You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Record where Fizzy stands against our OAuth rubric - #3193
Adds docs/oauth.md: where this repo stands against our OAuth design and conformance rubric (bc3 doc/oauth/rubric.md, basecamp/bc3#13882), by check id.
It maps the OAuth train (#2296 → … → #3169, #3192, plus #3158 and #3191) to the rubric and lists what's still missing: audience and account binding, token exchange, DPoP, CIMD, PAR, audit events, metrics, and in-place PAT migration. Hashing tokens at rest is #3192, step 1 of 3; storing plaintext was an oversight.
The rubric is one bar that apps meet to different degrees over time. New builds start at it. Existing apps migrate carefully and may lag a long time; a ✗ there is recorded migration debt.
Docs only. It follows the rubric as basecamp/bc3#13882 evolves.
jeremy
changed the title
Record OAuth status against the 37signals OAuth Standard
Record where Fizzy stands against our OAuth rubric
Oct 15, 2026
Documents Fizzy’s progress against the shared OAuth rubric, connecting the pending implementation train to remaining migration work.
Changes:
Maps rubric checks to implementation status and related PRs.
Records remaining gaps and the planned order of work.
Clarifies compatibility expectations for existing clients.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
File
Description
docs/oauth.md
Adds OAuth status mapping and migration priorities.
Correct integration docs to exclude pending #3192 migrations
docs/oauth.md:14
The integration branch's docs/oauth/integration-migrations.md lists the train through #3169, plus #3158 and #3191, but not #3192 or its digest migrations. Saying the entire train “is integrated” therefore overstates the beta snapshot. Distinguish the integrated stack from #3192's pending integration and migration-inventory update.
Review threads: 3 resolved (3 fixed, 0 declined with the reasoning in each thread).
Review bodies: the Copilot and Codex review bodies repeat the threads; there were no separate findings.
Not reported on the head: Copilot and Codex re-requested on 32229df
bc3's doc was renamed and reworded from a standard of requirements to a
design and conformance rubric. This file follows: the new path, and the
bar and its checks in place of the standard and its requirements. The
check ids are unchanged.
Rebased onto current main, plus a status update: GP-7 (optional state, #2296), TK-1 (fizzy_cs_, 257-bit bodies, #3163), SC-5 (no-store and no-referrer on every OAuth response, #3082) and SC-6 (log filtering, #2296). Head 3becdc6.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jeremy
changed the title
Adds
docs/oauth.md: where this repo stands against our OAuth design and conformance rubric (bc3doc/oauth/rubric.md, basecamp/bc3#13882), by check id.It maps the OAuth train (#2296 → … → #3169, #3192, plus #3158 and #3191) to the rubric and lists what's still missing: audience and account binding, token exchange, DPoP, CIMD, PAR, audit events, metrics, and in-place PAT migration. Hashing tokens at rest is #3192, step 1 of 3; storing plaintext was an oversight.
The rubric is one bar that apps meet to different degrees over time. New builds start at it. Existing apps migrate carefully and may lag a long time; a ✗ there is recorded migration debt.
Docs only. It follows the rubric as basecamp/bc3#13882 evolves.