docs(06-01): complete signing foundation plan — SUMMARY, STATE, ROADMAP updated

- created 06-01-SUMMARY.md with full task and decision documentation
- STATE.md: advanced to phase 6 plan 1, added 5 signing foundation decisions
- ROADMAP.md: marked 06-01-PLAN.md complete, Signing Flow at 1/6
- REQUIREMENTS.md: marked SIGN-02, LEGAL-01, LEGAL-02 complete

.planning/STATE.md

@@ -3,12 +3,12 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: unknown
-last_updated: "2026-03-20T06:08:20Z"
+last_updated: "2026-03-20T17:25:09Z"
 progress:
-  total_phases: 5
-  completed_phases: 4
-  total_plans: 18
-  completed_plans: 18
+  total_phases: 7
+  completed_phases: 5
+  total_plans: 23
+  completed_plans: 19
 ---
 
 # Project State
@@ -18,16 +18,16 @@ progress:
 See: .planning/PROJECT.md (updated 2026-03-19)
 
 **Core value:** Teressa can prepare and send any real estate form to a client for signing in minutes, from her browser, without leaving her site.
-**Current focus:** Phase 5 - PDF Fill and Field Mapping
+**Current focus:** Phase 6 - Signing Flow
 
 ## Current Position
 
-Phase: 5 of 7 (PDF Fill and Field Mapping) — ADDITIONAL BUG FIXES APPLIED, AWAITING RE-VERIFICATION
-Plan: 05-04 (4 of 4 plans) — three more precise UI fixes applied
-Status: Three additional fixes applied (commits f0ecfd1, 73ba6d5, c4e8d01): (1) ghost-rect drag placement + canvas-offset overlays fix field jumping on drop, (2) locked client replaced with editable primaryEmail input, (3) text stamp moved to 60pt from top, font 10pt. Build passes cleanly.
-Last activity: 2026-03-20 — Three targeted Phase 5 UI fixes: field placement accuracy, email input UX, stamp position
+Phase: 6 of 7 (Signing Flow) — Plan 1 complete
+Plan: 06-01 (1 of 5 plans) — cryptographic foundation, DB tables, utility library
+Status: signingTokens + auditEvents tables in PostgreSQL, documents extended with signedFilePath/pdfHash/signedAt, createSigningToken/verifySigningToken/logAuditEvent/embedSignatureInPdf utilities compiled and committed, npm run build passes cleanly.
+Last activity: 2026-03-20 — Phase 6 Plan 01: signing foundation (DB + JWT + audit + PDF embed utilities)
 
-Progress: [██████████] 100%
+Progress: [████████░░] 83%
 
 ## Performance Metrics
 
@@ -58,6 +58,7 @@ Progress: [██████████] 100%
 | Phase 04-pdf-ingest P04-03 | 5 | 2 tasks | 8 files |
 | Phase 05-pdf-fill-and-field-mapping P02 | 1 | 2 tasks | 2 files |
 | Phase 05-pdf-fill-and-field-mapping P03 | 3 | 2 tasks | 4 files |
+| Phase 06-signing-flow P01 | 2 | 2 tasks | 8 files |
 
 ## Accumulated Context
 
@@ -115,6 +116,11 @@ Recent decisions affecting current work:
 - [Phase 05-pdf-fill-and-field-mapping 05-02]: top: top - heightPx on overlay divs — pdfToScreenCoords returns y of bottom-left corner; must shift up by field height for DOM top-left origin
 - [Phase 05-pdf-fill-and-field-mapping]: PreparePanel canPrepare guard: only show prepare form for Draft status — read-only message for Sent/Signed
 - [Phase 05-pdf-fill-and-field-mapping]: currentClientId defaults to doc.assignedClientId ?? doc.clientId — allows reassigning client before preparing
+- [Phase 06-signing-flow 06-01]: SIGNING_JWT_SECRET uses real openssl rand -base64 32 value (not placeholder) — generated at plan execution time
+- [Phase 06-signing-flow 06-01]: auditEventTypeEnum defined before auditEvents table in schema.ts — pgEnum must precede referencing table (established Phase 3 pattern)
+- [Phase 06-signing-flow 06-01]: Signing utilities live in src/lib/signing/ — server-only, never import from client components
+- [Phase 06-signing-flow 06-01]: JWT jti stored in signingTokens table on createSigningToken — enables one-time-use enforcement in later plans
+- [Phase 06-signing-flow 06-01]: SHA-256 hash computed from disk after atomic rename — never from in-memory bytes (LEGAL-02)
 
 ### Pending Todos
 
@@ -131,5 +137,5 @@ None yet.
 ## Session Continuity
 
 Last session: 2026-03-20
-Stopped at: 05-04 additional fixes complete — ghost-rect drag, editable primary email, text stamp repositioned; ready for re-verification
+Stopped at: Completed 06-01-PLAN.md — signing foundation DB tables, JWT utilities, audit log, PDF embed with SHA-256
 Resume file: None