# Track A Status

| Task | Status | Branch | Notes / blockers |
|---|---|---|---|
| T-A-01 | ✅ merged | track-a/T-A-01-base-domain-model | BaseDomainModel + 5-DB scaffolding. |
| T-A-02 | ✅ merged | track-a/T-A-02-audit-events | audit_events + AuditService + Auditable hooks + GET /api/audit (immutable). |
| T-A-03 | ✅ merged | track-a/T-A-03-verification-tokens | verification_tokens + TokenService (issue/verify/consume, TTL, cooldown, lockout) + phone column. Full suite green. |
| T-A-04 | ✅ merged | track-a/T-A-04-rbac-engine | RBAC engine: roles/permissions/role_permission/user_role on identity_billing, RbacService (union, deny-by-default, institute hard boundary), `Can` middleware (`rbac.can:`), RolesController CRUD, RbacDefaultsSeeder. Audit endpoint gated by `rbac.can:audit.view`. |
| T-A-05 | 🚀 re-pushed (ownership-fixed; on new main 0d54b58) | track-a/T-A-05-response-envelope | ApiResponse trait + EnvelopeExceptionHandler wired in bootstrap/app.php (subsumes T-A-03 TokenStatusException render). **Ownership fix**: the orchestrator rejected the first push (`ownership_rejected`) because `app/Http/Concerns/` and `docs/api-conventions.md` are outside Track A's owned paths. Trait moved to `app/Exceptions/ApiResponse` (A-owned); the conventions doc is now the README "API Response & Error Conventions" section. Rebased onto main 0d54b58 (post T-A-06 merge); 74 passing, 0 failing. |
| T-A-06 | ✅ merged | track-a/T-A-06-domain-events | 11 owned contract events in app/Events/{Identity,Billing} (all ShouldQueue); 10 B/C/D same-shape test doubles; QUEUE_MAX_TRIES=3. Ownership fix (queue doc folded into README "Queue & domain-event dispatch policy" + new README "Contract Change Log") landed the merge. Merged to main as 0d54b58. |
| T-A-24 | ✅ merged | track-a/T-A-24-api-keys-rates-webhooks | API keys (issue/rotate/revoke, full key shown once, scope-gated), rate-limit policies (key>endpoint>global floor, burst+sustained, 429+Retry-After), webhook endpoints (admin CRUD + signing-secret rotation, 24h retry budget, IP allowlist). Models/services on identity_billing; `apikeys.manage` RBAC permission seeded. Merged to main as 5f33d23. |
| T-A-24f | ✅ merged | track-a/T-A-24-followup-fix-validation-500 | Bug fix: `RateLimitController` threw `ValidationException::withMessages()` without importing `Illuminate\Validation\ValidationException` → duplicate-subject / over-floor policy writes 500'd instead of 422 (merged 13-test suite never hit these paths). Added the import; removed redundant explicit `AuditService` logging (Auditable model hook already records create/update/delete with before/after snapshots, so double-logging was noise); set deterministic `APP_KEY` in the A-owned `BootsIdentityBilling` trait so the webhook `encrypted` cast works in a fresh checkout (no `.env`); broadened the test suite 13 → 28 covering over-scope 422, hash-only-at-rest, lookup-by-plaintext, sliding-window sustained + burst, global-floor clamp, retry-budget 422, and the two bug-triggering paths. 61 passing, 0 failing (full suite). Merged to main as 604496d. |
| T-A-07 | 🚀 in progress | track-a/T-A-07-user-model-v2 | User model v2: 11 type enum, status (active/suspended/deactivated), provenance (self/admin), pending_identity fields. AuthService: register per type (type-specific onboarding), login (timing-safe, 423 lockout), suspended 403, deactivated 403, one-phone-one-active 409, email/phone change (pending identity + re-verification). Identity\AuthController + routes on api_identity.php. PAT moved to identity_billing/. 14 new tests; 88 total passing. |
| T-A-08…T-A-23, T-A-25 | ⛔ blocked (T-A-08 deps: T-A-07) | — | Every remaining task depends transitively on T-A-07. **Unblocking task ID: T-A-07 (push + orchestrator merge).** |

## Gate 1 (Phase 0 complete)

**GATE 1 passed** — 2026-09-27: T-A-05 merged to main (4ad28ae) after T-A-06
(0d54b58). All six Phase 0 tasks (T-A-01…T-A-06) + T-A-24 are on main; tracks
B/C/D are unblocked to start. Their pre-flight blockers
(`track-b/status-pre-flight-blocked` / `track-c/pre-flight-status`) can be
closed: the "missing" artifacts — BaseDomainModel, envelope, RBAC middleware,
events bus — all exist on main now. Track A continues with T-A-07 (User
model v2 + AuthService), the first Phase-1 task.