ListWorkflowDocumentsByProject now projects author/reviewer/approver
id+name so clients cannot invent the current user as author.
Co-authored-by: Cursor <cursoragent@cursor.com>
Do not expose a production path that mutates only the in-memory proposal
index. Cover decision idempotency via ProposeModification+Decide and the
existing package MarkProposalApplied tests instead.
Co-authored-by: Cursor <cursoragent@cursor.com>
Write applied status to Postgres before mutating memory so a failed UPDATE
cannot leave a false in-memory applied state; treat already-applied as
idempotent success and expose PutChangeProposal for compensation seeding.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unauthorized actors no longer grab leases; controlled PATCH projects through
DocGov so author_last_edited and audit survive, with idempotent retry on failure.
Co-authored-by: Cursor <cursoragent@cursor.com>
Stage generation without a real document must not panic or enter the ledger.
Unknown orphan IDs are denied, write paths check author/lease/lifecycle, PATCH
no longer returns a fake 200, and overlay matching survives client/server block id drift.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use task run_id as doc lease holder so release tracks execution, and reclaim squad locks when the holder run is missing or no longer running.
Co-authored-by: Cursor <cursoragent@cursor.com>
Sync doc task status on approve and evaluate whether to emit stage advance readiness; chain docgov hooks.
Co-authored-by: Cursor <cursoragent@cursor.com>
Unify auth middleware and remove X-User-ID trust, add project_members
authorization, sandbox workspaces via resolver, and admin-only reconcile
by run_id. Introduce goose migrations with startup schema gate, fail closed
when DB unavailable outside explicit ALLOW_IN_MEMORY, bundle web/dist in
app Dockerfile, and remove frontend pseudo-login fallback.
