Commits

Commit history

1. Commits on Oct 1, 2026

   • feat(drk-deploy): db:runtime-login moves production onto a least-privilege login in one command, checked against the gate's target line, and retires old logins (DEP4)

     Show description for 951da1f
     

     devresponse

     and

     claude

     committed
     951da1fView commit details

     Copy full SHA for 951da1f

     View code at this pointBrowse repository at this point

   • feat(db): least-privilege runtime role: privilege manifest reconciled on every migrate, pnpm db:runtime-login, the gate's privilege check and ratchet, CI runs the app as a non-owner login (DEP3)

     Show description for fdca6c7
     

     devresponse

     and

     claude

     committed
     fdca6c7View commit details

     Copy full SHA for fdca6c7

     View code at this pointBrowse repository at this point

   • feat(deploy): migrate production on every push to main, refuse unsafe migration sessions, retire deploy.yml (DEP2)

     Show description for a0644f3
     

     devresponse

     and

     claude

     committed
     a0644f3View commit details

     Copy full SHA for a0644f3

     View code at this pointBrowse repository at this point

   • feat(deploy): fail-closed schema gate in the Vercel production build, plus the expand/contract rule and its guard (DEP1)

     Show description for 7d77f9d
     

     devresponse

     and

     claude

     committed
     7d77f9dView commit details

     Copy full SHA for 7d77f9d

     View code at this pointBrowse repository at this point

   • refactor(db): consolidate core migrations 0002-0008 into 0002-release.sql, keep pre-consolidation databases working (MIG)

     Show description for 66754df
     

     devresponse

     and

     claude

     committed
     66754dfView commit details

     Copy full SHA for 66754df

     View code at this pointBrowse repository at this point
2. Commits on Sep 30, 2026

   • refactor(http): move the route wrappers, request id, error envelopes, origin guard and rate limiters into src/lib/http (R13, I-13)

     Show description for ee804cd
     

     devresponse

     and

     claude

     committed
     ee804cdView commit details

     Copy full SHA for ee804cd

     View code at this pointBrowse repository at this point

   • feat(privacy): per-user data export and SECURITY DEFINER erasure with migration 0008 (F-151)

     Show description for d4f7a27
     

     devresponse

     and

     claude

     committed
     d4f7a27View commit details

     Copy full SHA for d4f7a27

     View code at this pointBrowse repository at this point

   • ci(deploy): install the Vercel CLI from vercel-cli's lockfile, document the SHA-pinning and production-environment settings (I-09)

     Show description for 5506f27
     

     devresponse

     and

     claude

     committed
     5506f27View commit details

     Copy full SHA for 5506f27

     View code at this pointBrowse repository at this point

   • docs: make topology, migration tags, handoff claims, SSO wording and UAT citations match the code (F-107, F-135, I-05, M-01, A-09, I-16)

     Show description for 495a82f
     

     devresponse

     and

     claude

     committed
     495a82fView commit details

     Copy full SHA for 495a82f

     View code at this pointBrowse repository at this point

   • fix(email): retry transient sends inline, lease rows from the drain, report invitation delivery (F-99, F-101, F-104)

     Show description for 84e4e77
     

     devresponse

     and

     claude

     committed
     84e4e77View commit details

     Copy full SHA for 84e4e77

     View code at this pointBrowse repository at this point

   • fix(db): lock role and permission deletes, make global role keys and the default flag unique, index the search ORs, store no provider tokens (F-97, F-93, M-02, F-150)

     Show description for 175f284
     

     devresponse

     and

     claude

     committed
     175f284View commit details

     Copy full SHA for 175f284

     View code at this pointBrowse repository at this point

   • fix(api): cap request bodies on the public endpoints before they authenticate (F-78)

     Show description for b466a94
     

     devresponse

     and

     claude

     committed
     b466a94View commit details

     Copy full SHA for b466a94

     View code at this pointBrowse repository at this point

   • fix(admin): revoked credentials no longer block an org delete, a launched enterprise app deletes with its nonces (F-98, F-84)

     Show description for 8e199af
     

     devresponse

     and

     claude

     committed
     8e199afView commit details

     Copy full SHA for 8e199af

     View code at this pointBrowse repository at this point

   • fix(sso): only the issuer signs as the issuer, the primary is never its own target, sso-session/create refuses HTTP (F-80, F-83, F-81)

     Show description for 4552f24
     

     devresponse

     and

     claude

     committed
     4552f24View commit details

     Copy full SHA for 4552f24

     View code at this pointBrowse repository at this point

   • fix(migrations): run both migrators under lock_timeout and statement_timeout, correct 0005's "online" claim (F-94)

     Show description for 6dd9f92
     

     devresponse

     and

     claude

     committed
     6dd9f92View commit details

     Copy full SHA for 6dd9f92

     View code at this pointBrowse repository at this point

   • fix(retention): run pruneAll from the outbox-drain cron, batch the outbox prune and sweep under a time budget (F-96)

     Show description for ae61482
     

     devresponse

     and

     claude

     committed
     ae61482View commit details

     Copy full SHA for ae61482

     View code at this pointBrowse repository at this point

   • fix(docs): resolve links from the doc's folder, one id namespace, literal traced roots, gate tests (F-90, F-91, F-88, F-92)

     Show description for 53ff0f0
     

     devresponse

     and

     claude

     committed
     53ff0f0View commit details

     Copy full SHA for 53ff0f0

     View code at this pointBrowse repository at this point

   • fix(docs): YAML-only frontmatter that fails closed, authorize the doc rendered, rate-limit assets (F-86, F-87, I-18, I-06)

     Show description for e992276
     

     devresponse

     and

     claude

     committed
     e992276View commit details

     Copy full SHA for e992276

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): up refuses what deploy refuses, auth migrates first on the URL alone, cookie domain covers the kit (F-137, F-141, F-146)

     Show description for cb265b0
     

     devresponse

     and

     claude

     committed
     cb265b0View commit details

     Copy full SHA for cb265b0

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): .env comments, spaced pnpm shim, secrets off argv (F-144, F-145, F-143)

     Show description for d11407e
     

     devresponse

     and

     claude

     committed
     d11407eView commit details

     Copy full SHA for d11407e

     View code at this pointBrowse repository at this point

   • fix(admin): an org admin's test email goes only to their own address, and admin-sent mail is budgeted in Postgres (F-64)

     Show description for 3fabbc9
     

     devresponse

     and

     claude

     committed
     3fabbc9View commit details

     Copy full SHA for 3fabbc9

     View code at this pointBrowse repository at this point

   • fix(auth): end over-age sessions on /api/auth/*, log failed sign-ins and budget them per account (F-54, F-55)

     Show description for 371a385
     

     devresponse

     and

     claude

     committed
     371a385View commit details

     Copy full SHA for 371a385

     View code at this pointBrowse repository at this point
3. Commits on Sep 25, 2026

   • fix(vercel-cli): roll back a build that fails its probe, and fail the probe on a key problem (F-51)

     Show description for 056513b
     

     devresponse

     and

     claude

     committed
     056513bView commit details

     Copy full SHA for 056513b

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): release only a clean, pushed commit; refuse the git-integration race (F-49)

     Show description for 9e5228a
     

     devresponse

     and

     claude

     committed
     9e5228aView commit details

     Copy full SHA for 9e5228a

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): name the migration URL and check it against production before migrating (F-47)

     Show description for 94cf36f
     

     devresponse

     and

     claude

     committed
     94cf36fView commit details

     Copy full SHA for 94cf36f

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): check env presence per target and verify public values before deploy (F-46)

     Show description for 4f3240d
     

     devresponse

     and

     claude

     committed
     4f3240dView commit details

     Copy full SHA for 4f3240d

     View code at this pointBrowse repository at this point

   • fix(vercel-cli): run drk-deploy's checks in CI and pin its release order (F-45)

     Show description for 61eab5a
     

     devresponse

     and

     claude

     committed
     61eab5aView commit details

     Copy full SHA for 61eab5a

     View code at this pointBrowse repository at this point

   • fix(orgs): the default organization is the one flagged is_default, not the slug "default" (F-40)

     Show description for 1b9fde3
     

     devresponse

     and

     claude

     committed
     1b9fde3View commit details

     Copy full SHA for 1b9fde3

     View code at this pointBrowse repository at this point

   • ci(deps): audit the vercel-cli lockfile; check Dependabot alerts (F-28)

     Show description for 1e402fc
     

     devresponse

     and

     claude

     committed
     1e402fcView commit details

     Copy full SHA for 1e402fc

     View code at this pointBrowse repository at this point

   • fix(ops): readiness checks env + Better Auth schema; env parsed at boot (F-26)

     Show description for dd49256
     

     devresponse

     and

     claude

     committed
     dd49256View commit details

     Copy full SHA for dd49256

     View code at this pointBrowse repository at this point

   • fix(config): validate origin env vars and import JWT keys at boot (F-22)

     Show description for 5721217
     

     devresponse

     and

     claude

     committed
     5721217View commit details

     Copy full SHA for 5721217

     View code at this pointBrowse repository at this point

   • fix(rate-limit): take SSO pre-auth limits from the shared bucket (F-19)

     Show description for 4d1759b
     

     devresponse

     and

     claude

     committed
     4d1759bView commit details

     Copy full SHA for 4d1759b

     View code at this pointBrowse repository at this point

   • fix(rate-limit): check the per-IP bucket before the global floor (F-18)

     Show description for d362705
     

     devresponse

     and

     claude

     committed
     d362705View commit details

     Copy full SHA for d362705

     View code at this pointBrowse repository at this point
4. Commits on Sep 19, 2026

   • fix(ci): stop the production deploy workflow failing red, and make the docs true (#448)

     Show description for b328486
     

     devresponse

     and

     claude

     authored
     b328486View commit details

     Copy full SHA for b328486

     View code at this pointBrowse repository at this point
5. Commits on Sep 7, 2026

   • fix(mcp,api-auth): validate tool arguments, enforce JSON-RPC/Streamable-HTTP conformance, fail boot on issuer mismatch, refuse dead-agent mutations, fence tool output as untrusted (review #54, #55,…

     Show description for ab67c6c
     

     devresponse

     and

     claude

     authored
     ab67c6cView commit details

     Copy full SHA for ab67c6c

     View code at this pointBrowse repository at this point