Register newTestServer cleanup and Shutdown WaitIdle so race detector
no longer hits RemoveAll on a live DataDir.
Co-authored-by: Cursor <cursoragent@cursor.com>
Principal comes from the session and query scope; body identifiers are ignored and admins cannot skip membership.
Co-authored-by: Cursor <cursoragent@cursor.com>
Pending-action task runs now use stageflow request aliases and Server ports, so chat no longer reaches through the orchestration root.
Co-authored-by: Cursor <cursoragent@cursor.com>
Move construction and document OnOutbox out of server, give HTTP/CLI a shared task use case, and block already-cleared import/event arch rules.
Co-authored-by: Cursor <cursoragent@cursor.com>
Ignore request user_id as identity, authorize from the session Principal, and hydrate restore/memory from the same visible set so HTTP, SSE, and prompt assembly cannot amplify hidden messages.
Co-authored-by: Cursor <cursoragent@cursor.com>
Hash deliverables through Capability.ReadArtifact, resolve backends on the server, and refuse workspace removal until frozen members match FAV receipts.
Co-authored-by: Cursor <cursoragent@cursor.com>
Authorize project members, reject direct project_shared creates, and
cover idempotent client_key plus revision-state after register.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose governance APIs for workflow selection/termination and allow login pages to read registration policy without admin credentials.
Co-authored-by: Cursor <cursoragent@cursor.com>
Close P0 auth gaps for lineage/runs, stage ABAC fail-closed, and
project:create; add IAM migrations 00021-23, me settings APIs, schema v2
manifests, orchestrator skeleton, and gate A regression coverage.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add confirm-gated resume API with resumable flag, Phase 5 finalize fault
and rolling-restart replay tests, Mermaid strict mode, request body limits,
and optional Runner Bearer auth between app and pi-agent.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add goose v19 task_runs/task_run_events tables with PG store for restart
replay, orphan interruption on startup, strict /ready checks, and strip
client work_dir from chat/SSE paths per P0 path sandbox requirements.
Co-authored-by: Cursor <cursoragent@cursor.com>
Inject stage access gate into bizdev service so task execution, project context reads, and prior docs respect live workflow ABAC.
Co-authored-by: Cursor <cursoragent@cursor.com>
Evaluate required document approvals before stage transition, expose readiness/advance APIs, show StageAdvanceBanner in the UI, and keep legacy workflow switch for explicit initial_workflow_key projects.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose draft/validate/publish/retire workflow APIs and template upload/list
routes wired to workflowdef service with DBCatalog refresh on publish.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add roles CRUD backed by system_roles tables, session list/revoke APIs,
capabilities fallback for memory mode, and route all admin checks through
AuthorizationService instead of hardcoded role-admin checks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
