Close the last ~15% — SuperTokens parity (execution log)

Started: 2026-07-28
Order: Batch A → B → C → D (approved “Full last 15%”)

Batch A — Trust (security locks live)

Item	Status
C1–C5 code (FDI key lock, magic-link allowlist, MFA challenge, rate limit, project admin)	Local + unit tests
Deploy to France `api` (+ web) via `safe-redeploy-service.sh`	Done 2026-07-28
Live probe: unauth `POST …/fdi/signinup/code`	PASS — HTTP 401 `project_required`
Live probe: project header without key	PASS — HTTP 401 `auth_key_required`
Re-prove 2026-07-29 (+ bad key + valid key)	PASS — see `AUTH-HARDEN-TEST-EVIDENCE-2026-07-29.md`

Batch B — Login completeness

Item	Status
Passkeys hosted UI → FDI webauthn (not auth-tenant 410)	Code done + web redeployed
Passkey engine client helpers + scaffold	Code done
Live Mavi enroll→sign-in retest	Human (Mavi already on FDI + key)
SMS	Ops-blocked — product honest (Twilio From + secrets). See `SMS-TWILIO-LIVE-PROVE.md`. Matrix stays P until live prove or flndrn marks N/A.

Batch C — Depth

Item	Status
IdP service E2E (`apps/api/scripts/idp-e2e-proof.mjs`)	Run after deploy
IdP browser consent path	Still recommended human
Migration foreign bcrypt/argon2 verify + upgrade to scrypt	Code done

Batch D — DX + claim

Item	Status
Framework pack: Next gold + passkey scaffold	Done
Captcha on passwordless create when Turnstile secret set	Code done
Captcha EP signup/signin when secret set	Already done
Explicit N/A list	Below — needs flndrn OK to claim 100%

Proposed N/A (won’t match SuperTokens 1:1)

Approve to clear the matrix:

SuperTokens Core Docker — already N/A (briven-engine on Doltgres).
Every framework SDK (Vue/Svelte/etc.) — Next + Express + Hono + vanilla scaffolds only unless a real project needs more.
SMS OTP — optional N/A until Twilio compliance ready (or keep P and prove later).
ST bulk-import job queue (list/delete jobs) — single batch POST max 500 is enough for v1.

Claim rule

100% SuperTokens only when every matrix row is Y or N/A (approved).