Commits

Commit history

1. Commits on Oct 5, 2026

   • Fix the high-severity comment/test findings from the 2026-10-01 review (K4-01, K2-01, K3-01, K11-01, K14-01, K14-02) (#511)

     Show description for c9e0839
     

     devresponse

     and

     claude

     authored
     c9e0839View commit details

     Copy full SHA for c9e0839

     View code at this pointBrowse repository at this point
2. Commits on Oct 1, 2026

   • feat(drk-deploy): db:runtime-login moves production onto a least-privilege login in one command, checked against the gate's target line, and retires old logins (DEP4)

     Show description for 951da1f
     

     devresponse

     and

     claude

     committed
     951da1fView commit details

     Copy full SHA for 951da1f

     View code at this pointBrowse repository at this point

   • feat(db): least-privilege runtime role: privilege manifest reconciled on every migrate, pnpm db:runtime-login, the gate's privilege check and ratchet, CI runs the app as a non-owner login (DEP3)

     Show description for fdca6c7
     

     devresponse

     and

     claude

     committed
     fdca6c7View commit details

     Copy full SHA for fdca6c7

     View code at this pointBrowse repository at this point

   • feat(deploy): migrate production on every push to main, refuse unsafe migration sessions, retire deploy.yml (DEP2)

     Show description for a0644f3
     

     devresponse

     and

     claude

     committed
     a0644f3View commit details

     Copy full SHA for a0644f3

     View code at this pointBrowse repository at this point

   • feat(deploy): fail-closed schema gate in the Vercel production build, plus the expand/contract rule and its guard (DEP1)

     Show description for 7d77f9d
     

     devresponse

     and

     claude

     committed
     7d77f9dView commit details

     Copy full SHA for 7d77f9d

     View code at this pointBrowse repository at this point

   • feat(shell): link the brand home and add Administration Console to the app switcher (NAVK)

     Show description for 9e37be5
     

     devresponse

     and

     claude

     committed
     9e37be5View commit details

     Copy full SHA for 9e37be5

     View code at this pointBrowse repository at this point

   • refactor(db): consolidate core migrations 0002-0008 into 0002-release.sql, keep pre-consolidation databases working (MIG)

     Show description for 66754df
     

     devresponse

     and

     claude

     committed
     66754dfView commit details

     Copy full SHA for 66754df

     View code at this pointBrowse repository at this point
3. Commits on Sep 30, 2026

   • fix(admin): hold an org admin's enterprise-app audience to the <prefix>:<app id> a satellite can consume (R15, I-01)

     Show description for a6a0a09
     

     devresponse

     and

     claude

     committed
     a6a0a09View commit details

     Copy full SHA for a6a0a09

     View code at this pointBrowse repository at this point

   • refactor(http): move the route wrappers, request id, error envelopes, origin guard and rate limiters into src/lib/http (R13, I-13)

     Show description for ee804cd
     

     devresponse

     and

     claude

     committed
     ee804cdView commit details

     Copy full SHA for ee804cd

     View code at this pointBrowse repository at this point

   • fix(admin): let an org admin create an enterprise app from the console, prefill and hint its org's slug namespace (R14, I-01)

     Show description for dad374e
     

     devresponse

     and

     claude

     committed
     dad374eView commit details

     Copy full SHA for dad374e

     View code at this pointBrowse repository at this point

   • fix(admin): save each dual-list editor in one atomic PATCH, refuse a stale organization, role or group save with an ETag, name the F-09 409s, regenerate the admin SDK (F-38, F-39, F-09)

     Show description for 42a01ec
     

     devresponse

     and

     claude

     committed
     42a01ecView commit details

     Copy full SHA for 42a01ec

     View code at this pointBrowse repository at this point

   • chore(deps): port to @sentry/nextjs 11.1 with span scrubbing on the streamed span shape (R11, supersedes #485)

     Show description for cf46969
     

     devresponse

     and

     claude

     committed
     cf46969View commit details

     Copy full SHA for cf46969

     View code at this pointBrowse repository at this point

   • chore(deps): replace the deprecated prom-client with @prometheus-io/client, floor overrides at the declared versions (F-113, #489)

     Show description for dc32cf4
     

     devresponse

     and

     claude

     committed
     dc32cf4View commit details

     Copy full SHA for dc32cf4

     View code at this pointBrowse repository at this point

   • feat(privacy): per-user data export and SECURITY DEFINER erasure with migration 0008 (F-151)

     Show description for d4f7a27
     

     devresponse

     and

     claude

     committed
     d4f7a27View commit details

     Copy full SHA for d4f7a27

     View code at this pointBrowse repository at this point

   • fix(help): gate the admin walkthrough by each screen's permission, recapture its real-data screenshots from synthetic seed data (F-89)

     Show description for 2bd211a
     

     devresponse

     and

     claude

     committed
     2bd211aView commit details

     Copy full SHA for 2bd211a

     View code at this pointBrowse repository at this point

   • fix(admin-api): honour a repeated filter on every admin list and export, answer the create and revoke shapes the spec declares (F-74)

     Show description for 1c13ce2
     

     devresponse

     and

     claude

     committed
     1c13ce2View commit details

     Copy full SHA for 1c13ce2

     View code at this pointBrowse repository at this point

   • ci(deploy): install the Vercel CLI from vercel-cli's lockfile, document the SHA-pinning and production-environment settings (I-09)

     Show description for 5506f27
     

     devresponse

     and

     claude

     committed
     5506f27View commit details

     Copy full SHA for 5506f27

     View code at this pointBrowse repository at this point

   • fix(security): clear the four open CodeQL alerts in code, say what the CodeQL gate really blocks (F-112)

     Show description for 768cebd
     

     devresponse

     and

     claude

     committed
     768cebdView commit details

     Copy full SHA for 768cebd

     View code at this pointBrowse repository at this point

   • fix(sso): end a handoff session 8 hours after the handoff, and end an app's handoff sessions when it is disabled or deleted (F-82)

     Show description for 429fd35
     

     devresponse

     and

     claude

     committed
     429fd35View commit details

     Copy full SHA for 429fd35

     View code at this pointBrowse repository at this point

   • fix(email): write invitations and the admin test email in the recipient's language, with a matching invite link (F-102)

     Show description for 870cf67
     

     devresponse

     and

     claude

     committed
     870cf67View commit details

     Copy full SHA for 870cf67

     View code at this pointBrowse repository at this point

   • fix(admin): org admins name enterprise apps under their org's slug, and never claim a global app id or SSO audience (I-01)

     Show description for 8f1850c
     

     devresponse

     and

     claude

     committed
     8f1850cView commit details

     Copy full SHA for 8f1850c

     View code at this pointBrowse repository at this point

   • fix(admin): gate an org's members, invitations and bindings on admin.orgs.manage, and keep every catalog key on a guard (F-69)

     Show description for 3e011ab
     

     devresponse

     and

     claude

     committed
     3e011abView commit details

     Copy full SHA for 3e011ab

     View code at this pointBrowse repository at this point

   • docs(governance): backfill the CHANGELOG since 1.0.0, Node 24 in CONTRIBUTING, a README that matches the tree (F-134, A-02)

     Show description for 6990a58
     

     devresponse

     and

     claude

     committed
     6990a58View commit details

     Copy full SHA for 6990a58

     View code at this pointBrowse repository at this point

   • test(coverage): raise the ratchet to measured coverage, floor every route file (F-125)

     Show description for 2cdb89b
     

     devresponse

     and

     claude

     committed
     2cdb89bView commit details

     Copy full SHA for 2cdb89b

     View code at this pointBrowse repository at this point

   • docs(architecture): plan the src/lib/http move, route definitions and typed linting (I-13)

     Show description for ca0e19b
     

     devresponse

     and

     claude

     committed
     ca0e19bView commit details

     Copy full SHA for ca0e19b

     View code at this pointBrowse repository at this point

   • docs: make topology, migration tags, handoff claims, SSO wording and UAT citations match the code (F-107, F-135, I-05, M-01, A-09, I-16)

     Show description for 495a82f
     

     devresponse

     and

     claude

     committed
     495a82fView commit details

     Copy full SHA for 495a82f

     View code at this pointBrowse repository at this point

   • refactor(db,admin): type timestamp columns as Date, route sibling code through loadScopedOrg, isUuid and status-values (F-131, F-133)

     Show description for 1759a34
     

     devresponse

     and

     claude

     committed
     1759a34View commit details

     Copy full SHA for 1759a34

     View code at this pointBrowse repository at this point

   • fix(api): one error envelope and one 429 per surface, count every denial, stamp request ids on the MCP pair (F-129, F-130, A-12)

     Show description for 118c7d0
     

     devresponse

     and

     claude

     committed
     118c7d0View commit details

     Copy full SHA for 118c7d0

     View code at this pointBrowse repository at this point

   • fix(auth): make sign-up provisioning, invitation acceptance and sign-in activation atomic, converge on concurrent duplicates (F-95)

     Show description for 7355255
     

     devresponse

     and

     claude

     committed
     7355255View commit details

     Copy full SHA for 7355255

     View code at this pointBrowse repository at this point

   • fix(email): drop queued invitation mail once its invitation dies, share the token TTLs, pin the seeded templates (F-100, F-103)

     Show description for 1eac12a
     

     devresponse

     and

     claude

     committed
     1eac12aView commit details

     Copy full SHA for 1eac12a

     View code at this pointBrowse repository at this point

   • fix(email): retry transient sends inline, lease rows from the drain, report invitation delivery (F-99, F-101, F-104)

     Show description for 84e4e77
     

     devresponse

     and

     claude

     committed
     84e4e77View commit details

     Copy full SHA for 84e4e77

     View code at this pointBrowse repository at this point

   • docs(uat): point the role and permission delete guards at their moved lines

     Show description for 266c685
     

     devresponse

     and

     claude

     committed
     266c685View commit details

     Copy full SHA for 266c685

     View code at this pointBrowse repository at this point

   • fix(db): lock role and permission deletes, make global role keys and the default flag unique, index the search ORs, store no provider tokens (F-97, F-93, M-02, F-150)

     Show description for 175f284
     

     devresponse

     and

     claude

     committed
     175f284View commit details

     Copy full SHA for 175f284

     View code at this pointBrowse repository at this point

   • fix(authz): check the scope, rate-limit and guard invariants per handler, gate every access-context caller (F-127, I-15)

     Show description for c61ed19
     

     devresponse

     and

     claude

     committed
     c61ed19View commit details

     Copy full SHA for c61ed19

     View code at this pointBrowse repository at this point

   • test(api): pin an org-less credential's binding and the users list's org names against Postgres (F-124, F-126)

     Show description for 1309632
     

     devresponse

     and

     claude

     committed
     1309632View commit details

     Copy full SHA for 1309632

     View code at this pointBrowse repository at this point