wip: phase-09 paused after UAT blocker (docker rebuild needed)

.planning/HANDOFF.json

@@ -1,6 +1,6 @@
 {
   "version": "1.0",
-  "timestamp": "2026-07-01T13:42:33.474Z",
+  "timestamp": "2026-07-02T06:21:28.260Z",
   "phase": "09",
   "phase_name": "cert-manager-module",
   "phase_dir": ".planning/phases/09-cert-manager-module",
@@ -9,37 +9,37 @@
   "total_tasks": null,
   "status": "paused",
   "completed_tasks": [
-    {"id": 1, "name": "Dashboard grid: widget-fix noCompactor deployed", "status": "done", "commit": "dashboard fix"},
-    {"id": 2, "name": "Phase 9 added to ROADMAP.md", "status": "done", "commit": "a32f5f9"},
-    {"id": 3, "name": "09-CONTEXT.md written with all decisions", "status": "done", "commit": "a32f5f9"}
+    {"id": 1, "name": "Phase 09 alle 6 Pläne ausgeführt (Waves 1–5)", "status": "done", "commit": "daff82e"},
+    {"id": 2, "name": "09-UAT.md erstellt, Playwright-Check durchgeführt", "status": "done", "commit": "in_memory"}
   ],
   "remaining_tasks": [
-    {"id": 4, "name": "Run /gsd-ui-phase 9 to generate UI-SPEC.md", "status": "not_started"},
-    {"id": 5, "name": "Run /gsd-plan-phase 9 after UI-SPEC exists", "status": "not_started"},
-    {"id": 6, "name": "Run /gsd-execute-phase 9", "status": "not_started"}
+    {"id": 3, "name": "API-Container neu bauen: docker compose build api && docker compose up -d api", "status": "not_started"},
+    {"id": 4, "name": "Prüfen: 'Cert-Manager module seeded in registry' in docker logs", "status": "not_started"},
+    {"id": 5, "name": "Cert-Manager im Marketplace aktivieren (Tenant: Default)", "status": "not_started"},
+    {"id": 6, "name": "UAT fortsetzen: /gsd-verify-work 9", "status": "not_started"}
   ],
   "blockers": [
     {
-      "description": "UI-SPEC.md missing — plan-phase UI safety gate blocks planning",
-      "type": "process",
-      "workaround": "Run /gsd-ui-phase 9 first, OR /gsd-plan-phase 9 --skip-ui"
+      "description": "Docker API-Container läuft alten Build — CertManagerModule nicht deployed. Keine cert-manager Routes, kein Seed. Marketplace zeigt nur dkv-fleet + domaincheck.",
+      "type": "human_action",
+      "workaround": "docker compose build api && docker compose up -d api"
     }
   ],
   "async_jobs": [],
-  "human_actions_pending": [],
+  "human_actions_pending": [
+    {
+      "action": "docker compose build api && docker compose up -d api",
+      "context": "Phase-09-Code (CertManagerModule) nicht im laufenden Container. Rebuild erforderlich vor UAT.",
+      "blocking": true
+    }
+  ],
   "decisions": [
-    {"decision": "Server-side processing via NestJS API", "rationale": "User specified", "phase": "09"},
-    {"decision": "Ephemeral — no DB, no file storage", "rationale": "User specified", "phase": "09"},
-    {"decision": "node-forge library for cert operations", "rationale": "Pure JS, handles PEM/DER/PFX/P7B, Docker-friendly", "phase": "09"},
-    {"decision": "Operations: inspect, split (chain→individual), merge (certs→chain or PFX), convert between formats", "rationale": "User clarified 'teilen' = split not share", "phase": "09"},
-    {"decision": "Password support for PFX/PKCS12 read+write", "rationale": "User requirement", "phase": "09"},
-    {"decision": "Tab UI: Analysieren / Aufteilen / Zusammenführen / Konvertieren", "rationale": "Discussed in context", "phase": "09"},
-    {"decision": "Module slug: cert-manager, category: security-tools", "rationale": "Context decision", "phase": "09"}
+    {"decision": "forge.pkcs12.toPkcs12Asn1(null, certs, password) funktioniert in node-forge 1.4.0 — null-key PFX liefert cert-only PKCS12", "rationale": "Open Question 1 resolved", "phase": "09"},
+    {"decision": "DER-Encoding: bytesToHex → Buffer.from(hex,'hex') → base64", "rationale": "Pitfall 1 — nie utf-8 roundtrip für Binary", "phase": "09"},
+    {"decision": "expect.extend(matchers) explizit in web vitest setup.ts", "rationale": "Vitest 4.x Bug — jest-dom extends nicht automatisch", "phase": "09"}
   ],
   "uncommitted_files": [
     ".mcp.json",
-    ".planning/REQUIREMENTS.md",
-    ".planning/STATE.md",
     "apps/api/src/auth/auth.service.ts",
     "apps/api/src/user/user.controller.ts",
     "apps/web/src/components/dashboard/dashboard-grid.tsx",
@@ -49,6 +49,6 @@
     "apps/web/src/lib/auth-actions.ts",
     "apps/web/src/lib/stores/dashboard-store.ts"
   ],
-  "next_action": "Run /gsd-ui-phase 9 to generate UI-SPEC.md, then /gsd-plan-phase 9",
-  "context_notes": "Phase 9 (Cert Manager) fully discussed and context captured. Dashboard widget noCompactor fix deployed. plan-phase blocked by UI-SPEC gate."
+  "next_action": "docker compose build api && docker compose up -d api — dann /gsd-verify-work 9",
+  "context_notes": "Phase 09 vollständig implementiert (6/6 Pläne, alle Tests grün: 27 API + 19 Web). UAT gestartet aber geblockt durch alten Docker-Build. Uncommitted files aus früheren Sessions — NICHT Phase-09-spezifisch, nicht committen."
 }