical)
 - Each worker operates in its own worktree
 - No git checkout collisions
 - Shared origin main as base
 ### 2.5 Dispatch orchestration
 A `dispatch-batch.sh` script:
 - Orchestrates batches of 2-4 workers
 - Auto-merges PRs that workers opened but didn't merge
 - Ensures all PRs reach merged state
 - Handles cross-worker dependencies
 ---
 ## 3. Why this works
 ### 3.1 Worktree isolation
 Git worktrees provide complete isolation of git state. Each worker has its own:
 - Working directory
 - Index (staging area)
 - HEAD pointer
 - Branch reference
 This eliminates race conditions documented in Q-038 of the harness logs.
 ### 3.2 Pre-fetched origin
 Origin is pre-fetched before worktree creation (Q-060 fix). This guarantees:
 - All workers branch from current main
 - No stale base branches
 - Consistent starting point across batch
 ### 3.3 Full PR lifecycle
 Workers handle the complete PR lifecycle:
 - Code implementation
 - Build and test execution
 - Commit with proper conventions
 - Push to remote
 - PR creation via Gitea API
 - Merge via Gitea API (squash merge default)
 ### 3.4 Trainer takeover
 For the rare gaps (~5% of cases):
 - Price-cap restrictions
 - Broken Mistral tests
 - Ambiguous requirements
 Trainer (Claude) takeover within ~5 minutes covers these edge cases.
 ---
 ## 4. How to read PR provenance
 ### 4.1 Commit message markers
 Look for these patterns in commit messages:
 | Marker | Meaning |
 |--------|---------|
 | `Mostly Mistral Vibe authored` | Mixed human + AI authorship |
 | `100% Mistral autonomous` | Fully autonomous workflow |
 | `batch<N>-task-<X>` | Brief slug reference |
 | `Q-058 trainer takeover` | Specific quirk reference |
 | `Q-062 fix applied` | Quirk mitigation applied |
 ### 4.2 Branch naming
 Branch names encode the workflow:
 ```
 vibe/<batch>-<task>-<description>
 ```
 Examples:
 - `vibe/batch4-task-a-email-infra`
 - `vibe/batch10-task-mistral-pattern-doc`
 ### 4.3 PR title conventions
 PR titles use gitmoji prefix:
 - `:memo:` - Documentation
 - `:robot:` - AI/automation
 - `:elephant:` - Database
 - `:rocket:` - Feature
 - `:test_tube:` - Testing
 ---
 ## 5. Reproducing the pattern
 ### 5.1 Quickstart guide
 See `~/.vibe/scripts/QUICKSTART-DISPATCH-BATCH.md` for complete how-to guide.
 ### 5.2 Resources
 | Resource | Path | Description |
 |----------|------|-------------|
 | Brief template | `~/.vibe/skills/prompt-builder/examples/dispatch-batch-task.md` | Standardized brief format |
 | Mistral quirks | `~/.vibe/memory/reference/mistral-quirks.md` | Accumulated lessons (Q-001 through Q-063 as of 2026-05-05) |
 | Architecture doc | `~/.vibe/memory/reference/architecture-mapreduce-orchestration.md` | Design rationale |
 | Budget history | `~/.vibe/memory/reference/budget-history.jsonl` | Empirical cost data |
 ---
 ## 6. Numbers (2026-05-05 reference)
 ### 6.1 Throughput
 | Metric | Value | Notes |
 |--------|-------|-------|
 | PRs merged (one day) | 20 | Mistral autonomous |
 | Wall-clock parallel (2 PRs) | ~2 minutes | vs ~3-4 minutes serial |
 | Wall-clock parallel (4 PRs) | ~2-3 minutes | Batch efficiency |
 ### 6.2 Cost
 | PR Type | Cost Range | Notes |
 |---------|------------|-------|
 | Simple PR | $0.5-1.5 | Documentation, minor changes |
 | Code-heavy PR | $2-3 | Complex logic, multiple files |
 | Complex PR | $3-5 | Architecture changes, deep refactoring |
 ### 6.3 Autonomy rate
 | Metric | Value |
 |--------|-------|
 | Autonomy rate per batch | 95-100% |
 | Trainer takeover rate | 5% |
 | Takeover reasons | Price-cap (2%), broken tests (2%), ambiguity (1%) |
 ---
 ## 7. Future evolution
 ### 7.1 Phase 1bis (current)
 - Multi-process workers operating in parallel
 - Claude trainer reduces observations
 - Improves harness reliability
 - Current state as of 2026-05-05
 ### 7.2 Phase 2 (target)
 - Mistral meta-agent performs reduce phase
 - Full autonomy loop without Claude
 - Self-improving pattern
 - Target: Q3 2026
 ### 7.3 Long-term vision
 - Fully autonomous feature development
 - Self-healing test failures
 - Cost-optimized batch dispatch
 - Multi-repository orchestration
 ---
 ## 8. Cross-references
 ### 8.1 Related ADRs
 | ADR | Description |
 |-----|-------------|
 | [ADR-0001](../adr/0001-go-1.26.1-standard.md) | Go 1.26.1 standard |
 | [ADR-0008](../adr/0008-bdd-testing.md) | BDD with Godog |
 | [ADR-0028](../adr/0028-passwordless-auth-migration.md) | Passwordless auth (Phase A complete) |
 ### 8.2 Related documentation
 | Document | Description |
 |----------|-------------|
 | [CONTRIBUTING.md](../CONTRIBUTING.md) | Contribution guidelines |
 | [AGENTS.md](../AGENTS.md) | Agent documentation |
 | [PHASE_B_ROADMAP.md](PHASE_B_ROADMAP.md) | Phase B OIDC roadmap |
 ---
 *Developer onboarding doc — see QUICKSTART-DISPATCH-BATCH.md for implementation details.*
--- a/documentation/MKCERT.md
+++ b/documentation/MKCERT.md
@@ -0,0 +1,120 @@
 # mkcert: Local HTTPS for Development
 ## Overview
 This document describes how to set up local HTTPS development certificates using `mkcert`.
 OIDC providers **reject `http://localhost` as a redirect URI** by default for security reasons. To test OAuth 2.0 / OpenID Connect flows locally, the development server must be accessible via HTTPS. `mkcert` provides a zero-configuration local Certificate Authority that generates trusted certificates for localhost and custom domains.
 This setup is a prerequisite for **ADR-0028 Phase B** (OpenID Connect Authorization Code flow).
 ## Why mkcert
 - **Trusted locally**: Certificates are automatically trusted by the system root store (macOS, Linux, Windows)
 - **No configuration**: Single commands to create and install the CA
 - **Local-only**: Certificates are valid only for localhost development, never exposed to production
 - **Industry standard**: Widely adopted tool for local HTTPS development
 ## Installation
 ### macOS (Homebrew)
 ```bash
 brew install mkcert
 mkcert -install
 ```
 The `mkcert -install` command creates and installs a local Certificate Authority in your system trust store.
 ### Linux
 See [mkcert GitHub](https://github.com/FiloSottile/mkcert#installation) for distribution-specific instructions.
 ### Windows
 See [mkcert GitHub](https://github.com/FiloSottile/mkcert#installation) for Windows installation.
 ## Generate Certificates
 Use the provided Make target to generate certificates for localhost development:
 ```bash
 make cert
 ```
 This runs the following command:
 ```bash
 mkcert -cert-file ./certs/dev-cert.pem -key-file ./certs/dev-key.pem localhost 127.0.0.1 ::1
 ```
 ### Output Files
 | File | Description |
 |------|-------------|
 | `./certs/dev-cert.pem` | TLS certificate for localhost, 127.0.0.1, and ::1 |
 | `./certs/dev-key.pem` | Private key for the certificate |
 Both files are created in the `./certs/` directory at the project root.
 ## Use in Development
 Once certificates are generated, start the server with TLS enabled:
 ```bash
 ./bin/server --tls-cert ./certs/dev-cert.pem --tls-key ./certs/dev-key.pem
 ```
 > **Note**: The `--tls-cert` and `--tls-key` flags are **not yet implemented** — this is planned for ADR-0028 Phase B.4. The Makefile and certificate generation are prepared in advance so that when the server TLS support is added, the certificates are ready.
 The server will then be accessible at:
 - `https://localhost:8080` (or the configured port)
 - `https://127.0.0.1:8080`
 - `https://[::1]:8080`
 All OIDC callback URLs must use HTTPS with one of these hostnames.
 ## Clean Up
 To remove generated certificates:
 ```bash
 make clean-cert
 ```
 This deletes the entire `./certs/` directory.
 ## .gitignore
 The `certs/` directory contains locally-generated certificates and **must not be committed** to version control.
 Ensure `certs/` is in your `.gitignore`. If it is not already present, add it:
 ```bash
 echo "certs/" >> .gitignore
 ```
 ## Cross-References
 - [ADR-0028: Passwordless authentication: magic link → OpenID Connect](../adr/0028-passwordless-auth-migration.md) — Phase B describes the OIDC implementation that requires HTTPS
 - [mkcert GitHub Repository](https://github.com/FiloSottile/mkcert) — Official documentation
 ## Troubleshooting
 ### "mkcert not found" when running `make cert`
 Ensure `mkcert` is installed and available in your `PATH`. The Makefile checks for this and will display an error message if `mkcert` is not found.
 ### Certificate not trusted by browser
 Run `mkcert -install` again. On macOS, you may need to restart your browser completely (close all windows, not just tabs).
 ### Port already in use
 If another process is using the port (e.g., a non-TLS server on port 8080), stop that process first or configure the server to use a different port.
 ## See Also
 - `make help` — List all available Make targets
 - [documentation/API.md](API.md) — API endpoints reference
 - [documentation/BDD_GUIDE.md](BDD_GUIDE.md) — BDD testing guide
--- a/documentation/OBSERVABILITY.md
+++ b/documentation/OBSERVABILITY.md
@@ -0,0 +1,94 @@
 # Observability — OpenTelemetry & Jaeger Integration
 Tracing setup for `dance-lessons-coach`. Extracted from the original `AGENTS.md` (Tâche 6 restructure) for lazy-loading compatibility with Mistral Vibe.
 The application supports OpenTelemetry for distributed tracing with Jaeger compatibility.
 ## Configuration
 Enable OpenTelemetry in your `config.yaml`:
 ```yaml
 telemetry:
  enabled: true
  otlp_endpoint: "localhost:4317"
  service_name: "dance-lessons-coach"
  insecure: true
  sampler:
    type: "parentbased_always_on"
    ratio: 1.0
 ```
 Or via environment variables:
 ```bash
 export DLC_TELEMETRY_ENABLED=true
 export DLC_TELEMETRY_OTLP_ENDPOINT="localhost:4317"
 export DLC_TELEMETRY_SERVICE_NAME="dance-lessons-coach"
 export DLC_TELEMETRY_INSECURE=true
 export DLC_TELEMETRY_SAMPLER_TYPE="parentbased_always_on"
 export DLC_TELEMETRY_SAMPLER_RATIO=1.0
 ```
 ## Testing with Jaeger
 **1. Start Jaeger in Docker:**
 ```bash
 docker run -d --name jaeger \
  -e COLLECTOR_OTLP_ENABLED=true \
  -p 16686:16686 \
  -p 4317:4317 \
  jaegertracing/all-in-one:latest
 ```
 **2. Start the server with OpenTelemetry enabled:**
 ```bash
 # Using config file
 ./scripts/start-server.sh start
 # Or with environment variables
 DLC_TELEMETRY_ENABLED=true ./scripts/start-server.sh start
 ```
 **3. Make API requests:**
 ```bash
 curl http://localhost:8080/api/v1/greet/John
 ```
 **4. View traces in Jaeger UI:**
 Open http://localhost:16686 and select the `dance-lessons-coach` service.
 ## Sampler Types
 | Sampler | Behavior |
 |---|---|
 | `always_on` | Sample all traces |
 | `always_off` | Sample no traces |
 | `traceidratio` | Sample based on trace ID ratio |
 | `parentbased_always_on` | Sample based on parent span (always on) |
 | `parentbased_always_off` | Sample based on parent span (always off) |
 | `parentbased_traceidratio` | Sample based on parent span with ratio |
 ## Testing Script
 A convenience script is provided:
 ```bash
 ./scripts/test-opentelemetry.sh
 ```
 This script:
 1. Starts Jaeger container
 2. Starts the server with OpenTelemetry
 3. Makes test API calls
 4. Shows Jaeger UI URL
 5. Cleans up on exit
 ## ADR Reference
 See [ADR-0007 — OpenTelemetry Integration](../adr/0007-opentelemetry-integration.md) for the full architectural decision and rationale (middleware-only approach, sampling strategy, OTLP/gRPC choice).
--- a/documentation/PHASE_B_ROADMAP.md
+++ b/documentation/PHASE_B_ROADMAP.md
@@ -0,0 +1,145 @@
 # ADR-0028 Phase B Roadmap
 **Document ID:** PHASE_B_ROADMAP
 **Date:** 2026-05-05 evening
 **Status:** In Progress
 **Author:** AI Agent (vibe/batch4-task-b-phase-b-roadmap)
 ---
 ## Status as of 2026-05-05 evening
 - [x] ADR-0028 Phase A complete (PRs #59-#63, #65)
 - [x] Phase B.1 OIDC config (PR #64)
 - [x] Phase B prep : pkg/auth skeleton (PR #69) + mkcert doc (PR #68)
 - [x] Phase B.3 OIDC client implementation : ✅ (PR #74)
 - [x] Phase B.4 OIDC HTTP handlers + tests : ✅ (PR #75 + PR #76 follow-up tests)
 ## Status as of 2026-05-05 evening (after autonomous Mistral session)
 Phase B is essentially complete except B.5. The OIDC client (B.3, PR #74), HTTP handlers and tests (B.4, PR #75 + PR #76) have been delivered and merged.
 ---
 ## Remaining work
 Phase B delivers OpenID Connect Authorization Code flow with PKCE. Work is organized into **3 shippable phases**, each deliverable as an independent PR. At the time of this update, only Phase B.5 (BDD scenarios) remains to be completed.
 ### Phase B.3 — OIDC client implementation
 - **Goal:** Implement the core OIDC client methods in `pkg/auth/oidc.go`
 - **Tasks:**
  - `Discover()`: HTTP GET to `/.well-known/openid-configuration`, parse + cache discovery document
  - `RefreshJWKS()`: HTTP GET to JWKS URI, parse RSA public keys, cache with TTL
  - `ExchangeCode()`: POST to token endpoint with code + PKCE verifier, return TokenResponse
  - `ValidateIDToken()`: Verify signature against JWKS, validate standard claims (iss, aud, exp, iat)
 - **LOE:** ~200 lines of Go + unit tests
 - **Dependencies:** None (uses standard library `crypto/rsa`, `encoding/jwt`)
 - **Deliverable:** 1 PR
 ### Phase B.4 — OIDC HTTP handlers
 - **Goal:** Add OIDC flow endpoints and wire them into the server
 - **Tasks:**
  - Create `pkg/user/api/oidc_handler.go`
  - `GET /api/v1/auth/oidc/start`:
    - Generate state (CSRF protection) + PKCE verifier + challenge
    - Store state + verifier (cookie or short-lived in-memory store)
    - Redirect to provider's authorization endpoint
  - `GET /api/v1/auth/oidc/callback`:
    - Validate state parameter matches stored state
    - Exchange code for tokens (calls B.3 client)
    - Validate id_token (calls B.3 client)
    - Issue internal JWT (reuse existing JWT manager from ADR-0021)
    - Return JWT in Set-Cookie + JSON body
  - Wire routes in `pkg/server/server.go`
 - **LOE:** ~150 lines of Go + unit tests + integration tests
 - **Dependencies:** B.3 (client methods must be implemented)
 - **Prerequisite:** Run `make cert` (mkcert, from PR #68) before starting dev
 - **Deliverable:** 1 PR
 ### Phase B.5 — BDD coverage
 - **Goal:** End-to-end OIDC testing
 - **Tasks:**
  - Create `features/auth/oidc.feature` with scenarios:
    - Happy path: start → provider auth → callback → JWT issued
    - Error: state mismatch
    - Error: invalid code
    - Error: expired id_token
  - Use mock OIDC provider (local in-process) OR deterministic test against Authelia/Keycloak in docker-compose
  - Follow ADR-0030 parallel BDD strategy for email assertions
 - **LOE:** ~150 lines of Gherkin + step definitions
 - **Dependencies:** B.3 + B.4 (endpoints must be operational)
 - **Deliverable:** 1 PR
 ---
 ## Dependencies and order
 ```
 B.3 (OIDC client)
    ↓
 B.4 (HTTP handlers) —— requires B.3
    ↓
 B.5 (BDD coverage) —— requires B.3 + B.4
 ```
 **Note:** mkcert (PR #68) is ready. When starting B.4 development, run `make cert` once to generate local HTTPS certificates.
 ---
 ## Out of scope for Phase B (deferred)
 | Item | Target Phase | Rationale |
 |------|--------------|-----------|
 | Decommission password auth | Phase C | Separate ADR after B is in production |
 | Multi-provider (Authelia + Google) | Phase B.6 (if needed) | Single provider sufficient for MVP |
 | JWKS rotation mid-flight retry | B.3 enhancement | Handle in initial implementation |
 | Token refresh flow | Future | Not required for auth code flow MVP |
 ---
 ## Risk register
 | Risk | Mitigation | Owner |
 |------|------------|-------|
 | JWKS rotation handling | Implement refresh + retry logic; key rotation must not break mid-flight validation | B.3 implementer |
 | PKCE storage | Use signed cookie or short-lived in-memory store; document trade-offs in implementation PR | B.4 implementer |
 | Testing without real provider | Use mock OIDC server for CI; local dev uses Authelia in docker-compose | B.5 implementer |
 | State CSRF protection | Use cryptographically random state; store server-side with short TTL | B.4 implementer |
 ---
 ## Cross-references
 - [ADR-0028: Passwordless authentication: magic link → OpenID Connect](../adr/0028-passwordless-auth-migration.md)
 - [ADR-0029: Email infrastructure (Mailpit)](../adr/0029-email-infrastructure-mailpit.md)
 - [ADR-0030: BDD email parallel strategy](../adr/0030-bdd-email-parallel-strategy.md)
 - [PR #59: Email infrastructure](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/59)
 - [PR #60: BDD Mailpit helper](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/60)
 - [PR #61: magic_link_tokens table](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/61)
 - [PR #62: Magic link handlers](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/62)
 - [PR #63: Magic link BDD](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/63)
 - [PR #64: OIDC config skeleton](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/64)
 - [PR #65: Magic link cleanup loop](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/65)
 - [PR #68: mkcert documentation](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/68)
 - [PR #69: pkg/auth skeleton](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/69)
 - [PR #74: Phase B.3 OIDC client implementation](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/74)
 - [PR #75: Phase B.4 OIDC HTTP handlers](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/75)
 - [PR #76: Phase B.4 follow-up tests](https://gitea.arcodange.lab/arcodange/dance-lessons-coach/pulls/76)
 ---
 ## Appendix: File inventory
 Existing (merged):
 - `pkg/auth/oidc.go` — skeleton with TODO methods (PR #69)
 - `pkg/auth/oidc_test.go` — placeholder tests (PR #69)
 - `documentation/MKCERT.md` — mkcert setup guide (PR #68)
 - `Makefile` — includes `make cert` target (PR #68)
 To be created:
 - `pkg/auth/oidc.go` — complete implementation (B.3)
 - `pkg/user/api/oidc_handler.go` — HTTP handlers (B.4)
 - `pkg/server/server.go` — route wiring (B.4)
 - `features/auth/oidc.feature` — BDD scenarios (B.5)
 - `pkg/auth/oidc_test.go` — expanded unit tests (B.3)
 - `pkg/user/api/oidc_handler_test.go` — handler tests (B.4)
--- a/documentation/ROADMAP.md
+++ b/documentation/ROADMAP.md
@@ -0,0 +1,40 @@
 # Roadmap & Future Enhancements
 Tracking pending features and architectural improvements. Extracted from the original `AGENTS.md` (Tâche 6 restructure). Status updated continuously — items move to "Completed Features" section once shipped.
 ## Potential Features
 - [ ] Database integration
 - [ ] Authentication / Authorization
 - [ ] Rate limiting
 - [ ] Metrics and monitoring
 - [ ] Docker containerization
 - ✅ CI/CD pipeline ([ADR-0016](../adr/0016-ci-cd-pipeline-design.md), [ADR-0017](../adr/0017-trunk-based-development-workflow.md))
 - [ ] Configuration hot reload
 - [ ] Circuit breakers
 ## Architectural Improvements
 - [ ] Request validation middleware
 - ✅ OpenAPI / Swagger documentation with embedded spec
 - [ ] Enhanced OpenTelemetry instrumentation
 - [ ] Metrics collection and visualization
 - [ ] Health check improvements
 - [ ] Configuration validation enhancements
 ## Completed Features
 - ✅ Graceful shutdown with readiness endpoint
 - ✅ OpenTelemetry integration with Jaeger support
 - ✅ Configuration management with Viper
 - ✅ Comprehensive logging with Zerolog
 - ✅ Build system with binary output
 - ✅ Complete documentation with commit conventions
 - ✅ Version management with runtime info
 ## How to Propose a New Feature
 1. Open a Gitea issue describing the use case and acceptance criteria
 2. If the feature implies an architectural decision, draft an ADR (`adr/<NNNN>-<slug>.md`) following the template
 3. Reference the ADR + issue in any PR introducing the feature
 4. Update this roadmap (move from "Potential" to "Completed" when shipped)
--- a/documentation/STATUS.md
+++ b/documentation/STATUS.md
@@ -0,0 +1,49 @@
 # Project Status Snapshot
 Last updated 2026-05-05 evening.
 ---
 ## Active Features
 - Magic-link passwordless auth (POST /api/v1/auth/magic-link/request + GET /consume) — production-ready, ADR-0028 Phase A complete
 - OIDC client + HTTP handlers (GET /api/v1/auth/oidc/{provider}/start + /callback with PKCE) — production-ready code, BDD coverage TODO. ADR-0028 Phase B (B.1, B.3, B.4 + tests done ; B.5 BDD scenarios TODO).
 - Username + password auth — legacy (ADR-0018), kept during migration. To be decommissioned in Phase C.
 - Versioned API, JWT, OpenTelemetry, Swagger, BDD
 ---
 ## What's In Progress / Next
 - Phase B.5 BDD scenarios for OIDC (1 PR Mistral expected)
 - Phase C decommission password auth (separate ADR)
 ---
 ## Project Structure Highlights
 ```
 adr/ : ADRs
 pkg/ : packages (auth, config, server, user, etc.)
 features/ : BDD scenarios
 documentation/ : docs index
 scripts/ : build + CI
 ```
 ---
 ## Key Documentation Entry Points
 - README.md : quick start
 - AGENTS.md : agent + automation conventions
 - documentation/AUTH.md : auth system synthesis
 - documentation/MISTRAL-AUTONOMOUS-PATTERN.md : how Mistral PRs are shipped
 - documentation/PHASE_B_ROADMAP.md : remaining auth migration work
 - documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md : the autonomous session highlights
 - adr/ : architecture decisions
 ---
 ## Today's Milestone (2026-05-05)
 27 PRs merged in 1 day via the Mistral autonomous multi-process pattern. ADR-0028 (passwordless auth migration) essentially complete except Phase B.5 BDD.
--- a/documentation/TROUBLESHOOTING.md
+++ b/documentation/TROUBLESHOOTING.md
@@ -0,0 +1,107 @@
 # Troubleshooting
 Common issues and their resolution. Extracted from the original `AGENTS.md` and merged with relevant sections from `AGENT_USAGE_GUIDE.md` and `BDD_GUIDE.md`. Refer back to those guides for context-specific troubleshooting (agent workflows, BDD test failures).
 ## Port Already in Use
 ```bash
 # Find and kill process using port 8080
 kill -TERM $(lsof -ti :8080)
 # Force kill if graceful does not work
 kill -9 $(lsof -ti :8080)
 ```
 ## Server Not Responding
 ```bash
 # Check if running
 curl -s http://localhost:8080/api/health
 # Restart server using control script
 ./scripts/start-server.sh restart
 # View recent logs
 ./scripts/start-server.sh logs
 ```
 If health endpoint returns connection refused, the server may have crashed. Check logs in `./scripts/start-server.sh logs` for stack traces.
 ## Dependency Issues
 ```bash
 # Clean and rebuild
 go mod tidy
 go build ./...
 # If dependency version conflicts persist
 go mod download
 go mod verify
 ```
 ## Tests Failing
 ### Unit tests
 ```bash
 # Run with verbose output
 go test -v ./...
 # Check specific test
 go test ./pkg/greet/ -run TestName
 ```
 ### BDD tests
 See [`BDD_GUIDE.md`](BDD_GUIDE.md) for the full BDD troubleshooting workflow (Godog setup, scenario isolation, step matching). Common BDD issues:
 - **Step not found** → check `pkg/bdd/steps/` for the step definition file
 - **Scenario state leaking** → review [ADR-0025](../adr/0025-bdd-scenario-isolation-strategies.md) for the isolation pattern
 - **Database not reset** → ensure the test fixtures cleanup runs (BDD scenario After hooks)
 ## Configuration Not Loading
 The application logs the configuration source at startup. Check logs for:
 ```
 [INF] Configuration loaded from: file:config.yaml
 # or
 [INF] Configuration loaded from: env
 # or
 [INF] Configuration loaded from: defaults
 ```
 If config is not loading as expected:
 1. Verify file exists and is readable: `ls -la config.yaml`
 2. Verify env vars are exported: `env | grep DLC_`
 3. Check for typos in keys (case-sensitive)
 4. Review [`AGENT_USAGE_GUIDE.md`](AGENT_USAGE_GUIDE.md) section "Configuration troubleshooting"
 ## OpenTelemetry Not Tracing
 1. Verify Jaeger is running: `docker ps | grep jaeger`
 2. Check `DLC_TELEMETRY_ENABLED=true` in environment or `telemetry.enabled: true` in config
 3. Verify OTLP endpoint reachable: `nc -zv localhost 4317`
 4. Check sampler is not `always_off`
 5. See [`OBSERVABILITY.md`](OBSERVABILITY.md) for full setup
 ## Build Failures
 ```bash
 # Clear caches
 go clean -cache -modcache
 go mod download
 # Rebuild
 go build ./...
 ```
 If errors persist, see [`local-ci-cd-testing.md`](local-ci-cd-testing.md) for the CI/CD pipeline that mirrors the production build.
 ## Where to Look Next
 - **Agent-specific issues** (vibe, mistral, programmer agent) → [`AGENT_USAGE_GUIDE.md`](AGENT_USAGE_GUIDE.md)
 - **BDD-specific issues** → [`BDD_GUIDE.md`](BDD_GUIDE.md)
 - **Version/release issues** → [`version-management-guide.md`](version-management-guide.md)
 - **CI/CD issues** → [`local-ci-cd-testing.md`](local-ci-cd-testing.md)
--- a/pkg/auth/oidc.go
+++ b/pkg/auth/oidc.go
@@ -0,0 +1,345 @@
 // Package auth provides OpenID Connect client primitives for the
 // dance-lessons-coach passwordless-auth migration (ADR-0028 Phase B).
 //
 // This file defines the client surface only. HTTP handlers wire-up
 // happens in pkg/user/api/oidc_handler.go (separate phase B.3).
 package auth
 import (
 	"context"
 	"crypto/rsa"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"math/big"
 	"net/http"
 	"net/url"
 	"strings"
 	"sync"
 	"time"
 	"github.com/golang-jwt/jwt/v5"
 )
 // OIDCClient is a per-provider OIDC client.
 // Holds the discovery document + JWKS cache + OAuth code-exchange config.
 type OIDCClient struct {
 	issuerURL    string
 	clientID     string
 	clientSecret string
 	httpClient   *http.Client
 	// discovery document, lazy-fetched on first use
 	discoveryMu sync.RWMutex
 	discovery   *Discovery
 	// JWKS cache (id_token signature verification keys), refreshed periodically
 	jwksMu      sync.RWMutex
 	jwks        map[string]*rsa.PublicKey
 	jwksFetched time.Time
 }
 // Discovery is the subset of the .well-known/openid-configuration document we use.
 type Discovery struct {
 	Issuer                string `json:"issuer"`
 	AuthorizationEndpoint string `json:"authorization_endpoint"`
 	TokenEndpoint         string `json:"token_endpoint"`
 	JWKSUri               string `json:"jwks_uri"`
 	UserinfoEndpoint      string `json:"userinfo_endpoint,omitempty"`
 }
 // TokenResponse is the response from the token endpoint after code exchange.
 type TokenResponse struct {
 	AccessToken  string `json:"access_token"`
 	TokenType    string `json:"token_type"`
 	ExpiresIn    int64  `json:"expires_in"`
 	RefreshToken string `json:"refresh_token,omitempty"`
 	IDToken      string `json:"id_token"`
 	Scope        string `json:"scope,omitempty"`
 }
 // IDTokenClaims represents the parsed claims from an ID token.
 type IDTokenClaims struct {
 	jwt.RegisteredClaims
 	Email         string `json:"email,omitempty"`
 	EmailVerified bool   `json:"email_verified,omitempty"`
 	Name          string `json:"name,omitempty"`
 }
 // jwks represents the JWKS (JSON Web Key Set) response.
 type jwks struct {
 	Keys []jwk `json:"keys"`
 }
 // jwk represents a single JSON Web Key.
 type jwk struct {
 	Kid string `json:"kid"`
 	Kty string `json:"kty"`
 	N   string `json:"n"`
 	E   string `json:"e"`
 	Use string `json:"use,omitempty"`
 	Alg string `json:"alg,omitempty"`
 }
 // NewOIDCClient constructs a client. Discovery + JWKS are NOT fetched eagerly;
 // they are lazy-loaded on first use to avoid blocking server startup if the
 // provider is temporarily down.
 func NewOIDCClient(issuerURL, clientID, clientSecret string) *OIDCClient {
 	return &OIDCClient{
 		issuerURL:    issuerURL,
 		clientID:     clientID,
 		clientSecret: clientSecret,
 		httpClient:   &http.Client{Timeout: 10 * time.Second},
 		jwks:         make(map[string]*rsa.PublicKey),
 	}
 }
 // ClientID returns the OIDC client ID.
 func (c *OIDCClient) ClientID() string {
 	return c.clientID
 }
 // IssuerURL returns the OIDC issuer URL.
 func (c *OIDCClient) IssuerURL() string {
 	return c.issuerURL
 }
 // SetHTTPClient sets a custom HTTP client for testing.
 func (c *OIDCClient) SetHTTPClient(client *http.Client) {
 	c.httpClient = client
 }
 // decodeRSAPublicKey reconstructs an *rsa.PublicKey from JWK n and e values.
 func decodeRSAPublicKey(j jwk) (*rsa.PublicKey, error) {
 	nBytes, err := base64.RawURLEncoding.DecodeString(j.N)
 	if err != nil {
 		return nil, fmt.Errorf("decode n: %w", err)
 	}
 	eBytes, err := base64.RawURLEncoding.DecodeString(j.E)
 	if err != nil {
 		return nil, fmt.Errorf("decode e: %w", err)
 	}
 	n := new(big.Int).SetBytes(nBytes)
 	e := new(big.Int).SetBytes(eBytes)
 	return &rsa.PublicKey{N: n, E: int(e.Int64())}, nil
 }
 // Discover fetches and caches the .well-known document. Idempotent.
 // First call: HTTP fetch + cache. Subsequent calls: cached value.
 func (c *OIDCClient) Discover(ctx context.Context) (*Discovery, error) {
 	c.discoveryMu.RLock()
 	if c.discovery != nil {
 		c.discoveryMu.RUnlock()
 		return c.discovery, nil
 	}
 	c.discoveryMu.RUnlock()
 	c.discoveryMu.Lock()
 	defer c.discoveryMu.Unlock()
 	// Double-check after acquiring write lock
 	if c.discovery != nil {
 		return c.discovery, nil
 	}
 	wellKnownURL := fmt.Sprintf("%s/.well-known/openid-configuration", c.issuerURL)
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, wellKnownURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("create discovery request: %w", err)
 	}
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("fetch discovery: %w", err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("discovery HTTP %d", resp.StatusCode)
 	}
 	var disc Discovery
 	if err := json.NewDecoder(resp.Body).Decode(&disc); err != nil {
 		return nil, fmt.Errorf("decode discovery: %w", err)
 	}
 	c.discovery = &disc
 	return &disc, nil
 }
 // RefreshJWKS fetches JWKS URI, parse keys, populate jwks map.
 func (c *OIDCClient) RefreshJWKS(ctx context.Context) error {
 	// Ensure discovery is loaded
 	if c.discovery == nil {
 		if _, err := c.Discover(ctx); err != nil {
 			return fmt.Errorf("discover: %w", err)
 		}
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.discovery.JWKSUri, nil)
 	if err != nil {
 		return fmt.Errorf("create JWKS request: %w", err)
 	}
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("fetch JWKS: %w", err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return fmt.Errorf("JWKS HTTP %d", resp.StatusCode)
 	}
 	var keySet jwks
 	if err := json.NewDecoder(resp.Body).Decode(&keySet); err != nil {
 		return fmt.Errorf("decode JWKS: %w", err)
 	}
 	c.jwksMu.Lock()
 	defer c.jwksMu.Unlock()
 	c.jwks = make(map[string]*rsa.PublicKey)
 	for _, key := range keySet.Keys {
 		if key.Kty == "RSA" {
 			pubKey, err := decodeRSAPublicKey(key)
 			if err != nil {
 				return fmt.Errorf("decode RSA key %s: %w", key.Kid, err)
 			}
 			c.jwks[key.Kid] = pubKey
 		}
 	}
 	c.jwksFetched = time.Now()
 	return nil
 }
 // ExchangeCode exchanges an authorization code for an access token and ID token.
 func (c *OIDCClient) ExchangeCode(ctx context.Context, code, codeVerifier, redirectURI string) (*TokenResponse, error) {
 	// Ensure discovery is loaded
 	if c.discovery == nil {
 		if _, err := c.Discover(ctx); err != nil {
 			return nil, fmt.Errorf("discover: %w", err)
 		}
 	}
 	form := url.Values{}
 	form.Set("grant_type", "authorization_code")
 	form.Set("code", code)
 	form.Set("code_verifier", codeVerifier)
 	form.Set("redirect_uri", redirectURI)
 	form.Set("client_id", c.clientID)
 	form.Set("client_secret", c.clientSecret)
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.discovery.TokenEndpoint, strings.NewReader(form.Encode()))
 	if err != nil {
 		return nil, fmt.Errorf("create token request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("exchange code: %w", err)
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("token HTTP %d", resp.StatusCode)
 	}
 	var tokenResp TokenResponse
 	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
 		return nil, fmt.Errorf("decode token response: %w", err)
 	}
 	return &tokenResp, nil
 }
 // ValidateIDToken verifies the signature and claims of an ID token.
 func (c *OIDCClient) ValidateIDToken(ctx context.Context, idToken string) (*IDTokenClaims, error) {
 	// First, parse without verification to get the kid
 	parser := jwt.NewParser()
 	unverifiedToken, _, err := parser.ParseUnverified(idToken, &IDTokenClaims{})
 	if err != nil {
 		return nil, fmt.Errorf("parse unverified token: %w", err)
 	}
 	claims, ok := unverifiedToken.Claims.(*IDTokenClaims)
 	if !ok {
 		return nil, fmt.Errorf("invalid claims type")
 	}
 	// Get kid from header
 	kid, ok := unverifiedToken.Header["kid"].(string)
 	if !ok || kid == "" {
 		return nil, fmt.Errorf("missing kid in token header")
 	}
 	// Get the key, refreshing JWKS if needed
 	c.jwksMu.RLock()
 	_, keyExists := c.jwks[kid]
 	c.jwksMu.RUnlock()
 	if !keyExists {
 		if err := c.RefreshJWKS(ctx); err != nil {
 			return nil, fmt.Errorf("refresh JWKS: %w", err)
 		}
 		c.jwksMu.RLock()
 		_, keyExists = c.jwks[kid]
 		c.jwksMu.RUnlock()
 		if !keyExists {
 			return nil, fmt.Errorf("key %s not found in JWKS", kid)
 		}
 	}
 	// Parse with verification
 	keyFunc := func(token *jwt.Token) (interface{}, error) {
 		if kid, ok := token.Header["kid"].(string); ok {
 			c.jwksMu.RLock()
 			defer c.jwksMu.RUnlock()
 			if key, exists := c.jwks[kid]; exists {
 				return key, nil
 			}
 		}
 		return nil, fmt.Errorf("key not found")
 	}
 	parsedToken, err := jwt.ParseWithClaims(idToken, &IDTokenClaims{}, keyFunc)
 	if err != nil {
 		return nil, fmt.Errorf("parse token: %w", err)
 	}
 	claims, ok = parsedToken.Claims.(*IDTokenClaims)
 	if !ok {
 		return nil, fmt.Errorf("invalid claims type after parse")
 	}
 	// Validate claims
 	if claims.Issuer != c.issuerURL {
 		return nil, fmt.Errorf("issuer mismatch: expected %s, got %s", c.issuerURL, claims.Issuer)
 	}
 	// Check audience contains clientID
 	audValid := false
 	if claims.Audience != nil {
 		for _, aud := range claims.Audience {
 			if aud == c.clientID {
 				audValid = true
 				break
 			}
 		}
 	}
 	if !audValid {
 		return nil, fmt.Errorf("audience does not contain client ID %s", c.clientID)
 	}
 	// Check expiration
 	if claims.ExpiresAt != nil && time.Now().UTC().After(claims.ExpiresAt.Time) {
 		return nil, fmt.Errorf("token expired")
 	}
 	return claims, nil
 }
--- a/pkg/auth/oidc_test.go
+++ b/pkg/auth/oidc_test.go
@@ -0,0 +1,431 @@
 package auth
 import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/base64"
 	"fmt"
 	"math/big"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"sync/atomic"
 	"testing"
 	"time"
 	"github.com/golang-jwt/jwt/v5"
 )
 func TestNewOIDCClient(t *testing.T) {
 	c := NewOIDCClient("https://example.com", "client_id", "client_secret")
 	if c == nil {
 		t.Fatal("NewOIDCClient returned nil")
 	}
 	if c.issuerURL != "https://example.com" {
 		t.Errorf("issuerURL not set: got %q", c.issuerURL)
 	}
 }
 func TestDiscover_HappyPath(t *testing.T) {
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/.well-known/openid-configuration" {
 			t.Errorf("unexpected path: %s", r.URL.Path)
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
 		w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 			server.URL, server.URL, server.URL, server.URL)))
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	disc, err := client.Discover(context.Background())
 	if err != nil {
 		t.Fatalf("Discover failed: %v", err)
 	}
 	if disc.Issuer != server.URL {
 		t.Errorf("issuer mismatch: got %s, want %s", disc.Issuer, server.URL)
 	}
 	if disc.TokenEndpoint != server.URL+"/token" {
 		t.Errorf("token endpoint mismatch: got %s", disc.TokenEndpoint)
 	}
 	if disc.JWKSUri != server.URL+"/jwks" {
 		t.Errorf("jwks_uri mismatch: got %s", disc.JWKSUri)
 	}
 }
 func TestDiscover_Idempotent(t *testing.T) {
 	var requestCount int32
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		atomic.AddInt32(&requestCount, 1)
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(http.StatusOK)
 		w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 			server.URL, server.URL, server.URL, server.URL)))
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// First call
 	_, err := client.Discover(context.Background())
 	if err != nil {
 		t.Fatalf("First Discover failed: %v", err)
 	}
 	// Second call
 	_, err = client.Discover(context.Background())
 	if err != nil {
 		t.Fatalf("Second Discover failed: %v", err)
 	}
 	if atomic.LoadInt32(&requestCount) != 1 {
 		t.Errorf("Expected 1 HTTP request, got %d", requestCount)
 	}
 }
 func generateTestRSAKey(t *testing.T) *rsa.PrivateKey {
 	t.Helper()
 	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatalf("failed to generate RSA key: %v", err)
 	}
 	return privKey
 }
 func encodeRSAPublicKey(privKey *rsa.PrivateKey) (n, e string) {
 	n = base64.RawURLEncoding.EncodeToString(privKey.PublicKey.N.Bytes())
 	e = base64.RawURLEncoding.EncodeToString(big.NewInt(int64(privKey.PublicKey.E)).Bytes())
 	return n, e
 }
 func TestRefreshJWKS_HappyPath(t *testing.T) {
 	privKey := generateTestRSAKey(t)
 	n, e := encodeRSAPublicKey(privKey)
 	var discoveryCalled, jwksCalled bool
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			discoveryCalled = true
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)))
 			return
 		}
 		if r.URL.Path == "/jwks" {
 			jwksCalled = true
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"keys":[{"kid":"test-key-id","kty":"RSA","use":"sig","alg":"RS256","n":"%s","e":"%s"}]}`, n, e)))
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// First discover to populate discovery
 	_, err := client.Discover(context.Background())
 	if err != nil {
 		t.Fatalf("Discover failed: %v", err)
 	}
 	// Now refresh JWKS
 	err = client.RefreshJWKS(context.Background())
 	if err != nil {
 		t.Fatalf("RefreshJWKS failed: %v", err)
 	}
 	if !discoveryCalled {
 		t.Error("discovery endpoint was not called")
 	}
 	if !jwksCalled {
 		t.Error("jwks endpoint was not called")
 	}
 	// Check that jwks was populated
 	client.jwksMu.RLock()
 	defer client.jwksMu.RUnlock()
 	if len(client.jwks) != 1 {
 		t.Errorf("expected 1 key in jwks, got %d", len(client.jwks))
 	}
 	if _, exists := client.jwks["test-key-id"]; !exists {
 		t.Error("test-key-id not found in jwks")
 	}
 }
 func TestExchangeCode_HappyPath(t *testing.T) {
 	tokenResponseJSON := `{"access_token":"access-token-123","id_token":"id-token-456","token_type":"Bearer","expires_in":3600}`
 	var receivedForm url.Values
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)))
 			return
 		}
 		if r.URL.Path == "/token" {
 			if r.Method != http.MethodPost {
 				t.Errorf("expected POST, got %s", r.Method)
 				w.WriteHeader(http.StatusMethodNotAllowed)
 				return
 			}
 			if r.Header.Get("Content-Type") != "application/x-www-form-urlencoded" {
 				t.Errorf("expected Content-Type application/x-www-form-urlencoded, got %s", r.Header.Get("Content-Type"))
 				w.WriteHeader(http.StatusBadRequest)
 				return
 			}
 			err := r.ParseForm()
 			if err != nil {
 				t.Errorf("failed to parse form: %v", err)
 				w.WriteHeader(http.StatusBadRequest)
 				return
 			}
 			receivedForm = r.Form
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(tokenResponseJSON))
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// Discover first to populate discovery
 	_, err := client.Discover(context.Background())
 	if err != nil {
 		t.Fatalf("Discover failed: %v", err)
 	}
 	resp, err := client.ExchangeCode(context.Background(), "auth-code-789", "code-verifier-123", "https://app.example.com/callback")
 	if err != nil {
 		t.Fatalf("ExchangeCode failed: %v", err)
 	}
 	if resp.AccessToken != "access-token-123" {
 		t.Errorf("access token mismatch: got %s", resp.AccessToken)
 	}
 	if resp.IDToken != "id-token-456" {
 		t.Errorf("id token mismatch: got %s", resp.IDToken)
 	}
 	if resp.TokenType != "Bearer" {
 		t.Errorf("token type mismatch: got %s", resp.TokenType)
 	}
 	// Check form values
 	if receivedForm.Get("grant_type") != "authorization_code" {
 		t.Errorf("grant_type mismatch: got %s", receivedForm.Get("grant_type"))
 	}
 	if receivedForm.Get("code") != "auth-code-789" {
 		t.Errorf("code mismatch: got %s", receivedForm.Get("code"))
 	}
 	if receivedForm.Get("code_verifier") != "code-verifier-123" {
 		t.Errorf("code_verifier mismatch: got %s", receivedForm.Get("code_verifier"))
 	}
 	if receivedForm.Get("redirect_uri") != "https://app.example.com/callback" {
 		t.Errorf("redirect_uri mismatch: got %s", receivedForm.Get("redirect_uri"))
 	}
 	if receivedForm.Get("client_id") != "client_id" {
 		t.Errorf("client_id mismatch: got %s", receivedForm.Get("client_id"))
 	}
 	if receivedForm.Get("client_secret") != "client_secret" {
 		t.Errorf("client_secret mismatch: got %s", receivedForm.Get("client_secret"))
 	}
 }
 func TestValidateIDToken_HappyPath(t *testing.T) {
 	privKey := generateTestRSAKey(t)
 	n, e := encodeRSAPublicKey(privKey)
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)))
 			return
 		}
 		if r.URL.Path == "/jwks" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"keys":[{"kid":"test-key-id","kty":"RSA","use":"sig","alg":"RS256","n":"%s","e":"%s"}]}`, n, e)))
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// Create and sign a JWT
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, &IDTokenClaims{
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    server.URL,
 			Audience:  jwt.ClaimStrings{"client_id"},
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
 			Subject:   "user-123",
 		},
 		Email:         "user@example.com",
 		EmailVerified: true,
 		Name:          "Test User",
 	})
 	token.Header["kid"] = "test-key-id"
 	signedToken, err := token.SignedString(privKey)
 	if err != nil {
 		t.Fatalf("failed to sign token: %v", err)
 	}
 	// Validate the token
 	claims, err := client.ValidateIDToken(context.Background(), signedToken)
 	if err != nil {
 		t.Fatalf("ValidateIDToken failed: %v", err)
 	}
 	if claims.Issuer != server.URL {
 		t.Errorf("issuer mismatch: got %s, want %s", claims.Issuer, server.URL)
 	}
 	if claims.Subject != "user-123" {
 		t.Errorf("subject mismatch: got %s", claims.Subject)
 	}
 	if claims.Email != "user@example.com" {
 		t.Errorf("email mismatch: got %s", claims.Email)
 	}
 	if !claims.EmailVerified {
 		t.Error("email_verified should be true")
 	}
 	if claims.Name != "Test User" {
 		t.Errorf("name mismatch: got %s", claims.Name)
 	}
 }
 func TestValidateIDToken_RejectsExpired(t *testing.T) {
 	privKey := generateTestRSAKey(t)
 	n, e := encodeRSAPublicKey(privKey)
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)))
 			return
 		}
 		if r.URL.Path == "/jwks" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"keys":[{"kid":"test-key-id","kty":"RSA","use":"sig","alg":"RS256","n":"%s","e":"%s"}]}`, n, e)))
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// Create an expired JWT
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, &IDTokenClaims{
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    server.URL,
 			Audience:  jwt.ClaimStrings{"client_id"},
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(-time.Hour)), // Expired 1 hour ago
 			IssuedAt:  jwt.NewNumericDate(time.Now().Add(-2 * time.Hour)),
 			Subject:   "user-123",
 		},
 	})
 	token.Header["kid"] = "test-key-id"
 	signedToken, err := token.SignedString(privKey)
 	if err != nil {
 		t.Fatalf("failed to sign token: %v", err)
 	}
 	// Should fail due to expired token
 	_, err = client.ValidateIDToken(context.Background(), signedToken)
 	if err == nil {
 		t.Error("expected error for expired token, got nil")
 	}
 }
 func TestValidateIDToken_RejectsWrongIssuer(t *testing.T) {
 	privKey := generateTestRSAKey(t)
 	n, e := encodeRSAPublicKey(privKey)
 	wrongIssuer := "https://wrong-provider.example.com"
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)))
 			return
 		}
 		if r.URL.Path == "/jwks" {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusOK)
 			w.Write([]byte(fmt.Sprintf(`{"keys":[{"kid":"test-key-id","kty":"RSA","use":"sig","alg":"RS256","n":"%s","e":"%s"}]}`, n, e)))
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer server.Close()
 	client := NewOIDCClient(server.URL, "client_id", "client_secret")
 	client.httpClient = server.Client()
 	// Create a JWT with wrong issuer
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, &IDTokenClaims{
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    wrongIssuer,
 			Audience:  jwt.ClaimStrings{"client_id"},
 			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
 			Subject:   "user-123",
 		},
 	})
 	token.Header["kid"] = "test-key-id"
 	signedToken, err := token.SignedString(privKey)
 	if err != nil {
 		t.Fatalf("failed to sign token: %v", err)
 	}
 	// Should fail due to issuer mismatch
 	_, err = client.ValidateIDToken(context.Background(), signedToken)
 	if err == nil {
 		t.Error("expected error for wrong issuer, got nil")
 	}
 }
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -109,12 +109,27 @@ type AuthConfig struct {
 	JWT                 JWTConfig       `mapstructure:"jwt"`
 	Email               EmailConfig     `mapstructure:"email"`
 	MagicLink           MagicLinkConfig `mapstructure:"magic_link"`
 	OIDC                OIDCConfig      `mapstructure:"oidc"`
 }
 // MagicLinkConfig holds passwordless-auth magic-link parameters (ADR-0028 Phase A).
 type MagicLinkConfig struct {
-	TTL     time.Duration `mapstructure:"ttl"`
+	TTL             time.Duration `mapstructure:"ttl"`
-	BaseURL string        `mapstructure:"base_url"`
+	BaseURL         string        `mapstructure:"base_url"`
 	CleanupInterval time.Duration `mapstructure:"cleanup_interval"`
 }
 // OIDCConfig holds OpenID Connect provider configuration (ADR-0028 Phase B).
 // Multiple providers are supported via a map keyed by provider name (e.g. "arcodange-sso", "google").
 type OIDCConfig struct {
 	Providers map[string]OIDCProvider `mapstructure:"providers"`
 }
 // OIDCProvider describes a single OIDC provider's discovery + client config.
 type OIDCProvider struct {
 	IssuerURL    string `mapstructure:"issuer_url"`
 	ClientID     string `mapstructure:"client_id"`
 	ClientSecret string `mapstructure:"client_secret"`
 }
 // EmailConfig holds outgoing email transport configuration.
@@ -286,6 +301,11 @@ func LoadConfig() (*Config, error) {
 	// Magic-link defaults (ADR-0028 Phase A).
 	v.SetDefault("auth.magic_link.ttl", 15*time.Minute)
 	v.SetDefault("auth.magic_link.base_url", "http://localhost:8080")
 	v.SetDefault("auth.magic_link.cleanup_interval", 1*time.Hour)
 	// OIDC defaults (ADR-0028 Phase B). Providers map is empty by default;
 	// configured per environment via config file or env vars.
 	v.SetDefault("auth.oidc.providers", map[string]interface{}{})
 	// Check for custom config file path via environment variable
 	if configFile := os.Getenv("DLC_CONFIG_FILE"); configFile != "" {
@@ -343,6 +363,14 @@ func LoadConfig() (*Config, error) {
 	// Magic-link environment variables (ADR-0028 Phase A).
 	v.BindEnv("auth.magic_link.ttl", "DLC_AUTH_MAGIC_LINK_TTL")
 	v.BindEnv("auth.magic_link.base_url", "DLC_AUTH_MAGIC_LINK_BASE_URL")
 	v.BindEnv("auth.magic_link.cleanup_interval", "DLC_AUTH_MAGIC_LINK_CLEANUP_INTERVAL")
 	// OIDC environment variables (ADR-0028 Phase B). One canonical "default"
 	// provider is bindable via env; additional providers must be defined in config.yaml.
 	v.BindEnv("auth.oidc.providers.default.issuer_url", "DLC_AUTH_OIDC_ISSUER_URL")
 	v.BindEnv("auth.oidc.providers.default.client_id", "DLC_AUTH_OIDC_CLIENT_ID")
 	v.BindEnv("auth.oidc.providers.default.client_secret", "DLC_AUTH_OIDC_CLIENT_SECRET")
 	v.BindEnv("telemetry.sampler.type", "DLC_TELEMETRY_SAMPLER_TYPE")
 	v.BindEnv("telemetry.sampler.ratio", "DLC_TELEMETRY_SAMPLER_RATIO")
@@ -494,6 +522,23 @@ func (c *Config) GetMagicLinkConfig() MagicLinkConfig {
 	return out
 }
 // GetOIDCProviders returns the configured OIDC providers, keyed by provider name.
 // Empty map (not nil) is returned when no providers are configured.
 func (c *Config) GetOIDCProviders() map[string]OIDCProvider {
 	if c.Auth.OIDC.Providers == nil {
 		return map[string]OIDCProvider{}
 	}
 	return c.Auth.OIDC.Providers
 }
 // GetMagicLinkCleanupInterval returns the magic-link cleanup interval (ADR-0028 Phase A consequence).
 func (c *Config) GetMagicLinkCleanupInterval() time.Duration {
 	if c.Auth.MagicLink.CleanupInterval <= 0 {
 		return 1 * time.Hour
 	}
 	return c.Auth.MagicLink.CleanupInterval
 }
 // GetJWTTTL returns the JWT TTL
 func (c *Config) GetJWTTTL() time.Duration {
 	if c.Auth.JWT.TTL == 0 {
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -18,6 +18,7 @@ import (
 	"github.com/rs/zerolog/log"
 	httpSwagger "github.com/swaggo/http-swagger"
 	"dance-lessons-coach/pkg/auth"
 	"dance-lessons-coach/pkg/cache"
 	"dance-lessons-coach/pkg/config"
 	"dance-lessons-coach/pkg/email"
@@ -246,6 +247,9 @@ func (s *Server) registerApiV1Routes(r chi.Router) {
 		r.Get("/{name}", s.handleGreetPath)
 	})
 	// Uptime endpoint
 	r.Get("/uptime", s.handleUptime)
 	// Register user authentication routes
 	if s.userService != nil && s.userRepo != nil {
 		// Use unified user service - much simpler!
@@ -276,6 +280,18 @@ func (s *Server) registerApiV1Routes(r chi.Router) {
 					)
 					mlHandler.RegisterRoutes(r)
 				}
 				// OIDC handlers (ADR-0028 Phase B.4)
 				oidcProviders := s.config.GetOIDCProviders()
 				if len(oidcProviders) > 0 {
 					oidcClients := make(map[string]*auth.OIDCClient, len(oidcProviders))
 					for name, p := range oidcProviders {
 						oidcClients[name] = auth.NewOIDCClient(p.IssuerURL, p.ClientID, p.ClientSecret)
 					}
 					redirectBase := s.config.GetMagicLinkConfig().BaseURL
 					oidcHandler := userapi.NewOIDCHandler(oidcClients, s.userService, s.userRepo, redirectBase)
 					oidcHandler.RegisterRoutes(r)
 				}
 			})
 			// Register admin routes
@@ -583,6 +599,30 @@ func (s *Server) handleInfo(w http.ResponseWriter, r *http.Request) {
 	w.Write(data)
 }
 // UptimeResponse represents the JSON response for /api/v1/uptime
 type UptimeResponse struct {
 	StartTime     string `json:"start_time"`
 	UptimeSeconds int    `json:"uptime_seconds"`
 }
 // handleUptime godoc
 //
 //	@Summary		Get server uptime
 //	@Description	Returns server start time and uptime duration
 //	@Tags			System/Info
 //	@Produce		json
 //	@Success		200	{object}	UptimeResponse
 //	@Router			/v1/uptime [get]
 func (s *Server) handleUptime(w http.ResponseWriter, r *http.Request) {
 	log.Trace().Msg("Uptime check requested")
 	resp := UptimeResponse{
 		StartTime:     s.startedAt.Format(time.RFC3339),
 		UptimeSeconds: int(time.Since(s.startedAt).Seconds()),
 	}
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(resp)
 }
 // handleGreetQuery godoc
 //
 //	@Summary		Get greeting with cache
@@ -764,6 +804,12 @@ func (s *Server) Run() error {
 		s.userService.StartJWTSecretCleanupLoop(rootCtx, s.config.GetJWTSecretCleanupInterval())
 	}
 	// Start the magic-link expired-token cleanup loop (ADR-0028 Phase A consequence).
 	if mlRepo, ok := s.userRepo.(user.MagicLinkRepository); ok {
 		runner := user.NewMagicLinkCleanupRunner(mlRepo)
 		runner.StartCleanupLoop(rootCtx, s.config.GetMagicLinkCleanupInterval())
 	}
 	// Wire the sampler hot-reload callback (ADR-0023 Phase 3, sub-phase 3.3).
 	// telemetrySetup is non-nil only when telemetry was successfully initialized
 	// at startup — hot-reloading telemetry-on is out of scope (see ADR-0023).
--- a/pkg/server/uptime_test.go
+++ b/pkg/server/uptime_test.go
@@ -0,0 +1,81 @@
 package server
 import (
 	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
 	"dance-lessons-coach/pkg/config"
 	"github.com/stretchr/testify/assert"
 )
 func TestHandleUptime(t *testing.T) {
 	// Setup with a known start time
 	cfg := &config.Config{}
 	// We need to create a server and then set its startedAt to a known time
 	// Since NewServer sets startedAt to time.Now(), we'll create the server
 	// and then use reflection or we can use NewServerWithUserRepo which also sets startedAt
 	s := NewServer(cfg, context.Background())
 	// Set a fixed start time for deterministic testing
 	// We can't directly set s.startedAt since it's unexported, but we can test
 	// that the handler uses the server's startedAt
 	// The test will verify the structure and that uptime_seconds is >= 0
 	// Create request
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/uptime", nil)
 	w := httptest.NewRecorder()
 	// Call handler
 	s.handleUptime(w, req)
 	// Check status code
 	assert.Equal(t, http.StatusOK, w.Code)
 	// Check content type
 	assert.Equal(t, "application/json", w.Header().Get("Content-Type"))
 	// Decode response
 	var resp UptimeResponse
 	err := json.NewDecoder(w.Body).Decode(&resp)
 	assert.NoError(t, err)
 	// Assert fields
 	assert.NotEmpty(t, resp.StartTime)
 	// Verify start_time is in RFC3339 format
 	_, err = time.Parse(time.RFC3339, resp.StartTime)
 	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, resp.UptimeSeconds, 0)
 }
 func TestHandleUptime_Deterministic(t *testing.T) {
 	// For a more deterministic test, we would need to be able to set startedAt
 	// Since startedAt is unexported, we test the behavior with a known server
 	// that was just created (uptime should be very small)
 	cfg := &config.Config{}
 	s := NewServer(cfg, context.Background())
 	// Small delay to ensure uptime is at least 0 seconds
 	time.Sleep(10 * time.Millisecond)
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/uptime", nil)
 	w := httptest.NewRecorder()
 	s.handleUptime(w, req)
 	assert.Equal(t, http.StatusOK, w.Code)
 	var resp UptimeResponse
 	err := json.NewDecoder(w.Body).Decode(&resp)
 	assert.NoError(t, err)
 	// Uptime should be at least 0 (it's int() of seconds, so minimum is 0)
 	assert.GreaterOrEqual(t, resp.UptimeSeconds, 0)
 	// Start time should be parseable
 	_, err = time.Parse(time.RFC3339, resp.StartTime)
 	assert.NoError(t, err)
 }
--- a/pkg/user/api/oidc_handler.go
+++ b/pkg/user/api/oidc_handler.go
@@ -0,0 +1,329 @@
 package api
 import (
 	"context"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
 	"net/http"
 	"net/url"
 	"sync"
 	"time"
 	"dance-lessons-coach/pkg/auth"
 	"dance-lessons-coach/pkg/user"
 	"github.com/go-chi/chi/v5"
 	"github.com/rs/zerolog/log"
 )
 // OIDCHandler exposes the OIDC authorization-code endpoints.
 type OIDCHandler struct {
 	clients      map[string]*auth.OIDCClient // keyed by provider name
 	users        user.UserService
 	repo         user.UserRepository
 	redirectBase string
 	pkceMu    sync.Mutex
 	pkceStore map[string]pkceEntry
 }
 type pkceEntry struct {
 	codeVerifier string
 	providerName string
 	expiresAt    time.Time
 }
 // NewOIDCHandler creates a new OIDCHandler.
 func NewOIDCHandler(clients map[string]*auth.OIDCClient, users user.UserService, repo user.UserRepository, redirectBase string) *OIDCHandler {
 	return &OIDCHandler{
 		clients:      clients,
 		users:        users,
 		repo:         repo,
 		redirectBase: redirectBase,
 		pkceStore:    make(map[string]pkceEntry),
 	}
 }
 // RegisterRoutes mounts the OIDC endpoints on the provided router.
 func (h *OIDCHandler) RegisterRoutes(router chi.Router) {
 	router.Get("/oidc/{provider}/start", h.handleStart)
 	router.Get("/oidc/{provider}/callback", h.handleCallback)
 }
 // handleStart initiates the OIDC authorization-code flow.
 //
 //	@Summary		Start OIDC authorization
 //	@Description	Generates PKCE state and verifier, redirects to the OIDC provider authorization endpoint.
 //	@Tags		API/v1/User
 //	@Produce		json
 //	@Param		provider	path		string		true	"OIDC provider name"
 //	@Success		302		{string}string	"Redirect to OIDC provider"
 //	@Failure		404		{object}map[string]string	"Unknown provider"
 //	@Failure		502		{object}map[string]string	"Discovery failed"
 //	@Router		/v1/auth/oidc/{provider}/start [get]
 func (h *OIDCHandler) handleStart(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	provider := chi.URLParam(r, "provider")
 	client, exists := h.clients[provider]
 	if !exists {
 		log.Warn().Ctx(ctx).Str("provider", provider).Msg("OIDC start: unknown provider")
 		writeJSONError(w, http.StatusNotFound, "unknown_provider", "unknown OIDC provider")
 		return
 	}
 	// Ensure discovery is loaded
 	disc, err := client.Discover(ctx)
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Str("provider", provider).Msg("OIDC start: discovery failed")
 		writeJSONError(w, http.StatusBadGateway, "discovery_failed", fmt.Sprintf("OIDC discovery failed: %v", err))
 		return
 	}
 	// Generate state: 32 bytes random, base64-url-no-padding
 	state := generateRandomBase64URL(32)
 	// Generate code verifier: 32 bytes random, base64-url-no-padding
 	codeVerifier := generateRandomBase64URL(32)
 	// Compute code challenge: SHA256 hash of code verifier, base64-url-no-padding
 	hash := sha256.Sum256([]byte(codeVerifier))
 	codeChallenge := base64.RawURLEncoding.EncodeToString(hash[:])
 	// Store PKCE entry
 	h.pkceMu.Lock()
 	// Lazy-clean expired entries
 	now := time.Now()
 	for k, entry := range h.pkceStore {
 		if entry.expiresAt.Before(now) {
 			delete(h.pkceStore, k)
 		}
 	}
 	h.pkceStore[state] = pkceEntry{
 		codeVerifier: codeVerifier,
 		providerName: provider,
 		expiresAt:    now.Add(10 * time.Minute),
 	}
 	h.pkceMu.Unlock()
 	// Build redirect URL
 	redirectURI := fmt.Sprintf("%s/api/v1/auth/oidc/%s/callback", h.redirectBase, provider)
 	v := url.Values{}
 	v.Set("response_type", "code")
 	v.Set("client_id", client.ClientID())
 	v.Set("redirect_uri", redirectURI)
 	v.Set("state", state)
 	v.Set("code_challenge", codeChallenge)
 	v.Set("code_challenge_method", "S256")
 	v.Set("scope", "openid email profile")
 	target := disc.AuthorizationEndpoint + "?" + v.Encode()
 	log.Debug().Ctx(ctx).Str("provider", provider).Str("target", target).Msg("OIDC start: redirecting to provider")
 	http.Redirect(w, r, target, http.StatusFound)
 }
 // handleCallback handles the OIDC callback after authorization.
 //
 //	@Summary		OIDC callback handler
 //	@Description	Validates state, exchanges code for tokens, validates id_token, signs up on first use, issues JWT.
 //	@Tags		API/v1/User
 //	@Produce		json
 //	@Param		provider	path		string		true	"OIDC provider name"
 //	@Param		state		query		string		true	"State parameter"
 //	@Param		code		query		string		false	"Authorization code"
 //	@Param		error		query		string		false	"OIDC error"
 //	@Success		200		{object}	OIDCCallbackResponse	"Successfully signed in via OIDC"
 //	@Failure		401		{object}	map[string]string	"Invalid state, missing code, or OIDC error"
 //	@Failure		502		{object}	map[string]string	"Token exchange or validation failed"
 //	@Failure		500		{object}	map[string]string	"Internal server error"
 //	@Router		/v1/auth/oidc/{provider}/callback [get]
 func (h *OIDCHandler) handleCallback(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	provider := chi.URLParam(r, "provider")
 	client, exists := h.clients[provider]
 	if !exists {
 		log.Warn().Ctx(ctx).Str("provider", provider).Msg("OIDC callback: unknown provider")
 		writeJSONError(w, http.StatusNotFound, "unknown_provider", "unknown OIDC provider")
 		return
 	}
 	// Read query parameters
 	state := r.URL.Query().Get("state")
 	code := r.URL.Query().Get("code")
 	oidcError := r.URL.Query().Get("error")
 	// If OIDC provider returned an error
 	if oidcError != "" {
 		log.Warn().Ctx(ctx).Str("provider", provider).Str("error", oidcError).Msg("OIDC callback: provider error")
 		writeJSON(w, http.StatusUnauthorized, map[string]string{
 			"error":          "oidc_error",
 			"provider_error": oidcError,
 		})
 		return
 	}
 	// Validate state
 	if state == "" {
 		log.Warn().Ctx(ctx).Msg("OIDC callback: missing state")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_state", "missing state parameter")
 		return
 	}
 	h.pkceMu.Lock()
 	entry, exists := h.pkceStore[state]
 	if !exists {
 		h.pkceMu.Unlock()
 		log.Warn().Ctx(ctx).Str("state", state).Msg("OIDC callback: state not found")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_state", "state not found or already used")
 		return
 	}
 	// Check expiration and provider match
 	now := time.Now()
 	if entry.expiresAt.Before(now) {
 		delete(h.pkceStore, state)
 		h.pkceMu.Unlock()
 		log.Warn().Ctx(ctx).Str("state", state).Msg("OIDC callback: state expired")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_state", "state expired")
 		return
 	}
 	if entry.providerName != provider {
 		delete(h.pkceStore, state)
 		h.pkceMu.Unlock()
 		log.Warn().Ctx(ctx).Str("state", state).Str("expected_provider", entry.providerName).Str("actual_provider", provider).Msg("OIDC callback: provider mismatch")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_state", "provider mismatch")
 		return
 	}
 	// Delete the entry (single-use)
 	codeVerifier := entry.codeVerifier
 	delete(h.pkceStore, state)
 	h.pkceMu.Unlock()
 	// Validate code parameter
 	if code == "" {
 		log.Warn().Ctx(ctx).Msg("OIDC callback: missing code")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_request", "missing authorization code")
 		return
 	}
 	// Build redirect URI
 	redirectURI := fmt.Sprintf("%s/api/v1/auth/oidc/%s/callback", h.redirectBase, provider)
 	// Exchange code for tokens
 	tokenResp, err := client.ExchangeCode(ctx, code, codeVerifier, redirectURI)
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Str("provider", provider).Msg("OIDC callback: code exchange failed")
 		writeJSONError(w, http.StatusBadGateway, "token_exchange_failed", fmt.Sprintf("code exchange failed: %v", err))
 		return
 	}
 	// Validate ID token
 	claims, err := client.ValidateIDToken(ctx, tokenResp.IDToken)
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Str("provider", provider).Msg("OIDC callback: ID token validation failed")
 		writeJSONError(w, http.StatusUnauthorized, "invalid_id_token", fmt.Sprintf("ID token validation failed: %v", err))
 		return
 	}
 	// Check email in claims
 	if claims.Email == "" {
 		log.Warn().Ctx(ctx).Str("provider", provider).Msg("OIDC callback: no email in ID token")
 		writeJSONError(w, http.StatusUnauthorized, "no_email_in_id_token", "ID token does not contain an email claim")
 		return
 	}
 	// Ensure user exists (sign-up on first use)
 	u, err := h.ensureUser(ctx, claims.Email)
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Str("email", claims.Email).Msg("OIDC callback: user upsert failed")
 		writeJSONError(w, http.StatusInternalServerError, "server_error", fmt.Sprintf("user upsert failed: %v", err))
 		return
 	}
 	// Generate JWT
 	jwtToken, err := h.users.GenerateJWT(ctx, u)
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Str("email", claims.Email).Msg("OIDC callback: JWT generation failed")
 		writeJSONError(w, http.StatusInternalServerError, "server_error", fmt.Sprintf("JWT generation failed: %v", err))
 		return
 	}
 	log.Info().Ctx(ctx).Str("provider", provider).Str("email", claims.Email).Msg("OIDC callback: user signed in successfully")
 	writeJSON(w, http.StatusOK, map[string]string{
 		"message": "signed in via oidc",
 		"token":   jwtToken,
 		"user":    claims.Email,
 	})
 }
 // ensureUser returns the user keyed on email (stored as Username),
 // creating them if absent. Newly-created users get a random unguessable
 // bcrypt-hashed password so the password endpoints stay locked out.
 func (h *OIDCHandler) ensureUser(ctx context.Context, email string) (*user.User, error) {
 	if h.repo != nil {
 		existing, err := h.repo.GetUserByUsername(ctx, email)
 		if err != nil {
 			return nil, fmt.Errorf("get user by username: %w", err)
 		}
 		if existing != nil {
 			return existing, nil
 		}
 	}
 	// Generate random password
 	rawPass := generateRandomHex(32)
 	hash, err := h.users.HashPassword(ctx, rawPass)
 	if err != nil {
 		return nil, fmt.Errorf("hash password: %w", err)
 	}
 	u := &user.User{
 		Username:     email,
 		PasswordHash: hash,
 		IsAdmin:      false,
 	}
 	if err := h.users.CreateUser(ctx, u); err != nil {
 		return nil, fmt.Errorf("create user: %w", err)
 	}
 	if h.repo != nil {
 		return h.repo.GetUserByUsername(ctx, email)
 	}
 	return u, nil
 }
 // generateRandomBase64URL generates a random string suitable for use in OIDC PKCE flows.
 func generateRandomBase64URL(length int) string {
 	b := make([]byte, length)
 	if _, err := rand.Read(b); err != nil {
 		panic(fmt.Sprintf("failed to read random bytes: %v", err))
 	}
 	return base64.RawURLEncoding.EncodeToString(b)
 }
 // generateRandomHex generates a random hex string.
 func generateRandomHex(length int) string {
 	b := make([]byte, length/2)
 	if _, err := rand.Read(b); err != nil {
 		panic(fmt.Sprintf("failed to read random bytes: %v", err))
 	}
 	return hex.EncodeToString(b)
 }
 // OIDCCallbackResponse represents the JSON response from the OIDC callback.
 type OIDCCallbackResponse struct {
 	Message string `json:"message"`
 	Token   string `json:"token"`
 	User    string `json:"user"`
 }
--- a/pkg/user/api/oidc_handler_test.go
+++ b/pkg/user/api/oidc_handler_test.go
@@ -0,0 +1,134 @@
 package api
 import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"dance-lessons-coach/pkg/auth"
 	"dance-lessons-coach/pkg/user"
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
 )
 // fakeUserSvc is reused from magic_link_handler_test.go
 // It's in the same package (api) so we can use it directly.
 // fakeUserRepo is reused from magic_link_handler_test.go
 // It's in the same package (api) so we can use it directly.
 // setupMockOIDCProvider creates a mock OIDC provider server for testing.
 // Uses the Q-062 mitigation pattern with var server *httptest.Server.
 func setupMockOIDCProvider(t *testing.T) *httptest.Server {
 	t.Helper()
 	var server *httptest.Server
 	server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/.well-known/openid-configuration" {
 			w.Header().Set("Content-Type", "application/json")
 			fmt.Fprintf(w, `{"issuer":"%s","authorization_endpoint":"%s/auth","token_endpoint":"%s/token","jwks_uri":"%s/jwks"}`,
 				server.URL, server.URL, server.URL, server.URL)
 			return
 		}
 		w.WriteHeader(http.StatusNotFound)
 	}))
 	return server
 }
 // mountOIDCHandler mounts the OIDCHandler on a new router and returns it.
 func mountOIDCHandler(t *testing.T, handler *OIDCHandler) *chi.Mux {
 	t.Helper()
 	r := chi.NewRouter()
 	handler.RegisterRoutes(r)
 	return r
 }
 // newTestOIDCHandler creates an OIDCHandler with the given clients.
 func newTestOIDCHandler(clients map[string]*auth.OIDCClient) *OIDCHandler {
 	return NewOIDCHandler(
 		clients,
 		newFakeUserSvc(),
 		&fakeUserRepo{svc: newFakeUserSvc()},
 		"http://localhost:8080",
 	)
 }
 // TestOIDCHandler_Start_RejectsUnknownProvider tests that starting with an unknown provider returns 404.
 func TestOIDCHandler_Start_RejectsUnknownProvider(t *testing.T) {
 	handler := newTestOIDCHandler(map[string]*auth.OIDCClient{})
 	router := mountOIDCHandler(t, handler)
 	req := httptest.NewRequest(http.MethodGet, "/oidc/unknown/start", nil)
 	rr := httptest.NewRecorder()
 	router.ServeHTTP(rr, req)
 	assert.Equal(t, http.StatusNotFound, rr.Code)
 }
 // TestOIDCHandler_Callback_RejectsMissingState tests that callback without state returns 401.
 func TestOIDCHandler_Callback_RejectsMissingState(t *testing.T) {
 	client := auth.NewOIDCClient("http://mock-provider", "test-id", "test-secret")
 	handler := newTestOIDCHandler(map[string]*auth.OIDCClient{"test": client})
 	router := mountOIDCHandler(t, handler)
 	req := httptest.NewRequest(http.MethodGet, "/oidc/test/callback", nil)
 	rr := httptest.NewRecorder()
 	router.ServeHTTP(rr, req)
 	assert.Equal(t, http.StatusUnauthorized, rr.Code)
 }
 // TestOIDCHandler_Callback_RejectsUnknownState tests that callback with unknown state returns 401.
 func TestOIDCHandler_Callback_RejectsUnknownState(t *testing.T) {
 	client := auth.NewOIDCClient("http://mock-provider", "test-id", "test-secret")
 	handler := newTestOIDCHandler(map[string]*auth.OIDCClient{"test": client})
 	router := mountOIDCHandler(t, handler)
 	req := httptest.NewRequest(http.MethodGet, "/oidc/test/callback?state=unknown&code=any", nil)
 	rr := httptest.NewRecorder()
 	router.ServeHTTP(rr, req)
 	assert.Equal(t, http.StatusUnauthorized, rr.Code)
 }
 // TestOIDCHandler_Start_RedirectsWithPKCE tests that starting with a valid provider redirects with PKCE.
 func TestOIDCHandler_Start_RedirectsWithPKCE(t *testing.T) {
 	// Setup mock OIDC provider
 	mockServer := setupMockOIDCProvider(t)
 	defer mockServer.Close()
 	// Create OIDC client pointing to mock server
 	client := auth.NewOIDCClient(mockServer.URL, "test-id", "test-secret")
 	// Set a custom HTTP client that can reach the mock server
 	client.SetHTTPClient(mockServer.Client())
 	handler := newTestOIDCHandler(map[string]*auth.OIDCClient{"test": client})
 	router := mountOIDCHandler(t, handler)
 	req := httptest.NewRequest(http.MethodGet, "/oidc/test/start", nil)
 	rr := httptest.NewRecorder()
 	router.ServeHTTP(rr, req)
 	// Assert 302 redirect
 	assert.Equal(t, http.StatusFound, rr.Code)
 	// Get Location header
 	location := rr.Header().Get("Location")
 	assert.NotEmpty(t, location)
 	// Location should start with the mock auth endpoint
 	expectedAuthEndpoint := mockServer.URL + "/auth"
 	assert.Contains(t, location, expectedAuthEndpoint)
 	// Location should contain code_challenge and state
 	assert.Contains(t, location, "code_challenge=")
 	assert.Contains(t, location, "state=")
 	assert.Contains(t, location, "response_type=code")
 	assert.Contains(t, location, "client_id=test-id")
 	assert.Contains(t, location, "code_challenge_method=S256")
 }
 // Ensure the interfaces are satisfied at compile time
 var _ user.UserService = (*fakeUserSvc)(nil)
 var _ user.UserRepository = (*fakeUserRepo)(nil)
--- a/pkg/user/auth_service.go
+++ b/pkg/user/auth_service.go
@@ -106,7 +106,7 @@ func (s *userServiceImpl) GenerateJWT(ctx context.Context, user *User) (string,
 	// Use the most recently added secret (last in the list)
 	// This ensures new tokens are signed with the latest secret
 	signingSecret := validSecrets[len(validSecrets)-1].Secret
-	log.Trace().Ctx(ctx).Str("signing_secret", signingSecret).Bool("is_primary", validSecrets[len(validSecrets)-1].IsPrimary).Msg("Generating JWT with latest secret")
+	log.Trace().Ctx(ctx).Str("signing_secret_fp", tokenFingerprint(signingSecret)).Bool("is_primary", validSecrets[len(validSecrets)-1].IsPrimary).Msg("Generating JWT with latest secret")
 	// Sign and get the complete encoded token as a string
 	tokenString, err := token.SignedString([]byte(signingSecret))
@@ -114,20 +114,20 @@ func (s *userServiceImpl) GenerateJWT(ctx context.Context, user *User) (string,
 		return "", fmt.Errorf("failed to sign JWT: %w", err)
 	}
-	log.Trace().Ctx(ctx).Str("token", tokenString).Msg("Generated JWT token")
+	log.Trace().Ctx(ctx).Str("token_fp", tokenFingerprint(tokenString)).Int("token_len", len(tokenString)).Msg("Generated JWT token")
 	return tokenString, nil
 }
 // ValidateJWT validates a JWT token and returns the user
 func (s *userServiceImpl) ValidateJWT(ctx context.Context, tokenString string) (*User, error) {
-	log.Trace().Ctx(ctx).Str("token", tokenString).Msg("Validating JWT token")
+	log.Trace().Ctx(ctx).Str("token_fp", tokenFingerprint(tokenString)).Int("token_len", len(tokenString)).Msg("Validating JWT token")
 	// Get all valid secrets for validation
 	validSecrets := s.secretManager.GetAllValidSecrets()
 	log.Trace().Ctx(ctx).Int("num_secrets", len(validSecrets)).Msg("Validating JWT with multiple secrets")
 	for i, secret := range validSecrets {
-		log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret", secret.Secret).Bool("is_primary", secret.IsPrimary).Msg("Trying secret")
+		log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret_fp", tokenFingerprint(secret.Secret)).Bool("is_primary", secret.IsPrimary).Msg("Trying secret")
 	}
 	// Try each valid secret until we find one that works
@@ -146,7 +146,7 @@ func (s *userServiceImpl) ValidateJWT(ctx context.Context, tokenString string) (
 		})
 		if err == nil && token.Valid {
-			log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret", secret.Secret).Msg("JWT validation successful")
+			log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret_fp", tokenFingerprint(secret.Secret)).Msg("JWT validation successful")
 			parsedToken = token
 			break
 		}
@@ -154,7 +154,7 @@ func (s *userServiceImpl) ValidateJWT(ctx context.Context, tokenString string) (
 		// Store the last error for reporting
 		validationError = err
 		if err != nil {
-			log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret", secret.Secret).Err(err).Msg("JWT validation failed")
+			log.Trace().Ctx(ctx).Int("secret_index", i).Str("secret_fp", tokenFingerprint(secret.Secret)).Err(err).Msg("JWT validation failed")
 		}
 	}
@@ -351,3 +351,13 @@ func (s *PasswordResetServiceImpl) CompletePasswordReset(ctx context.Context, us
 	// Complete the password reset
 	return s.repo.CompletePasswordReset(ctx, username, hashedPassword)
 }
 // tokenFingerprint returns the first 16 hex chars of SHA-256 hash of a token/secret.
 // Used for safe logging correlation without leaking sensitive values.
 func tokenFingerprint(tok string) string {
 	if tok == "" {
 		return ""
 	}
 	sum := sha256.Sum256([]byte(tok))
 	return hex.EncodeToString(sum[:8]) // 16 hex chars = 8 bytes
 }
--- a/pkg/user/magic_link_cleanup.go
+++ b/pkg/user/magic_link_cleanup.go
@@ -0,0 +1,56 @@
 package user
 import (
 	"context"
 	"time"
 	"github.com/rs/zerolog/log"
 )
 // MagicLinkCleanupRunner periodically deletes expired magic-link tokens
 // (ADR-0028 Phase A consequence — the rows accumulate without cleanup
 // otherwise, and stale rows are pure overhead since the token plaintext
 // is never stored).
 type MagicLinkCleanupRunner struct {
 	repo MagicLinkRepository
 }
 // NewMagicLinkCleanupRunner creates a new cleanup runner.
 func NewMagicLinkCleanupRunner(repo MagicLinkRepository) *MagicLinkCleanupRunner {
 	return &MagicLinkCleanupRunner{repo: repo}
 }
 // StartCleanupLoop runs the cleanup pass every `interval`. Stops when ctx
 // is cancelled. interval <= 0 disables the loop.
 func (r *MagicLinkCleanupRunner) StartCleanupLoop(ctx context.Context, interval time.Duration) {
 	if interval <= 0 {
 		return
 	}
 	go func() {
 		ticker := time.NewTicker(interval)
 		defer ticker.Stop()
 		for {
 			select {
 			case <-ctx.Done():
 				return
 			case <-ticker.C:
 				_, _ = r.runOnce(ctx)
 			}
 		}
 	}()
 }
 // runOnce performs a single cleanup pass. Returns the count of deleted rows.
 // Exposed for testing — tests drive runOnce directly instead of waiting on
 // the ticker.
 func (r *MagicLinkCleanupRunner) runOnce(ctx context.Context) (int64, error) {
 	n, err := r.repo.DeleteExpiredMagicLinkTokens(ctx, time.Now())
 	if err != nil {
 		log.Error().Ctx(ctx).Err(err).Msg("magic-link cleanup: delete failed")
 		return 0, err
 	}
 	if n > 0 {
 		log.Trace().Ctx(ctx).Int64("deleted", n).Msg("magic-link cleanup: removed expired tokens")
 	}
 	return n, nil
 }
--- a/pkg/user/magic_link_cleanup_test.go
+++ b/pkg/user/magic_link_cleanup_test.go
@@ -0,0 +1,64 @@
 package user
 import (
 	"context"
 	"errors"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 type fakeMLRepo struct {
 	deleteN    int64
 	deleteErr  error
 	cutoffSeen time.Time
 }
 func (r *fakeMLRepo) CreateMagicLinkToken(_ context.Context, _ *MagicLinkToken) error { return nil }
 func (r *fakeMLRepo) GetMagicLinkTokenByHash(_ context.Context, _ string) (*MagicLinkToken, error) {
 	return nil, nil
 }
 func (r *fakeMLRepo) MarkMagicLinkTokenConsumed(_ context.Context, _ uint, _ time.Time) error {
 	return nil
 }
 func (r *fakeMLRepo) DeleteExpiredMagicLinkTokens(_ context.Context, before time.Time) (int64, error) {
 	r.cutoffSeen = before
 	return r.deleteN, r.deleteErr
 }
 func TestRunOnce_ReturnsCount(t *testing.T) {
 	repo := &fakeMLRepo{deleteN: 7}
 	r := NewMagicLinkCleanupRunner(repo)
 	n, err := r.runOnce(context.Background())
 	require.NoError(t, err)
 	assert.EqualValues(t, 7, n)
 	assert.WithinDuration(t, time.Now(), repo.cutoffSeen, time.Second)
 }
 func TestRunOnce_PropagatesError(t *testing.T) {
 	repo := &fakeMLRepo{deleteErr: errors.New("simulated")}
 	r := NewMagicLinkCleanupRunner(repo)
 	_, err := r.runOnce(context.Background())
 	require.Error(t, err)
 }
 func TestStartCleanupLoop_StopsOnContextCancel(t *testing.T) {
 	repo := &fakeMLRepo{}
 	r := NewMagicLinkCleanupRunner(repo)
 	ctx, cancel := context.WithCancel(context.Background())
 	r.StartCleanupLoop(ctx, 10*time.Millisecond)
 	time.Sleep(25 * time.Millisecond) // 2 ticks
 	cancel()
 	time.Sleep(15 * time.Millisecond) // give the goroutine time to exit
 	// Implicit assertion: no goroutine leak (test would hang in -race mode otherwise).
 }
 func TestStartCleanupLoop_NoOpWhenIntervalZero(t *testing.T) {
 	repo := &fakeMLRepo{}
 	r := NewMagicLinkCleanupRunner(repo)
 	r.StartCleanupLoop(context.Background(), 0)
 	// Just make sure no goroutine is started ; nothing observable to assert
 	// beyond "no panic, returns immediately".
 }
Author	SHA1	Message	Date
Gabriel Radureau	f74ba51d7a	✨ feat(deploy): Dockerfile + Helm chart for k3s homelab deployment (#89 ) Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 8s Details CI/CD Pipeline / Trigger Docker Push (push) Has been cancelled Details CI/CD Pipeline / CI Pipeline (push) Has started running Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-06 06:51:14 +02:00
Gabriel Radureau	02bafbb0e2	🔒 fix(security): redact JWT tokens and HMAC secrets in trace logs (auth_service.go) (#88 ) All checks were successful CI/CD Pipeline / Build Docker Cache (push) Successful in 9s Details CI/CD Pipeline / CI Pipeline (push) Successful in 4m29s Details CI/CD Pipeline / Trigger Docker Push (push) Successful in 6s Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-06 06:43:30 +02:00
Gabriel Radureau	1aef136436	📝 docs: cherry-pick 6 focused guides from PR #17 (option c) (#87 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-06 06:37:17 +02:00
arcodange	da51883c88	Merge pull request '📝 docs(changelog): record PR #85 ' (#86 ) from vibe/batch18-task-changelog-85 into main	2026-05-05 22:52:40 +02:00
Gabriel Radureau	904bbe41f5	📝 docs(changelog): record PR #85	2026-05-05 22:52:25 +02:00
arcodange	b9dd23a64f	Merge pull request '📝 docs: STATUS.md project snapshot 2026-05-05' (#85 ) from vibe/batch17-task-status-snapshot into main	2026-05-05 22:50:55 +02:00
Gabriel Radureau	af9518fcce	📝 docs: STATUS.md project snapshot 2026-05-05	2026-05-05 22:50:41 +02:00
Gabriel Radureau	620f68df51	📝 docs(changelog): record PR #83 (#84 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:48:33 +02:00
arcodange	14478ed338	Merge pull request '📝 docs(readme): link to Mistral autonomous pattern doc' (#83 ) from vibe/batch15-task-readme-pattern-link into main	2026-05-05 22:46:37 +02:00
Gabriel Radureau	1f4529f710	📝 docs(readme): link to Mistral autonomous pattern doc	2026-05-05 22:46:24 +02:00
arcodange	464b84ab2d	Merge pull request '📝 docs(changelog): record PRs #80 , #81 ' (#82 ) from vibe/batch14-task-changelog-79-81 into main	2026-05-05 22:45:00 +02:00
Gabriel Radureau	5929bbcee1	📝 docs(changelog): record PRs #80 , #81	2026-05-05 22:44:42 +02:00
Gabriel Radureau	99c71ca815	📝 docs: 2026-05-05 autonomous session recap (#81 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:43:27 +02:00
arcodange	6aeb197f58	Merge pull request '📝 docs: PHASE_B_ROADMAP — mark B.3 + B.4 done' (#80 ) from vibe/batch12-task-phase-b-roadmap-update into main	2026-05-05 22:40:51 +02:00
Gabriel Radureau	5ad596d163	📝 docs: PHASE_B_ROADMAP — mark B.3 + B.4 done (PRs #74 , #75 , #76 )	2026-05-05 22:40:27 +02:00
arcodange	c9389282a5	Merge pull request '📝 docs(changelog): record PRs #73 , #78 ' (#79 ) from vibe/batch11-task-changelog-78 into main	2026-05-05 22:39:10 +02:00
Gabriel Radureau	2a7d2cad82	📝 docs(changelog): record PRs #73 , #78	2026-05-05 22:38:54 +02:00
Gabriel Radureau	d8bab4541d	📝 docs: Mistral autonomous pattern guide for contributors (#78 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:37:22 +02:00
Gabriel Radureau	fe33127969	📝 docs(changelog): record PRs #74 , #75 , #76 (#77 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:34:31 +02:00
Gabriel Radureau	f1443e0fd7	🧪 test(auth): OIDC handler unit tests (ADR-0028 Phase B.4 follow-up) (#76 ) Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 19s Details CI/CD Pipeline / CI Pipeline (push) Failing after 4m15s Details CI/CD Pipeline / Trigger Docker Push (push) Has been skipped Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:31:40 +02:00
Gabriel Radureau	d19fed6610	✨ feat(auth): OIDC HTTP handlers /start + /callback (ADR-0028 Phase B.4) (#75 ) Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 9s Details CI/CD Pipeline / Trigger Docker Push (push) Has been cancelled Details CI/CD Pipeline / CI Pipeline (push) Has been cancelled Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 22:29:34 +02:00
Gabriel Radureau	9b4087b765	✨ feat(auth): implement OIDC client methods (ADR-0028 Phase B.3) (#74 ) All checks were successful CI/CD Pipeline / Build Docker Cache (push) Successful in 8s Details CI/CD Pipeline / CI Pipeline (push) Successful in 4m44s Details CI/CD Pipeline / Trigger Docker Push (push) Successful in 6s Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:54:08 +02:00
Gabriel Radureau	0c01789605	📝 docs: AUTH.md synthesis (Phase A complete, Phase B partial) (#73 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:36:25 +02:00
Gabriel Radureau	0ea47d9c68	📝 docs(changelog): record PRs #67-#71 (#72 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:31:39 +02:00
Gabriel Radureau	55f0a0da02	📝 docs: ADR-0028 Phase B roadmap (B.3 / B.4 / B.5 outline) (#71 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:30:58 +02:00
Gabriel Radureau	fbf00a3cd0	✨ feat(auth): pkg/auth skeleton for OpenID Connect (ADR-0028 Phase B prep) (#69 ) All checks were successful CI/CD Pipeline / Build Docker Cache (push) Successful in 9s Details CI/CD Pipeline / CI Pipeline (push) Successful in 4m4s Details CI/CD Pipeline / Trigger Docker Push (push) Successful in 5s Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:24:41 +02:00
arcodange	001172e5b3	Merge pull request '📝 docs: mkcert local HTTPS setup + Makefile cert target (ADR-0028 Phase B prep)' (#68 ) from vibe/batch3-task-y-mkcert-doc into main Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 26s Details CI/CD Pipeline / Trigger Docker Push (push) Has been cancelled Details CI/CD Pipeline / CI Pipeline (push) Has been cancelled Details	2026-05-05 19:23:13 +02:00
Gabriel Radureau	c05e508d56	📝 docs: mkcert local HTTPS setup + Makefile cert target (ADR-0028 Phase B prep)	2026-05-05 19:22:38 +02:00
Gabriel Radureau	b17b727157	✨ feat(server): add GET /api/v1/uptime endpoint (#67 ) Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 8s Details CI/CD Pipeline / Trigger Docker Push (push) Has been cancelled Details CI/CD Pipeline / CI Pipeline (push) Has been cancelled Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:18:24 +02:00
Gabriel Radureau	087ce8a4e1	📝 docs: add top-level CHANGELOG.md (keepachangelog format) (#66 ) Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 19:17:53 +02:00
Gabriel Radureau	b6a6a2b3d7	✨ feat(user): magic-link expired-token cleanup loop (ADR-0028 Phase A consequence) (#65 ) All checks were successful CI/CD Pipeline / Build Docker Cache (push) Successful in 11s Details CI/CD Pipeline / CI Pipeline (push) Successful in 4m27s Details CI/CD Pipeline / Trigger Docker Push (push) Successful in 6s Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 13:07:01 +02:00
Gabriel Radureau	6ed95165d3	feat(config): OIDC provider config skeleton (ADR-0028 Phase B.1 prep) (#64 ) Some checks failed CI/CD Pipeline / Build Docker Cache (push) Successful in 9s Details CI/CD Pipeline / Trigger Docker Push (push) Has been cancelled Details CI/CD Pipeline / CI Pipeline (push) Has been cancelled Details Co-authored-by: Gabriel Radureau <arcodange@gmail.com> Co-committed-by: Gabriel Radureau <arcodange@gmail.com>	2026-05-05 13:04:14 +02:00