# Project Status Snapshot

Last updated 2026-05-05 evening.

---

## Active Features

- Magic-link passwordless auth (POST /api/v1/auth/magic-link/request + GET /consume) — production-ready, ADR-0028 Phase A complete
- OIDC client + HTTP handlers (GET /api/v1/auth/oidc/{provider}/start + /callback with PKCE) — production-ready code, BDD coverage TODO. ADR-0028 Phase B (B.1, B.3, B.4 + tests done ; B.5 BDD scenarios TODO).
- Username + password auth — legacy (ADR-0018), kept during migration. To be decommissioned in Phase C.
- Versioned API, JWT, OpenTelemetry, Swagger, BDD

---

## What's In Progress / Next

- Phase B.5 BDD scenarios for OIDC (1 PR Mistral expected)
- Phase C decommission password auth (separate ADR)

---

## Project Structure Highlights

```
adr/ : ADRs
pkg/ : packages (auth, config, server, user, etc.)
features/ : BDD scenarios
documentation/ : docs index
scripts/ : build + CI
```

---

## Key Documentation Entry Points

- README.md : quick start
- AGENTS.md : agent + automation conventions
- documentation/AUTH.md : auth system synthesis
- documentation/MISTRAL-AUTONOMOUS-PATTERN.md : how Mistral PRs are shipped
- documentation/PHASE_B_ROADMAP.md : remaining auth migration work
- documentation/2026-05-05-AUTONOMOUS-SESSION-RECAP.md : the autonomous session highlights
- adr/ : architecture decisions

---

## Today's Milestone (2026-05-05)

27 PRs merged in 1 day via the Mistral autonomous multi-process pattern. ADR-0028 (passwordless auth migration) essentially complete except Phase B.5 BDD.