Changeset 0.24.3 (#159)

docs/DESIGN-0.24.0.md

@@ -663,7 +663,7 @@ separate table. This avoids a join-heavy permission resolution
 path and keeps the grant model simple.
 
 ```sql
--- 019_v024_permissions.sql
+-- 020_permissions.sql
 
 ALTER TABLE groups
     ADD COLUMN IF NOT EXISTS permissions JSONB NOT NULL DEFAULT '[]'::jsonb;
@@ -895,10 +895,10 @@ type SessionParticipant struct {
 }
 ```
 
-### Migration 020
+### Migration 021
 
 ```sql
--- 020_v024_sessions.sql
+-- 021_sessions.sql
 
 CREATE TABLE IF NOT EXISTS session_participants (
     id            TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
@@ -1054,7 +1054,7 @@ session participant activity attributed to the session identity:
 
 ### What Ships
 
-- Migration 020 (session_participants table)
+- Migration 021 (session_participants table, channels.allow_anonymous)
 - `server/auth/session.go` (session creation/resume)
 - `middleware/session_auth.go` (AuthOrSession)
 - Session-scoped message and completion handlers
@@ -1092,11 +1092,12 @@ Each subversion is independently testable:
 
 ```
 018_v024_auth.sql          — users.handle, auth_source, external_id
-019_v024_permissions.sql   — groups.permissions, token_budget, allowed_models
-020_v024_sessions.sql      — session_participants table
+019_v024_oidc.sql          — oidc_auth_state, groups.source
+020_permissions.sql        — groups.permissions, token_budget, allowed_models, Everyone group
+021_sessions.sql           — session_participants table, channels.allow_anonymous
 ```
 
-All three are additive (new columns, new tables). No destructive
+All four are additive (new columns, new tables). No destructive
 changes. Can be applied sequentially as each subversion merges.
 SQLite equivalents for each.
 

docs/ROADMAP.md

@@ -119,13 +119,13 @@ v0.23.1 Multi-User Navigation + Conversation Taxonomy      ✅
           │
 v0.23.2 Multi-User Polish + Channel Lifecycle              ✅
           │
-v0.24.0 Auth Abstraction + User Identity                   ← active
+v0.24.0 Auth Abstraction + User Identity                   ✅
           │
-          ├── v0.24.1 mTLS + OIDC Providers (parallel)
+          ├── v0.24.1 mTLS + OIDC Providers (parallel)     ✅ 
           │       │
-          │       └── v0.24.3 Anonymous Sessions
+          │       └── v0.24.3 Anonymous Sessions           ✅ 
           │
-          └── v0.24.2 Fine-Grained Permissions (parallel)
+          └── v0.24.2 Fine-Grained Permissions (parallel)  ✅
           │
   ┌───────┴──────────────┐
   │                      │
@@ -1450,14 +1450,14 @@ prerequisite for v0.25.0 (Workflow Engine).
 Depends on: mTLS provider (v0.24.1) for cert-based anonymous identity.
 See [DESIGN-0.24.0.md](DESIGN-0.24.0.md) §v0.24.3 for full spec.
 
-- [ ] `session_participants` table (channel-scoped, ephemeral token)
-- [ ] Session JWT: `SessionClaims{SessionID, ChannelID}` — distinct from user JWT
-- [ ] `SessionOrAuth()` middleware: accepts either JWT type
-- [ ] Capability scoping: session participants limited to their bound channel
-- [ ] mTLS anonymous path: cert fingerprint as stable session identity
-- [ ] `channels.allow_anonymous` flag
-- [ ] Session display in participant list (team members see visitor identity)
-- [ ] Migration 021: `session_participants` table, `allow_anonymous` column
+- [x] `session_participants` table (channel-scoped, ephemeral token)
+- [x] `AuthOrSession()` middleware: tries JWT first, falls back to session cookie (cookie-based, no separate session JWT needed)
+- [x] Capability scoping: session participants limited to their bound channel
+- [x] mTLS anonymous path: cert fingerprint as stable session identity
+- [x] `channels.allow_anonymous` flag
+- [x] Session added as channel participant (`participant_type=session`, `role=visitor`)
+- [x] Workflow entry page: `GET /w/:id` (Go template, standalone chat UI)
+- [x] Migration 021: `session_participants` table, `allow_anonymous` column
 
 ---