Auth0 → OpenIddict Migration¶
This directory is a temporary planning space for the Auth0 → OpenIddict migration work. Delete these planning docs after the migration completes.
Epic issue: #2418
Structure¶
- strategy.md — Current 5-phase plan (revised after Phase 1 shipped). The source of truth for phase scope and sequencing, except Phase 5, which is governed by M005-ROADMAP.md and M005-CONTEXT.md.
- actions-openiddict-mapping.md — Defines the evidence-backed native Identity/OpenIddict behaviour-parity gate that must close before non-production rehearsal.
- phases/ — Per-phase execution artefacts (context, roadmap, slices, summaries). These come from the milestones tracked during implementation.
- _archive/ — Superseded plans preserved for reference (e.g. the original BFF-only strategy that predates the "BFF + Auth0 first" revision).
Phase status¶
| Phase | Title | Status | Execution detail |
|---|---|---|---|
| 1 | BFF Infrastructure | Shipped (PR #2416) | — |
| 2 | Identity Service Readiness | Shipped | phases/02-identity-service-readiness/ |
| 3 | Parallel Authentication | Shipped | phases/03-parallel-authentication/ |
| 4 | User Migration | Shipped | phases/04-user-migration/ |
| 5 | Cutover + Decommission | Planned | phases/05-cutover-decommission/ |
Phase numbering follows strategy.md. Phase 1 is documented via PR #2416 and does not have a separate phase directory.
“Shipped” in this table means the phase's application/tooling PRs merged. It does not mean that real users were migrated, browser/API traffic was switched, or Auth0 was changed or retired. Those live operations remain governed by Phase 5 approvals and gates.
Mandatory pre-rehearsal gate¶
The current code contains the native Identity foundations, but it has not yet closed all Auth0-domain behaviour gaps. Before any isolated preview/staging rehearsal, the focused implementation PRs and acceptance matrix in actions-openiddict-mapping.md had to be merged and green. As of 2026-09-15 they are merged — twelve auth PRs landed that day, in merge order #3219, #3220, #3215, #3229, #3216, #3233, #3214, #3222, #3237, #2928,
2932 and #3221 — and the R17 code clauses are closed (see¶
M005-VALIDATION.md). The remaining gate is live/environment evidence, not code; nothing has been deployed. The requirements were, in particular: stable Investigator mapping, conflict handling, email verification policy, safe external linking, profile completion and migration field preservation are prerequisites rather than rehearsal discoveries.
Why this lives under docs/planning/¶
Per the project documentation framework, temporary planning documents go in docs/planning/. These docs will be deleted or archived once the migration is complete and the production system is fully on OpenIddict.
The per-phase execution artefacts under phases/ were previously tracked in .gsd/milestones/M001-M005/. They are moved here so they live alongside the strategy document and are discoverable through the docs site.