fix: close promotion review and foundation gates

.gitattributes

@@ -11,6 +11,7 @@
 *.yaml text eol=lf
 *.yml text eol=lf
 *.toml text eol=lf
+*.hcl text eol=lf
 *.ts text eol=lf
 *.tsx text eol=lf
 *.css text eol=lf
@@ -23,6 +24,7 @@
 *.kt text eol=lf
 *.kts text eol=lf
 *.py text eol=lf
+*.sh text eol=lf
 *.ps1 text eol=crlf
 *.bat text eol=crlf
 *.cmd text eol=crlf

docs/operations/coderabbit-pr-29-disposition.md

@@ -0,0 +1,51 @@
+# CodeRabbit PR 29 Disposition
+
+Date: 2026-08-03
+Promotion PR: [#29](https://github.com/DatabreezeService/databreeze-platform/pull/29)
+Automatic review run: `f61cec20-123e-4694-9265-e71aa976b01b`
+Reviewed range: `3ed3d77d..86f25c85`
+
+CodeRabbit ran once automatically on the promotion PR. No manual rerun was requested. Every inline, outside-diff, and review-body finding was reproduced against the later `dev` state. Valid gaps were fixed on `fix/coderabbit-promotion-29`; findings already addressed by later `dev` commits are recorded rather than duplicated.
+
+| ID | Finding | Disposition | Evidence |
+|---|---|---|---|
+| I-01 | Reservation settlement lacked a revision predicate. | Accepted; already fixed on later `dev`. | `216f4a1`, Prisma reservation race test. |
+| I-02 | Membership updates could lose a concurrent write. | Accepted; already fixed on later `dev`. | `237ba56`, Prisma membership race test. |
+| I-03 | Bootstrap immutability used `JSON.stringify`. | Accepted; already fixed on later `dev`. | `e6800db`, owned-field comparison tests. |
+| I-04 | Sign-out did not prove session ownership. | Accepted; already fixed on later `dev`. | `295b911`, cross-user sign-out rejection test. |
+| O-01 | API composition did not expose audit and entitlement database options. | Accepted; already fixed on later `dev`. | `4d3f40d`, foundation composition test. |
+| M-01 | BUA dropped project scope from usage rows. | Accepted and fixed. Project IDs are persisted, indexed, reconstructed, and included in inherited reads. | `ccbb9d3`, project usage round-trip test, migration `20260803020000_bua_project_usage_scope`. |
+| M-02 | Public audit reads were unbounded. | Accepted and fixed. Public event/seal reads now use limits of 1–100 and tenant-bound opaque cursors; event pages verify each immutable digest. | `a5ba31b`, `72064d6`, `bbca81c`, cursor/Prisma/HTTP tests. |
+| M-03 | Direct BUA usage persistence was not transactional. | Accepted and fixed. | `a8a5a47`, transaction invocation test. |
+| M-04 | Audit append loaded the complete scope history. | Accepted; already fixed on later `dev`. | `ebe73cf`, bounded duplicate/latest lookups. |
+| M-05 | Audit reads allegedly verified multiple scopes as one chain. | Rejected as a false positive. The reviewed domain implementation already groups events by canonical scope before verifying each chain. | `packages/domain/src/audit/v1.ts`, multi-scope grouping in `verifyAuditChainV1`. |
+| M-06 | Cookie-name validation rejected valid token characters. | Accepted and fixed. | `0615d54`, hyphenated/dotted cookie-name test. |
+| M-07 | Production CSRF origins were not configured explicitly. | Accepted; already fixed on later `dev`. | `8ea5ec9`, production-origin configuration test. |
+| M-08 | `GET /v1/auth/me` lacked bearer security and a regression guard. | Accepted. The endpoint annotation was already fixed; a contract-wide protected-operation guard was added. | `295b911`, `21eb825`, generated OpenAPI. |
+| M-09 | Refresh response declared `refreshToken` as write-only. | Accepted and fixed. | `0483b4b`, generated-schema assertion. |
+| M-10 | `sessionDatabase` composition did not create request tenant context. | Accepted and fixed with one shared session adapter instance. | `1bf5650`, foundation composition test. |
+| M-11 | MFA factor activation required no factor proof. | Accepted and fixed with a fail-closed proof-verifier port. | `66a9a56`, invalid/valid proof tests. |
+| M-12 | IAM membership reads loaded memberships outside the organization. | Accepted; already fixed on later `dev`. | `b7ee10a`, scoped query tests. |
+| M-13 | Entitlement endpoints broke the Problem Details convention. | Accepted; already fixed on later `dev`. | `2328dd4`, HTTP problem tests. |
+| M-14 | Unsafe-principal test used a malformed bearer token and asserted the wrong path. | Accepted; already fixed on later `dev`. | `44c1fae`, valid-token unsafe-principal test. |
+| M-15 | Session authority outages were reported as credential rejection. | Accepted; already fixed on later `dev`. | `7c94a11`, `a62e515`, availability-boundary tests. |
+| M-16 | Mutation requests fabricated idempotency keys from request IDs. | Accepted and fixed. Unsafe methods now require an explicit `Idempotency-Key`; read-only methods may use the request ID. | `85d60cc`, adapter and HTTP sign-out tests. |
+| M-17 | One malformed membership row could block unrelated reads. | Accepted and fixed. Read paths skip invalid rows while mutation paths remain strict. | `259c92a`, malformed-row isolation test. |
+| M-18 | `mfaRequired` should centrally block protected operations. | Rejected as proposed and retained as planned work. The field currently reports enrolled-factor presence, so blocking when true would lock out MFA-enrolled users. Endpoint risk classification and authenticated step-up assertions remain `partial` under Plan 020/IAM-012 and must be implemented as a dedicated vertical slice. | `PrismaSessionLifecycleAdapter.findPrincipal`, `MfaService.requireStepUp`, requirement traceability status. |
+| M-19 | Sign-out lacked caller authorization. | Accepted; duplicate of I-04 and already fixed. | `295b911`. |
+| M-20 | IAM transaction callbacks incorrectly required root `$transaction`. | Accepted and fixed with a transaction-scoped client type. | `d83eeb9`, compile-time transaction double and repository tests. |
+| M-21 | Personal bootstrap chose unstable first matches and display-name markers. | Accepted and fixed. Selection now finds the unique personal organization and deterministically chooses the earliest active workspace/internal project while preserving renamed display values. | `222910a`, multi-organization and rename tests. |
+| M-22 | MFA compare-and-set did not enforce the revision in the update predicate. | Accepted; already fixed on later `dev`. | `e668bd4`, stale-revision tests. |
+| M-23 | Direct bootstrap save was not transactional. | Accepted; already fixed on later `dev`. | `868c573`, rollback test. |
+| M-24 | Organization membership fallback selected an arbitrary workspace. | Accepted; already fixed on later `dev`. | `26ff403`, deterministic workspace selection test. |
+| M-25 | Refresh fell back to the presented token when no active family token existed. | Accepted and fixed. Missing or multiple active tokens fail closed and revoke the family. | `cf47989`, missing-active-token test. |
+| M-26 | Refresh ignored the session inactivity deadline. | Accepted and fixed. Session, refresh tokens, and access tokens expire atomically at the deadline. | `a5478ae`, inactivity-boundary test. |
+| M-27 | MFA lifecycle timestamps were client-controlled. | Accepted and fixed. Enrollment, verification, and recovery timestamps now come from an injected server clock; forged timestamp fields are rejected. | `774d4d5`, application and HTTP tests. |
+| M-28 | Response DTO `refreshToken` was marked write-only. | Accepted; duplicate of M-09. | `0483b4b`. |
+| M-29 | Documented and machine-enforced commit-budget minimums disagreed. | Accepted; already fixed on later `dev`. | `2c12a91`, orchestration checker and docs. |
+
+## Release handling
+
+- PR #29 remains a historical promotion slice. Review fixes are applied to `dev` first, following the repository rule that feature/fix PRs target `dev` without CodeRabbit.
+- Main is not considered releasable until every ordered promotion slice, including this fix branch, has landed and passed its one automatic CodeRabbit review.
+- The rejected M-18 proposal does not mark IAM-012 complete; the traceability record remains `partial` until the planned step-up authorization slice is implemented and verified.

docs/operations/foundation-aws-opentofu-2026-08-03.md

@@ -0,0 +1,48 @@
+# FND-004 portable AWS validation evidence
+
+Observed at (UTC): 2026-08-03T08:43:33Z
+
+Task: `FND-004 — Close portable AWS foundation gaps`
+
+## Verified boundary
+
+- OpenTofu is pinned to `1.12.5`; the official container image is
+  `ghcr.io/opentofu/opentofu:1.12.5`.
+- The alpha composition locks the signed `hashicorp/aws` provider at `6.0.0`
+  and initialization treats the lock file as read-only.
+- Official formatting covers every module, environment file, and OpenTofu test.
+- Backend-disabled initialization and configuration validation run with provider
+  data isolated outside the repository.
+- A mocked plan exercises the Singapore alpha composition without AWS
+  credentials or provider API calls. It verifies that NAT, managed data, ECS
+  services, CloudFront, and GitHub deployment trust remain disabled by default.
+- Static tests continue to verify private networking, encryption, recovery,
+  least-privilege OIDC scope, production image digests, destroy protection, and
+  the absence of credentials or state backends.
+
+## Commands and results
+
+Passed:
+
+- `node --test tools/repo-cli/test/aws-infrastructure.test.mjs`
+- `corepack pnpm infra:check`
+- `corepack pnpm infra:validate`
+- OpenTofu `fmt -check -recursive`
+- OpenTofu `init -backend=false -input=false -lockfile=readonly -no-color`
+- OpenTofu `validate -no-color`
+- OpenTofu `test -no-color`: one mocked plan passed
+
+The first provider download ended with `unexpected EOF`; a fresh isolated retry
+installed the same locked, signed provider successfully. No source or lock drift
+was accepted from that transient failure.
+
+## Safety and rollback
+
+No AWS credentials were loaded, no remote state backend was configured, and no
+real plan or apply command ran. Provider caches were created under a guarded
+temporary directory and removed after validation.
+
+Rollback is source-only: revert the version pin, provider lock, formatter,
+runner, and plan-test commits together, then restore FND-004 to `implemented` in
+the execution ledger. Reverting does not change any AWS resource because this
+slice created none.

docs/operations/foundation-local-infrastructure-2026-08-02.md

@@ -54,3 +54,37 @@ Environment-gated:
 Revert the lifecycle commit and retain the prior static Compose checks. No
 containers, named volumes, host files, or credentials are modified by the
 repository changes.
+
+## Live verification closure
+
+Observed at (UTC): 2026-08-03T08:21:34Z
+
+Environment:
+
+- Docker Engine `29.5.3`
+- Docker Desktop `4.77.0`
+- Docker Compose `5.1.4`
+- Windows host with Linux containers
+
+The live run first reproduced and corrected four startup gaps: a nonexistent
+MinIO client tag, a fixed 30-second image-pull timeout, CRLF bytes in the
+Linux-mounted bootstrap script, and readiness that ignored a failed
+`minio-init` completion job. The corrected lifecycle then passed:
+
+- `node --test tools/repo-cli/test/local-infrastructure.test.mjs`
+- `node tools/repo-cli/src/local-services.mjs check`
+- `node tools/repo-cli/src/local-services.mjs start --wait-seconds=600`
+- health checks for PostgreSQL, Redis, MinIO, Mailpit, OpenTelemetry, and its
+  HTTP health companion
+- successful `minio-init` completion with both private buckets created
+- a PostgreSQL catalog query finding all 19 module-owned schemas
+- `restart-check --wait-seconds=600`
+- `persistence-check --wait-seconds=600`, including sentinel cleanup
+- an intentional duplicate-port preflight that failed closed
+- an intentional impossible disk threshold that failed closed
+- `stop --wait-seconds=600`, followed by inspection of all four preserved named
+  volumes and the stopped containers
+
+FND-003 is verified. Rollback remains source-only: revert the focused lifecycle
+commits. The validation left stopped containers and named volumes intact and
+did not delete local development data.

docs/plans/002-complete-execution-orchestration.md

@@ -66,7 +66,7 @@ This plan was reconciled on 2026-08-02 from remote `dev` at `783a4710c0aa2a2808d
 
 Merged PRs 1–23 establish substantial engineering, IAM/AUD/BUA, IAE/DSM, JRA, and DSO code. PR 19 delivered the normal 73-commit foundation batch to `dev`; PR 20 promoted it to `main`; PRs 21–23 carried validated promotion-review fixes back through `dev`. Plans 010–050 must therefore start with evidence reconciliation, not blind reimplementation. Plans 060–500 remain unverified and must be treated as planned until their gates pass.
 
-The active execution packet is `B01` in `004-luna-max-execution-plan.md`, starting with `FND-003` on `feat/foundation-identity-completion`. The packet preserves the requested 30–99 commit rule, targets about 70 commits, and carries the implementation forward without opening a documentation-only PR.
+The active execution packet is `B01` in `004-luna-max-execution-plan.md`, continuing with `FND-005` after live verification closed `FND-003` and containerized OpenTofu verification closed `FND-004`. The packet preserves the requested 30–50 commit target and exceptional 79-commit ceiling, and carries implementation forward without opening a documentation-only PR.
 
 The hashes above are an audit anchor, not a branch lock. Every session must fetch and recompute live state; update the ledger checkpoint only as part of a committed task/PR handoff so session-local observations do not create meaningless dirty files.
 

docs/plans/004-luna-max-execution-plan.md

@@ -64,7 +64,7 @@ Each batch may require multiple normal integration PR slices before its exit gat
 
 | Batch | Branch | Tasks | Dependencies | Commit budget | Exit gate |
 |---|---|---|---|---|---|
-| `B01` | `feat/foundation-identity-reconciliation` | `FND-003..007`, all Plan 020 tasks | Verified `FND-001/002` | 30–50 target; exceptional ceiling 79 | Foundation external gates recorded; IAM/AUD/BUA obligations reconciled and completed |
+| `B01` | `feat/foundation-identity-reconciliation` | `FND-005..007`, all Plan 020 tasks | Verified `FND-001..004` | 30–50 target; exceptional ceiling 79 | Foundation external gates recorded; IAM/AUD/BUA obligations reconciled and completed |
 | `B02` | `feat/artifacts-datasets-completion` | All Plan 030 tasks | `B01` | 30–50 target; exceptional ceiling 79 | Immutable artifact/evidence/dataset foundations verified |
 | `B03` | `feat/jobs-processing-completion` | All Plan 040 tasks | `B02` | 30–50 target; exceptional ceiling 79 | Signed typed jobs execute locally/cloud with approvals and durable recovery |
 | `B04` | `feat/devices-sync-completion` | All Plan 050 tasks | `B03` | 30–50 target; exceptional ceiling 79 | Desktop/Android sync, offline, conflict, transfer, and revocation gates pass |
@@ -145,10 +145,10 @@ corepack pnpm orchestration:check
 corepack pnpm requirements:check
 ```
 
-Then resume `FND-003`:
+Live Docker and containerized OpenTofu verification closed `FND-003` and `FND-004` on 2026-08-03. Resume `FND-005`:
 
-1. Run the Docker-capable checks in `docs/operations/foundation-local-infrastructure-2026-08-02.md` when Docker Desktop/Compose v2 is available.
-2. If Docker remains unavailable, preserve `FND-003` as incomplete, finish only credential-independent `FND-004..007` evidence, and record the external gate. Do not claim foundation verification.
+1. Reconcile correlation propagation, allowlisted telemetry, and safe diagnostics across TypeScript, Kotlin, and Python against the merged implementation.
+2. Preserve any hosted or platform-specific telemetry gap as explicit evidence; do not promote the task solely from static source presence.
 3. Reconcile Plans 020–050 against merged code before implementing any missing behavior. For `B01`, complete Plan 020 only after the remaining foundation boundaries are explicit.
 4. End every session with the handoff record from `003-luna-handoff-runbook.md`, including exact branch/HEAD, open PRs, checks, task/batch status, rollback points, and safest next command.
 

docs/plans/execution-orchestration.json

@@ -54,7 +54,7 @@
     "post-ga-planned",
     "blocked"
   ],
-  "nextTaskId": "FND-003",
+  "nextTaskId": "FND-005",
   "activeBatchId": "B01",
   "taskState": {
     "FND-001": {
@@ -82,8 +82,8 @@
       "note": "Room, WorkManager, Keystore, bilingual resources, generated contracts/tokens, backup/network policy, account isolation, and process-recreation evidence are complete. No product requirement status was promoted."
     },
     "FND-003": {
-      "status": "in-progress",
-      "commit": "783a4710c0aa2a2808d78ad7f0643e6731150bd7",
+      "status": "verified",
+      "commit": "b3d000086cd786c3cdf9c812f48cf96f0bd7f213",
       "evidence": [
         "infrastructure/local/compose.yml",
         "infrastructure/local/README.md",
@@ -92,18 +92,23 @@
         "tools/repo-cli/test/local-infrastructure.test.mjs",
         "docs/operations/foundation-local-infrastructure-2026-08-02.md"
       ],
-      "note": "Static Compose/bootstrap/lifecycle checks, daemon-free config/preflight, bounded local diagnostics/log retention, AWS safety checks, telemetry redaction tests, and infrastructure path-aware CI are integrated and promoted. Live Docker health, port-collision, disk-pressure, and restart-persistence evidence remains pending because the Docker daemon was unavailable in the implementation environment."
+      "note": "Docker Engine 29.5.3 and Compose 5.1.4 live verification passed on 2026-08-03: all long-running services became healthy, MinIO initialization exited successfully, all 19 module schemas existed, restart and Redis persistence checks passed, collision and disk-pressure probes failed closed, and safe stop preserved containers and named volumes."
     },
     "FND-004": {
-      "status": "implemented",
-      "commit": "3ed3d77d0281ef239d0509c81ded447d8fffd213",
+      "status": "verified",
+      "commit": "c18c7b0a65b5bfae0c5991223bfbee527018cf52",
       "evidence": [
         "infrastructure/aws/README.md",
+        "infrastructure/aws/.opentofu-version",
         "infrastructure/aws/environments/alpha/main.tf",
+        "infrastructure/aws/environments/alpha/.terraform.lock.hcl",
+        "infrastructure/aws/environments/alpha/tests/alpha-plan.tofutest.hcl",
+        "tools/repo-cli/src/validate-aws-opentofu.mjs",
         "tools/repo-cli/src/check-aws-infrastructure.mjs",
-        "tools/repo-cli/test/aws-infrastructure.test.mjs"
+        "tools/repo-cli/test/aws-infrastructure.test.mjs",
+        "docs/operations/foundation-aws-opentofu-2026-08-03.md"
       ],
-      "note": "Portable AWS modules and static safety checks are promoted. Pinned OpenTofu fmt/init/validate and any reviewed plan/apply evidence remain external gates."
+      "note": "OpenTofu 1.12.5 official-container formatting, backend-disabled locked initialization, validation, and one credential-free mocked alpha plan passed on 2026-08-03. Static safety tests cover encryption, private networking, OIDC scope, recovery, destroy protection, and production image digests; no AWS credentials, remote state, real plan, or apply were used."
     },
     "FND-005": {
       "status": "implemented",
@@ -150,8 +155,6 @@
       "commitBudget": { "minimum": 30, "target": 45, "maximum": 79 },
       "maximumChangedFiles": 260,
       "taskIds": [
-        "FND-003",
-        "FND-004",
         "FND-005",
         "FND-006",
         "FND-007",

infrastructure/aws/.opentofu-version

@@ -0,0 +1 @@
+1.12.5

infrastructure/aws/README.md

@@ -20,6 +20,16 @@ repository.
 
 ## Validate without applying
 
+The repository pins OpenTofu `1.12.5` in `.opentofu-version`. Use that exact
+native CLI release, or the official
+`ghcr.io/opentofu/opentofu:1.12.5` container when a host installation is not
+available. Do not use a floating container tag for validation evidence.
+The alpha composition commits `.terraform.lock.hcl`; initialization uses it
+read-only so provider selections cannot drift during a validation run.
+`pnpm infra:validate` also executes a mocked plan test for the safe alpha
+defaults, exercising plan-time evaluation without AWS credentials or remote
+side effects.
+
 ```text
 pnpm infra:check
 cd infrastructure/aws/environments/alpha