promote: IAM foundation reconciliation to main

docs/operations/coderabbit-pr-40-disposition.md

@@ -0,0 +1,48 @@
+# CodeRabbit disposition for promotion PR 40
+
+Promotion PR [#40](https://github.com/DatabreezeService/databreeze-platform/pull/40)
+received one automatic full CodeRabbit review. After the focused fix PR merged
+into `dev`, the CodeRabbit integration automatically ran one incremental review
+on the new promotion head; no additional review was manually requested or
+invoked, and no further run will be requested.
+
+- Review ID: `4845720374`
+- Run ID: `2397e2ad-4258-4b05-9516-0a8b6fb4f39c`
+- Submitted: `2026-08-03T15:20:07Z`
+- Reviewed range: `8a4c0af52ed872715103710e3c89ca832f999bd4..f1573921446e9f86313e0f58b926777aed9e1402`
+- Automatic incremental review ID: `4846097863`
+- Automatic incremental run ID: `ce0a1c0d-b669-4551-bbd1-b9cad29de291`
+- Incremental range: `f1573921446e9f86313e0f58b926777aed9e1402..c80994cf4e2cf97be5a9137160417b8feb2b4eb7`
+
+## Valid findings fixed
+
+All six actionable inline findings, the outside-diff orchestration finding, and
+the twelve review-body nitpicks were reproduced against the reviewed code and
+fixed in focused commits on `fix/coderabbit-pr-40-reconciliation`:
+
+| Finding | Disposition and evidence |
+|---|---|
+| FND-007 was omitted from B01 task traversal. | Accepted. `789a3db` records `FND-007` as an explicit handoff task and asserts its position in the orchestration checker. |
+| Project-scoped bootstrap sessions lost `projectId`; `apiVersion` was too broad. | Accepted. `37f2289` preserves project scope and constrains the generated API schema. |
+| Invitation and removed memberships could be activated through `transition`. | Accepted. `cc1118a` requires an existing `ACTIVE` membership for administrative transitions; invitation activation remains in `accept`. |
+| Membership identity uniqueness did not cover nullable scope components. | Accepted. `e98c63e` adds the null-safe PostgreSQL uniqueness index, in-memory parity, conflict mapping, and migration inventory coverage. |
+| Hierarchy reads and membership outcomes returned denial/not-found/conflict envelopes as HTTP 200. | Accepted. `0689d70` maps hierarchy `NOT_FOUND` to 404 and membership result codes to 400/403/404/409/410/503, with generated OpenAPI and regression tests. |
+| Windows Android test command mixed PowerShell and cmd.exe syntax. | Accepted. `de3ff3d` documents valid commands for both shells. |
+| Maintainability and boundary nitpicks (shared DTO constants, cross-field scope validation, identity state coverage, adapter equality/filtering, rollback assertions, and mapped bootstrap assertions). | Accepted. These are covered by `c459a10`, `06588ea`, `0689d70`, and the preceding `37f2289` test changes. |
+| The documented membership error body did not match the emitted rejection envelope. | Accepted. `73b6199` documents `MembershipRejectedResponseDto` with `accepted: false` and the bounded error-code enum for every mapped error status. |
+| `handoffTaskIds` accepted malformed non-array values and could throw while checking the ledger. | Accepted. `8414b83` normalizes and diagnoses malformed shapes, with object/string regression coverage. |
+| The uniqueness migration test omitted `project_id` normalization. | Accepted. `d79c74b` asserts the project `COALESCE` expression alongside the workspace assertion. |
+
+## Rejected findings
+
+None. Every posted actionable finding and review-body nitpick had a reproducible
+correctness, contract, security, or test-coverage improvement in this slice.
+
+## Verification and merge rule
+
+The focused fixes must pass the affected API/domain tests, OpenAPI drift check,
+`corepack pnpm repo:check`, `corepack pnpm repo:build`, and the hosted checks on
+the follow-up `dev` PR. This document records both the one full review and the
+integration-triggered incremental result; it does not authorize another
+CodeRabbit run. PR #40 remains unmergeable until its current checks are green
+and all valid findings from both completed results are resolved.

docs/operations/foundation-handoff-2026-08-03.md

@@ -0,0 +1,71 @@
+# Engineering foundation handoff
+
+**Observed at:** 2026-08-03 (UTC)
+
+**Repository:** `databreeze-platform`
+
+## Current checkpoint
+
+- Integration base: `origin/dev` at `9265e15125c2e50cfcaca455524c903b6b92383e`.
+- Stable base: `origin/main` at `8a4c0af52ed872715103710e3c89ca832f999bd4`.
+- Active worktree branch: `feat/foundation-fnd005-reconciliation-20260803`.
+- Active delivery batch: `B01` (foundation verification and identity completion).
+- Foundation evidence units: FND-005 telemetry reconciliation is recorded;
+  FND-006 hosted supply-chain protection remains an explicit external gate;
+  FND-007 is this handoff record plus the linked runbooks.
+- Next implementation boundary after this reconciliation: `IAM-001`.
+
+The implementation program remains conservative: merged code and green tests
+do not promote product requirements to `verified` or `released`.
+
+## Verification record
+
+The following evidence is reproducible from the checkpoint:
+
+- `corepack pnpm --filter @databreeze/telemetry test` — TypeScript package,
+  hostile-input, exporter-isolation, and cross-runtime source parity tests pass.
+- `uv run pytest tests/test_telemetry.py` from `services/engine` — Python
+  telemetry tests pass.
+- PowerShell: `$env:ANDROID_HOME = Join-Path $env:LOCALAPPDATA 'Android\\Sdk'`, then
+  `& .\\apps\\android\\gradlew.bat :app:testDebugUnitTest --offline --no-daemon` —
+  Android/Kotlin unit suite passes when the SDK is supplied by the workstation/toolchain.
+- cmd.exe: `set "ANDROID_HOME=%LOCALAPPDATA%\\Android\\Sdk"`, then
+  `call apps\\android\\gradlew.bat :app:testDebugUnitTest --offline --no-daemon` —
+  the same Android/Kotlin unit suite passes from a Windows command prompt.
+- `corepack pnpm orchestration:check` and `corepack pnpm requirements:check`
+  pass with 611 requirement records and the B01 dependency graph intact.
+- Existing root checks, API tests, OpenAPI drift checks, infrastructure static
+  checks, and build evidence remain in the prior foundation records.
+
+No customer data or credentials were used. No AWS infrastructure, database
+migration against a customer environment, or production release was applied.
+
+## Explicit external gates
+
+- FND-006 protected GitHub release-environment reviewers and administrator
+  branch restrictions still require hosted evidence; the local policy tests do
+  not assert that an administrator configured those controls.
+- OpenTofu live format/validate and Docker collector health remain hosted or
+  workstation gates recorded by the FND-003/FND-004 evidence.
+- Android instrumentation, signed packaging, hosted exporter health, and
+  release provenance remain production-readiness gates.
+
+These gaps are not hidden, weakened, or represented as product completion.
+
+## B01 resume point
+
+Resume on a short-lived feature branch from the fetched `origin/dev` base.
+Read Plan 020 and the IAM-001 task, then use the TDD loop to reconcile tenant
+transaction context, ancestry checks, authorization epochs, and atomic
+mutation/audit boundaries before implementing later IAM lifecycle surfaces.
+Keep feature PRs targeted to `dev` without CodeRabbit; only the subsequent
+promotion to `main` receives the single full CodeRabbit review allowed for that
+promotion PR.
+
+## Rollback points
+
+- `adba0aa` — telemetry diagnostics reconciliation evidence and its guard test.
+- The containing handoff commit can be reverted independently without touching
+  runtime code, tenant data, or infrastructure state.
+- Existing merged foundation promotion commits remain available through the
+  fetched `origin/dev`/`origin/main` refs and the local historical branches.

docs/operations/foundation-telemetry-diagnostics-2026-08-03.md

@@ -0,0 +1,70 @@
+# Foundation telemetry and diagnostics reconciliation
+
+**Evidence date:** 2026-08-03 (UTC)
+
+**Source checkpoint:** `origin/dev` at `9265e15125c2e50cfcaca455524c903b6b92383e`
+
+**Scope:** FND-005 content-safe telemetry and the diagnostics boundary across
+the TypeScript control plane/shared clients, Python engine, and native Android
+client. This record is task evidence only. No requirement record was promoted
+to `verified`.
+
+No requirement record was promoted to `verified`.
+
+## Scope and safety boundary
+
+The canonical record and allowlist live in `packages/telemetry/schemas/v1.json`
+and `packages/telemetry/src/v1.ts`. TypeScript, Python, and Kotlin mirrors are
+checked against the same safe attribute set. Telemetry carries bounded IDs,
+route/operation/outcome tokens, counters, durations, status, and correlation
+context only. Paths, filenames, source values, formulas, evidence excerpts,
+prompts, contact data, credentials, tokens, provider payloads, and raw
+exception messages are outside the contract.
+
+Provider/exporter failures are isolated from domain work. Diagnostics use a
+generic unreadable result when a provider mapping, clock, header collection, or
+attribute map cannot be safely inspected; the provider's cause is never copied
+into a record or Problem response.
+
+## Cross-runtime verification
+
+The following checks passed from the source checkpoint:
+
+| Runtime/boundary | Command | Result |
+| --- | --- | --- |
+| TypeScript package and source parity | `corepack pnpm --filter @databreeze/telemetry test` | 12 tests passed, including the canonical TypeScript/Python/Android allowlist parity check. |
+| Python engine | `uv run pytest tests/test_telemetry.py` from `services/engine` | 14 tests passed. |
+| Android/Kotlin | `ANDROID_HOME=%LOCALAPPDATA%\\Android\\Sdk apps/android/gradlew.bat :app:testDebugUnitTest --offline --no-daemon` | Build and unit suite passed; 31 Gradle tasks completed. |
+| API propagation | `corepack pnpm --filter @databreeze/api test` | Trace-context propagation and safe failure tests passed as part of the API suite. |
+
+The Android invocation uses the workstation SDK path only as an environment
+configuration; it is not committed and no device credentials are required.
+
+## Failure and privacy probes
+
+The suites exercise hostile getter/proxy-backed attributes and headers,
+ambiguous or malformed correlation/traceparent values, invalid timestamps,
+oversized and path-like values, email/source-like values, provider exporter
+exceptions, clock failures, and Python/Kotlin mapping failures. Assertions
+verify that sanitized output is empty or bounded, stable generic errors are
+returned, and provider causes do not appear in serialized records or messages.
+
+## Known environment limits
+
+- A clean shell without `ANDROID_HOME` cannot locate the Android SDK; CI and
+  release workspaces must provide the SDK through the documented toolchain
+  setup. With the local SDK path configured, the Kotlin suite passed above.
+- OpenTofu formatting/validation, live Docker collector health, hosted
+  OpenTelemetry delivery, and protected release-environment approvals remain
+  external gates recorded by FND-003/FND-004/FND-006. No infrastructure was
+  applied and no collector was treated as domain authority.
+- Android instrumentation, signed packaging, and production exporter health
+  are later release gates; this record does not claim them complete.
+
+## Release decision
+
+FND-005 has cross-runtime implementation and privacy evidence at this
+checkpoint. Keep product requirements conservative and retain FND-006 as
+`implemented` until protected hosted release-environment evidence is supplied.
+This task record is reversible with the documentation/test commit and does not
+change customer-data handling or application authority.

docs/operations/iam-foundation-checkpoint-2026-08-03.md

@@ -0,0 +1,35 @@
+# IAM foundation checkpoint — 2026-08-03
+
+This checkpoint records the work on `feat/foundation-fnd005-reconciliation-20260803` before the first 30-commit integration boundary. It is evidence for the partial IAM-001/IAM-003/IAM-004 slice; it does not claim that the IAM plan or the product is complete.
+
+## Reversible implementation units
+
+- `be7367d` accepts a scoped invitation only for the invited principal, rejects stale/expired requests, and clears invitation-only lifetime fields.
+- `b90c9d4` persists cleared invitation lifetime fields through the Prisma membership adapter.
+- `2b97550` exposes invitation acceptance through the versioned API and OpenAPI artifact.
+- `7eb92f4` adds owner-only, revisioned atomic ownership promotion/demotion with transaction rollback coverage.
+- `11484b1` exposes ownership transfer through the versioned API and OpenAPI artifact.
+- `c4ed1e6`, `2419607`, `5f1d9b3`, `74582a2`, and `dcce9b3` compose, read, expose, and type the authenticated personal-tenant bootstrap state.
+- `6ec3282`, `110848d`, and `98f1774` constrain owner invitations, authorize membership listing, and protect Owner membership removals.
+- `66c91d9`, `9e80b73`, and `6593454` prove ownership rollback and stable availability failures.
+
+## Verification recorded
+
+- API TypeScript tests compile successfully with `tsconfig.test.json`.
+- Membership service direct run: 12 passing tests.
+- Identity bootstrap direct run: 5 passing tests.
+- Bootstrap controller direct run: 2 passing tests.
+- Deterministic OpenAPI test and `openapi:check` pass; the checked-in `services/api/openapi/v1.json` includes `/v1/me/bootstrap`, invitation acceptance, and ownership transfer.
+- Repository gates pass on this branch: formatting, lint, strict typecheck, orchestration and 611-requirement validation, contract drift, infrastructure static checks, 81 repository tests, 21 workspace test tasks (including 336 API tests), and the complete workspace build.
+
+## Deliberate remaining gaps
+
+The following requirements remain partial and must not be promoted to `verified` from this checkpoint:
+
+- durable invitation token hashing/email binding and single-use token redemption;
+- recent-MFA step-up assertions and the specified seven-day signed ownership-transfer request/explicit recipient acceptance flow;
+- audit/outbox events for every membership mutation and authorization-epoch invalidation;
+- account registration/recovery orchestration and full organization enumeration for non-personal team tenants;
+- production migration/restore evidence.
+
+The next integration action is to prepare the feature PR to `dev` from this clean, verified branch. A promotion PR to `main` receives the single CodeRabbit review cycle required by the repository workflow. This checkpoint still represents a partial IAM slice and does not promote any requirement to `verified` beyond the already recorded foundation evidence.

docs/plans/execution-orchestration.json

@@ -16,14 +16,14 @@
     }
   },
   "checkpoint": {
-    "observedAt": "2026-08-02T13:38:28Z",
-    "remoteDev": "783a4710c0aa2a2808d78ad7f0643e6731150bd7",
-    "remoteMain": "3ed3d77d0281ef239d0509c81ded447d8fffd213",
-    "lastFeaturePullRequest": 19,
-    "lastPromotionPullRequest": 20,
-    "lastPromotionFixPullRequest": 23,
+    "observedAt": "2026-08-03T00:00:00Z",
+    "remoteDev": "9265e15125c2e50cfcaca455524c903b6b92383e",
+    "remoteMain": "8a4c0af52ed872715103710e3c89ca832f999bd4",
+    "lastFeaturePullRequest": 36,
+    "lastPromotionPullRequest": 38,
+    "lastPromotionFixPullRequest": 37,
     "openPullRequestsObserved": 0,
-    "note": "PR 19 merged a 73-commit foundation batch to dev; PR 20 promoted dev to main after CodeRabbit review and PRs 21-23 delivered validated review fixes. Historical observation only; every session must fetch and recompute current state."
+    "note": "PRs 37 and 38 promoted the remaining foundation commits to main. PR 37 received one CodeRabbit review cycle and valid findings were reconciled; PR 38's one full-review request was rate-limited after hosted checks. Historical observation only; every session must fetch and recompute current state."
   },
   "reviewPolicy": {
     "featurePullRequest": {
@@ -54,7 +54,7 @@
     "post-ga-planned",
     "blocked"
   ],
-  "nextTaskId": "FND-005",
+  "nextTaskId": "IAM-001",
   "activeBatchId": "B01",
   "taskState": {
     "FND-001": {
@@ -111,14 +111,17 @@
       "note": "OpenTofu 1.12.5 official-container formatting, backend-disabled locked initialization, validation, and one credential-free mocked alpha plan passed on 2026-08-03. Static safety tests cover encryption, private networking, OIDC scope, recovery, destroy protection, and production image digests; no AWS credentials, remote state, real plan, or apply were used."
     },
     "FND-005": {
-      "status": "implemented",
-      "commit": "3ed3d77d0281ef239d0509c81ded447d8fffd213",
+      "status": "verified",
+      "commit": "adba0aac0fdd2060a6dd965f726c0bc245b96b77",
       "evidence": [
         "docs/operations/telemetry-safety.md",
+        "docs/operations/foundation-telemetry-diagnostics-2026-08-03.md",
+        "tools/repo-cli/test/foundation-telemetry-reconciliation.test.mjs",
         "packages/telemetry/test/telemetry-v1.test.mjs",
-        "services/engine/tests/test_telemetry.py"
+        "services/engine/tests/test_telemetry.py",
+        "apps/android/app/src/test/java/com/databreeze/android/TelemetryContractTest.kt"
       ],
-      "note": "TypeScript and Python telemetry boundaries, hostile-input normalization, and redaction tests are promoted; final clean-checkout reconciliation remains in B01."
+      "note": "Cross-runtime TypeScript, Python, and Kotlin allowlist/correlation boundaries, hostile-input normalization, exporter isolation, and privacy probes were reconciled. Android unit evidence uses the documented SDK environment; instrumentation and hosted exporter gates remain external."
     },
     "FND-006": {
       "status": "implemented",
@@ -133,29 +136,30 @@
       "note": "Hosted checks, supply-chain policy, SBOM, and provenance safeguards are promoted. GitHub release-environment protection remains an administrator-recorded external gate."
     },
     "FND-007": {
-      "status": "partial-needs-reconciliation",
-      "commit": "3ed3d77d0281ef239d0509c81ded447d8fffd213",
+      "status": "verified",
+      "commit": "7670ee6798f9ce50368aca626ef3fbe237cba61d",
       "evidence": [
+        "docs/operations/foundation-handoff-2026-08-03.md",
         "docs/development/README.md",
         "docs/operations/engineering-foundation-verification.md",
         "docs/operations/deployment-and-rollback.md",
         "docs/operations/secret-rotation.md",
-        "docs/operations/provider-adapters.md"
+        "docs/operations/provider-adapters.md",
+        "tools/repo-cli/test/foundation-handoff.test.mjs"
       ],
-      "note": "Runbooks and static evidence exist; B01 must reconcile live external gates and publish the final foundation handoff before advancing plan status."
+      "note": "Development, deployment, rollback, provider, support, telemetry, and clean-checkpoint evidence is published. External release-environment and hosted-toolchain gates remain explicit rather than being represented as product completion."
     }
   },
   "deliveryBatches": [
     {
       "batchId": "B01",
-      "name": "Foundation verification and identity completion",
+      "name": "Foundation external gate and identity completion",
       "branch": "feat/foundation-identity-reconciliation",
       "dependencies": [],
       "status": "in-progress",
       "commitBudget": { "minimum": 30, "target": 45, "maximum": 79 },
       "maximumChangedFiles": 260,
       "taskIds": [
-        "FND-005",
         "FND-006",
         "FND-007",
         "IAM-001",
@@ -170,6 +174,7 @@
         "IAM-006",
         "IAM-007"
       ],
+      "handoffTaskIds": ["FND-007"],
       "exitGate": "Foundation external gates are explicit and IAM, AUD, and BUA requirements are reconciled, completed, tested, and evidenced."
     },
     {