Un-stale Tasks 3-7 of the Martyrology OIDC plan - #25

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@auth/handoffs/liturgicalcalendar.md`:
- Around line 41-43: Update the warning in the handoff text to say that checking
deleter or test_definition is invalid only against the current/latest model.
Preserve the surrounding history and the statement that existing pinned
consumers remain unaffected.

In `@docs/superpowers/plans/2026-08-03-martyrology-oidc-login-client.md`:
- Around line 398-429: Rename the heading “Tasks 3-7: local verification now
runs against the local stack” to indicate only Tasks 3, 5, 6, and 7 are
affected, such as “Tasks 3, 5-7: local verification now runs against the local
stack.” Leave the clarification bullets unchanged.
- Line 1637: Update the “Placeholder scan” statement to classify AUTH_ZITADEL_ID
as a runtime value rather than a runtime secret, while continuing to identify
AUTH_ZITADEL_SECRET and AUTH_SECRET as secrets.
- Around line 775-778: Update the test instructions around the imported module
to explicitly name the exact required AUTH_* environment variables, resolving
the mismatch between “four” and the five variables listed in the local-stack
setup: AUTH_ZITADEL_ISSUER, AUTH_ZITADEL_ID, AUTH_ZITADEL_SECRET, AUTH_SECRET,
and AUTH_URL. Correct the stated count if all five are required.
- Around line 832-842: Update the local-stack instructions around “docker
compose stop martyrology-frontend” to provide the correct working directory or
explicit Compose file defining that service. Use the repository’s actual
local-stack configuration, or remove this stop command if the stack no longer
includes martyrology-frontend.

In `@docs/superpowers/plans/2026-08-04-openfga-1182-upgrade.md`:
- Around line 371-385: Update Step 4’s data probes to issue an authorization
Check against the LiturgicalCalendar store as well as Martyrology. Add the
known-good LitCal tuple and verify its expected allowed decision, while
preserving the existing model-ID validation and Martyrology Check.
- Around line 70-83: Update the Step 4 Playground verification command to
guarantee termination in both startup-success and startup-failure cases, using
either a bounded detached health check with explicit container cleanup or a
timeout that cleans up the container afterward. Preserve the existing
preshared-auth and Playground environment settings and continue capturing enough
startup output to verify the expected error behavior.
- Around line 209-215: Update the migration steps in both the local verification
section and the production task to wait for openfga-migrate to finish before
starting openfga. Replace detached migration startup with exit-code-aware
execution or explicitly wait for and validate the one-shot container exits with
code 0, then run docker compose up -d openfga.
- Around line 161-167: Update Step 5’s pytest command so host tests are not used
when container tests fail: only fall back to the repository’s documented host
invocation when the API container is unavailable, while preserving a failing
status for container test failures. Keep a single canonical test-environment
path and retain the expected-pass instruction.

In `@docs/superpowers/plans/2026-08-04-openfga-model-ownership.md`:
- Around line 355-370: Update Step 10 to recreate the throwaway store’s
out-of-band state after the guard implementation, either by resetting the store
or re-uploading the Step 3 out-of-band model before running the dangerous
command. Ensure the verification then exercises the no-lock refusal branch and
asserts that the latest model ID remains unchanged.
- Around line 422-455: Update Task 3 Step 1 to fetch each deployed model’s full
content, normalize it using the same normalization as the lock-validation guard,
and compare it with the corresponding committed model file before creating
locks. Stop and report a mismatch instead of writing a lock when IDs or
normalized contents differ; only generate the lock files after both production
models match their repository definitions.
- Around line 341-345: Fix the documentation lint issues in the affected
Markdown sections: add an appropriate language identifier to the fence
containing --force-model-upload, mark the non-code fence with no-code, remove
spacing inside the nested code span, and change the relevant terminology to
end-to-end. Preserve the surrounding documentation content.
- Around line 766-781: Update the Step 2 verification script so a lock/live
model mismatch sets a failure flag instead of relying on the `&& ... || ...`
expression’s exit status. Initialize the flag before the `for` loop, set it when
printing `MISMATCH`, and exit non-zero after the loop if any mismatch occurred;
preserve the existing `OK` output and comparison behavior.
- Around line 136-143: Bind each throwaway OpenFGA Docker port to loopback by
updating the published mappings at
docs/superpowers/plans/2026-08-04-openfga-model-ownership.md lines 136-143,
docs/superpowers/plans/2026-08-04-openfga-1182-upgrade.md lines 58-65, and
docs/superpowers/plans/2026-08-04-openfga-1182-upgrade.md lines 74-80 to use
127.0.0.1 before the host ports, preserving the existing port numbers and
container port.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/superpowers/plans/2026-08-04-openfga-1182-upgrade.md`:
- Around line 370-375: Update the production migration validation around
MIGRATE_EXIT and the openfga-migrate logs to assert that the migration completed
successfully without applying changes before starting OpenFGA. Check the
captured docker compose log output for the expected no-op indicator, or compare
migration state before and after, and fail with a clear error if changes were
applied.
- Around line 230-232: Update both detached migration completion paths at
docs/superpowers/plans/2026-08-04-openfga-1182-upgrade.md lines 230-232 and
370-372 to use a reliable exited-container lookup before docker wait, such as
docker compose ps -q --status=exited or docker compose ps -a --status=exited, or
replace the flow with up --exit-code-from openfga-migrate; apply the same
approach to both local and production migration checks.

In `@docs/superpowers/plans/2026-08-04-openfga-model-ownership.md`:
- Around line 357-371: The Step 3 scenario is mislabeled as adoption and does
not validate that the out-of-band upload succeeded. Rename the relevant
description and assertion labels to “no-lock refusal branch,” and update the
upload commands to use curl’s HTTP-failure behavior plus validation that
OOB_MODEL is non-empty and not null before proceeding.
- Around line 475-486: Update the verification loop around the deployed model
response so it extracts both the model ID and normalized content from the same
response, rather than discarding the ID. Compare the extracted ID with the
expected ID from Step 1, and only report the model as safe and permit Step 3 to
write that verified ID when both the ID and content match; otherwise report a
mismatch and do not lock.
- Around line 819-830: The verification loop must reject missing lock fields and
failed API responses instead of allowing null values to compare equal. Update
the jq lookups in the LiturgicalCalendar/Martyrology loop to use jq -er with //
empty, add curl --fail-with-body to the live-model request, and mark any empty
store, model, or live value as a verification failure before comparing IDs.