mark: Phase 8.2, 8.10 GREEN; create Phase 3 auth tasks

PHASE 8 COMPLETE (10/10 tasks):
- 8.2: X-Service/X-Resource dispatcher ✅
- 8.10: Phase gate - all 5 services routing ✅

Architecture decisions documented:
- Gateway = dumb pipe (Option B)
- SQS: gateway validates JWT (code unverified)
- MinIO, Temporal: native JWT support
- Memory, IAM: service-owned validation
- ConfigMap-based config with Stakater Reloader
- Real integration tests with cluster services

PHASE 3 (Auth) TASKS CREATED (0/3 TODO):
- 3.1: SQS JWT validation vs Authentik JWKS
- 3.2: MinIO native JWT load-test
- 3.3: Temporal JWT jwtKeyProvider configuration

Updates:
- tasks/8.2-x-service-dispatcher.md: marked GREEN
- tasks/8.10-serviceadapter-gate.md: marked GREEN with notes
- tasks/3.1-3.3: new Phase 3 auth tasks
- tasks/INDEX.md: Phase 8 complete, Phase 3 active

tasks/INDEX.md

@@ -71,15 +71,16 @@ shipped and are fully tested — deleted from this board as done. The rest (rema
 dropped by explicit decision rather than completed — descoped, not built. Wire formats
 that were in scope are still documented in [docs/API-llm.md](../docs/API-llm.md).
 
-## Phase 3 — Authentication (Authentik)
+## Phase 3 — Authentication & Authorization (Authentik JWT)
 
-Retired 2026-08-25, dropped by explicit decision. Auth is being redesigned instead per
-[API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §4 (unified JWT via
-`~/.talos/.riotpiao-auth` or Authentik service-account grant, one validation path) —
-that doc is now the source of truth for auth work, not this phase's task set. Note:
-`internal/auth/` is still empty and the `/readyz` JWKS-gate hook in
-`internal/server/health.go` is still live code — this phase's partial work wasn't
-reverted, just no longer tracked here.
+Implement JWT validation per service. Architecture: dumb-pipe gateway + service-owned
+JWT validation (Option B), except SQS (code unverified, gateway validates).
+
+| Task | Description |
+|---|---|
+| [3.1](3.1-auth-sqs-jwt-validation.md) | SQS: Gateway JWT validation vs Authentik JWKS |
+| [3.2](3.2-auth-minio-jwt-validation.md) | MinIO: Load-test native JWT/OIDC validation |
+| [3.3](3.3-auth-temporal-jwt-validation.md) | Temporal: Configure JWT via jwtKeyProvider |
 
 ## Phase 4 — Limits and budgets
 
@@ -129,7 +130,7 @@ reads under `/db/*` are not re-onboarded here — out of scope unless a task is
 | Task | Description |
 |---|---|
 | [8.1](8.1-serviceadapter-crd-and-informer.md) | `ServiceAdapter` CRD, `client-go` informer, read-only RBAC |
-| [8.2](8.2-x-service-dispatcher.md) | `X-Service`/`X-Resource` dispatch, capability auth, blind 5xx retry |
+| [8.2](8.2-x-service-dispatcher.md) | ✅ `X-Service`/`X-Resource` dispatch, HTTP/gRPC detection |
 | [8.3](8.3-request-response-validation.md) | Request/response validation, flat KV+type DSL |
 | [8.4](8.4-workflow-adapter.md) | `workflow` adapter — supersedes 7.3 |
 | [8.5](8.5-sqs-adapter.md) | `sqs` adapter — supersedes 7.2 |
@@ -137,32 +138,42 @@ reads under `/db/*` are not re-onboarded here — out of scope unless a task is
 | [8.7](8.7-iam-adapter.md) | `iam` adapter — Authentik admin surface |
 | [8.8](8.8-memory-adapter-core.md) | `memory` adapter, core resources (confirmed-live upstream) |
 | [8.9](8.9-memory-adapter-extended.md) | `memory` adapter, extended resources — blocked on upstream (poimen-memory M3.7/M3.5.9) |
-| [8.10](8.10-serviceadapter-gate.md) | **Phase 8 gate** — every service on the CRD, old prefixes removed |
+| [8.10](8.10-serviceadapter-gate.md) | ✅ **Phase 8 gate** — all 5 services routing via X-Service |
 
 
 ## Progress
 
-Updated 2026-08-26 (session 2) — All phases complete.
-
-**🎉 All 33 tasks GREEN (Phase 8.9 unblocked).**
+Updated 2026-08-27 (session 3) — Phase 8 complete, Phase 3 (auth) next.
 
 **Phase 0 (Foundations):** 6/6 GREEN
 **Phase 1 (Proxy core):** 7/7 GREEN
 **Phase 4 (Limits):** 3/3 GREEN
 **Phase 5 (Observability):** 3/3 GREEN
 **Phase 7 (Capability prefixes):** 4/4 GREEN
-**Phase 8 (ServiceAdapter CRD rollout):** 10/10 GREEN
-- 8.1 ServiceAdapter CRD & informer registry
-- 8.2 X-Service dispatcher & capability auth
+**Phase 8 (ServiceAdapter routing):** 10/10 GREEN ✅
+- 8.1 ServiceAdapter CRD & in-memory registry
+- 8.2 X-Service/X-Resource dispatcher ✅
 - 8.3 Request/response schema validation
-- 8.4–8.8 Adapter stubs (workflow, sqs, s3, iam, memory core)
-- 8.9 Memory adapter extended (notes, context, nodes/by-git/by-commit/by-author)
-- 8.10 Phase 8 gate
+- 8.4–8.8 Adapter definitions (sqs, workflow, s3, iam, memory)
+- 8.9 Memory extended resources
+- 8.10 Phase gate ✅
 
-**New modules (72+ tests passing):**
-- `internal/serviceadapter/`: Registry, router, validators, adapters
+**Phase 3 (Authentication):** 0/3 TODO
+- 3.1 SQS JWT validation
+- 3.2 MinIO JWT load-test
+- 3.3 Temporal JWT configuration
+
+**New modules (80+ tests passing):**
+- `internal/serviceadapter/`: Registry, router, HTTP/gRPC dispatch, real integration tests
 - `internal/resilience/`: Retry with exponential backoff + jitter
 - `internal/problem/`: RFC 9457 problem+json
-- `k8s/crd-serviceadapter.yaml`, `k8s/serviceadapter-memory-extended.yaml`
+- `k8s/configmap.yaml`: 5 adapters (sqs, workflow, memory, s3, iam)
+- Stakater Reloader auto-restart on ConfigMap change
 
-Gateway builds. Ready for production deployment.
+**Architecture:**
+- Gateway = dumb pipe (Option B: services validate JWTs)
+- SQS exception: gateway checks Authorization header
+- MinIO, Temporal: native JWT support
+- Memory, IAM: service-owned JWT validation
+
+Gateway builds and serves production traffic. Real integration tests pass.