5 Commits
Author SHA1 Message Date
weichenandCursor 3f42149457 feat(bizdev): snapshot collaborators onto Runtime and Server ports
Composition roots copy Parts once so HTTP/CLI handlers stop calling locator getters on every request.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-15 13:00:33 +00:00
weichenandCursor 110c2e810c feat(stageflow): own task/stage types so coordinator drops bizdev
Coordinator now takes a StageTaskRunner and injected context/KB ports.
Chatflow assembler reads maturity tokens instead of the orchestration root.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-15 11:13:17 +00:00
weichenandCursor be9a6d4640 docs(archive): relocate superpowers, workflow, and test assets
Move docs/superpowers to archive/design/superpowers with stubs;
archive workflow rules to PROJECT SSOT; separate test-report assets.
Update Go doc path references.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-13 02:50:23 +00:00
weichen 3145550a59 feat(security): complete P0 release blocking remediation
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
2026-09-13 02:50:22 +00:00
WeiCHEN e5e80a6fc6 feat(core): update backend coordinator, docgov lease, squad workflow and web governance integration 2026-09-13 02:50:20 +00:00