docs(easycla-ss): P10 — confirm EasyCLA has no NATS transit pre-M6

[mlehotskylf]

Updates P10 in docs/easycla-ss-migration/architecture-proposal.md to record Eric Searcy's confirmation (2026-07-30) that EasyCLA has no NATS transit pre-M6, replacing the stale "pending confirmation from Eric" parenthetical.

Why

P10 (trust-SS "My CLAs" identity read + azp allow-list) hinged on one open dependency: whether EasyCLA could reach NATS pre-M6. If it could, "same data, less machinery" would argue for EasyCLA calling lfx.auth-service.user_identity.list directly and skipping both the SS payload bridge and the azp mechanism.

Eric confirmed it cannot, and not merely for IP-reachability reasons:

• the RPC is a request/reply (inbox) subject, so EasyCLA would have to be a cluster consumer for the reply;
• EasyCLA (us-east-1) ↔ v2 k8s cluster (us-west-2) is a cross-region WAN link — you don't run inbox consumers over WAN;
• a federated NATS super-cluster with gateways is overkill.

So the SS payload bridge + azp mechanism is the right pre-M6 design; EasyCLA calling the RPC directly is deferred to M6.

Scope

Docs-only change: adds the EasyCLA → Self Serve M1 spec/architecture docs (docs/easycla-ss-migration/, specs/001-easycla-ss-integration-fable/m1-my-cla/) and the P10 rationale update. No behavioral/code change.

Supersedes #5130, which incorrectly targeted the stale spec/easycla-ss-m1 base branch and pulled in unrelated commits.

Decision: linuxfoundation/lfx-self-serve#1216 · Follow-ups: linuxfoundation/lfx-self-serve#1224 (EasyCLA) / linuxfoundation/lfx-self-serve#1225 (SS)

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

The PR adds migration architecture and authorization documentation for moving EasyCLA user-facing functionality into LFX Self Serve, plus Milestone 1 specifications for a read-only “My CLAs” experience, including API contracts, research, task planning, mockups, and validation instructions.

Changes

EasyCLA Self Serve migration

Layer / File(s)	Summary
Migration architecture and cutover plan docs/easycla-ss-migration/README.md, docs/easycla-ss-migration/architecture-proposal.md	Defines migration scope, milestones, integration boundaries, identity trust handling, cutover decisions, and documented risks.
Authorization feasibility and dev spikes docs/easycla-ss-migration/role-mapping-feasibility.md, docs/easycla-ss-migration/spike-runbook.md	Documents gateway and EasyCLA v4 authorization behavior, Self Serve token requirements, endpoint enforcement differences, and dev validation steps.
My CLAs contracts and implementation plan specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/*, specs/001-easycla-ss-integration-fable/m1-my-cla/research.md, specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md	Specifies authenticated listing and PDF URL APIs, identity resolution, authorization, status mapping, UI integration, testing, and milestone execution tasks.
My CLAs mockups and quickstart specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/*, specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md	Adds populated and empty-state HTML mockups plus local execution, acceptance verification, and direct API-call instructions.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• linuxfoundation/easycla#5123: Adds or modifies overlapping migration architecture and Milestone 1 specification artifacts.
• linuxfoundation/easycla#5124: Aligns the same migration documentation and My CLAs contracts.
• linuxfoundation/easycla#5126: Implements upstream identity resolution and project display data referenced by these specifications.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main doc update: confirming EasyCLA has no NATS transit before M6.
Description check	✅ Passed	The description is directly related to the documentation updates and the P10 NATS transit decision.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/p10-nats-transit-confirmed

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds M1 Self Serve migration specifications and records that EasyCLA cannot use NATS before M6.

Changes:

• Documents M1 architecture, tasks, contracts, and UI mockups.
• Adds authorization feasibility and spike guidance.
• Confirms the transitional SS payload bridge and azp trust model.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
tasks.md	Defines M1 implementation tasks.
research.md	Records M1 technical decisions.
quickstart.md	Provides validation instructions.
mockups/README.md	Describes UI mockups.
my-clas-populated.html	Shows populated CLA view.
my-clas-empty-state.html	Shows empty CLA view.
upstream-easycla-api.md	Documents EasyCLA APIs.
ss-me-clas-api.md	Defines Self Serve API contract.
spike-runbook.md	Documents authentication spikes.
role-mapping-feasibility.md	Analyzes authorization integration.
README.md	Indexes architecture materials.
architecture-proposal.md	Records P10 NATS decision.

Comments suppressed due to low confidence (2)

specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md:42

• These direct calls exercise the superseded username/signature APIs rather than the merged M1 contract. Update the verification flow to call /v4/my-clas and /v4/my-clas/{signatureID}/pdf with the same complete session-derived identity parameters that SS forwards; otherwise this quickstart does not validate the implementation being shipped.

# identity
curl -H "Authorization: Bearer $TOK" "$GW/cla-service/v3/users/username/<lf-username>"
# agreements
curl -H "Authorization: Bearer $TOK" "$GW/cla-service/v4/signatures/user/<userID>"
# pdf url
curl -H "Authorization: Bearer $TOK" "$GW/cla-service/v4/signatures/<signatureID>/signed-document"

specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md:26

• The acceptance check compares against the superseded per-user endpoint. Since M1 now uses the consolidated API, the expected list should be compared with /v4/my-clas using the same session-derived identity parameters; otherwise the check bypasses EasyCLA's aggregation and validity logic.

| US1-AS1: ICLAs listed + PDF works | Click Download PDF → browser gets S3 URL, file opens; compare list against `GET /v4/signatures/user/{userID}` called directly with a dev token |

[coderabbitai]

Actionable comments posted: 10

🧹 Nitpick comments (1)

specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md (1)

66-66: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Base classification tests on the authoritative claType field.

Research says claType is authoritative and the legacy cclaCompanyID rule is fallback, but T013 specifies only the old rule. Add explicit icla, ecla, and ccla cases plus fallback coverage.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md` at line 66, Update
the T013 unit-test task description to make claType the authoritative
classification field, adding explicit icla, ecla, and ccla cases and coverage
for the legacy cclaCompanyID fallback when claType is unavailable. Preserve the
existing classification, status, merge, filtering, and sorting test
requirements.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/easycla-ss-migration/spike-runbook.md`:
- Line 41: Update the refresh-token instructions in the runbook to prohibit
retrieving tokens from debug logs, and recommend only controlled session-store
access or the authorization-code+PKCE flow. State that logs must redact tokens
and that any test tokens used for the spike must be revoked or rotated
afterward.
- Line 36: Update the JWT inspection command in the runbook to decode the
payload with a base64url-safe decoder instead of plain base64. Also make the
TOKEN fetch fail closed by validating that the exchange succeeds and returns a
non-empty token before proceeding to claim inspection.

In
`@specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md`:
- Line 39: Update the GitHub-link CTA contract in the identity resolution
documentation to use the implemented user-facing route `/profile/identities`
instead of `/social/callback`, and keep the surrounding return and re-fetch
behavior unchanged.
- Around line 51-53: Choose and document one feature-flag enforcement model
across all three sites: either revise the API contract to specify Angular-only
gating or require server-side route gating. Update research.md to describe the
same behavior, and align T015/T018 in tasks.md with the selected model,
including the corresponding route-test expectations.

In
`@specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md`:
- Line 1: The M1 documentation uses conflicting EasyCLA identity-resolution and
authorization contracts; establish one authoritative endpoint and flow. In
specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md:1,
rewrite the contract for the current endpoints or explicitly mark old sections
legacy; in docs/easycla-ss-migration/architecture-proposal.md:94, state whether
P10 is the M1 contract or a later transition; update R2 in
specs/001-easycla-ss-integration-fable/m1-my-cla/research.md:17-30, scope
T007–T010a in specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md:43-47,
revise the userID read-path analysis in
docs/easycla-ss-migration/role-mapping-feasibility.md:112-118, target the
authoritative endpoint in docs/easycla-ss-migration/spike-runbook.md:61-68, and
align acceptance checks and direct calls in
specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md:26-42.

In
`@specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/my-clas-populated.html`:
- Around line 144-199: Reorder the sample rows in the populated CLA table so
their signed dates follow the documented signedOn descending order, placing the
2024 CDM entry before the 2023 FDC3 entry and continuing in descending order for
all rows. Update the row ordering around the table’s project entries without
changing their displayed content.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md`:
- Around line 5-20: Update the quickstart configuration prerequisites to remove
CLA_SERVICE_BASE_URL and document API_GW_AUDIENCE instead, using the implemented
authentication/API gateway configuration. In the Run steps, replace the /me/clas
URL and “Me lens” reference with the Profile-tab route profile/clas, while
preserving the existing expected CLA results.
- Around line 34-42: Define or source the GW shell variable before the “Useful
direct calls (dev, with token)” curl snippets in quickstart.md, using the
appropriate development gateway value so $GW expands to a valid host when the
examples are copied.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md`:
- Around line 26-33: Keep the M1 release checkpoint blocked until T001 and T002
are completed with deployed-dev token and role-less-user results recorded in
research.md R3; in specs/001-easycla-ss-integration-fable/m1-my-cla/research.md
lines 38-43, add those results. In tasks.md line 72, distinguish completed
username-only work from the unresolved production path, and at line 90 require
completion of the remaining telemetry, component, E2E, and aggregation tasks
before marking US1 or the release gate complete.
- Around line 106-110: Update the dependency and ownership map in tasks.md to
include T010a alongside T007–T010, including the Phase 2 chain and the
cross-repo note identifying cla-backend-go work. Ensure T010a’s projectName
response work is represented in the upstream release scope.

---

Nitpick comments:
In `@specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md`:
- Line 66: Update the T013 unit-test task description to make claType the
authoritative classification field, adding explicit icla, ecla, and ccla cases
and coverage for the legacy cclaCompanyID fallback when claType is unavailable.
Preserve the existing classification, status, merge, filtering, and sorting test
requirements.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b7b24d61-0d86-4309-ad83-030f37e500f1

📥 Commits

Reviewing files that changed from the base of the PR and between 22867ae and 29e15da.

📒 Files selected for processing (12)

• docs/easycla-ss-migration/README.md
• docs/easycla-ss-migration/architecture-proposal.md
• docs/easycla-ss-migration/role-mapping-feasibility.md
• docs/easycla-ss-migration/spike-runbook.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/README.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/my-clas-empty-state.html
• specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/my-clas-populated.html
• specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

TOKEN="$(curl ... | jq -er '.access_token')"
PAYLOAD="$(printf '%s' "$TOKEN" | cut -d. -f2)"

python - "$PAYLOAD" <<'PY'
import base64
import json
import sys

part = sys.argv[1]
part += "=" * ((4 - len(part) % 4) % 4)
print(json.dumps(json.loads(base64.urlsafe_b64decode(part)), indent=2))
PY

Repository: linuxfoundation/easycla

Length of output: 533

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

file="docs/easycla-ss-migration/spike-runbook.md"

echo "== line count =="
wc -l "$file"

echo
echo "== relevant sections =="
sed -n '1,120p' "$file" | cat -n

Repository: linuxfoundation/easycla

Length of output: 6552

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
import base64, subprocess, textwrap, json, os, tempfile, sys

samples = {
    # URL-safe alphabet, no padding
    "urlsafe_no_padding": "eyJmb28iOiJiYXIifQ",
    # URL-safe alphabet with characters that differ from standard base64
    "urlsafe_chars": "eyJfIjoiLSJ9",  # {"_":"-"} in base64url form
    # Standard base64 with padding, for comparison
    "standard_padded": base64.b64encode(b'{"foo":"bar"}').decode(),
}

for name, s in samples.items():
    print(f"\n== {name} ==")
    print("input:", s)
    p = subprocess.run(
        ["bash", "-lc", f"printf '%s' '{s}' | base64 -d 2>&1"],
        capture_output=True,
        text=True,
    )
    print("base64 -d rc:", p.returncode)
    print("base64 -d out:", p.stdout.strip())
    print("base64 -d err:", p.stderr.strip())

    # show equivalent urlsafe decode in Python
    pad = s + "=" * ((4 - len(s) % 4) % 4)
    try:
        decoded = base64.urlsafe_b64decode(pad)
        print("urlsafe decoded:", decoded.decode("utf-8", "replace"))
    except Exception as e:
        print("urlsafe decode error:", e)
PY

Repository: linuxfoundation/easycla

Length of output: 594

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

python3 - <<'PY'
import base64, subprocess

samples = {
    "urlsafe_no_padding": "eyJmb28iOiJiYXIifQ",
    "urlsafe_chars": "eyJfIjoiLSJ9",
    "standard_padded": base64.b64encode(b'{"foo":"bar"}').decode(),
}

for name, s in samples.items():
    print(f"\n== {name} ==")
    print("input:", s)
    p = subprocess.run(
        ["bash", "-lc", f"printf '%s' '{s}' | base64 -d 2>&1"],
        capture_output=True,
        text=True,
    )
    print("base64 -d rc:", p.returncode)
    print("base64 -d out:", p.stdout.strip())
    print("base64 -d err:", p.stderr.strip())

    pad = s + "=" * ((4 - len(s) % 4) % 4)
    try:
        decoded = base64.urlsafe_b64decode(pad)
        print("urlsafe decoded:", decoded.decode("utf-8", "replace"))
    except Exception as e:
        print("urlsafe decode error:", e)
PY

Repository: linuxfoundation/easycla

Length of output: 594

---

Use a base64url-safe decoder and guard the token fetch. base64 -d is brittle for JWT payloads, and the current TOKEN=$(...) step can leave an empty token after a bad exchange unless the command fails closed.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/easycla-ss-migration/spike-runbook.md` at line 36, Update the JWT
inspection command in the runbook to decode the payload with a base64url-safe
decoder instead of plain base64. Also make the TOKEN fetch fail closed by
validating that the exchange succeeds and returns a non-empty token before
proceeding to claim inspection.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Never retrieve refresh tokens from debug logs.

A refresh token is a bearer credential. Recommending that operators copy it from a debug log creates a credential-disclosure path; use controlled session-store access, redact logs, and revoke or rotate test tokens after the spike.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/easycla-ss-migration/spike-runbook.md` at line 41, Update the
refresh-token instructions in the runbook to prohibit retrieving tokens from
debug logs, and recommend only controlled session-store access or the
authorization-code+PKCE flow. State that logs must redact tokens and that any
test tokens used for the spike must be revoked or rotated afterward.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Point the identity-link CTA at the implemented route.

The contract references /social/callback, while the implementation notes and tasks use /profile/identities. Confirm the user-facing entry point and document it consistently; otherwise the recovery flow may dead-end.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md`
at line 39, Update the GitHub-link CTA contract in the identity resolution
documentation to use the implemented user-facing route `/profile/identities`
instead of `/social/callback`, and keep the surrounding return and re-fetch
behavior unchanged.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Choose one feature-flag enforcement model.

The contract promises route-level 404s, while the implementation notes and tasks specify Angular-only gating. This affects both runtime behavior and the required route tests.

• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md#L51-L53: change the contract to Angular-only behavior, or require server-side gating.
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L62-L68: make the implementation note match the chosen behavior.
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L74-L74: align T015/T018 with that decision.

📍 Affects 3 files

• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md#L51-L53 (this comment)
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L62-L68
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L74-L74

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/ss-me-clas-api.md`
around lines 51 - 53, Choose and document one feature-flag enforcement model
across all three sites: either revise the API contract to specify Angular-only
gating or require server-side route gating. Update research.md to describe the
same behavior, and align T015/T018 in tasks.md with the selected model,
including the corresponding route-test expectations.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Reconcile the M1 API and authorization model before implementation.

The documents simultaneously describe P10’s trusted identity-list/consolidated flow and the older client-side by-identity plus per-user signature flow. They must identify one authoritative contract.

• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md#L1-L1: rewrite the contract around the current endpoints, or label the old sections as legacy.
• docs/easycla-ss-migration/architecture-proposal.md#L94-L94: state whether P10 is the M1 contract or a later transition.
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L17-L30: update R2’s identity-resolution decision and rationale.
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L43-L47: replace or explicitly legacy-scope T007–T010a.
• docs/easycla-ss-migration/role-mapping-feasibility.md#L112-L118: mark the userID flow as historical or update the read-path analysis.
• docs/easycla-ss-migration/spike-runbook.md#L61-L68: run the spike against the authoritative endpoint.
• specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md#L26-L42: update acceptance checks and direct calls.

📍 Affects 7 files

• specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md#L1-L1 (this comment)
• docs/easycla-ss-migration/architecture-proposal.md#L94-L94
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L17-L30
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L43-L47
• docs/easycla-ss-migration/role-mapping-feasibility.md#L112-L118
• docs/easycla-ss-migration/spike-runbook.md#L61-L68
• specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md#L26-L42

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md`
at line 1, The M1 documentation uses conflicting EasyCLA identity-resolution and
authorization contracts; establish one authoritative endpoint and flow. In
specs/001-easycla-ss-integration-fable/m1-my-cla/contracts/upstream-easycla-api.md:1,
rewrite the contract for the current endpoints or explicitly mark old sections
legacy; in docs/easycla-ss-migration/architecture-proposal.md:94, state whether
P10 is the M1 contract or a later transition; update R2 in
specs/001-easycla-ss-integration-fable/m1-my-cla/research.md:17-30, scope
T007–T010a in specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md:43-47,
revise the userID read-path analysis in
docs/easycla-ss-migration/role-mapping-feasibility.md:112-118, target the
authoritative endpoint in docs/easycla-ss-migration/spike-runbook.md:61-68, and
align acceptance checks and direct calls in
specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md:26-42.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Match the mockup order to the documented sort.

The sample dates are 2019, 2021, 2022, 2024, then 2023, while the contract requires signedOn descending. Reorder the sample rows or label the mockup as illustrative so it does not contradict acceptance checks.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@specs/001-easycla-ss-integration-fable/m1-my-cla/mockups/my-clas-populated.html`
around lines 144 - 199, Reorder the sample rows in the populated CLA table so
their signed dates follow the documented signedOn descending order, placing the
2024 CDM entry before the 2023 FDC3 entry and continuing in descending order for
all rows. Update the row ordering around the table’s project entries without
changing their displayed content.

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Refresh the quickstart to match the implemented route and configuration.

CLA_SERVICE_BASE_URL was dropped, and the UI route is profile/clas, not /me/clas. As written, developers configure a dead env var and open the wrong URL. Document API_GW_AUDIENCE and the Profile-tab route instead.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md` around lines
5 - 20, Update the quickstart configuration prerequisites to remove
CLA_SERVICE_BASE_URL and document API_GW_AUDIENCE instead, using the implemented
authentication/API gateway configuration. In the Run steps, replace the /me/clas
URL and “Me lens” reference with the Profile-tab route profile/clas, while
preserving the existing expected CLA results.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Define GW before using the direct-call snippets.

The shell examples interpolate $GW, but this file never assigns it. Copy-pasting them therefore produces an empty host. Add GW=... or source it before these examples.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/quickstart.md` around lines
34 - 42, Define or source the GW shell variable before the “Useful direct calls
(dev, with token)” curl snippets in quickstart.md, using the appropriate
development gateway value so $GW expands to a valid host when the examples are
copied.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Do not declare the M1 release gate complete while auth and acceptance work remain open.

The auth spikes are unchecked and inconclusive, while the task list marks implementation complete and calls US1 fully functional.

• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L26-L33: keep the checkpoint blocked until T001/T002 results are recorded.
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L38-L43: record deployed-dev token and role-less-user results.
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L72-L72: split completed username-only work from the unresolved production path.
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L90-L90: require the remaining telemetry, component, E2E, and aggregation tasks before claiming completion.

🧰 Tools

🪛 LanguageTool

[uncategorized] ~28-~28: The official name of this software platform is spelled with a capital “H”.
Context: ...ities()in SS dev — bare numeric ID vsgithub|-prefixed (Auth0Identity.user_id`...

(GITHUB)

📍 Affects 2 files

• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L26-L33 (this comment)
• specs/001-easycla-ss-integration-fable/m1-my-cla/research.md#L38-L43
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L72-L72
• specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md#L90-L90

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md` around lines 26 -
33, Keep the M1 release checkpoint blocked until T001 and T002 are completed
with deployed-dev token and role-less-user results recorded in research.md R3;
in specs/001-easycla-ss-integration-fable/m1-my-cla/research.md lines 38-43, add
those results. In tasks.md line 72, distinguish completed username-only work
from the unresolved production path, and at line 90 require completion of the
remaining telemetry, component, E2E, and aggregation tasks before marking US1 or
the release gate complete.

[coderabbitai]

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Include T010a in the dependency and ownership map.

T010a edits cla-backend-go, but the dependency chain and cross-repo note mention only T007–T010. Add T010a to both, or the projectName response work can be omitted from the upstream release.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@specs/001-easycla-ss-integration-fable/m1-my-cla/tasks.md` around lines 106 -
110, Update the dependency and ownership map in tasks.md to include T010a
alongside T007–T010, including the Phase 2 chain and the cross-repo note
identifying cla-backend-go work. Ensure T010a’s projectName response work is
represented in the upstream release scope.

[mlehotskylf]

Closing as redundant — #5124 already contained the M1 spec docs + P10 trust-SS decision; the only delta this PR added (the NATS-transit-confirmed update in architecture-proposal.md) has been cherry-picked onto #5124's branch directly.