promote: foundation and IAM completion - #25

Closed

BeforeLights wants to merge 181 commits into

mainfrom

Commits on Aug 2, 2026

docs(plans): orchestrate Luna Max delivery batches
BeforeLights
committed
62e10cd
docs(operations): record Luna Max handoff
BeforeLights
committed
eeb0853
feat(api): compose audit and entitlement foundations
BeforeLights
committed
1ebdc1e
feat(aud): add tenant-scoped Prisma audit persistence
BeforeLights
committed
db436ce
feat(bua): add durable entitlement and usage persistence
BeforeLights
committed
ff69724
feat(iam): add versioned PKCE boundary
BeforeLights
committed
0f46d16
feat(iam): add versioned CSRF boundary
BeforeLights
committed
0124139
feat(iam): add durable credential lookup
BeforeLights
committed
46c2ee5
refactor(iam): make session principal lookup async
BeforeLights
committed
881b5d5
feat(iam): add durable session lifecycle
BeforeLights
committed
a10e443
feat(iam): persist personal identity bootstrap
BeforeLights
committed
5360c15
fix(iam): resolve organization memberships for sign-in
BeforeLights
committed
54cc494
feat(iam): persist MFA factors and recovery codes
BeforeLights
committed
5f7c58f
feat(iam): persist tenant-scoped memberships
BeforeLights
committed
3c90475
feat(api): enforce browser CSRF boundary
BeforeLights
committed
7ff5bd4
feat(iam): add secure session cookie boundary
BeforeLights
committed
9f140f1
feat(iam): keep browser refresh credentials in cookies
BeforeLights
committed
a909d9c
fix(iam): accept rotating refresh token cookie values
BeforeLights
committed
305fdec
feat(iam): rotate refresh sessions through HTTP
BeforeLights
committed
3af9101
feat(iam): revoke sessions through HTTP
BeforeLights
committed
15d7018
feat(iam): persist access-token lookup digests
BeforeLights
committed
5dc1779
feat(iam): derive tenant context from live sessions
BeforeLights
committed
0b19a0b
test(iam): verify protected tenant context integration
BeforeLights
committed
152eae3
feat(iam): compose durable MFA service
BeforeLights
committed
7852402
feat(iam): expose authenticated MFA lifecycle
BeforeLights
committed
02c1822
test(iam): verify MFA HTTP lifecycle
BeforeLights
committed
676c632
feat(aud): expose authenticated immutable audit reads
BeforeLights
committed
293ed25
feat(bua): expose scoped entitlement reads
BeforeLights
committed
dc045fd
feat(iam): expose current session identity
BeforeLights
committed
39dc6e0
fix(iam): preserve MFA state in session context
BeforeLights
committed
559124f
fix(ci): satisfy strict TypeScript lint gates
BeforeLights
committed
fa3795f
fix(ci): normalize repository formatting
BeforeLights
committed
238ce52
Merge pull request #24 from DatabreezeService/feat/foundation-identity-completion
BeforeLights
authored
86f25c8
feat(iae): expose exact artifact version reads
BeforeLights
committed
8022db1
feat(iae): expose artifact lineage reads
BeforeLights
committed
b06482a
feat(iae): version content placement availability
BeforeLights
committed
56ed43a
feat(iae): model explicit artifact deletion authorization
BeforeLights
committed
474843f
feat(iae): add governed retention request service
BeforeLights
committed
bf197f4
feat(iae): define verifiable artifact export manifests
BeforeLights
committed
c678bed
feat(iae): persist artifact export manifests
BeforeLights
committed
33e2fe6
feat(dsm): expose governed dataset publication APIs
BeforeLights
committed
98bcb59
feat(dsm): expose mapping publication endpoint
BeforeLights
committed
aef376c
feat(dsm): expose rule-set publication endpoint
BeforeLights
committed
2269787
feat(dsm): expose reference entity version history
BeforeLights
committed
66d2a11
feat(dsm): persist immutable dataset result manifests
BeforeLights
committed
f23dc51
feat(iae): add retention and export persistence schema
BeforeLights
committed
b36f66d
fix(iae): make Prisma placement registration idempotent
BeforeLights
committed
538cff4
feat(dsm): add Prisma dataset version adapter
BeforeLights
committed
2ce24da
feat(iae): add Prisma retention repository
BeforeLights
committed
9808e8f
feat(iae): add Prisma export repository
BeforeLights
committed
8d1baac
feat(iae): add Prisma lineage repository
BeforeLights
committed
72131d1
fix(iae): persist validated inbox transitions
BeforeLights
committed
9bbc79e
feat(iae): add resumable upload domain
BeforeLights
committed
1ca8cc2
feat(iae): coordinate resumable upload sessions
BeforeLights
committed
67713f2
feat(iae): persist resumable upload sessions
BeforeLights
committed
3fbb581
feat(iae): add Prisma upload session adapter
BeforeLights
committed
270ceb1
feat(iae): expose upload session control plane
BeforeLights
committed
1970f55
feat(iae): add Prisma evidence grant adapter
BeforeLights
committed
a077152
fix(dsm): enforce dataset result input validation
BeforeLights
committed
0bb9391
feat(dsm): list dataset result manifests
BeforeLights
committed
11bb7b7
feat(iae): persist artifact admission status
BeforeLights
committed
7da9117
feat(iae): coordinate artifact admission
BeforeLights
committed
ad9857b
feat(iae): expose artifact admission endpoint
BeforeLights
committed
f54d096
fix(iae): normalize retention adapter formatting
BeforeLights
committed
a860c91
fix(test): satisfy strict API lint gates
BeforeLights
committed
f496647
chore(api): refresh generated OpenAPI and migration inventory
BeforeLights
committed
356a4ff
feat(dsm): add immutable dataset quality result contract
BeforeLights
committed
8e430ba
feat(dsm): coordinate tenant-scoped quality results
BeforeLights
committed
b4e1873
feat(dsm): persist quality results with Prisma
BeforeLights
committed
53acdea
feat(dsm): expose dataset quality result API
BeforeLights
committed
9c12117
feat(engine): evaluate value-free dataset quality rules
BeforeLights
committed
e87d729
feat(iae): add revisioned inbox metadata policy
BeforeLights
committed
6b3c8cd
feat(iae): coordinate inbox metadata updates
BeforeLights
committed
76e7053
feat(iae): persist inbox metadata with Prisma
BeforeLights
committed
e6207c2
feat(iae): expose revisioned inbox metadata patch
BeforeLights
committed
0aba003
fix(test): remove unsafe quality response assertion
BeforeLights
committed
ecd89c9
feat(dsm): add reproducible profile disclosure contract
BeforeLights
committed
511c483
feat(dsm): coordinate scoped profile disclosures
BeforeLights
committed
612c1fe
feat(dsm): expose profile disclosure API
BeforeLights
committed
ef43306
feat(dsm): persist profile disclosures with Prisma
BeforeLights
committed
384213b
feat(dsm): add typed safe finding subjects
BeforeLights
committed
e415fa7
feat(dsm): expose typed safe finding values
BeforeLights
committed
261c8af
feat(dsm): add stable profile pagination
BeforeLights
committed
083e076
feat(dsm): expose cursor-paginated profiles
BeforeLights
committed
ebadd9d
feat(iae): add opaque upload storage boundary
BeforeLights
committed
ddb7fd2
feat(iae): verify uploads through storage boundary
BeforeLights
committed
56b61b1
feat(iae): expose opaque upload transfer grants
BeforeLights
committed
79ebbfd
feat(iae): add secret-free protected document unlock contract
BeforeLights
committed
83982e8
feat(iae): coordinate protected document unlock attempts
BeforeLights
committed
b2beaaf
feat(iae): expose protected document unlock workflow
BeforeLights
committed
25863a0
feat(iae): persist protected document unlock state
BeforeLights
committed
06272d4
feat(dsm): add governed dataset export manifest contract
BeforeLights
committed
f978b19
feat(dsm): coordinate governed export manifests
BeforeLights
committed
66b6e49
feat(dsm): expose governed dataset export manifests
BeforeLights
committed
f3d6356
feat(dsm): persist governed export manifests
BeforeLights
committed
e396283
fix(iae): clean expired upload storage state
BeforeLights
committed
27f8a56
feat(sa): add safe deterministic spreadsheet auditor core
BeforeLights
committed
135cac8
feat(sa): add value-free spreadsheet audit result contract
BeforeLights
committed
7a03e21
feat(sa): coordinate immutable spreadsheet audit results
BeforeLights
committed
032ba16
feat(sa): expose spreadsheet audit API boundary
BeforeLights
committed
3a88d39
feat(sa): persist spreadsheet audit results
BeforeLights
committed
534b518
feat(sa): bridge engine audits to value-free manifests
BeforeLights
committed
bdd03af
docs(sa): record vertical slice evidence and limits
BeforeLights
committed
45c4ed0
fix(foundation): keep application layers adapter-independent
BeforeLights
committed
203cc7a
fix(sa): preserve formula geometry and formatting gates
BeforeLights
committed
a110846
fix(engine): satisfy deterministic processor lint gates
BeforeLights
committed
b85d843
fix(engine): match Ruff processor formatting
BeforeLights
committed
5459778
Merge pull request #26 from DatabreezeService/feat/artifacts-datasets-completion
BeforeLights
authored
688896a
fix(iae): fail closed for unavailable evidence
BeforeLights
committed
e107145
feat(iae): expose safe evidence resolution
BeforeLights
committed
e52bd2a
fix(iae): make evidence persistence idempotent
BeforeLights
committed
7927cf2
fix(sa): validate finding geometry
BeforeLights
committed
081147b
feat(iae): persist artifact scan state
BeforeLights
committed
2563aab
feat(iae): expose retention request reads
BeforeLights
committed
d4cda4d
fix(dsm): enforce deterministic quality state
BeforeLights
committed
70a4596
fix(iae): reject invalid lineage references
BeforeLights
committed
9312775
feat(iae): enforce one lineage per derived version
BeforeLights
committed
6431c9a
test(sa): ignore correlation id in content assertion
BeforeLights
committed
556dd73
feat(sa): detect deterministic formula gaps
BeforeLights
committed
968168e
fix(iae): validate evidence geometry before lookup
BeforeLights
committed
d87cdac
fix(sa): preserve absolute formula references
BeforeLights
committed
27789f7
fix(api): expose audit and entitlement composition options
BeforeLights
committed
4d3f40d
fix(iam): wrap direct bootstrap saves in transactions
BeforeLights
committed
868c573
fix(iam): guard membership updates by revision
BeforeLights
committed
237ba56
fix(iae): guard placement updates by revision
BeforeLights
committed
bc069e2
fix(iae): use unique lookup for derived lineage
BeforeLights
committed
68e69df
fix(iae): bind retention requests to actor context
BeforeLights
committed
e2ccd90
fix(iae): guard retention transitions by revision
BeforeLights
committed
221c3c6
fix(iae): guard artifact status transitions by scan state
BeforeLights
committed
536a2d1
test(iae): cover retention HTTP actor binding
BeforeLights
committed
91b63ba
fix(iam): reject changed stale MFA revisions
BeforeLights
committed
9bbcb53
fix(iam): guard device transitions by revision
BeforeLights
committed
068286b
fix(bua): guard reservation settlement by revision
BeforeLights
committed
216f4a1
fix(dso): guard capability replacement by revision
BeforeLights
committed
735c1f3
fix(dso): guard sync transitions by revision
BeforeLights
committed
98f7f75
fix(dso): guard grant revocation by revision
BeforeLights
committed
49e7426
fix(dsm): validate immutable dataset revisions
BeforeLights
committed
ebf76c5
fix(dsm): validate immutable mapping revisions
BeforeLights
committed
9d3f82e
fix(style): format artifact domain tests
BeforeLights
committed
21be92e
fix(tooling): ignore worktrees in lint
BeforeLights
committed
1336ddc
fix(engine): satisfy ruff pairwise checks
BeforeLights
committed
48ede83
fix(api): satisfy strict correlation redaction typing
BeforeLights
committed
c9cac6b
fix(engine): format spreadsheet auditor fixtures
BeforeLights
committed
8f50039
Merge pull request #27 from DatabreezeService/feat/iae-evidence-governance
BeforeLights
authored
12d9271
fix(iam): compare bootstrap rows by owned fields
BeforeLights
committed
e6800db
perf(iam): bound membership reads to organization scope
BeforeLights
committed
b7ee10a
fix(iam): make membership selection deterministic
BeforeLights
committed
26ff403
fix(iam): expire in-memory access tokens
BeforeLights
committed
587eebe
fix(iam): compare-and-set MFA revisions
BeforeLights
committed
e668bd4
fix(iam): use constant-time recovery matching
BeforeLights
committed
6d26ec7
fix(iam): map session persistence failures to unavailable
BeforeLights
committed
a62e515
fix(http): require production CSRF origins
BeforeLights
committed
8ea5ec9
perf(aud): scope chain reads to the target ledger
BeforeLights
committed
8874b36
fix(aud): compare immutable records by owned fields
BeforeLights
committed
463abbb

Commits on Aug 3, 2026

fix(bua): compare immutable records by owned fields
BeforeLights
committed
eb02077
perf(aud): bound append lookups to latest and replay
BeforeLights
committed
ebe73cf
perf(bua): scope usage reads to tenant ancestry
BeforeLights
committed
bb8a11f
fix(bua): enforce terminal reservation transitions
BeforeLights
committed
50e325d
fix(bua): return entitlement problems with HTTP status
BeforeLights
committed
2328dd4
fix(iam): authorize sign-out session ownership
BeforeLights
committed
295b911
fix(iam): map MFA persistence failures to unavailable
BeforeLights
committed
afdd94b
fix(iam): fail closed at device identity API boundary
BeforeLights
committed
5e67f8b
fix(iam): distinguish session authority outages
BeforeLights
committed
7c94a11
test(iam): exercise unsafe principal rejection
BeforeLights
committed
44c1fae
fix(iam): bound session cookie parsing
BeforeLights
committed
868267d
fix(http): bound CSRF cookie parsing
BeforeLights
committed
447b029
fix(iam): enforce narrowest membership authority
BeforeLights
committed
048d5bd
fix(iam): scope membership mutation lookup
BeforeLights
committed
c48aa8b
fix(iam): scope device identity lookups
BeforeLights
committed
4f1b555
fix(aud): map read outages to unavailable
BeforeLights
committed
ead1d27
fix(aud): scope event identity lookup
BeforeLights
committed
ab1e2a6
fix(bua): scope entitlement identity lookups
BeforeLights
committed
e86f7ad
fix(iam): propagate session authority outages
BeforeLights
committed
784fa32
fix(iam): bind sessions to tenant scope
BeforeLights
committed
7b628f2
docs(traceability): reconcile identity foundation coverage
BeforeLights
committed
12b8c3a
docs(git): enforce 30 to 50 commit PR slices
BeforeLights
committed
2c12a91
style(iam): format bootstrap repository
BeforeLights
committed
8e9d753
test(api): register session scope migration
BeforeLights
committed
47db553
test(web): tolerate lazy route startup under load
BeforeLights
committed
d323c02
fix(aud): preserve success responses in OpenAPI
BeforeLights
committed
5d09843
Merge pull request #28 from DatabreezeService/feat/foundation-identity-reconciliation
BeforeLights
authored
7ccbbd1