Repository navigation

feat(identity): enforce live scoped authorization and trusted evidence - #39

Merged

cemililik merged 697 commits into

mainfrom

development

Oct 28, 2026

Merged

feat(identity): enforce live scoped authorization and trusted evidence#39
cemililik merged 697 commits into
mainfrom
development

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 22, 2026
- docs(roadmap): close tooling census correction reviews
  cemililik
  committed
  d2a32c9
- test(jobs): preserve native wait failure attribution
  cemililik
  committed
  f3ca5c4
- docs(roadmap): record native wait diagnostic review
  cemililik
  committed
  8234856
- docs(roadmap): close native wait diagnostic reviews
  cemililik
  committed
  12d4f08
- test(jobs): wait for actual cleanup before fixture hints
  cemililik
  committed
  87ac371
- test(jobs): retain cancellation before fixture hint emission
  cemililik
  committed
  9d1ba8c
- docs(roadmap): close fixture handoff correction reviews
  cemililik
  committed
  9eecf96
- fix(ci): bound browser dependency mirror waits
  cemililik
  committed
  b25d00a
- test(ci): exercise partial browser setup writes
  cemililik
  committed
  6027530
- docs(ci): record browser acquisition review closeout
  cemililik
  committed
  e2954be
- fix(ci): reserve bounded public demo completion time
  cemililik
  committed
  d5f1982
- docs(roadmap): record first outer-budget correction reviews
  cemililik
  committed
  2dc9d74
- docs(roadmap): close outer-budget correction reviews
  cemililik
  committed
  58d9ecd
- fix(ci): join maintenance in OpenAPI control repositories
  cemililik
  committed
  f5696ec
- test(ci): require successful owned Git maintenance proof
  cemililik
  committed
  ace2a77
- docs(roadmap): close Git maintenance fixture reviews
  cemililik
  committed
  979750c
- fix(ci): retain closed producer gate refusal diagnostics
  cemililik
  committed
  5bce55d
- docs(roadmap): record gate diagnostic review evidence
  cemililik
  committed
  84f681a
- docs(roadmap): close producer gate diagnostic reviews
  cemililik
  committed
  95edb21
- fix(ci): own Outbox startup and attribute producer refusal
  cemililik
  committed
  8231d17
- docs(roadmap): record Outbox correction first review
  cemililik
  committed
  0fa8e64
- docs(roadmap): record independent Outbox correction approval
  cemililik
  committed
  ed223ac
- fix(ci): bound pending producer metadata acquisition
  cemililik
  committed
  4834e0c
- fix(ci): validate creation times before metadata settlement
  cemililik
  committed
  8e437c3
- docs(roadmap): record independent metadata acquisition reviews
  cemililik
  committed
  dada277
- docs(decisions): accept ADR-0069 phase documents and delivery logs
  
  cemililik
  and
  claude
  committed
  8a04bc5
- docs(roadmap): split Phase 02b and 02d records into delivery logs
  
  cemililik
  and
  claude
  committed
  f5a4382
- docs: hold packet status once and record the delivery log rule
  
  cemililik
  and
  claude
  committed
  34c6be9
- ci(meta): guard link fragments and roadmap structure
  
  cemililik
  and
  claude
  committed
  1b6107c
- docs(decisions): amend ADR-0069 with generated delivery log indexes
  
  cemililik
  and
  claude
  committed
  81cedbb
- docs(roadmap): open each delivery log with a generated index
  
  cemililik
  and
  claude
  committed
  fa32c0c
Commits on Oct 23, 2026
- fix(ci): install Chromium without the APT mirror
  
  cemililik
  and
  claude
  committed
  395d078
- docs(decisions): propose owned tenant BFF sessions
  cemililik
  committed
  baeb32f
- docs(decisions): resolve BFF session proposal review findings
  cemililik
  committed
  30933cb
- docs(roadmap): finish the BFF decision pass and prior closeout
  cemililik
  committed
  7474015
- docs(decisions): revise BFF ownership after maintainer review
  cemililik
  committed
  325558e
- docs(decisions): retain logout owners in subject admission
  cemililik
  committed
  ecb34b5
- docs(roadmap): complete revised BFF proposal review
  cemililik
  committed
  d3033f3
- docs(decisions): accept native tenant BFF session ownership
  cemililik
  committed
  eb91186
- feat(identity): add inactive BFF RP and provider event policy
  cemililik
  committed
  1d51393
- fix(identity): qualify logout and event response boundaries
  cemililik
  committed
  26ccc73
- fix(identity): preserve provider defaults and closed network reasons
  cemililik
  committed
  fd70846
- feat(identity): own bounded native BFF session lifecycles
  cemililik
  committed
  11cd37d
- fix(identity): preserve current callback visitor attribution
  cemililik
  committed
  47ffca7
- docs(roadmap): close native BFF ownership reviews
  cemililik
  committed
  2ebae0c
- feat(web): implement closed BFF HTTP and request projections
  cemililik
  committed
  3279258
- fix(web): retain native RSC activity through Next middleware
  cemililik
  committed
  7fded69
- docs(roadmap): close P02b-7 HTTP protocol review rounds
  cemililik
  committed
  e91cf15
- feat(web): activate optional tenant BFF and localized session UI
  cemililik
  committed
  09b3aa6
- fix(web): close development auth traces and add skip links
  cemililik
  committed
  2cf2a25
- fix(web): preserve focus through session recovery transitions
  cemililik
  committed
  a48011c
- test(identity): prove native BFF lifecycle and browser isolation
  cemililik
  committed
  5efecf7
- fix(identity): join BFF proof owners before reporting success
  cemililik
  committed
  83858d1
- fix(identity): observe parent EOF throughout BFF acquisition
  cemililik
  committed
  b600a0f
- chore: synchronize merged main history
  cemililik
  committed
  fedffbe
- test(web): expect closed shells when tenant sign-in is disabled
  cemililik
  committed
  d3d7c04
- test(ci): isolate held-constructor cancellation and copied ingress
  cemililik
  committed
  19cd810
Commits on Oct 24, 2026
- test(jobs): preserve the handoff control before constructor entry
  cemililik
  committed
  1784507
- test(web): distinguish closed browser readiness failures
  cemililik
  committed
  c245afc
- test(jobs): retain the first source-contention failure
  cemililik
  committed
  f2a3814
- test(jobs): accept lawful finalizer retries in causal restart
  cemililik
  committed
  419a8d9
- test(web): retain closed browser failure and cleanup evidence
  cemililik
  committed
  4ce7d4d
- docs(roadmap): close P02b-7 implementation qualification
  cemililik
  committed
  5fc18ce
- fix(web): preserve anonymous reads and BFF failure ownership
  cemililik
  committed
  903ed92
- docs(roadmap): record the reviewed BFF correction handoff
  cemililik
  committed
  a8ee8ba
- test(web): retain startup evidence until child absence
  cemililik
  committed
  5e07cce
- test(jobs): distinguish recovery renewal from initial timer setup
  cemililik
  committed
  268e30c
- docs(roadmap): refresh the recovery follow-up index
  cemililik
  committed
  c2a7e97
- fix(ci): classify private fixture image preparation failures
  cemililik
  committed
  c12f4ee
- docs(auth): propose uncertain AccountSite refusal policy
  cemililik
  committed
  f712fad
- docs(auth): accept explicit AccountSite refusal decision
  cemililik
  committed
  e782f97
- fix(auth): bind closed BFF boundaries and lifecycle proofs
  cemililik
  committed
  0fa1afe
- test(auth): close configuration and scoped dependency escapes
  cemililik
  committed
  9a32318
- fix(auth): retain ordinary sessions on uncertain API refusal
  cemililik
  committed
  7133f8a
- test(auth): pin the checked configuration plugin binding
  cemililik
  committed
  4dbb1d5
- fix(auth): preserve accessible recovery and proof observations
  cemililik
  committed
  31a2754
- test(auth): bind provider and CI proof failure boundaries
  cemililik
  committed
  18f3c70
- fix(auth): reconcile current session proof carriers
  cemililik
  committed
  4ead28c
- docs(auth): distinguish verified callback authority
  cemililik
  committed
  f64c51f
- test(auth): observe provider time and actual HTML refusal
  cemililik
  committed
  9fb1cf3
- test(auth): bind authenticated SDK result boundaries
  cemililik
  committed
  4b7f01a
- docs(auth): record SDK counterfactual review evidence
  cemililik
  committed
  abdd5da
- docs(auth): hand off the reviewed correction source
  cemililik
  committed
  e42cc55
- test(jobs): retain closed recurrence wait observations
  cemililik
  committed
  d380aa6
- test(ci): bind both recurrence observation cases independently
  cemililik
  committed
  43b12c7
- test(auth): preserve closed browser launch observations
  cemililik
  committed
  dd57d53
- test(auth): report browser liveness without inferring exit
  cemililik
  committed
  aeeea13
- test(jobs): isolate causal stop after actual provider acceptance
  cemililik
  committed
  ae2f7f7
- docs(roadmap): record final BFF correction qualification
  cemililik
  committed
  a286950
- fix(auth): close review proof and recovery gaps
  cemililik
  committed
  cac786d
- docs(roadmap): retain first correction review receipts
  cemililik
  committed
  86598f7
- docs(roadmap): record independent correction recheck
  cemililik
  committed
  806d6ba
- test(auth): delimit opaque observer child arguments
  cemililik
  committed
  3dedda8
- docs(roadmap): record observer argument review evidence
  cemililik
  committed
  5748dbb
- docs(roadmap): freeze reviewed observer correction
  cemililik
  committed
  0bde36f
- docs(roadmap): record reviewed BFF correction qualification
  cemililik
  committed
  6b6f062
- docs(roadmap): close merged tenant BFF delivery
  cemililik
  committed
  0d0696a
- docs(roadmap): propose phase exit enforcement decisions
  cemililik
  committed
  c0261ca
- docs(roadmap): refine phase exit proposal after review
  cemililik
  committed
  7e6e61f
- docs(roadmap): require canonical inventory before gate acceptance
  cemililik
  committed
  49b541c
- docs(roadmap): record phase exit proposal review verification
  cemililik
  committed
  486588d
- docs(decisions): accept phase exit enforcement package
  cemililik
  committed
  4b29ea7
- feat(kernel): guard sensitive exception messages at compile time
  cemililik
  committed
  212ec0f
- fix(kernel): analyze dynamically bound exception constructors
  cemililik
  committed
  4682e26
- docs(roadmap): close first phase exit implementation step
  cemililik
  committed
  fa56aac
- test(kernel): verify durable asynchronous inventory coverage
  cemililik
  committed
  b20ffae
- fix(kernel): refuse unsupported inventory table creation
  cemililik
  committed
  c241301
- fix(kernel): close inventory schema resolution bypasses
  cemililik
  committed
  bfa6ec8
- docs(roadmap): close asynchronous inventory verification
  cemililik
  committed
  3a56444
- fix(kernel): reconcile delivered phase contract carriers
  cemililik
  committed
  1231aed
- docs(roadmap): record carrier reconciliation review
  cemililik
  committed
  4d242bc
- docs(roadmap): close phase carrier reconciliation
  cemililik
  committed
  63a4b52
- chore(repo): merge current main into development
  cemililik
  committed
  c5847a9
Commits on Oct 25, 2026
Commits on Oct 26, 2026
- feat(identity): add scoped membership and owned seed foundation
  cemililik
  committed
  0495f2b
- docs(identity): reconcile contextual proof inventory
  cemililik
  committed
  9c9ec4a
- fix(identity): confine value-bearing storage diagnostics
  cemililik
  committed
  f814d97
- fix(identity): confine exported storage failure descriptions
  cemililik
  committed
  67d75e6
- docs(roadmap): close contextual identity foundation reviews
  cemililik
  committed
  7d29843
- feat(identity): normalize existing bindings before tenant admission
  cemililik
  committed
  5f7a062
- fix(identity): confine binding read failure diagnostics
  cemililik
  committed
  cb5937a
- docs(roadmap): close existing identity binding admission reviews
  cemililik
  committed
  83f701d
- test(identity): reconcile complete qualification inventories
  cemililik
  committed
  6c379f1
- chore(repo): reconcile merged main ancestry
  cemililik
  committed
  124ff4a
- docs(identity): reconcile remaining foundation carrier claims
  cemililik
  committed
  3f1d4f6
- fix(identity): close complete qualification findings
  cemililik
  committed
  4fc7e1a
- fix(identity): qualify the complete parent refusal stack
  cemililik
  committed
  3754e4e
- fix(testing): isolate the BFF browser credential store
  cemililik
  committed
  e05ba3a
- ci(testing): refresh source-bound advisory method timings
  cemililik
  committed
  193d61c
- docs(roadmap): close P03-1 implementation qualification
  cemililik
  committed
  d32f310
- fix(identity): close reviewed migration and lifecycle boundaries
  cemililik
  committed
  413c9bd
- fix(identity): confine read failures and reject empty authority input
  cemililik
  committed
  2692314
- fix(identity): refuse ambiguous migration credentials
  cemililik
  committed
  492f3f6
- fix(ci): include contextual read proofs in fixture census
  cemililik
  committed
  c14ec6a
- fix(ci): refresh measured identity test timing weights
  cemililik
  committed
  dfdf9ca
- fix(ci): isolate independent architecture mutation collections
  cemililik
  committed
  7aabc6d
- docs(decisions): propose ordinary CI job window
  cemililik
  committed
  2d2a6f9
- docs(decisions): close ordinary window proposal findings
  cemililik
  committed
  e50e6d1
- docs(roadmap): record second ordinary window proposal review
  cemililik
  committed
  b048412
- docs(decisions): clarify ordinary window review boundaries
  cemililik
  committed
  d5ebab8
- docs(roadmap): record revised window proposal first review
  cemililik
  committed
  9ba876f
- docs(roadmap): record revised window proposal second review
  cemililik
  committed
  c274fa6
- docs(decisions): accept ordinary-only CI job window
  cemililik
  committed
  2a1917c
- docs(roadmap): record first CI window acceptance review
  cemililik
  committed
  7dc3f8b
- docs(roadmap): close CI window acceptance reviews
  cemililik
  committed
  1d609d3
- fix(ci): bind ordinary windows to verified producer identity
  cemililik
  committed
  c2695f2
- docs(roadmap): record first ordinary budget code review
  cemililik
  committed
  6bb91ed
- docs(roadmap): close ordinary budget reviews for qualification
  cemililik
  committed
  ea114d2
- docs(roadmap): record complete ordinary window hosted proof
  cemililik
  committed
  0db4b42
- docs(roadmap): record first hosted evidence review
  cemililik
  committed
  146f743
- docs(roadmap): distinguish hosted fixture subset evidence
  cemililik
  committed
  468e9c6
- docs(roadmap): close ordinary CI window implementation
  cemililik
  committed
  58e5a1d
Commits on Oct 27, 2026
Commits on Oct 28, 2026
- fix(kernel): retain bounded provider startup diagnostics
  cemililik
  committed
  09ac7c8
- docs(roadmap): record startup diagnostic review evidence
  cemililik
  committed
  01d8234
- docs(roadmap): freeze reviewed startup diagnostic source
  cemililik
  committed
  9385c9e
- fix(web): wait for complete owned browser port publication
  cemililik
  committed
  7dbf68f
- docs(roadmap): record browser readiness review and clean replay
  cemililik
  committed
  8a43eb9
- fix(kernel): pace recovery settlement after proven renewals
  cemililik
  committed
  6ea5e67
- docs(roadmap): record recovery scheduling lifetime review
  cemililik
  committed
  16614b3
- docs(roadmap): freeze reviewed browser and recovery corrections
  cemililik
  committed
  07a0431
- test(docs): admit the zero-adopted standard census
  cemililik
  committed
  fb7a892
- docs(roadmap): record the zero census first review
  cemililik
  committed
  bf79404
- docs(roadmap): freeze the reviewed final corpus source
  cemililik
  committed
  c39ab61
- docs(identity): close qualified authorization delivery carriers
  cemililik
  committed
  6c6747e
- docs(roadmap): record final authorization handoff reviews
  cemililik
  committed
  c37c3df
- fix(tooling): reject incomplete auxiliary sources before setup
  cemililik
  committed
  74254c8
- docs(roadmap): record PR 39 correction validation
  cemililik
  committed
  39c98e4
- test(tooling): complete isolated API launcher dependencies
  cemililik
  committed
  6cf8c71
- test(identity): acknowledge the exact role-catalog blocker
  cemililik
  committed
  6ed0f12
- docs(roadmap): record cancellation control proof and review
  cemililik
  committed
  ca82e24
- docs(roadmap): close cancellation control review rounds
  cemililik
  committed
  4406c1d

Commits

Commits on Oct 22, 2026

Commits on Oct 23, 2026

Commits on Oct 24, 2026

Commits on Oct 25, 2026