Phase-3 doc/side-file audit + cleanup (census done -> keep/migrate/delete)

[ahmetabdullahgultekin]

Interactive human-in-the-loop session to read every side file and decide keep-reference
/ migrate-to-issue / archive / delete. Read-only census 2026-06-13:

~427 .md, ~41 .sh, ~76 .yml across parent+submodules (EXCLUDED transient: 3,986 worktree
.md + 509 archive .md).

• PARENT ROOT = epicenter: ~30 dated AUDIT/REVIEW/REGISTER/TRIAGE .md (~17 UNTRACKED
  local-only) -> port findings to issues then rm. Biggest signal-per-effort.
• Stray untracked dirs at root (~142M): _wt-bio-multiimg, web-app-worktrees,
  client-apps-apk-...release -> delete (after the parent stale-branch sign-off).
• infra secret-ish .txt (CREDENTIALS/PENDING_SECRETS/ROTATED 2026-04-30) -> verify rotated
  then purge to a secrets manager.
• scripts/cloudflare-tunnel.sh -> violates the No-Cloudflare rule, delete.
• Submodules are GOOD (already use docs/archive/); per-repo migration is tiny.

Full per-file decision list posted as a comment on this issue. KEEP reference docs
(CLAUDE.md, specs, runbooks); MIGRATE tracking docs to issues; DELETE junk/dupes/strays.
This audit produced NO new doc on purpose — findings live in this issue.

[ahmetabdullahgultekin]

Side-file census (read-only, 2026-06-13) — decision input for the cleanup session

Scope = parent fivucsas + 7 submodules + infra. Nothing modified.

Counts (transient EXCLUDED: 3,986 worktree .md + 509 archive .md)

Ext	Total
.md	~427
.sh	~41
.yml/.yaml	~76
.json (non-source)	~123 (90 = spoof-detector paper eval)
.txt	~26
.html	~21
.py (tooling)	~30

Per-repo verdict (do parent root FIRST)

Repo	Side-files	Keep	Migrate	Delete
parent root+subdirs	~100	~25	~32	~6
docs/	~110	~95	~10	~3
infra	~50	~40	~5	~3
identity-core-api	40	~25	~12	~3
biometric-processor	~105	~102	~2	0
web-app	~72	~55	~4(archived)	0
client-apps	21	~19	1	0
spoof-detector	110	~88	3	3
practice-and-test	43	~33	(archived)	~2

MIGRATE → issues then archive/rm (parent root = the pile; ~17 are UNTRACKED = trivial rm)

• MASTER_ISSUE_REGISTER_2026-06-03.md (untracked) — IS the backlog → port to issues
• MASTER_GAP_REGISTER_2026-06-01.md, MASTER_REVIEW_SYNTHESIS_2026-06-02.md (untracked)
• REVIEW_*.md ×10 (BACKEND/CHIEF_ENGINEER/DATABASE/DEVOPS/FRONTEND/ML/NETWORK/PRINCIPAL/QA/UIUX, 2026-06-02) — LOCAL-ONLY (don't push public), archive offline
• LOGIC_AUDIT, DEMO_FIVUCSAS_AUDIT, FEATURE_COMPLETENESS, SECURITY_FINDINGS, NFC_EID_READINESS, VERIFICATION_ROADMAP, VISUAL_AUDIT_ALLSITES (all _2026-06-01)
• TECH_DEBT_AUDIT, TEST_COVERAGE_ASSESSMENT, OPEN_TASKS_RECONCILIATION (2026-06-02, untracked)
• ISSUE_SWEEP_2026-06-03, WEBSITE_CLAIMS_FIXLIST_2026-06-03, USER_FINDINGS_2026-06-0{2,3} (untracked)
• DOCS_AUDIT_2026-05-29, PROJECT_STATUS_2026-05-29, REPO_HYGIENE_2026-05-29, FILE_TREE_CLEANUP_2026-06-02 (untracked)
• OPERATOR_TODO_2026-06-01, root ROADMAP.md, POSTER_FACTCHECK/POSTER_V4_REVIEW/POSTER_BRIEF, SUNUM_KONUSMASI_2026-06-02, VIDEO_SCRIPT_CSE4298_2026-06-10.md
• submodules (small): identity-core-api/{TODO,ROADMAP}.md (ROADMAP self-marked superseded), its docs/findings/2026-06-07-*, client-apps/ROADMAP_CLIENT_APPS.md (superseded) + docs/MOBILE_TRIAGE_2026-06-03.md, spoof-detector/docs/SESSION_2026-0{5-31,6-01}.md, biometric-processor/tests/{TEST_RESULTS_REPORT,benchmarks/RESULTS}.md, infra/OPERATOR_HANDOFF_2026-05-11.md + infra/docs/* dated audits

DEAD (unreferenced / job-done)

• scripts/cloudflare-tunnel.sh — violates the No-Cloudflare rule, should not exist
• scripts/deploy-ubuntu-coolify.sh, scripts/deploy/deploy-identity-core-hetzner.{sh,ps1} — old deploy era (prod = infra/deploy.sh+compose)
• scripts/drift-check.sh (refs=0), scripts/fix-flyway-hetzner.sh (one-shot, done)
• identity-core-api/scripts/{test-rbac,test-crud}.sh, scripts/deploy-gcp.sh, deploy/gcp-setup.sh (CI covers / GCP deprecated)
• spoof-detector/data/protocol/report_20260502_*.json ×3, practice-and-test/DeepFacePractice1/_archive/* (README says "safe to delete")

DUPLICATE

• 3× poster-brief (POSTER_BRIEF.md ≈ poster/CLAUDE_DESIGN_BRIEF.md ≈ landing-website/.../fivucsas-poster-brief.md) — keep the shipped landing one
• identity-core-api/docs/SSO_APP_LAUNCHER_{DESIGN,PHASE1_PLAN}.md — consolidate
• identity-core-api/TODO.md ↔ docs/archive/TODO.md; monitoring/prometheus.yml ↔ monitoring/prometheus/prometheus.yml

DELETE-candidate (stray, ~142M)

• _wt-bio-multiimg/ (32M, untracked), web-app-worktrees/ (7.5M, untracked), client-apps-apk-v5.3.0-rebuild-2026-06-03.release/ (103M, untracked) — leftover dirs at repo root
• VIDEO_SCRIPT_CSE4298_2026-06-10.{html,pdf}, poster/FIVUCSAS_Poster_v3.html — generated derivatives
• infra/{PENDING_SECRETS_2026-04-30.txt, ROTATED_2026-04-30_biometric_api_key.txt, observability/CREDENTIALS_2026-04-30.txt} — secret-ish dated .txt → verify rotated then purge to secrets manager (do NOT leave in repo)

KEEP-reference (groups)

• Per-repo: README/CLAUDE/CHANGELOG/SECURITY/CONTRIBUTING/LICENSE
• infra: 17 RUNBOOK_*.md + 5 guard scripts + traefik/observability/shared-db configs (exemplary)
• docs/: numbered sections + 9 ADRs + 13 design specs + diagrams
• biometric-processor: full docs/ + 13 model-tooling .py (cleanest repo)
• spoof-detector: paper/ + eval JSON (reproducibility)
• all .github/workflows, docker-compose*.yml, monitoring configs

Submodules already practice docs/archive/ discipline → bulk of debt is the parent root + the parent stale-branch question (deferred, needs owner sign-off before touching the 142M stray dirs). Out-of-scope strays in /opt/projects/ parent (sibling of fivucsas): nlztrk_notebook_raw.md, login *.png/.jpeg.

[ahmetabdullahgultekin]

MIGRATE-pile disposition — docs → issues (2026-06-13)

Per-doc disposition of the MIGRATE pile (census above). Every "issues-created" item was source-verified still-open on current HEAD (grepped the symptom on the relevant submodule's origin/main); anything already-fixed/shipped was skipped (most of the 2026-06-01/02/03 P0/P1 cluster is now FIXED). LOCAL-ONLY/sensitive docs were not reproduced publicly. No files were deleted or moved.

30 issues created across 6 repos. They are all on the FIVUCSAS Delivery board. Dedup baseline = the existing seed issues (#148–#176 + per-repo equivalents) and the gpuless/phase-/surface-/dead-code/dry/infra-blocker/decision/security label taxonomy.

Parent-root tracking docs

Doc	Disposition
MASTER_ISSUE_REGISTER_2026-06-03.md	Primary source → issues created (see below). After verification: API-1→identity#229, WEB-2→web#225, WEB-1→web#226, WEB-8→web#227, WEB-4→web#228, BIO-3→bio#153, BIO-8→bio#154, BIO-10→bio#155, SPOOF-2→spoof#103, INFRA-1→identity#237, INFRA-3→#185, INFRA-11→#186, DOCS-1/2→#178, DOCS-3→#179, DOCS-4→#180, DOCS-6→#181, DOCS-7→#182. Already-fixed (skipped): API-2 (client-binding shipped, V85), P0-2/3/4, P1-1/2/3/5/6/7/8/9/10, BIO-6 (SHA pinned), eMRTD cert-validity, SPOOF-3 (npm claim removed), MOB-4..9/16. → superseded→archive
ISSUE_SWEEP_2026-06-03.md	Same 8-auditor sweep, same day = duplicate content of the register → already-covered-by-#175 census + the issues above → superseded→archive
MASTER_GAP_REGISTER_2026-06-01.md	Self-marked "fix tomorrow"; its P0/P1 cluster is now shipped on HEAD (DOC-1 in the register flags it as stale). Only B4 (autofill blue) still open → web#229. → superseded→archive
MASTER_REVIEW_SYNTHESIS_2026-06-02.md	Index of the LOCAL-ONLY 11-team review set → local-only→keep-offline (flagged)
OPEN_TASKS_RECONCILIATION_2026-06-02.md	Superseded by the 06-03 register (its open items re-verified fixed except UV) → superseded→archive
TECH_DEBT_AUDIT_2026-06-02.md	Cleanup items already covered by seed #173/#174/#175 (demo-ui/out, .claude/worktrees, BFG history, branch prune). face_db.pkl PII + BFG history-rewrite are decisions folded into #174/#175 scope. → already-covered-by-#173/#174/#175
TEST_COVERAGE_ASSESSMENT_2026-06-02.md	Skipped-integration-suite debt (BIO-9 intentional gate; WEB-7 pre-i18n) — low, infra-gated, no new issue → superseded→archive (re-file if test-debt is prioritized)
SECURITY_FINDINGS_2026-06-01.md	local-only ("Internal/candid — do NOT publish") → kept offline; only clearly-safe sanitized items filed: BIO health leak→bio#152, users-PII-leak→identity#230, sessionStorage/httpOnly→web#226, landing privacy link→#183, AES/RLS wording→#184. Already-fixed: open-register-tenant fallback (fail-closed), OTP email stub (branded HTML). Sensitive (AI-authorship policy, scrub candid docs, history-rewrite of dead .env, personal emails) → flagged for owner, not filed → local-only→keep-offline (flagged)
LOGIC_AUDIT_2026-06-01.md	38-bug detail behind MASTER_GAP_REGISTER; verified-open subset already filed via the register → superseded→archive
FEATURE_COMPLETENESS_2026-06-01.md	"do-not-demo" list = HARDWARE_KEY/iOS/BYOD/demographics(now flag-gated)/sprint-4/pairwise-sub — operator/roadmap, no new actionable code item → superseded→archive
DEMO_FIVUCSAS_AUDIT_2026-06-01.md	BYS-demo audit; live demo surface verified clean on origin/master (per WEBSITE_CLAIMS_FIXLIST) → superseded→archive
NFC_EID_READINESS_2026-06-01.md	Student-card NFC fixed+shipped; eID pipeline is code-complete but dormant — blockers are operator (CSCA roots) + a multi-day "wire chip SOD/DGs into /auth/mfa/step" feature (already in client-apps docs/TODO A1). Not a small confirmed-open item → keep as reference; flagged for owner (eID go-live is a roadmap track, not a bug)
VERIFICATION_ROADMAP_2026-06-01.md	Demo-day E2E verification plan (executed; demo passed) → superseded→archive
VISUAL_AUDIT_ALLSITES_2026-06-01.md	Visual polish; live-claim subset folded into DOCS-*/website issues → superseded→archive
OPERATOR_TODO_2026-06-01.md	Operator-only (OTP delivery test, npm decision, status-page toggle, APK keystore, CSCA roots, FIDO2 purchase, runner re-pair). Runner→seed#171, deploy→#172, model-hosting→seed identity#226. Rest are human/credential/hardware → flagged for owner, not code issues → local-only→keep-offline(operator)
USER_FINDINGS_2026-06-03.md (+ _2026-06-02)	User-reported. Still-open filed: #1 QR approve swallow→client-apps#93, #3 rate-limit knobs→identity#236, #8 Add-card→client-apps#94, #10 invites endpoint→identity#235, #11 tenant count→identity#233, #15 device row→identity#234, #12 autofill→web#229. Already-fixed: #2 random-logout (seed client-apps#92), #5/#9/#10-crash (origin/main, need APK rebuild — operator), #13 step counter (web#202 merged), #14 system-tenant (by design), #7 NFC (on-device adb only — operator). → issues-created + already-covered
ROADMAP.md (root)	Product roadmap; active items shipped or operator-gated (paper push, iBeta, Stripe). Superseded by docs/ROADMAP_2026-06-12.md → superseded→archive
POSTER_BRIEF.md / POSTER_FACTCHECK_2026-05-21.md / POSTER_V4_REVIEW_2026-06-03.md	FACTCHECK is the source for the still-open poster .tex over-claim → #180. POSTER_BRIEF is a 3× duplicate (keep the shipped landing copy) → duplicate / reference.
SUNUM_KONUSMASI_2026-06-02.md / VIDEO_SCRIPT_CSE4298_2026-06-10.md	Presentation speech/script — content artifacts, not tracking → keep-reference (no issue)
DOCS_AUDIT_2026-05-29 / PROJECT_STATUS_2026-05-29 / REPO_HYGIENE_2026-05-29 / FILE_TREE_CLEANUP_2026-06-02	Stale status/hygiene snapshots; current state captured in #173/#174/#175 → superseded→archive
WEBSITE_CLAIMS_FIXLIST_2026-06-03.md	Self-marked FIXED & DEPLOYED (FIVUCSAS#141, web-app#201, spoof#99). Residual still-open subset (AES per-tenant, RLS wording, landing privacy link) → #183/#184/#185 (Traefik). cdn/bio NXDOMAIN refs no longer found on origin/main. → superseded→archive

REVIEW_*.md ×10 (BACKEND/CHIEF_ENGINEER/DATABASE/DEVOPS/FRONTEND/ML/NETWORK/PRINCIPAL/QA/UIUX, 2026-06-02)

ALL local-only→keep-offline (flagged for owner). These are candid senior-review reports explicitly marked "don't push public." Their sensitive content was NOT reproduced. Where they overlap the register's verified-open findings, those are already filed via the register issues; no review-specific sensitive item was published.

Submodule tracking docs

Doc	Disposition
identity-core-api/TODO.md	Two genuine open items filed: FORCE RLS + non-superuser role→#231, RbacPermissionEvaluator target-aware→#232. Testcontainers CI lane = FIXED (PR #221, both required checks green). → issues-created
identity-core-api/ROADMAP.md	Self-marked "historical snapshot, superseded by parent" → superseded→archive
identity-core-api/docs/findings/2026-06-07-authz-idor-fixes.md	Deferred follow-ups → #231/#232 (above). Pre-existing test rot (OAuth2 aud test, WebAuthn enrollment-binding Mockito) noted as low test-debt, not filed (test-only). → issues-created + reference
identity-core-api/docs/findings/2026-06-07-tests-and-security.md	.env.hetzner leak de-escalated: stale GCP creds, NOT live; already untracked on origin/main (verified — not tracked). Hygiene branch claude/untrack-env-hetzner-secret is leftover. No issue. → already-remediated
client-apps/ROADMAP_CLIENT_APPS.md	Self-marked SUPERSEDED (hosted-first pivot) → superseded→archive
client-apps/docs/TODO.md	Stale (2026-04-18); eID/NFC items operator-gated + roadmap (A1 NFC integration, A2 GDPR mobile UI) — not small confirmed-open → keep-reference (eID flagged for owner)
client-apps/docs/MOBILE_TRIAGE_2026-06-03.md	Triage already reconciled (client-apps #84); demo-safe fixes shipped → superseded→archive
spoof-detector/docs/SESSION_2026-05-31.md / SESSION_2026-06-01.md	Research session notes; open follow-ups are research (multi-subject thresholds, pose-normalized deformation, replay-veto polarity = SPOOF-1 uncertain-by-code). SP-D/PAD already = seed#149. → keep-reference (research)
biometric-processor/tests/{TEST_RESULTS_REPORT,benchmarks/RESULTS}.md	Test/benchmark result snapshots (reproducibility) → keep-reference

Flagged for owner (LOCAL-ONLY / sensitive / decisions — NOT filed as public issues)

1. REVIEW_*.md ×10 (2026-06-02) — candid senior reviews, keep offline.
2. SECURITY_FINDINGS_2026-06-01.md + MASTER_REVIEW_SYNTHESIS_2026-06-02.md — internal/candid, keep offline; sensitive items NOT published.
3. AI-authorship policy (Co-Authored-By / .claude/ prompt library on public master), scrubbing committed candid audit docs off public branches, and history-rewrite of the 3 dead .env files — policy decisions for the owner (SECURITY_FINDINGS §3/§4), deliberately not filed publicly.
4. Personal emails on poster/landing/verify → swap for academic/info@ (privacy decision).
5. eID/passport go-live (CSCA trust roots + wiring chip SOD/DGs into /auth/mfa/step) — multi-day roadmap track + operator credential, not a bug.
6. Operator-only items (OTP delivery test, APK rebuild from origin/main to clear mobile Claude/check root repo 011 cv1y j3 j5 xl4 qp68 l crd pg #5/Claude/check root repo 011 cv1y j3 j5 xl4 qp68 l crd pg #9/Claude/initial setup 01 jnne jv8t t tsi mxz ru b pjjb #10, FIDO2 purchase, status-page URL toggle) — already in OPERATOR_TODO; runner/deploy/model-hosting already have seed issues [BLOCKER] Hetzner self-hosted runner not claiming Deploy jobs #171/[BLOCKER] infra/deploy.sh has no 'biometric' build branch #172/thesis: accuracy sweep vs live code (Ayşe Gülsüm review + 5-chapter audit) #226.

Issues created (30)

• identity-core-api: chore(deps): bump dompurify from 3.4.8 to 3.4.11 in /docs-site/book #229 WebAuthn UV (security) · chore(deps-dev): bump @babel/core from 7.29.0 to 7.29.7 in /landing-website #230 users-list PII leak (security) · chore(deps-dev): bump vite and @vitejs/plugin-react in /landing-website #231 FORCE RLS + non-superuser role (security/infra) · #232 RbacPermissionEvaluator target-aware (security) · #233 tenant member count=0 (bug) · #234 mobile login no device row (bug) · #235 invites-received endpoint (feature) · #236 rate-limit env knobs (feature) · #237 audit_logs partitioning decision
• web-app: thesis: precise desktop/iOS delivery framing + QA nice-to-haves (N1-N11) #225 auth-methods-testing auto-enroll (security) · thesis: accuracy sweep vs live code (Ayşe Gülsüm review + 5-chapter audit) #226 sessionStorage/httpOnly JSDoc (security) · docs: sync CLAUDE.md + README_THESIS.md test count with thesis (≈4,863) #227 postMessage trust-on-first-use (security) · Reconcile or retire legacy main branch (388 behind / 145 ahead of master) #228 puzzle soft-pass-on-404 · chore(deps): bump dompurify from 3.4.8 to 3.4.11 in /docs-site/book #229 password autofill blue (bug)
• biometric-processor: docs(thesis): FIVUCSAS graduation thesis + coming-soon web page #152 /health ML-stack leak (security) · docs: verified test counts in CLAUDE.md + thesis tile on links.fivucsas #153 dead liveness floor 0.4 (dead-code) · fix(thesis-page): mobile 320px horizontal overflow #154 unused UNIFACE flag (dead-code) · fix(launcher-overlap): demo badge off FAB corner + thesis copy button #155 multi-face stub (dead-code)
• spoof-detector: docs: stabilize-&-harden backlog COMPLETE 2026-05-30 + submodule pointer bumps #103 Python↔TS fuser weight divergence (dry)
• client-apps: infra(submodules): bump api+bio for P1-3 enrollment score persistence #93 QR approveSession swallows non-2xx (bug) · infra(submodule): bump api → identity Phase 1 #94 'Add card' dead-end (decision)
• FIVUCSAS: Website: download page advertises .deb/.msi/.apk that all 404 (+ pretty /download 404s) #178 download 404 · Website: docs SDK Quick-Start documents a fabricated API (onSuccess/onError + auth.verify()) #179 fabricated SDK docs · Poster: printed .tex sources still carry NO-MERGE over-claims (0.97 AUC etc.) #180 poster .tex over-claims · Website: bys-demo/test-elements.html loads a non-existent fivucsas-elements.js (404) #181 test-elements.js 404 · Website: inconsistent test/migration counts across landing/poster/docs — pick one truth #182 inconsistent counts · Website: landing footer has no Privacy/Terms/KVKK link (policy lives only on app.fivucsas.com) #183 landing privacy/KVKK link · Truth-in-claims: drop 'AES per tenant' (landing) + fix RLS wording in web-app privacy policy #184 AES/RLS truth-in-claims · Infra: declare a single Traefik source of truth (live /opt/projects/infra vs stale in-repo copy) #185 Traefik source-of-truth (decision) · Dead code: remove scripts/cloudflare-tunnel.sh (violates the standing No-Cloudflare rule) #186 cloudflare-tunnel.sh dead script (Phase-3)

No files deleted or moved (deletion is a later human step). The MIGRATE docs that are "superseded→archive" can be moved to archive/ once the owner confirms the issue coverage above.

[ahmetabdullahgultekin]

Held-back items now filed PUBLIC + ROADMAP-doc sweep (2026-06-13)

Owner authorized public filing of the previously-held-back LOCAL-ONLY items (the "Flagged for owner" list in the disposition above). All were re-verified still-open on current submodule origin/main (identity 9e61d3e, bio eb4cad7, web 8a7d84d, client-apps a1a30cf4) before filing; already-fixed items were skipped with evidence. Many 2026-06-02 review findings had since shipped and were correctly skipped (examples verified FIXED: /register fail-closed, voice centroid L2-normalized, the :8000 orphan gateway removed from the host, the verify EN/TR toggle now wired in HostedLoginApp.tsx, common.close/copy/copied i18n keys present, UserEnrollment @SQLRestriction, the NFC cross-tenant PII leak remediated in PR #211, the identity Testcontainers IT lane green via PR #221).

Security exception — advisories vs public issues

No currently-exploitable, unremediated, unfiled vulnerability was found, so no Security Advisory was drafted. The strongest candidate — the cross-tenant NFC serial lookup (D3) — is already remediated at the application layer (PR #211 tenant-scopes verifyCard/searchByCardSerial; ROOT-only global view; device:read gate). What remains of D3 is a defense-in-depth gap (5 entities still lack @Filter), filed as a public security hardening issue (identity#238), not an advisory, because there is no live exploitable path. The advisory API (gh api repos/.../security-advisories) is reachable (GET returns []); it simply wasn't needed. (Already-filed exploitable-adjacent items: WebAuthn UV identity#229, FORCE-RLS identity#231, sessionStorage dead-doc web#226, users-PII web#225/identity#230.)

Issues created (28)

identity-core-api: #238 defense-in-depth @filter on 5 tenant-scoped entities (security) · #239 consolidate dual login path / retire layer1IsPassword+verify2FAMethod · #240 mask PII in INFO logs / KVKK (security) · #241 @scheduled cleanup of expired refresh_tokens+mfa_sessions · #242 standardize error-response envelope (stable errorCode) · #243 Map<String,Object> bodies → @Valid DTOs · #244 @SQLRestriction on Role (UserEnrollment already done) · #245 FaceVerifyMfaStepHandler 0% coverage + anonymous-deny filters-ON sweep
biometric-processor: #156 DECISION plaintext embeddings + HNSW defeat "encrypted at rest" (security/decision)
web-app: #230 dead useAuthFlowBuilder hook + AuthFlowBuilderPage (dead-code) · #231 hosted-login autofill/autocomplete + AuthFlowBuilder affordances (UX)
client-apps: #95 on-device YOLO card-nano + TFLite voice (gpuless — from superseded ROADMAP_CLIENT_APPS Phase-4)
FIVUCSAS (umbrella): #191 shared-db compose archive_mode landmine (infra-blocker) · #192 observability/alerting gap · #193 static-site headers + strip source maps (security) · #194 poster-viewer İ corruption (docs) · #195 DECISION AI-authorship on public master · #196 DECISION scrub candid audit docs off public branches · #197 DECISION purge 3 dead .env files from history (verify-rotated first) · #198 personal emails on poster/landing/verify (privacy) · #199 DECISION eID/passport go-live (CSCA roots + chip-into-login wiring) · #200 operator tasks (OTP test / signed-APK rebuild / FIDO2 / status-page toggle)

EPICs created (task-list grouping)

• EPIC: GPU-less go-live #201 EPIC: GPU-less go-live (phase-2-golive, milestone Phase 2) → children [BLOCKER] Hetzner self-hosted runner not claiming Deploy jobs #171/[BLOCKER] infra/deploy.sh has no 'biometric' build branch #172, bio#148/docs(book): fix C4 image (SVG xmlns) + no-cache HTML #150, identity#226/docs: sync CLAUDE.md + README_THESIS.md test count with thesis (≈4,863) #227, bio#149
• EPIC: Phase-3 cleanup (LAST) #202 EPIC: Phase-3 cleanup (phase-3-cleanup, milestone Phase 3) → children identity#228, Phase-3 DRY: research-snapshot mirror, spoof-algo canonical home, exception/ratelimit dedup #173/Phase-3 hygiene: committed build artifacts → CI/LFS; stale dated docs → archive #174/Phase-3 doc/side-file audit + cleanup (census done -> keep/migrate/delete) #175/Project/repo structure: submodule model, splits (landing-website), stale-branch reconcile, data→LFS #177, biometric-puzzle#1, docs#24 (+ folds Decision: AI-authorship visible on public master (Co-Authored-By trailers + .claude/ prompt library) #195/Decision: scrub candid internal audit docs off public branches #196/Decision: purge 3 dead .env files (+ a rotated DB password) from public git history #197 once approved)
• EPIC: Thesis hardcopy + paper #203 EPIC: Thesis hardcopy + paper (surface/docs) → children Thesis review (academic + accuracy): HARDCOPY polish + PAPER items (submission-critical already fixed in #187) #188/Thesis softcopy (due 17 Jun 22:00 → advisor + Kübra format-check): Word F9 + export PDF + submit #189/Paper plan: FIVUCSAS systems/platform paper (PIVOTED from client-embedding angle) #190

ROADMAP-doc sweep (all migrated → mostly superseded→archive)

Roadmap doc	Disposition
parent ROADMAP.md (2026-05-12)	Superseded by docs/ROADMAP_2026-06-12.md. Open items are operator-gated (Stripe/iBeta/APK-keystore/DNS → #200) or already tracked (RLS Task #27 → identity#231; spoof paper → #190; GitGuardian keystore → operator). → superseded→archive
identity-core-api/ROADMAP.md (near-term 2026-06-07)	#1 Testcontainers IT lane = FIXED (PR #221, both required checks green). #2 FORCE-RLS + non-superuser role = already identity#231. #3 RbacPermissionEvaluator target-aware = already identity#232. Historical snapshot all shipped. → superseded→archive
client-apps/ROADMAP_CLIENT_APPS.md	Self-marked SUPERSEDED (hosted-first pivot). One genuine open Phase-4 item filed: on-device YOLO/TFLite ML → client-apps#95. Rest done/future. → superseded→archive
docs/03-development/IMPLEMENTATION_ROADMAP.md (Oct-2025 MVP)	All shipped long ago (Koin DI, platform token storage, MediaPipe liveness all in production). → superseded→archive
ROADMAP_AUTH_2026-05-30.md	Referenced by client-apps CLAUDE.md but does not exist in the tree (parent ROADMAP serves the auth tracker). → n/a

The board now carries Start/Target date fields + 2 phase-milestones, so the board IS the roadmap; these superseded roadmap docs can be archived once the owner confirms the coverage above. No files deleted/moved (deletion is the later Phase-3 step #202).

[ahmetabdullahgultekin]

Phase-3 doc cleanup EXECUTED — deletions shipped as PRs + missed open items filed (2026-06-13)

Built on the 3-comment disposition above. Verified the prior md-migrate pass, then EXECUTED the
deletions (one PR per repo, off origin/main|master via clean worktrees — the stale local parent
checkout was NOT touched) and extended the same to the submodules. No PRs merged (owner reviews).

Deletion PRs (8)

Repo	PR	Tracking docs removed
FIVUCSAS (parent)	#208	9 (ROADMAP, ROADMAP_AUTH_2026-05-30, USER_FINDINGS_2026-06-03, PRE_DEMO_FIX_HANDOFF, POSTER_BRIEF dup, BOOK_PLAN, + 3 archive/2026-06 audits)
identity-core-api	#252	7 (ROADMAP, TODO x2, 2 findings, SECURITY-rotate note, AUTH_PLATFORM_ROADMAP)
biometric-processor	#157	54 (audits/compliance reports + the 2026-04-16 archive report pile; design specs/guides kept)
web-app	#234	5 (ROADMAP + 4 archive audit/TODO)
client-apps	#97	7 (ROADMAP_CLIENT_APPS, MOBILE_TRIAGE, TODO + 4 archive summaries; guides kept)
spoof-detector	#109	3 (ROADMAP, 2 SESSION notes; durable content moved into research/README)
practice-and-test	#13	10 (archive status/progress/compliance reports; checklist/research kept)
docs	#25	41 (IMPLEMENTATION_ROADMAP, audits, 2026-04-16 + 2026-05-28 archive; ADRs/specs/diagrams kept)

MISSED still-open items the prior pass had NOT filed (caught + filed this pass, 14 new)

From AUTH_PLATFORM_ROADMAP_2026-06-06.md (identity, not previously dispositioned), grep-verified open on HEAD:
identity#246 F7 discovery hides refresh_token grant · #247 F6 pairwise flag+salt decision ·
#248 F4 REST public-PKCE provisioning · #249 F11 RSA RS256 rotation NOT shipped (orchestrator wrongly
thought shipped — agent verified the getKid()/rotation is HS512-only) · #250 F15 guardian_of delegation
primitive · #251 F8/F9/F10/F13/F14 OIDC standards-completeness.
From the parent CODE_QUALITY_AUDIT_2026-05-31 (still-open subset):
identity#253 Turkish-ID checksum disabled + raw "2fa-sms:" literal · identity#254 fail-open MFA catch ·
bio#158 model<->dimension default mismatch · spoof#110 amispoof video-replay misses (screen_flicker
Nyquist + planarity gate + unmerged flash-temporal-probe).
Submodule agents also filed: web#232 session-id double-cast · web#233 identifier-endpoint canonicalization ·
client-apps#96 FCM action-button approve-login · spoof#104-#108 (replay-veto, multi-subject thresholds,
pose-deformation, dead LivenessProof axes, browser leftovers).

Owner action items

1. Parent untracked local-only docs (~17, incl. REVIEW_*.md x10): NOT on origin/master — only on the
   deferred stale-branch checkout. Listed in detail in PR chore(docs): remove superseded tracking docs (content -> issues/board) #208's body; clear via the Project/repo structure: submodule model, splits (landing-website), stale-branch reconcile, data→LFS #177 fresh-clone
   reconciliation, not a PR. Their open items were already migrated (sensitive ones kept offline).
2. Stray dirs (_wt-bio-multiimg/, web-app-worktrees/, client-apps-apk-*.release/, ~142M) + secret-ish
   dated .txt under infra/ remain owner-scoped per the census.

Every reference doc (CLAUDE/README/CHANGELOG/SECURITY/runbooks/design specs/VitePress book/thesis/eval
artifacts) was kept; dangling links in surviving KEEP docs were repointed to the board. No AI-attribution
trailers in any commit.