.planning/ROADMAP.md

@@ -437,7 +437,7 @@ At ≤767px (`window.matchMedia('(max-width: 767px)')` in `apps/pwa/src/App.tsx`
 | 16. CI Dep Audit, Sec & Img Hyg  | v1.1 | 6/6 | Complete    | 2026-06-13 |
 | 17. UI Optimization & Polish     | v1.1 | 0/?   | Not started | -       |
 | 18. Auto Timezone Detection      | v1.1 | 4/4 | Complete    | 2026-06-14 |
-| 19. Local Auth (No-OIDC Mode)    | v1.1 | 0/5 | Planned     | -          |
+| 19. Local Auth (No-OIDC Mode)    | v1.1 | 1/5 | In Progress|  |
 
 ## Backlog
 
@@ -683,7 +683,7 @@ Plans:
 **Mode:** standard
 **Depends on:** Phase 12 (Initial Setup Wizard) — builds directly on the pre-OIDC **local-user foundation** introduced there: nullable `users.oidc_iss`/`oidc_sub` + the claimed/pending marker, and the first-login-claims merge. Phase 19 generalizes that single bootstrap local user into a full local-account model + login.
 **Requirements**: AUTH-LOCAL-01..AUTH-LOCAL-20 (derived during planning 2026-06-17) — local_credentials schema (01), scrypt hash/verify (02), login route (03), localAuthMiddleware (04), auth-mode endpoint (05), logout (06), admin create-member (07), admin reset (08), self-change (09), OIDC-link (10), break-glass CLI (11), LoginPage (12), admin UI (13), settings UI (14), routing gate (15), dev-bypass/harness rework (16), hasLocalCredential (17), de-Authelia copy (18), rate-limit/lockout (19), auth unit tests (20). Plus `LOCAL_SESSION_SECRET` env + boot assertion (D-05).
-**Plans:** 5 plans (4 waves)
+**Plans:** 1/5 plans executed
 
 **Provenance:** Deferred from the Phase 12 discussion (2026-06-15) — see `.planning/phases/12-initial-setup-wizard/12-CONTEXT.md` §Deferred Ideas. The operator runs FamilySync this way themselves and wants no-OIDC operation as a first-class mode.
 
@@ -697,7 +697,7 @@ Plans:
 Plans:
 **Wave 1**
 
-- [ ] 19-01-PLAN.md — Foundation (TDD): local_credentials schema + 0003 migration, scrypt hash/verify, local-session JWT helpers, LOCAL_SESSION_SECRET boot guard + generate-secrets, .dockerignore scripts exclusion (AUTH-LOCAL-01/02)
+- [x] 19-01-PLAN.md — Foundation (TDD): local_credentials schema + 0003 migration, scrypt hash/verify, local-session JWT helpers, LOCAL_SESSION_SECRET boot guard + generate-secrets, .dockerignore scripts exclusion (AUTH-LOCAL-01/02)
 
 **Wave 2** *(blocked on Wave 1)*
 

.planning/STATE.md

@@ -2,16 +2,17 @@
 gsd_state_version: 1.0
 milestone: v1.1
 milestone_name: Operability & Polish
-current_phase: 13
-status: "Phase 12 shipped — PR #22"
+current_phase: 19
+current_phase_name: local-auth-no-oidc-mode
+status: executing
 stopped_at: Phase 19 UI-SPEC approved
-last_updated: "2026-06-17T20:04:38.622Z"
+last_updated: "2026-06-17T20:08:36.716Z"
 last_activity: 2026-06-17
-last_activity_desc: Phase 19 planning complete
+last_activity_desc: Phase 19 execution started
 progress:
   total_phases: 24
   completed_phases: 10
-  total_plans: 44
+  total_plans: 49
   completed_plans: 43
   percent: 42
 ---
@@ -23,14 +24,14 @@ progress:
 See: .planning/PROJECT.md (updated 2026-06-16)
 
 **Core value:** One color-coded family calendar (shared + personal) and shared lists from a single low-friction PWA — cross-ecosystem, no app store
-**Current focus:** Phase 13 — real-lint-gate-eslint
+**Current focus:** Phase 19 — local-auth-no-oidc-mode
 
 ## Current Position
 
-Phase: 13
-Plan: Not started
-Status: Phase 12 shipped — PR #22
-Last activity: 2026-06-17 — Phase 19 planning complete
+Phase: 19 (local-auth-no-oidc-mode) — EXECUTING
+Plan: 1 of 5
+Status: Executing Phase 19
+Last activity: 2026-06-17 — Phase 19 execution started
 
 ### ✅ Resolved Checkpoint — Phase 15 Plan 15-03 Task 2 (human-action)