Commits

Commit history

1. Commits on Oct 1, 2026

   • feat(db): least-privilege runtime role: privilege manifest reconciled on every migrate, pnpm db:runtime-login, the gate's privilege check and ratchet, CI runs the app as a non-owner login (DEP3)

     Show description for fdca6c7
     

     devresponse

     and

     claude

     committed
     fdca6c7View commit details

     Copy full SHA for fdca6c7

     View code at this pointBrowse repository at this point

   • feat(deploy): migrate production on every push to main, refuse unsafe migration sessions, retire deploy.yml (DEP2)

     Show description for a0644f3
     

     devresponse

     and

     claude

     committed
     a0644f3View commit details

     Copy full SHA for a0644f3

     View code at this pointBrowse repository at this point

   • feat(deploy): fail-closed schema gate in the Vercel production build, plus the expand/contract rule and its guard (DEP1)

     Show description for 7d77f9d
     

     devresponse

     and

     claude

     committed
     7d77f9dView commit details

     Copy full SHA for 7d77f9d

     View code at this pointBrowse repository at this point
2. Commits on Sep 30, 2026

   • ci: Bump the github-actions group with 3 updates

     Show description for 9f582ac
     

     dependabot[bot]

     authored and

     devresponse

     committed
     9f582acView commit details

     Copy full SHA for 9f582ac

     View code at this pointBrowse repository at this point

   • ci(dependabot): exclude next and eslint-config-next from the prod and dev groups (K1)

     Show description for e1e3724
     

     devresponse

     and

     claude

     committed
     e1e3724View commit details

     Copy full SHA for e1e3724

     View code at this pointBrowse repository at this point

   • refactor(http): move the route wrappers, request id, error envelopes, origin guard and rate limiters into src/lib/http (R13, I-13)

     Show description for ee804cd
     

     devresponse

     and

     claude

     committed
     ee804cdView commit details

     Copy full SHA for ee804cd

     View code at this pointBrowse repository at this point

   • ci(deploy): install the Vercel CLI from vercel-cli's lockfile, document the SHA-pinning and production-environment settings (I-09)

     Show description for 5506f27
     

     devresponse

     and

     claude

     committed
     5506f27View commit details

     Copy full SHA for 5506f27

     View code at this pointBrowse repository at this point

   • fix(security): clear the four open CodeQL alerts in code, say what the CodeQL gate really blocks (F-112)

     Show description for 768cebd
     

     devresponse

     and

     claude

     committed
     768cebdView commit details

     Copy full SHA for 768cebd

     View code at this pointBrowse repository at this point

   • test(mutation): mutate the tenant-boundary predicates and sso-launch-return, kill the trusted-origins survivors (I-11)

     Show description for 57c5dfb
     

     devresponse

     and

     claude

     committed
     57c5dfbView commit details

     Copy full SHA for 57c5dfb

     View code at this pointBrowse repository at this point

   • fix(docker): browser Sentry values as build args, CI boots the image it scans (F-108)

     Show description for e737c7f
     

     devresponse

     and

     claude

     committed
     e737c7fView commit details

     Copy full SHA for e737c7f

     View code at this pointBrowse repository at this point

   • fix(docs): resolve links from the doc's folder, one id namespace, literal traced roots, gate tests (F-90, F-91, F-88, F-92)

     Show description for 53ff0f0
     

     devresponse

     and

     claude

     committed
     53ff0f0View commit details

     Copy full SHA for 53ff0f0

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): up refuses what deploy refuses, auth migrates first on the URL alone, cookie domain covers the kit (F-137, F-141, F-146)

     Show description for cb265b0
     

     devresponse

     and

     claude

     committed
     cb265b0View commit details

     Copy full SHA for cb265b0

     View code at this pointBrowse repository at this point
3. Commits on Sep 25, 2026

   • ci(dependabot): propose next and eslint-config-next in one group (#482)

     Show description for 837a5c0
     

     devresponse

     and

     claude

     authored
     837a5c0View commit details

     Copy full SHA for 837a5c0

     View code at this pointBrowse repository at this point

   • ci: Bump the github-actions group across 1 directory with 3 updates (#469)

     Show description for 4aa8ab6
     

     dependabot[bot]

     and

     devresponse

     authored
     4aa8ab6View commit details

     Copy full SHA for 4aa8ab6

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): run drk-deploy's checks in CI and pin its release order (F-45)

     Show description for 61eab5a
     

     devresponse

     and

     claude

     committed
     61eab5aView commit details

     Copy full SHA for 61eab5a

     View code at this pointBrowse repository at this point

   • fix(db): test:db runs against DATABASE_TEST_URL and refuses a non-local host (F-44)

     Show description for 7a01084
     

     devresponse

     and

     claude

     committed
     7a01084View commit details

     Copy full SHA for 7a01084

     View code at this pointBrowse repository at this point

   • test(e2e): bearer mutations, API-key rotation, cross-org, self sign-up, #464 (F-43)

     Show description for 4347ba8
     

     devresponse

     and

     claude

     committed
     4347ba8View commit details

     Copy full SHA for 4347ba8

     View code at this pointBrowse repository at this point

   • fix(orgs): the default organization is the one flagged is_default, not the slug "default" (F-40)

     Show description for 1b9fde3
     

     devresponse

     and

     claude

     committed
     1b9fde3View commit details

     Copy full SHA for 1b9fde3

     View code at this pointBrowse repository at this point

   • ci(deps): audit the vercel-cli lockfile; check Dependabot alerts (F-28)

     Show description for 1e402fc
     

     devresponse

     and

     claude

     committed
     1e402fcView commit details

     Copy full SHA for 1e402fc

     View code at this pointBrowse repository at this point

   • fix(ops): readiness checks env + Better Auth schema; env parsed at boot (F-26)

     Show description for dd49256
     

     devresponse

     and

     claude

     committed
     dd49256View commit details

     Copy full SHA for dd49256

     View code at this pointBrowse repository at this point

   • build(node): pin engines.node to the exact major, 24.x (F-25)

     Show description for 3377954
     

     devresponse

     and

     claude

     committed
     3377954View commit details

     Copy full SHA for 3377954

     View code at this pointBrowse repository at this point

   • ci: give db:auth:migrate the env it validates at load

     Show description for 5e65dcf
     

     devresponse

     and

     claude

     committed
     5e65dcfView commit details

     Copy full SHA for 5e65dcf

     View code at this pointBrowse repository at this point

   • ci: apply Better Auth's tables before the DB-backed suites

     Show description for 6a3db7c
     

     devresponse

     and

     claude

     committed
     6a3db7cView commit details

     Copy full SHA for 6a3db7c

     View code at this pointBrowse repository at this point
4. Commits on Sep 22, 2026

   • chore(dependabot): give the react-table decline evidence and an exit (#467)

     Show description for 7cc3692
     

     devresponse

     and

     claude

     authored
     7cc3692View commit details

     Copy full SHA for 7cc3692

     View code at this pointBrowse repository at this point
5. Commits on Sep 20, 2026

   • chore(dependabot): watch vercel-cli so its advisories can be fixed by upgrade (#458)

     Show description for bd0d691
     

     devresponse

     and

     claude

     authored
     bd0d691View commit details

     Copy full SHA for bd0d691

     View code at this pointBrowse repository at this point

   • build(deps-dev): take three dev bumps, hold jsdom at 30.0.1 (#450)

     Show description for 1215846
     

     devresponse

     and

     claude

     authored
     1215846View commit details

     Copy full SHA for 1215846

     View code at this pointBrowse repository at this point
6. Commits on Sep 19, 2026

   • fix(ci): stop the production deploy workflow failing red, and make the docs true (#448)

     Show description for b328486
     

     devresponse

     and

     claude

     authored
     b328486View commit details

     Copy full SHA for b328486

     View code at this pointBrowse repository at this point
7. Commits on Sep 14, 2026

   • ci: Bump the github-actions group across 1 directory with 5 updates (#435)

     Show description for d4b4df7
     

     dependabot[bot]

     and

     devresponse

     authored
     d4b4df7View commit details

     Copy full SHA for d4b4df7

     View code at this pointBrowse repository at this point
8. Commits on Sep 7, 2026

   • fix(db,supply-chain,tooling): one connection per migration/seed/reset transaction, cooldown + hashed package manager, enforced mutation floors, intra-PR secret scan (review #84, #88, #226, #229, #2…

     Show description for 610d7a9
     

     devresponse

     and

     claude

     authored
     610d7a9View commit details

     Copy full SHA for 610d7a9

     View code at this pointBrowse repository at this point
9. Commits on Sep 6, 2026

   • fix(admin-api,sdk): model every admin route in the OpenAPI spec, document bearer auth, stop returning session tokens, pin the SDK generator (review #192, #193, #67/#194, #195, #196, #111/#197, #198…

     Show description for 49eb9d1
     

     devresponse

     and

     claude

     authored
     49eb9d1View commit details

     Copy full SHA for 49eb9d1

     View code at this pointBrowse repository at this point
10. Commits on Sep 5, 2026

    • test(e2e): drive the authz contracts against real Better Auth; make admin [id] not-found a real 404 (review #29, #50, #53) (#410)

      Show description for a854f49
      

      devresponse

      and

      claude

      authored
      a854f49View commit details

      Copy full SHA for a854f49

      View code at this pointBrowse repository at this point

    • ci: move the dependency audit into its own scheduled workflow (review #227) (#402)

      Show description for 7e5130a
      

      devresponse

      and

      claude

      authored
      7e5130aView commit details

      Copy full SHA for 7e5130a

      View code at this pointBrowse repository at this point

    • chore(ci): run CI, the Docker image and engines on Node 24 — the major production already runs (follow-up to #400) (#401)

      Show description for 6097cf5
      

      devresponse

      and

      claude

      authored
      6097cf5View commit details

      Copy full SHA for 6097cf5

      View code at this pointBrowse repository at this point

    • fix(sso): sign handoffs with an Ed25519 key + public JWKS, drop the fleet-wide HS256 secret (review #5, #60, #61) (#398)

      Show description for 4206015
      

      devresponse

      and

      claude

      authored
      4206015View commit details

      Copy full SHA for 4206015

      View code at this pointBrowse repository at this point
11. Commits on Sep 4, 2026

    • chore(dependabot): ignore semver-major bumps for node (docker) and @tanstack/react-table (#390)

      Show description for d2b65ef
      

      devresponse

      and

      claude

      authored
      d2b65efView commit details

      Copy full SHA for d2b65ef

      View code at this pointBrowse repository at this point