## 1. Planning and contracts

- [x] 1.1 Add typed durable auth-session and Run-session contracts, repository interfaces, validation rules, and safe DTO projections.
- [x] 1.2 Document the auth/authorization matrix, signed envelope, replay/clock constraints, secret-ref boundary, and deferred production risks.

## 2. Durable authentication and Run trust

- [x] 2.1 Persist hashed user sessions with expiry, revocation, rotation, and reload support in MemoryStore/FileStore/MySQLStore.
- [x] 2.2 Persist Run session state and enforce bounded lifecycle plus signed timestamp/nonce validation at HTTP channel boundaries.
- [x] 2.3 Add login/session-rotation/revocation routes and safe 401/403 error behavior.

## 3. Authorization and secret boundary

- [x] 3.1 Enforce platform-admin, owner/administrator, and Run-service authorization on sensitive routes and repeat checks in services.
- [x] 3.2 Persist component-key/distribution/secret metadata through all durable snapshots without raw secret disclosure.
- [x] 3.3 Add API and service regressions for cross-owner access, expired/revoked credentials, replay, and non-disclosure.

## 4. Web and verification

- [x] 4.1 Update platform_web API/session handling for 401/403 and capability-safe projections with no secret literals.
- [x] 4.2 Add frontend regressions for session reset/denied access and secret/path/socket non-disclosure.
- [x] 4.3 Run platform, plugin, web, OpenSpec strict validation, structure checks, and risk-relevant independent Run tests; record evidence and leave later roadmap work explicitly deferred.