diff --git a/PLAN.md b/PLAN.md
index dd12288..1cf0716 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -258,7 +258,7 @@ Check off items as completed. Each phase builds on the previous.
   - [x] Request ID generation
 - [x] Create `web/auth.py` with get_current_user, require_role
 - [x] Write tests: auth extraction, CSRF validation, untrusted IP rejection
-- [ ] **Commit checkpoint**
+- [x] **Commit checkpoint** (84225d8)
 
 ### Step 7.2: Health & Static Assets
 - [ ] Create `web/routes/health.py` with /healthz (DB writable check)