Move document_records duty-slot writes into docgov, project ledger
heads through docgov/freedoc ports, and workspace deliverable I/O
through DeliverableStore so arch-check baseline drops to sql_write:1
path:13.
Heal used to resolve and backfill on the pool without the member-write advisory lock, so a stale snapshot of reviewer A could overwrite a committed transfer to B. Lock, resolve, and document updates now share one transaction and the same lock key.
Co-authored-by: Cursor <cursoragent@cursor.com>
Duty revoke must share the project advisory lock with reading old holders and writing members, so a post-commit service snapshot cannot miss a transfer. Heal still fills the new holder after commit, and sync failure stays ERR_DUTY_SYNC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Require TEST_DATABASE_URL and refuse agent_system_dev. Script creates a
throwaway database, runs packages serially, then drops it.
Co-authored-by: Cursor <cursoragent@cursor.com>
Omit project_role no longer defaults to member. Exclusive duty writes
take an advisory lock and retry conflicts so last-writer wins without
dual reviewers. Author write tests require err==nil.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stop inventing reviewer_id=2. Use project document_duty as the authority, heal missing or non-member placeholders, and keep write paths rejected for reviewer and outsiders.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add roles CRUD backed by system_roles tables, session list/revoke APIs,
capabilities fallback for memory mode, and route all admin checks through
AuthorizationService instead of hardcoded role-admin checks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
weichen