promote: reviewed IAM recovery slice

docs/operations/iam-010-invitation-token-2026-08-03.md

@@ -0,0 +1,33 @@
+# IAM-010 durable invitation token slice — 2026-08-03
+
+## Scope
+
+This evidence record covers the durable persistence boundary for the IAM-010 invitation-token
+slice. It is a partial implementation record, not a release approval or a claim that Plan 020 is
+complete.
+
+## Delivered
+
+- `2a65756` adds the `iam.invitation_tokens` Prisma model and centrally ordered migration.
+- Only the token digest and recipient-email digest are persisted; the raw bearer value is accepted
+  only by the delivery port and is never returned by the application result or stored in a row.
+- `PrismaIamInvitationRepositoryAdapter` maps persisted rows through domain validation, enforces
+  tenant scope visibility, rejects sibling-token reads, prevents multiple active invitations per
+  membership, and uses compare-and-set revisions for redemption and membership activation.
+- The versioned invitation controller and IAM module composition now expose the acceptance flow
+  through the same replaceable repository and delivery ports; the HTTP boundary never returns the
+  raw token.
+- The Prisma foundation test proves the schema diff and migration inventory include the new table.
+
+## Verification
+
+- `corepack pnpm --filter @databreeze/api exec prisma validate --config prisma.config.ts`
+- `corepack pnpm --filter @databreeze/api test` — 352 tests passed.
+- `corepack pnpm --filter @databreeze/domain test` — 134 tests passed.
+- `git diff --check` passed before commit.
+
+## Explicitly not complete
+
+Transactional AUD append, registration for unknown recipients, resend/revocation administration,
+an SMTP/SES delivery adapter, and production PostgreSQL/backup/security evidence remain future
+work. IAM-010 therefore remains `partial` and `not-verified` in the requirement manifest.

docs/operations/iam-bua-security-slice-2026-08-03.md

@@ -0,0 +1,52 @@
+# IAM, audit, and entitlement security slice — 2026-08-03
+
+## Scope
+
+This evidence record covers the 30-commit `feat/iam-security-completion` batch based on
+`origin/dev`. It is implementation evidence only. It does not claim that Plan 020 or any
+P0/P1 release gate is complete.
+
+## Delivered
+
+- IAM service-account identities now use bounded permissions, digest-only secrets, one-time
+  secret issuance, rotation, permanent revocation, last-use monotonicity, tenant-scoped
+  repositories, Prisma persistence, and versioned lifecycle HTTP contracts.
+- AUD action vocabulary includes service-account lifecycle actions. Audit seal attestations
+  are canonical, independently signed, immutable, tenant-scoped, transaction-aware, and
+  available through in-memory and Prisma adapters with API verification.
+- BUA entitlement snapshots validate their complete provider-independent plan projection.
+  Signed offline leases are bounded to 24 hours and snapshot expiry, bind revision and
+  security epoch, persist immutably, verify canonical payloads, and use a replaceable HMAC
+  signer or injected HSM/KMS-compatible signer.
+- BUA and AUD module composition defaults to unavailable signing when key material is absent;
+  no secret is generated, logged, or committed by the repository.
+
+## Verification
+
+- Domain build and 148 domain tests pass, including canonical lease acceptance, malformed plan
+  rejection, attestation binding, tenant ancestry, and signature tampering cases.
+- Focused API TypeScript compilation, ESLint, Prisma validation, OpenAPI generation/check,
+  Redocly validation, and focused IAM/AUD/BUA tests pass.
+- Prisma migrations are ordered and add only `bua.entitlement_leases` and
+  `aud.audit_seal_attestations`; no migration was applied to a live environment.
+- Traceability entries for IAM-013, AUD-015, AUD-016, BUA-017, and BUA-018 remain `partial`
+  and `not-verified`. They point to the concrete code, tests, and this evidence record.
+
+## Security and rollback notes
+
+- Lease payloads are canonicalized before signature verification; malformed, stale, expired,
+  overlong, wrong-scope, and tampered leases fail closed.
+- Attestation storage never broadens a caller scope and rejects immutable-identity changes.
+- HMAC keys must be at least 32 bytes and should be supplied by a secret manager. HMAC is a
+  portable default, not a replacement for a production KMS/HSM policy.
+- Every commit on the feature branch is independently reversible. The migration commits must
+  be reverted only with a reviewed down-migration/restore procedure; no destructive rollback
+  was executed here.
+
+## Remaining gates
+
+Full audit export/legal-hold/retention administration, atomic cross-module audit coordination,
+offline authorization snapshots, entitlement reconciliation/usage exports, real PostgreSQL
+integration, backup restoration, security assessment, and release evidence remain outstanding.
+The feature PR targets `dev` without CodeRabbit; CodeRabbit remains reserved for the later
+`dev` to `main` promotion PR and is invoked once there.

docs/operations/iam-recovery-2026-08-03.md

@@ -0,0 +1,33 @@
+# IAM recovery slice — 2026-08-03
+
+This evidence records the partial account-recovery boundary delivered on `feat/iam-recovery`.
+It does not claim that IAM-015 or the IAM plan is complete.
+
+## Scope
+
+- Validate a bounded recovery request and return the same accepted response for known and unknown email addresses.
+- Generate a short-lived, single-use bearer, deliver the raw value only through the delivery port, and persist only keyed HMAC digests.
+- Consume the bearer exactly once and atomically rotate the Argon2id credential, advance the user security epoch, revoke active sessions and MFA factors, and mark MFA re-enrollment required.
+- Clear the re-enrollment gate in the same MFA transaction when a newly enrolled factor is successfully verified; failed proofs do not clear it.
+- Carry the live gate through credential lookup, session lookup, protected request context, and sign-in/current-session projections without trusting client-supplied state.
+- Apply a bounded, replaceable recovery-admission port before account lookup; unknown and throttled addresses receive the same generic response.
+- The `RedisRecoveryAdmissionAdapter` implements that port for horizontally scaled deployments. It accepts only keyed digests, namespaces counter keys, requires an injected atomic `INCR`/`PEXPIRE` implementation, and fails closed on malformed input or counter failure. The in-memory adapter remains the alpha default until a Redis client is provisioned.
+- Completion attempts use a separate admission port and, when Redis is configured, a distinct `databreeze:iam:recovery:completion:v1:` namespace so email-request and token-brute-force limits cannot collide.
+- Keep the public completion response free of bearer material; no session is automatically created.
+- Select the Prisma recovery adapter only when persistence is configured, and fail closed when the delivery, digest, or password boundary is missing.
+
+## Evidence
+
+- Recovery state-machine tests: `packages/domain/test/recovery-v1.test.mjs`.
+- Abuse-control tests: `services/api/test/features/iam/recovery-admission.test.ts` and `redis-recovery-admission.adapter.test.ts`.
+- In-memory transaction/service tests: `services/api/test/features/iam/recovery.service.test.ts`.
+- Durable schema adapter and atomic side-effect tests: `services/api/test/features/iam/prisma-recovery-repository.test.ts`.
+- MFA re-enrollment transaction tests: `services/api/test/features/iam/mfa.service.test.ts` and `services/api/test/features/iam/prisma-mfa-repository.test.ts`.
+- Live principal/context propagation tests: `services/api/test/features/iam/prisma-credential-lookup.test.ts`, `services/api/test/features/iam/prisma-session-lifecycle.test.ts`, and `services/api/test/platform/http/session-tenant-context.test.ts`.
+- Composition/controller/HTTP tests: `services/api/test/features/iam/recovery-composition.test.ts`, `recovery-controller.test.ts`, and `recovery-http.test.ts`.
+- Public routes: `services/api/openapi/v1.json` (`POST /v1/auth/recovery` and `POST /v1/auth/recovery/complete`).
+- Bilingual problem copy: `packages/i18n/src/catalogs-v1.ts` and `packages/i18n/test/catalogs-v1.test.mjs`.
+
+## Verification
+
+The scoped API TypeScript build, recovery tests, i18n tests, OpenAPI generation/check, and Prisma validation passed on 2026-08-03. The requirement remains `partial` and `not-verified` until authenticated MFA re-enrollment enforcement, audit events, rate limits, abuse monitoring, restoration drills, and the complete IAM release gates are delivered.

docs/operations/iam-registration-2026-08-03.md

@@ -0,0 +1,27 @@
+# IAM registration slice — 2026-08-03
+
+This evidence records the partial account-registration boundary delivered on `feat/iam-registration`.
+It does not claim that IAM-001 or the IAM plan is complete.
+
+## Scope
+
+- Normalize and validate the email, display name, locale, and password at the application boundary.
+- Hash the password through the existing Argon2id password port; raw passwords never enter persistence.
+- Create the user, credential, personal organization, workspace, internal project, and owner membership in one transaction.
+- Keep duplicate-email responses generic and map persistence races to a safe rejection.
+- Return a generic `202 Accepted` body (`{"accepted":true}`) from `POST /v1/auth/register`; the endpoint never returns hierarchy identifiers, bearer material, or an account-existence signal and never automatically creates a session.
+- Apply bounded, domain-separated admission before Argon2id hashing: the control plane hashes the normalized client IP and normalized email into separate rate-limit namespaces, and the durable Redis adapter fails closed on counter errors.
+- Select the Prisma registration adapter only when durable registration storage and the password boundary are configured; otherwise the endpoint fails closed.
+
+## Evidence
+
+- Service and in-memory transaction tests: `services/api/test/features/iam/registration.service.test.ts`.
+- Durable adapter and rollback tests: `services/api/test/features/iam/prisma-registration-repository.test.ts`.
+- Composition and controller tests: `services/api/test/features/iam/registration-composition.test.ts` and `services/api/test/features/iam/registration-controller.test.ts`.
+- HTTP and problem-details tests: `services/api/test/features/iam/registration-http.test.ts`.
+- OpenAPI route: `services/api/openapi/v1.json` (`POST /v1/auth/register`).
+- Bilingual error catalog coverage: `packages/i18n/src/catalogs-v1.ts` and `packages/i18n/test/catalogs-v1.test.mjs`.
+
+## Verification
+
+The scoped API TypeScript build, registration tests, i18n tests, OpenAPI generation/check, and Redocly validation passed on 2026-08-04. The rollback test stages the row in the transaction before injecting a persistence failure, proving no partial hierarchy remains. Admission tests prove IP/email throttling occurs before password hashing and persistence. The requirement remains `partial` and `not-verified` until the complete IAM release gates, audit integration, recovery, MFA, and restoration evidence are delivered.