Mark M1 done in AGENTS.md/CLAUDE.md

[stephane-segning]

Summary

• AGENTS.md (CLAUDE.md symlinks to it) — status line for Milestone 1 changed from "in progress" to "done," and the stale "M1 is still open: Service-account provisioning (provisionAppClient) #23, RBAC layers 1 and 2 #24, Gate: a persisted client_credentials client gets a token #25" line replaced with a writeup of what each of those three PRs actually built.

Intent

#23/#24/#25 merged as #111/#112/#113, closing epic #18 (M1 — sms-auth). The project-context doc every session reads first still said M1 was open and named those three issues as outstanding, which would mislead the next session into re-scoping already-finished work. Source of truth: #111, #112, #113, and epic #18 (all closed).

Scope

Documentation only, one file. Adds three paragraphs matching the file's existing density (specific file/line references, what was found and how, not just what shipped):

• #23: the schema's own ProvisionClientResult.clientSecret and the issue's own text both predated the private_key_jwt-only decision and still described a shared-secret flow — caught by cross-checking sms-auth/src/lib.rs's existing client_secret_hash: None hardcode before any implementation started. Documents the resolution (server-generated RSA keypair, private key returned once, only the public JWK persisted) and what was explicitly cut (retirement/overlap-window rotation).
• #24: Layer 1 regression tests, the new Layer 2 primitive (require_permission), and the provider:write -> provider:update permission-literal bug Lightbridge's review caught before merge (the literal matched nothing in §5.2's actual vocabulary).
• #25: the two-genuinely-separate-OS-processes acceptance gate, and the one documented, reasoned deviation from the issue's literal wording (provisioning via direct procedure call rather than HTTP, since no real token in this deployment can carry the owner/admin role provisionAppClient requires).

Verification

Documentation-only change — no code paths affected.

• Confirmed Implement provisionAppClient (#23) #111/RBAC layer 2: permission/scope enforcement (#24) #112/M1 acceptance gate: persisted client_credentials client gets a token (#25) #113 are all merged into main and epic Epic: M1 — sms-auth: OIDC, service accounts, RBAC #18 is closed before writing "M1 closed" (gh issue view / gh pr view against the live repo, not assumed).
• Rebased cleanly onto current main (AGENTS.md untouched by any intervening commit), no conflicts.

Screenshots/Evidence

N/A — prose-only documentation change, no UI surface.

Risk Assessment

None. Doc-only, additive, no code or schema touched.

AI Usage Declaration

This PR was written by Claude Code (Claude Sonnet 5) under my direction, summarizing work from the same session that implemented and landed #111/#112/#113 (which I reviewed and merged myself).

• I reviewed the added text against the actual merged PRs it describes.
• The specific claims here (the client-secret/JWK conflict, the provider:write/provider:update bug, the two-process gate) were independently verified during the session that authored them, not taken from PR descriptions alone.
• I take responsibility for this being an accurate account of what M1 shipped and why.

Reviewer Focus

Whether the M1 writeup is pitched at the right level of detail for this file's existing style — dense enough to be useful, not so long it drowns the next section.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 577de59

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR