From f68349d94dbaa13bc32b69f5bc25a597ab3da651 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Wed, 19 Aug 2026 23:17:31 +0000
Subject: [PATCH] =?UTF-8?q?docs(ship):=20P4=20complete=20=E2=86=92=20v1.27?=
 =?UTF-8?q?.4=20(v1.28=20token-vend-pat,=20highest-risk=20phase)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---ci---
project: acdl
phase: 4
milestone: v1.28
status: complete
---/ci---
---
 .ciagent/CHECKPOINT.json | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json
index 47355ea..d597301 100644
--- a/.ciagent/CHECKPOINT.json
+++ b/.ciagent/CHECKPOINT.json
@@ -1,19 +1,20 @@
 {
-  "phase": 3,
+  "phase": 4,
   "stage": "complete",
   "milestone": "v1.28",
   "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-08-19T22:30:00Z",
+  "updated_at": "2026-08-19T23:15:00Z",
   "project": "acdl",
   "projects": ["acdl", "nova-blockchain-exchange"],
   "active_milestone": "v1.28",
   "milestone_branch": "milestone/v1.28-cli-identity",
-  "phase_branch": "phase/03-idp-auth",
+  "phase_branch": "phase/04-token-vend-pat",
   "tag_line": "v1.27.x",
-  "phase_name": "idp-auth",
-  "reqs_covered": ["REQ-333", "REQ-334", "REQ-335"],
-  "caps_verified": ["CAP-036"],
-  "tests": {"p3_specific": 22, "total_passing": 944, "failures": 0},
-  "notes": "v1.28 P3 SHIP. idp-auth complete. Tag v1.27.3. Merged phase/03 -> milestone/v1.28-cli-identity. 3 REQs covered (REQ-333..335), CAP-036 verified. nova-idp-auth Lambda (sign-up/sign-in/session), Argon2id t=3 m=65536 p=1 fail-closed, 4 DDB tables. Next: P4 token-vend-pat (highest-risk, double-length)."
+  "phase_name": "token-vend-pat",
+  "reqs_covered": ["REQ-336", "REQ-337", "REQ-338", "REQ-339", "REQ-340", "REQ-341", "REQ-342", "REQ-343", "REQ-344"],
+  "caps_verified": ["CAP-037", "CAP-038"],
+  "tests": {"p4_specific": 54, "total_passing": 998, "failures": 0},
+  "grill_conditions_resolved": ["C-6.1/C-7.1 ABAC fail-closed", "C-5.1 requested_claims shape", "C-7.3 cred file no raw PAT", "C-8.2 kj pinned", "C-2.1 P5 folded into P4 W8"],
+  "notes": "v1.28 P4 SHIP. token-vend-pat complete (highest-risk, double-length, 8 waves). Tag v1.27.4. 9 REQs covered (REQ-336..344 + REQ-340/341 folded), CAP-037 + CAP-038 verified. ABAC fail-closed (7 tests), KMS ES256 DER->raw, JWKS, PAT lifecycle, nova auth, nova idp setup. 54 P4 tests + 998 total. Next: P5 docs-integration."
 }
\ No newline at end of file