Repository navigation
feat(identity): enforce live scoped authorization and trusted evidence - #39
Merged
Merged
Conversation
Record the different second review pair and retain the failed initial attempt's evidence limits. Fresh same-source A/B qualification follows. ADR: 0007, 0056, 0063
Retain the first body or explicit runtime-join exception instead of masking it in finally. Export only case-bound closed boundary and owner task observations so startup and cleanup cancellations can be separated. Validate clean and three planted fault paths with actual native work, including the old test's masking counterexample. The earlier hosted cancellation remains unexplained; no timeout or runtime policy changes. ADR: 0007, 0047, 0060, 0063
Preserve original proof receipts and disclose the corrected container count against retained raw cleanup evidence. Record source binding and the first independent review round without asserting a hosted cause. ADR: 0007, 0047, 0060, 0063
Record the second fresh independent pair and exact retained evidence verification. Keep hosted cancellation and helper scheduling causes unproven until source-bound qualification supplies actual evidence. ADR: 0007, 0047, 0060, 0063
The native execution fixtures may consume their sole extra hint while an earlier empty recovery still owns private cleanup. Wait for actual native work and local identity release before issuing that same hint. Reproduce premature consumption with real SQL/native workers and an owned System timer cleanup barrier. Preserve all existing budgets, production policy and original case identities; add one regression fact. ADR: 0047, 0059, 0060, 0063
Restore the original final cancellation check after readiness waits. Record the first independent review round and fresh exact-source clean and planted-failure evidence without claiming atomic cancellation or a cause for the earlier hosted failure. ADR: 0007, 0047, 0059, 0060, 0063
Record the second fresh pair and exact proof/source verification. Preserve the unknown hosted cause and require complete final-source A/B qualification before the follow-up draft is ready for review. ADR: 0007, 0047, 0059, 0060, 0063
Let the hosted browser installer leave stalled APT mirrors while retaining its complete dependency set, verification and existing time budgets. Read back effective root settings and remove only the exclusive fragment. Exercise the actual workflow shell across success and failure paths, and retain the failed prior attempts as unqualified observations. ADR: 0007, 0056, 0063
Make the write-failure control leave a genuinely incomplete fragment before refusing, then verify that the actual workflow shell removes it. Record the first independent review pair and the failed A receipt. ADR: 0007, 0056, 0063
Record the second fresh independent review pair and its extracted-shell checks. Keep the prior failed attempts separate from the complete hosted A/B qualification still required on the resulting source. ADR: 0007, 0056, 0063
The complete B assignment reaches the last public audit before its sixteen-minute outer allowance cancels it. Allocate seventeen minutes inside the same twenty-minute job, twelve-minute proof and thirty-second native cleanup limits. Bound the remaining cleanup/receipt steps and restore NuGet without a save post-hook to retain a three-minute tail. Exercise actual deadline and tail shells, preserving forced failures. Keep failed partial evidence distinct from complete qualification. ADR: 0007, 0056, 0063
Record two independent approvals, their actual-shell controls and historical evidence checks without claiming new hosted qualification. ADR: 0056, 0063
Record fresh second-round approvals and independent historical evidence revalidation. Keep complete final-source hosted A/B as a separate gate. ADR: 0056, 0063
The hosted snapshot control fails strict temporary cleanup while its Git object directory changes. Keep maintenance in the foreground only in the synthetic repository so the waited commit also waits its actual work. Prove nested commit-graph completion with a real Git trace under a private configuration that otherwise requests background maintenance. Retain strict cleanup and all OpenAPI comparison and admission rules. The observed mechanism is not a captured trace of the hosted failure. ADR: 0007, 0052
Reject a planted graph write failure even when a prior graph exists. Correct pinned source anchors using physical raw-file lines and record both first-round reviews and their verified fixes. ADR: 0007, 0052
Record two fresh second-round approvals and the independently repeated clean, detached and planted-failure controls with their runtime limits. ADR: 0007, 0052
Both aggregate jobs reject a gate but discard which source-owned producer and step failed validation. Emit finite state words before the unchanged refusal so later API success cannot obscure the original observation. Never export arbitrary provider values or retry inconsistent evidence. Keep the unsuccessful historical attempt separate from new qualification. ADR: 0007, 0063
Retain independent closed-output checks and historical evidence limits. Separate complete public component observations from failed whole-run qualification and final-source A/B still required. ADR: 0007, 0056, 0063
Record fresh differential and mutant controls, independent component archive checks and the unchanged final-source whole-workflow gate. ADR: 0007, 0063
Disable the unowned telemetry exporter in the Outbox host fixture and join actual startup before disposal even when its assertion wait expires. Retain only finite startup facts from the real test adapter output. Report closed producer states before the unchanged aggregate refusal. Keep unknown hosted causes distinct from local counterfactual evidence. ADR: 0007, 0044, 0046, 0063
Record independent code, protocol and retained-evidence validation while preserving unknown hosted causes and complete final-source A/B gates. ADR: 0063
Record the second fresh review pair and narrow container identity prose to the exact retained evidence. Keep full final-source A/B pending. ADR: 0063
Read fresh complete attempt snapshots under one short acquisition budget before applying the unchanged successful-producer witness. Refuse terminal, malformed and identity-invalid evidence immediately, including when an earlier owner is pending. Never combine snapshots. Keep the five-minute aggregate ceiling and upload reserve unchanged. ADR: 0063
Reject malformed or reversed creation timestamps before a pending owner can cause another read. Record independent repros and corrected first-round review validation. ADR: 0063
Record fresh second-round deadline and malformed-evidence controls, with retained failed-attempt and pending hosted qualification limits. ADR: 0063
Phase 02b's phase document reached 18,884 lines, 92% of them dated packet records, and Phase 02d followed the same shape; status was narrated in five places and no check covered link fragments. The maintainer accepts keeping the plan and the record in separate files, status in one place, and two CI guards that hold both, after one review round whose findings this text resolves. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moves every dated packet record out of the two phase documents into sibling append-only delivery logs, grouped by packet in source order, with the superseded Status blocks kept verbatim in each log's archive. Each heading's anchor was recomputed in its new file and checked against its original one, duplicates included, and every original line survives the split; only heading levels and link targets around the text change. 606 inbound links are retargeted with their text unchanged, so the Accepted ADRs touched owe no amendment. Phase 04's one dated plan heading keeps its date in its acceptance line and its six links follow it. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Packet state was narrated in the phase Status block, the packet table, the Completion Criteria preamble, the roadmap index, CLAUDE.md and the repository README, and every step edited all of them. Each now points at the phase document, whose bounded Status block owns packet state; CLAUDE.md drops from 856 to 405 lines. The rule itself lands where readers look for it: Roadmap § Phase Structure and § Decision Timing, Documentation Standards, the glossary, CLAUDE.md and the two skills that write roadmap records. ADR-0069's dated amendment names the README as a sixth carrier and fixes how its budgets are counted. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The link audit strips fragments and reads only changed files, so a moved heading broke links silently, and nothing stopped a phase document from growing records again. The meta job now resolves every fragment link in the tree against GitHub's heading slugs and holds phase documents, delivery logs, the roadmap index, CLAUDE.md and the README to ADR-0069; `make lint` runs both through `lint-docs`. Each guard ships planted-violation controls, the source census classifies the four new tooling files, and the link audit now skips code spans as it already skipped fenced samples. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A delivery log is too large to read whole, so an agent needing one entry has no map of the rest. The amendment opens each log with an index generated from its headings and checked in CI, listing lengths rather than line numbers and no inferred record kinds, and states that the index is navigation, not a record. ADR: 0069 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Retain two fresh second-round approvals and actual rediscovery of both complete assignments. Keep the unchanged plan and population explicit; final-source hosted A/B remains the qualification gate. ADR: 0063, 0076, 0077
Give admission, routing, generation binding, framework capabilities and provenance their own whole-method proofs in the existing collection. Preserve the complete control bodies and one shared capability inventory; leave detectors, production code and execution limits unchanged. Record exact source-token reconstruction and instrumented control/result multiset equality. Clean timing, plan review and full hosted A/B remain required; diagnostic instrumentation is restored and never ships. ADR: 0047, 0063, 0076, 0077
Retain all prior timing rows and add only actual complete passing new Facts, with clean source/tree/binary and raw TRX provenance. Review the new population and both complete assignment discoveries without changing counts, algorithms, concurrency, ceilings or cleanup reserve. Record the first independent review and measured-plan approval; second review and final-source hosted A/B remain open. ADR: 0047, 0063, 0076, 0077
Retain two fresh independent second-round approvals and the complete source/control/timing/discovery evidence. Keep final-source hosted A/B as the remaining qualification gate with unchanged execution limits. ADR: 0047, 0063, 0076, 0077
Expand each nonsealed helper once per detector evaluation while retaining all direct helper visits and existing clean, dirty and restored controls. The three focused controls pass before and after; local mutation duration falls from 122.297 to 6.486 seconds without changing the CI window. Preserve the latest failed hosted attempt and keep complete final-source A/B qualification open. ADR: 0046, 0063, 0069
Record independent semantic and evidence review plus both actual selector layouts without treating local speed measurements as hosted fit. ADR: 0063, 0069
Record the second fresh semantic and evidence reviews while retaining the existing complete hosted A/B qualification gate and CI limits. ADR: 0063, 0069
Include historical stock proofs in the existing closed failure projection. Observe provider SDK milestones and capture startup cancellation before cleanup without exporting raw errors or changing lifecycle authority. Preserve the failed full attempt, existing startup limits and incomplete qualification status. Native controls and a real HTTPS provider smoke pass. ADR: 0062, 0063, 0069
Record independent semantic and protocol review with repeated native controls and raw failed-attempt audit. Keep the provider cause unknown. ADR: 0062, 0063, 0069
Close the second independent review while retaining the unknown provider cause, unchanged bounds and mandatory complete hosted A/B qualification. ADR: 0062, 0063, 0069
Poll incomplete readiness within the existing startup allowance instead of admitting a numeric prefix or refusing an empty publication immediately. Preserve owner, cancellation, native-exit and closed-diagnostic boundaries. Add actual-file and counterfactual controls, preserve the failed hosted attempt, and keep complete clean-source qualification open. ADR: 0055, 0056, 0063, 0069
Retain independent source review and a complete clean-workspace frontend replay while keeping actual demo and hosted qualification separate. ADR: 0055, 0056, 0063, 0069
Keep real renewal and expired-window proof, then hold the next actual pacing callback while the positive Outcome completes. Preserve every assertion, allowed conservative refusal and existing lease/stage bound. Join real callbacks and factories on all exits; retain clean, refusal and isolated dirty-cleanup evidence without claiming hosted qualification. ADR: 0047, 0059, 0063, 0069
Retain independent source and raw-proof review while distinguishing the selected positive schedule from unknown historical CI interleavings. ADR: 0047, 0059, 0063, 0069
Record both fresh review closures and the clean managed browser proof before restarting complete hosted qualification on one stable source. Local evidence does not promote the packet or replace the full A/B pair. ADR: 0063, 0069, 0076, 0077
The final permission promotion leaves no Adopted standards. Preserve the existing status/index check while allowing its truthful zero count. An isolated future-document twin fails before and passes after this fix. ADR: 0069, 0076, 0077
Retain independent raw before/after and cancelled-attempt checks before the next review round and complete hosted source qualification. ADR: 0063, 0069, 0076, 0077
Close the second independent census review and preserve the source-bound qualification gate before promoting final permission and test carriers. ADR: 0063, 0069, 0076, 0077
Promote live permission and catalogue status only after complete same-source hosted A/B and independent original-evidence audits. Keep later entry, UI, Platform and closure work in their owning Phase 03 packets. ADR: 0063, 0069, 0076, 0077 Module: Identity, Tenancy, Customization, Education, Audit
Close the fresh documentation review after qualified A/B and preserve source provenance, later packet ownership and the pending PR review. ADR: 0063, 0069, 0076, 0077
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Architecture 
Inside the changed components — 1 viewComponent view — Live Authorization and Evidence Internal components handling policy verification, isolated read sessions, and mandatory evidence durability 
Data flow 
Review ✨ Nothing flagged · reviewed Tip Open a diagram on the canvas, then press W or click play to walk through the change one step at a time 🪧 More tips
Thanks for using PR Lens! It's free for OSS. If it helped, a star helps other teams find it. |
Contributor
|
Important Review skippedToo many files! This PR contains 368 files, which is 218 over the limit of 150. To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to Team to raise the limit. Usage-priced reviews support at most 300 files.
 |
Share the explicit pair rule across seed and API runtime projections so invalid local configuration cannot reach stack startup or migrations. Reconcile verified stale authorization carriers with the delivered code. ADR: 0069, 0076, 0077
Retain the first independent review and complete guarded frontend result for the two verified review fixes before the second review round. ADR: 0069, 0076, 0077
Keep the real launcher fixture's dependency closure intact after sharing auxiliary configuration validation. Record live PostgreSQL/API results and the second independent correction review before updating PR 39. ADR: 0069, 0076, 0077
Replace a racy any-lock observation and timed release with positive SQL acquisition and explicit cleanup ownership. Keep runtime cancellation bounds intact and retain safe source locations for future CI failures. ADR: 0063, 0069, 0076
Retain the independent lifetime and evidence checks together with a real wrong-mode counterfactual before the second correction review round. ADR: 0063, 0069, 0076
Record independent lifetime and diagnostic proof without attributing a historical interleaving or new-head CI success that has not been observed. ADR: 0063, 0069, 0076
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Approach
Authorization reads use a separate four-owner app-role lane; standalone evidence uses a separate two-owner lane. Qualification binds both to the installed Identity authority and actual business database. Operation-bound witnesses carry accepted tenant-wide read authority through the same EF/RLS owner and generation. Writable outer success commits unresolved denials atomically; read-only/ownerless success requires prior standalone acknowledgement.
Finite grant administration and manifest adoption remain explicit audited application operations. Current native BFF operations retain their existing AccountSite ceiling; P03-3 owns the next web administration and new-user entry surfaces.
Tests
Complete hosted A/B, implementation source
c39ab614: 27/27 jobs per attempt, all seven required checks. Each passes 6,927 backend cases (2,998 Unit, 3,331 Integration, 593 Architecture, five Contract), zero failures/skips, with different complete assignments and identical source/toolchain/plan/population. All 50 original ZIPs pass API identity, size, SHA-256 and CRC checks; two independent reviewers audit the original evidence.Each A/B hosted frontend run passes 2,458 tests / 73 files / two packages, zero skips/todos, plus typecheck, lint, build and native ingress cleanup. Each hosted public demo verifies 27 audits, nine browser navigations, 24 visibility controls, TLS/timeout counterfactuals, 134 HTTP-200 API completions and owned cleanup. Eight LCP medians per attempt remain advisory warnings.
Real PostgreSQL/PgBouncer small-pool progress, denial commit/crash, fixed-key reconciliation, scoped SQL/EF, grant/delegation and real provider/native controls are part of the completed population. Earlier failed and cancelled attempts remain disclosed in the delivery log.
Final documentation-only commits follow the qualified implementation source and receive corpus checks plus documentation lint. The PR's own protected checks run against its merge head; they are distinct from the implementation-source A/B evidence.
Review follow-up: seed and API share the explicit auxiliary-pair rule; invalid empty/partial pairs refuse before stack startup or migrations. Six stale documentation/skill carriers now match runtime. Validation: 246 focused tests, 2,481 guarded frontend tests, six seed environment controls, three real PostgreSQL/API launcher cases, typecheck, lint and documentation checks pass. This follow-up retains the original implementation-source A/B attribution and the maintainer's broader review scope limits.
CI cancellation-control follow-up: failed run
40662644606contained one cancellation-test failure; integration aggregation correctly rejected that producer. The test now uses a private SQL lock acknowledgement, exact holder PID/mode checks and explicit joined release. Application admission timeouts remain unchanged. Validation passes 9/9 focused PostgreSQL tests, 95/95 native controls, an expected-failing wrong-mode counterfactual and two fresh review rounds. Current PR merge-head CI, head4406c1d3, passes 27/27 jobs, all seven required checks and 6,927/6,927 backend cases, zero failures/skips. All 25 original ZIPs pass API identity, size, SHA-256 and CRC verification.Risk
Migration / Rollback
Use the existing P03-1 schema and installed authority. Outside Development, configure both
ConnectionStrings:IdentityAuthorizationandConnectionStrings:AuthorizationEvidence; Development can derive the pair from its owned direct PostgreSQL Default. Keep the real app role and qualify the actual database/authority. Configuration and binary rollback follow retained-owner shutdown before replacing the process.Related
Prepared with Codex.