3 Commits

Include renames

Author	SHA1	Message	Date
weichen	f1302ed5b3	Enable canonical versioned Go module consumption ... Why: Allow consumers to download an immutable module revision without nested source checkouts or local path replacements. Evidence: SELF package tests and the prior canonical-path rejection are recorded in the Dev dependency-workspace task card; remote consumption is replayed against the committed candidate. Impact: Change the module identity and its Go imports while preserving API behavior. Existing historical submodule revisions remain buildable. Refs: Versioned dependencies U1/U3; feature/dependency-workspace	2026-10-13 15:47:16 +00:00
weichen	e0b1c27f1f	Scope command audit storage and queries to the requesting owner ... Why: GET /api/commands/audit leaked every tenant's audit rows (command ids, entrances, conversation ids, param digests) to any authenticated user; owner was never recorded nor filtered. Evidence: Red run at a7cc69b FAIL (alice sees bob's row); after fix go test ./... 32/32 packages ok, including TestCommandAuditOwnerScoping and the v18 backfill test (rows recorded on the task card). Impact: v18 migration adds command_audit.owner with actor-based backfill (empty-actor rows stay invisible via API, kept in-table); AppendAudit/ListAudits gain owner params; cmdbus port and fakes updated; handler passes authenticated owner. No public extension surface change. Refs: Task card R1; U0 proposal section 5 C7 finding.	2026-10-08 14:02:19 +00:00
weichen	a7cc69b61e	Add a red test for cross-tenant command audit leakage ... Why: GET /api/commands/audit returns every tenant's audit rows; the regression test pins the desired owner-scoped behavior before the fix. Evidence: go test ./internal/server -run TestCommandAuditOwnerScoping FAIL (owner alice sees bob's row; output recorded on the task card). Impact: Test only; suite red on this commit by design. Refs: Task card R1; U0 proposal section 5 C7 security finding.	2026-10-08 13:57:30 +00:00