deferred(2): close DEFERRED #5 (lasuite-docs OIDC); open upload_conversion as follow-up

machine-docs/DEFERRED.md

@@ -81,22 +81,14 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA:** —
 
 ### 2026-05-28 — lasuite-docs OIDC parity ports + create-a-doc deeper test
-- [ ] **What:** Port `recipe-info/lasuite-docs/tests/oidc_login.py` (authenticated OIDC flow against
-      lasuite-docs's protected API) + `recipe-info/lasuite-docs/tests/upload_conversion.py` (.md/.docx
-      uploads via authenticated `/api/v1.0/documents/<id>/upload`) + add `test_create_doc.py` (the
-      §4.3 prescribed create-a-doc + read-back via authenticated `/api/v1.0/documents/`).
-- **Filed by:** Builder, phase 2 (Q3.1 lasuite-docs PARITY pass)
-- **Reason for deferral:** Requires lasuite-docs's OIDC env wired to the dep keycloak at install
-  time — `tests/lasuite-docs/install_steps.sh` that reads `$CCCI_DEPS_FILE` for the dep keycloak
-  domain, calls `harness.sso.setup_keycloak_realm`, inserts `SECRET_OIDC_RPCS` via abra, and writes
-  the OIDC env vars (`OIDC_REALM`, `OIDC_OP_*`) to the parent's `.env`. The Q3.1 first pass shipped
-  `test_oidc_with_keycloak.py` (exercises OIDC against the dep) + `test_auth_required.py` (proves
-  the auth gate is wired) — these meet the ≥2 specific floor but do not exercise the authenticated
-  lasuite-docs API.
-- **Re-entry trigger:** Before any Q3 gate claim (Q3.1 must show §4.3 create-a-doc) — i.e. the next
-  Phase-2 work cycle, not Phase-4. Adversary's Q3/Q4 checkpoint @ 2026-05-28 explicitly noted "will
-  revisit when Q3.1 is formally claimed."
-- **Linked IDEA:** —
+- [x] **CLOSED @2026-05-28** by Builder commits `41ede13` (SSO-dep refactor: deps-after-generic
+      tiers + `tests/lasuite-docs/setup_custom_tests.sh` hook + `deps_creds` fixture) and
+      `cd25f52` (functional/test_oidc_login.py parity port + functional/test_create_doc.py §4.3
+      prescribed create-a-doc + read-back). Both tests marked @pytest.mark.requires_deps.
+      Cold-verifiable: `RECIPE=lasuite-docs STAGES=install,custom cc-ci-run runner/run_recipe_ci.py`
+      → 5 custom tests PASS (incl. the two new ones), deploy-count=2 (recipe + keycloak dep).
+      `upload_conversion.py` parity (.md/.docx upload+conversion via authenticated
+      `/api/v1.0/documents/<id>/upload`) remains as a Phase-2 follow-up below.
 
 ### 2026-05-28 — cryptpad create-a-pad + content round-trip Playwright test
 - [ ] **What:** Add `tests/cryptpad/playwright/test_pad_content_roundtrip.py` — exercise the full
@@ -185,3 +177,13 @@ before the build is called done) — but does **not** force closure.
   logs in an interactive session; OR (b) re-enroll plausible after the operator confirms a
   working env recipe.
 - **Linked IDEA:** —
+
+### 2026-05-28 — lasuite-docs upload_conversion.py parity (.md/.docx upload + conversion)
+- [ ] **What:** Port `recipe-info/lasuite-docs/tests/upload_conversion.py`. The original uploads
+      a `.md` and a `.docx` to `POST /api/v1.0/documents/<id>/upload` and asserts the y-provider /
+      docspec conversion paths fire (.md → yjs; .docx → BlockNote → yjs).
+- **Filed by:** Builder, phase 2 (Q3.1 follow-up after the OIDC pieces closed)
+- **Reason for deferral:** Builder priority — the §4.3 create-a-doc floor is met by
+  test_create_doc.py (closed in the entry above). Upload/conversion exercises a distinct subsystem
+  (y-provider + docspec) and adds two binary fixtures + a multi-service-readiness wait.
+  Defensible defer; lift when the operator wants the deeper coverage OR Phase-4 reviews.