promote: foundation and IAM completion

apps/web/test/error-privacy-query.test.tsx

@@ -13,7 +13,9 @@ describe('safe localized recovery', () => {
     const router = createAppRouter({ initialEntries: ['/vi-VN/debug/route-error'] });
     render(<ApplicationBoundary router={router} />);
 
-    expect(await screen.findByRole('heading', { name: 'Không thể mở khu vực này' })).toBeTruthy();
+    expect(
+      await screen.findByRole('heading', { name: 'Không thể mở khu vực này' }, { timeout: 5_000 }),
+    ).toBeTruthy();
     expect(screen.queryByText(/internal tenant detail/u)).toBeNull();
     consoleError.mockRestore();
   });

docs/operations/identity-audit-entitlement-reconciliation-2026-08-03.md

@@ -0,0 +1,29 @@
+# Identity, audit, and entitlement reconciliation — 2026-08-03
+
+## Scope
+
+This evidence record covers the 30-commit `feat/foundation-identity-reconciliation` batch based on `dev`. The batch hardens existing IAM, AUD, and BUA foundations; it does not claim completion of Plan 020 or any production release gate.
+
+## Implemented in this batch
+
+- IAM persistence now compares only owned immutable fields, scopes membership and Device lookups before row materialization, applies optimistic revisions to MFA state, binds sessions to the exact sign-in organization/workspace, expires access credentials, separates rejected credentials from authority outages, authorizes sign-out ownership, and bounds cookie/CSRF parsing.
+- Membership authority flows only from a containing tenant scope, and the narrowest applicable membership wins. A project or workspace membership cannot authorize its parent or a sibling.
+- AUD append paths use scoped, bounded replay/latest lookups; immutable comparisons ignore persistence metadata; read outages return safe retryable `AUDIT_UNAVAILABLE` problems.
+- BUA tenant-owned identity lookups and usage reads are scope-bound; immutable comparisons ignore persistence metadata; reservations allow only one terminal transition; API failures return stable Problem Details.
+
+## Conservative requirement state
+
+The traceability manifest marks only requirements with concrete implementation and tests as `partial`. All remain `not-verified`; no P0/P1 release status is promoted. Requirements whose primary behavior is absent—such as invitations, service accounts, account recovery, audit exports/legal holds, commercial billing reconciliation, and usage exports—remain `planned`.
+
+## Evidence
+
+- Domain tests: `packages/domain/test/identity-v1.test.mjs`, `packages/domain/test/audit-v1.test.mjs`, `packages/domain/test/entitlements-v1.test.mjs`, and tenant/authorization/CSRF/MFA suites.
+- API tests: `services/api/test/features/iam/`, `services/api/test/features/aud/`, `services/api/test/features/bua/`, `services/api/test/platform/http/`, and `services/api/test/http-contract.test.ts`.
+- Persistence: `services/api/prisma/schema/iam.prisma`, `services/api/prisma/schema/aud.prisma`, `services/api/prisma/schema/bua.prisma`, and the ordered IAM session-scope migration.
+- Focused verification passed throughout the batch, including TypeScript compilation, Prisma schema validation, 122 domain tests, and the affected API suites.
+
+## Remaining gates
+
+- Plan 020 still requires invitations, ownership transfer workflows, service accounts, signed offline authorization issuance, full permission enforcement, audit action-definition governance, signed independent seals, legal holds/retention/export/restore, provider-independent subscriptions, offline entitlement issuance, reconciliation/exports, client administration surfaces, and real PostgreSQL/backup/security evidence.
+- FND-003 remains blocked only on live Docker daemon evidence; this batch does not change its status.
+- The feature PR targets `dev` without CodeRabbit. CodeRabbit remains reserved for the later `dev` to `main` promotion PR and is invoked once there.

docs/operations/luna-max-handoff-2026-08-02.md

@@ -0,0 +1,85 @@
+# Luna Max implementation handoff
+
+Observed at (UTC): `2026-08-02T14:16:09Z`
+
+## Repository state
+
+- Canonical repository/worktree: `databreeze-platform/.worktrees/luna-max-orchestration`
+- Branch: `feat/foundation-identity-completion`
+- Upstream: `origin/feat/foundation-identity-completion`
+- Branch base / remote `dev`: `783a4710c0aa2a2808d78ad7f0643e6731150bd7`
+- Remote `main`: `3ed3d77d0281ef239d0509c81ded447d8fffd213`
+- Completed orchestration commit: `62e10cddeda3cd6d49a3c78795a420b7c58331fc`
+- Open feature PR: none
+- Open promotion PR: none
+- CodeRabbit invocation for this batch: `0`
+- Normal batch count before this handoff record: `1` commit and `8` changed files
+
+## Active execution state
+
+- Active batch: `B01 — Foundation verification and identity completion`
+- Next task: `FND-003 — Close local infrastructure gaps`
+- Batch target: 70 atomic commits; allowed range 30–85; repository hard maximum 99
+- Promotion changed-file target: at most 260; review stop gate: 280
+- Requirement ledger remains conservative: 608 `planned`, 3 `partial`, 0 `verified`
+- Verified foundation task evidence: `FND-001`, `FND-002`
+- Integrated but incompletely evidenced foundation work: `FND-003..007`
+
+## Delivered planning outcome
+
+- Added `docs/plans/004-luna-max-execution-plan.md` with 15 dependency-safe delivery batches covering all 153 unfinished orchestration tasks exactly once.
+- Updated the execution ledger to version 2 with the current promotion checkpoint, `activeBatchId`, exact batch dependencies, branch names, commit budgets, changed-file limits, exit gates, and conservative foundation task states.
+- Extended the orchestration checker to reject missing/duplicate task ownership, batch dependency cycles, undersized normal batches, 100-or-more commit maxima, changed-file limits above 260, undocumented batch drift, and an active batch that does not contain the next task.
+- Updated the resume runbook with batch-state recovery, sequential package-manager operation, `EBUSY`/`EEXIST` recovery, and the exact Luna Max bootstrap contract.
+- Corrected the stale plan-package filename in `docs/plans/README.md`.
+
+## Verification evidence
+
+Passed from the isolated worktree after sequential bootstrap:
+
+- `corepack pnpm install --frozen-lockfile`
+- `uv sync --locked --offline` in `services/engine`
+- `corepack pnpm repo:check`
+- `corepack pnpm repo:build`
+- `git diff --check`
+- Orchestration checker: 19 plans, 155 tasks, 15 batches, 611 requirements, next `FND-003`, active `B01`
+- Repository CLI tests: 74 passed
+- Orchestration tests: 13 passed
+- Python engine tests: 92 passed
+- Turborepo tests: 21 successful tasks
+- Turborepo builds: 12 successful tasks
+- TypeScript/Python/Kotlin contract parity: 28 cases
+
+Environment gates intentionally remain open:
+
+- OpenTofu is unavailable on this workstation; static AWS checks pass, but pinned `fmt/init/validate` and reviewed plan evidence remain required.
+- Docker Desktop/Compose v2 was unavailable during the foundation implementation; live health, collision, disk-pressure, Redis persistence, and restart checks remain required for `FND-003`.
+- GitHub protected release-environment reviewers and branch restrictions require administrator evidence.
+- Android instrumentation/emulator and signed packaging remain later release gates.
+
+## Resume instructions
+
+Run sequentially:
+
+```powershell
+git fetch --all --prune
+git switch feat/foundation-identity-completion
+git pull --ff-only origin feat/foundation-identity-completion
+corepack pnpm install --frozen-lockfile
+Push-Location services/engine
+uv sync --locked --offline
+Pop-Location
+corepack pnpm orchestration:check
+corepack pnpm requirements:check
+```
+
+Then read `AGENTS.md`, `docs/plans/002-complete-execution-orchestration.md`, `docs/plans/003-luna-handoff-runbook.md`, `docs/plans/004-luna-max-execution-plan.md`, the Plan 010/020 documents, and the selected trace records. Resume `FND-003` from its live-environment gate; reconcile existing merged behavior before writing replacement code.
+
+Do not open a PR yet. Continue atomic `B01` work on this branch until it reaches at least 30 commits, targeting about 70. The feature PR goes to `dev` without CodeRabbit; the later `dev` to `main` promotion receives the single full CodeRabbit review.
+
+## Rollback and preserved state
+
+- Revert the handoff-record commit to remove only this status record.
+- Revert `62e10cddeda3cd6d49a3c78795a420b7c58331fc` to remove the Luna batch plan, ledger version 2, and its validation changes as one independent unit.
+- No infrastructure was applied, no database was migrated, no customer data was read, and no feature flag changed.
+- Ignored `node_modules`, `.venv`, `dist`, and tool caches are disposable worktree products; tracked files are clean after the containing handoff commit.

docs/plans/000-platform-program.md

@@ -43,6 +43,8 @@ Child plans are written and approved before their product slice begins. Each nam
 
 docs/plans/requirement-traceability.json records all 611 IDs with requested trace fields, one primary plan/task, release status, and verified paths only after evidence exists.
 
+`docs/plans/004-luna-max-execution-plan.md` packages the unfinished orchestration tasks into 15 dependency-safe delivery batches. A normal PR slice contains 30–50 atomic commits; an exceptional completed-task boundary may extend to 79 but never to CodeRabbit's 100-commit limit. Promotion diffs stay at or below 260 changed files and use the `feat/*` or `fix/*` → `dev` → reviewed `main` flow below.
+
 ## Branch, commit, and review policy
 
 - `main` contains stable releases. `dev` is the integration branch.

docs/plans/002-complete-execution-orchestration.md

@@ -4,7 +4,7 @@
 
 **Goal:** Finish all 611 DataBreeze requirements through dependency-ordered, independently reversible tasks and preserve enough verified state that a new model can resume without guessing.
 
-**Architecture:** The numbered child plans remain the requirement owners. This document adds the execution DAG, atomic task boundaries, parallel-work rules, cross-plan gates, failure handling, and handoff contract that bind those child plans into one program. `execution-orchestration.json` is the machine-readable control record; `requirement-traceability.json` remains the requirement-to-code-and-evidence authority.
+**Architecture:** The numbered child plans remain the requirement owners. This document adds the execution DAG, atomic task boundaries, parallel-work rules, cross-plan gates, failure handling, and handoff contract that bind those child plans into one program. `004-luna-max-execution-plan.md` packages unfinished tasks into reviewable delivery batches, `execution-orchestration.json` is the machine-readable control record, and `requirement-traceability.json` remains the requirement-to-code-and-evidence authority.
 
 **Tech Stack:** pnpm/Turborepo and strict TypeScript, NestJS/Fastify, PostgreSQL 17 with Prisma, Redis 7.4, S3-compatible storage, Electron, Kotlin/Compose, Python 3.13, OpenAPI/JSON Schema, OpenTofu/AWS Singapore, GitHub Actions, and CodeRabbit.
 
@@ -33,8 +33,9 @@ Read sources in this order when they disagree:
 3. Normative requirements under `docs/specs/` and `docs/specs/requirement-index.json`.
 4. Product and architecture documents under `docs/product/` and `docs/architecture/`.
 5. The requirement-owning child plan under `docs/plans/`.
-6. This orchestration plan and `execution-orchestration.json`.
-7. Existing code and historical implementation reports.
+6. This orchestration plan.
+7. `004-luna-max-execution-plan.md` and `execution-orchestration.json`.
+8. Existing code and historical implementation reports.
 
 Code is evidence of work, not evidence of full requirement completion. Use these states consistently:
 
@@ -57,11 +58,15 @@ The ledger also uses these plan/task states; they are not requirement statuses a
 
 Never infer `verified` from a merged PR, a green unit test, file existence, or a previous model's prose.
 
+The numbered child plans own requirement scope and release obligations. Their early generated `Paths` examples are not repository path authority. Section 4 of this document supersedes generic aggregate names such as `identity-audit-entitlements`, `production-readiness`, or hyphenated Python processor directories; use the module-owned roots and deterministic platform keys below.
+
 ## 2. Recorded checkpoint
 
-This plan was prepared on 2026-08-02 from remote `dev` at `b21642b` and remote `main` at `8ac8bca`; promotion PR 8 had merged and no PR was open. The requirement manifest contained 611 records: 444 P0, 154 P1, 13 P2; 608 were `planned` and 3 were `partial`.
+This plan was reconciled on 2026-08-02 from remote `dev` at `783a4710c0aa2a2808d78ad7f0643e6731150bd7` and remote `main` at `3ed3d77d0281ef239d0509c81ded447d8fffd213`; promotion PR 20 had merged and no PR was open. The requirement manifest contained 611 records: 444 P0, 154 P1, 13 P2; 608 were `planned` and 3 were `partial`.
+
+Merged PRs 1–23 establish substantial engineering, IAM/AUD/BUA, IAE/DSM, JRA, and DSO code. PR 19 delivered the normal 73-commit foundation batch to `dev`; PR 20 promoted it to `main`; PRs 21–23 carried validated promotion-review fixes back through `dev`. Plans 010–050 must therefore start with evidence reconciliation, not blind reimplementation. Plans 060–500 remain unverified and must be treated as planned until their gates pass.
 
-Merged PRs 1–8 establish substantial engineering, IAM/AUD/BUA, IAE/DSM, JRA, and DSO code. Plans 010–050 must therefore start with evidence reconciliation, not blind reimplementation. Plans 060–500 remain unverified and must be treated as planned until their gates pass.
+The active execution packet is `B01` in `004-luna-max-execution-plan.md`, starting with `FND-003` on `feat/foundation-identity-completion`. The packet preserves the requested 30–99 commit rule, targets about 70 commits, and carries the implementation forward without opening a documentation-only PR.
 
 The hashes above are an audit anchor, not a branch lock. Every session must fetch and recompute live state; update the ledger checkpoint only as part of a committed task/PR handoff so session-local observations do not create meaningless dirty files.