# Complete - m-principal-provider-credential-slot-routing/03+01,02_projection_auth

## Completion Date

2026-08-01

## Summary

Completed the dormant principal-projection and managed ingress-auth foundation after one superseded pre-implementation scaffold and one implementation review; final verdict: PASS.

## Loop History

| Plan | Review | Verdict | Notes |
|------|--------|---------|-------|
| `plan_cloud_G10_0.log` | `code_review_cloud_G10_0.log` | SUPERSEDED | Archived before implementation because the original design attempted to activate authorization over the unauthenticated plain Control Plane-Edge transport. |
| `plan_cloud_G09_1.log` | `code_review_cloud_G09_1.log` | PASS | Verified durable secret-free generations, the bounded immutable Edge cache, dormant managed OpenAI/Anthropic auth, and the absence of production transport activation. |

## Implementation and Cleanup

- Added additive secret-free principal projection protobuf values and deterministic Control Plane snapshot construction with durable mutation generations, expiry, filtering, and hard entry/wire-size bounds.
- Added a transport-neutral Edge cache with deep-copy normalization, atomic higher-generation swaps, constant-time digest lookup, race-safe reads, and persistent managed fail-closed behavior after expiry or revocation.
- Added shared dormant managed authentication for OpenAI bearer and Anthropic bearer/`X-Api-Key` requests while preserving the existing unmanaged static configuration behavior.
- Kept the current Control Plane-Edge parser, server, connector, and runtime free of projection listeners, pushes, or cache-writer wiring; contracts describe the new types as reserved until authenticated confidential transport exists.

## Final Verification

- `make proto && make proto-dart` - PASS; Go and Dart protobuf outputs regenerated without drift.
- `go vet ./apps/control-plane/internal/credentialstore ./apps/edge/internal/authprojection ./apps/edge/internal/input ./apps/edge/internal/openai` with workspace Go cache paths - PASS; no findings.
- `go test -count=1 -race ./apps/control-plane/internal/credentialstore ./apps/edge/internal/authprojection ./apps/edge/internal/input ./apps/edge/internal/openai` with workspace Go cache paths - PASS; all four packages passed under the race detector.
- `make client-test && cd apps/client && flutter analyze` - PASS; 42 Flutter tests passed and analysis reported no issues.
- `make test-openai-ollama` with workspace temporary/cache paths - PASS; the deterministic real-process OpenAI-compatible smoke completed successfully.
- `make test-control-plane-edge-wire` with workspace temporary/cache paths - PASS; real Control Plane and Edge processes completed hello, connection, and disconnect without activating projection delivery.
- `if rg --sort path -n 'PrincipalProjection' apps/control-plane/internal/wire/edge_server.go apps/edge/internal/controlplane/connector.go apps/edge/internal/bootstrap/runtime.go; then exit 1; else exit 0; fi` - PASS; no dormant projection activation reference was found.
- `git diff --check` and `gofmt -d` over the affected Go files - PASS; no whitespace or formatting drift.

## Remaining Nits

- None

## Follow-up Work

- Authenticated confidential `secure-transport` rollout must activate delivery before the roadmap `auth-projection` and `surface-auth` Tasks can be completed; this foundation packet intentionally carries no Roadmap Completion claim.
