Repository navigation
feat(identity): add scoped Studio and membership administration - #40
Merged
Merged
Conversation
Record two fresh independent source and retained-evidence approvals, with explicit proof limits and the pending maintainer decision. ADR: 0063, 0069
Prepare own-record amendments for both inherited CI decisions and scope feedback cost per running job. Distinguish expected-owner observations from unchanged operation deadlines without implementing the policy. ADR: 0062, 0063, 0069
Record independent source and corpus checks of the maintainer review clarifications, including the justified observation-bound disposition. ADR: 0062, 0063, 0069
Record fresh source and corpus approvals with explicit execution and acceptance limits. Keep the policy Proposed for maintainer review. ADR: 0062, 0063, 0069
Record maintainer acceptance, append each predecessor amendment and reconcile current carriers before implementing the closed budget policy. Acceptance and existing catalogue enforcement do not establish new fit. ADR: 0062, 0063, 0069, 0075
Record independent amendment-byte and carrier-consistency approvals without claiming executable implementation or hosted fit. ADR: 0062, 0063, 0069, 0075
Record two fresh second-round approvals and the completed documentation step before starting dependent budget implementation. ADR: 0062, 0063, 0069, 0075
Share one closed mode/job/index duration policy across launch, fixture preparation and independent result validation. Extend only ordinary whole job and enclosing observation windows while preserving cleanup and operation caps. Add positive and forged-identity threshold controls. ADR: 0062, 0063, 0075
Record independent authority-path approval and offline counterfactual reruns while leaving hosted qualification explicitly pending. ADR: 0062, 0063, 0069, 0075
Record fresh independent second-round approvals and freeze the reviewed source for complete same-source A/B qualification without inferred fit. ADR: 0062, 0063, 0069, 0075
Record two complete same-source hosted assignments, retained original packages and exact result/lifecycle evidence before independent review. Keep implementation-source qualification distinct from later doc heads. ADR: 0062, 0063, 0069, 0075
Record independent original-archive and lifecycle/public audits of both complete assignments, with explicit source and chronology proof limits. ADR: 0062, 0063, 0069, 0075
Correct an unshipped evidence-label finding and record independent second-round audits. Both actual fixture subsets demonstrate distinct assignments; no execution source or result changes. ADR: 0062, 0063, 0069, 0075
Record completed acceptance, code and hosted-evidence review cycles with source-bound full A/B qualification. Keep later documentation identity and normal protected checks explicit for the PR handoff. ADR: 0062, 0063, 0069, 0075
Integrate squash merge 012e67c into development without rewriting published history. The merged main and reviewed PR head have identical file trees; subsequent closeout work stays on development.
Record PR 38's verified squash merge and source-bound qualification. Mark P03-1 complete, retain later activation gates, and identify P03-2 as the next packet without starting its implementation. ADR: 0069, 0072, 0073, 0074, 0075
Resolve the activation gaps against merged identity storage before implementing live membership, scope and denied evidence. Keep proposed authority and the minimum useful HTTP consumer behind maintainer review. ADR: 0033, 0036, 0040, 0044, 0064, 0065, 0072, 0073
Close the first independent proposal review findings before maintainer acceptance. Separate ordinary grant ceilings from finite adoption and preserve denial evidence under nested read-only execution. ADR: 0017, 0033, 0040, 0044, 0064, 0073
Remove obsolete module-loader and registration-time grant sketches so the next packet follows the accepted scoped definition and manifest contract. This documentation repair activates no live authorization. ADR: 0069, 0073
Record the second fresh proposal review and its evidence limits so the maintainer can approve the coupled authority and evidence contracts before the first runtime implementation step. ADR: 0069, 0073
Separate bounded authority and evidence resources from retained business owners. Require denial durability before outer success and define fixed occurrence reconciliation without promising restart replay recovery. ADR: 0033, 0040, 0044, 0047, 0069, 0072, 0073
Retain the independent liveness and durability review boundaries and require real server-transaction ownership in the pooling proof before presenting the corrected decision package for acceptance. ADR: 0040, 0044, 0047, 0069
Record independent second-round approval and the corrected maintainer findings without treating design review as runtime qualification or inferring acceptance of the revised contracts. ADR: 0033, 0040, 0044, 0047, 0069
Record the maintainer's joint approval before runtime implementation. Reconcile canonical owners, historical decision amendments, source classification and registered proofs without claiming activation. ADR: 0033, 0036, 0040, 0044, 0047, 0064, 0065, 0073, 0076, 0077 Module: Identity, Tenancy, Audit, Education
Keep role identity separate from the accepted auxiliary source pair and make the approved pending setup and scoped-policy workflow discoverable. Preserve all executable environment values and runtime activation gates. ADR: 0076, 0077
Record both fresh review rounds and their verified correction so the accepted candidate-reader implementation can proceed without confusing contract approval with activation evidence. ADR: 0076, 0077
Read current scoped authority without borrowing a retained business connector or publishing tenant context. Keep actual cleanup, role checks and the total deadline under one bounded owner, with real PostgreSQL and transaction-pool progress controls before production activation. ADR: 0003, 0036, 0040, 0047, 0076, 0077 Module: Identity, Tenancy
Reconcile finished job lanes before helper admission and pin the verified credential witness and corrupt role-bound controls at their exact owners. ADR: 0076, 0077 Module: Identity, Tenancy
Record the independently checked fixes and both review verdicts before continuing with the real policy and read-scope consumer. ADR: 0076, 0077
Bind every declared act to its live source, fresh authorization decision and one physical read owner. Keep tenant-wide EF and SQL reads aligned without widening organization writes or activating the HTTP surface. Add the internal audited membership directory and real owner, lifecycle, metadata and direct/PgBouncer progress controls. Preserve staged launch until denial evidence and HTTP activation are qualified. ADR: 0076, 0077 Module: Identity, Tenancy, Customization, Education
Keep the current package and CI policy while making the remaining provenance wrapper choice explicit before any setting changes or early draft publication. ADR: 0089
Use the existing source-bound PR workflow if early draft review is explicitly authorized, without adding a parallel manual CI run or relaxing qualification. ADR: 0089
Record both independent reviews and preserve explicit approval for the two settings and any draft publication before complete qualification. ADR: 0089
Distinguish discovered files and inner cases, retain the pnpm probes, and record authorization for parallel draft review using the existing PR CI. ADR: 0089
Allow the existing setup and 112 serial controls more signal/failure time without changing command, outcomes, package guards or product policy. ADR: 0089
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @cemililik, this pull request is too large to review
It changes 952 files. Sourcery can review pull requests with up to 300 changed files.
Contributor
WalkthroughWarning Review details and warnings were omitted to fit the comment limit. |
Record both fresh reviews and the complete local guard, and let the PR own current hosted proof without moving source after its final A/B binding. ADR: 0089
Keep the same scan, allocation and fail-closed behavior while exposing the existing closed subprocess failure class instead of losing it at this call. ADR: 0062
Record the completed PR A and preserve explicit approval for the separately retained SDK pair while avoiding a duplicate known-incomplete workflow. ADR: 0090
Distinguish uncached acceptance from cached refusal, name the canonical carriers, and retain the unchanged aggregate and ownership proof boundaries. ADR: 0090
Give the existing sequential cold commands more stop-request allowance while retaining both counterfactuals, actual retirement and the package guard. ADR: 0090
Record the full stable-source guard and both reviews, keeping product review and final-source hosted qualification distinct on the existing PR workflow. ADR: 0090
cemililik
marked this pull request as ready for review
November 3, 2026 14:48
Architecture
Inside the changed components — 2 viewsComponent view — Scope Admission and Entry Internal modules handling candidate admission and global self entry.
Component view — Identity and Tenancy Controllers Administrative endpoints and replay protection in the API.
Data flow
Data model
The other flows — 1 sequence
Review ✨ Nothing flagged · reviewed Tip Set 🪧 More tips
Thanks for using PR Lens! It's free for OSS. If it helped, a star helps other teams find it. |
There was a problem hiding this comment.
Sorry @cemililik, this pull request is too large to review
It changes 953 files. Sourcery can review pull requests with up to 300 changed files.
Keep complete positive image proof and the final cleanup ledger while making the preflight and metadata allocation choice explicit for review. ADR: 0091
Name both phases and their shared metadata sublimit explicitly while keeping the final ledger, positive proof and exact-source qualification requirements. ADR: 0091
Separate preflight from final inventory and scope metadata sublimits to the existing positive proof without changing the final reserve ledger. ADR: 0091
Remove the stale unchanged-native-policy statement while retaining the SDK aggregate boundary and source-bound implementation review evidence. ADR: 0091
Record the complete source-bound controls and corrected two-round review, keeping hosted qualification on the final immutable PR source binding. ADR: 0091
Record the repeated same-source SDK failure and aggregate expiry, with one coordinated four-setting proposal and unchanged proof duties. Keep executable timers pending explicit maintainer approval.
Resolve the paired SDK and package allowance under maintainer closure delegation, with complete qualification and ownership proof retained. ADR: 0092
Give the canonical SDK package a coherent inner and aggregate allowance while preserving discovery, cold commands and actual ownership proof. Keep the frontend job allowance consistent with both tested packages. ADR: 0092
Record complete committed-source validation and both fresh reviews, then hand one fixed final source to the existing PR qualification flow. ADR: 0092
Support the documented EC2 Nitro VM signature within the existing exclusive standard-runner contract. Keep exact producer and receipt validation, container refusal and all authority/ownership checks intact. ADR: 0062
Make failed session checks an explicit choice for dirty forms and keep invalid profile submissions correctable in the native response. Select recovery language from the current actor while preserving bounded publication, authorization and physical cleanup. Reconcile verified review findings without expanding privileges or test windows. ADR: 0070, 0078, 0079, 0083 Module: Identity, Tenancy I18n: auth.session.extend_unsaved, auth.mutation.validation, profile.invalid_display_name, profile.invalid_preferred_locale
Place the existing real visitor-window wait before profile replay so recovery preference reads do not exhaust the earlier page journey. Preserve production limits and all commit, replay and audit assertions. Record the failed hosted source and successful actual-provider proof. ADR: 0070, 0078, 0079
Make published seed-child validation explicit while preserving the fixed writer authority and prerequisite fences. Link delivered transport and profile behavior to its accepted contracts and keep qualification in the phase status and PR proof record. ADR: 0069, 0078, 0079, 0080 Module: Education, Identity
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A signed-in person can discover their memberships, explicitly choose an institution or branch, and enter the protected Studio. The API checks the provider association, live membership and actual host before publishing scoped session authority.
Tests
Merged2026-11-04 as
ef344c0f, from reviewed headb97214e7. Final-head PR attempt1/A passes27/27 jobs. Full A/B/original-archive proof remains bound to parent620fdaf3; final-head B/archive verification is an open evidence follow-up. Manual accessibility remains deferred and unexecuted.Merged-head CI41826206204 completes27/27 jobs successfully for head
b97214e7, treef8e89aea. Local follow-up checks pass: CI=true Release build with zero warnings/errors,3,434/3,434 unit cases,46/46 real PostgreSQL seed-continuation cases, the one aggregate seed-continuation architecture control,3,322 Markdown fragment links, roadmap structure and all three delivery indexes. The seven previously unstaged files are now reviewed, refined and included; the working tree is clean. No new writer, permission, schema, timeout or completed manual proof is introduced.Correct dirty-session edit loss through explicit localized consent, keep private controls inert during a check, and retain fail-closed expiry/failure behavior. Native profile validation now preserves escaped editable values with field-associated messages and a fresh correction key, including without JavaScript. Recovery language comes from the current actor's API-verified enabled preference.
Earlier native-correction validation (parent
620fdaf3): 3,586/3,586 guarded frontend cases (web 3,432/112 files; SDK154/nine), zero skips/todos; typecheck/lint; focused controls 204/204; CI=true Release solution build; 3,434/3,434 unit cases; 105/105 selected PostgreSQL/idempotency HTTP cases; 9/9 Release delivery architecture controls. The actual two-host HTTPS browser Fact passes its positive and counter journeys with the new session-consent/failure/retry and no-JavaScript correction checks.Both independent correction reviews and final dependent-control supplements approve. Small verified backend fixes preserve sentinel refusal, audit argument checking and fixture cleanup. Supplied invalid-factory/null-context/SQL-injection/cleanup claims were reconciled against actual source and contracts; no privilege, endpoint, migration or timeout expansion is bundled.
Pre-follow-up full A/B evidence: A attempt1 and whole-run B attempt2 each pass27/27 jobs, bound to head
620fdaf3, treec4b4258b, basee55aa5d7, executed merge source76ecd566. All 50 original archives pass API identity/size/SHA-256/ZIP CRC checks; both independently recomputed aggregates reconcile the identical 7,951 backend case IDs. Each frontend guard passes 3,586/3,586 cases (web112 files/3,432; SDK9 files/154), zero skips/todos. Each public-demo invocation has27 exact JSON/HTML report pairs, mandatory budgets and confirmed process/Compose/private-file/environment/lock cleanup; the invocations are distinct. No partial, cancelled or combined-attempt result supplies qualification.The preceding correction A41803770511 finished24/27: real warm-provider profile replay received429; public-demo completed27 budget-passing original report pairs but refused cleanup; the required integration aggregate also failed. All24 published original archives are retained with API size/digest and ZIP CRC checks; no qualification credit.
The warm-provider failure reproduces locally and is repaired by moving the existing real visitor-window wait before the unchanged profile/replay journey. The complete real-provider two-host Fact then passes1/1 in296.648s; both independent narrow reviews approve. Production quotas, timers and all commit/replay/audit assertions remain unchanged. The earlier cleanup refusal remains unattributed; both
620fdaf3attempts independently prove actual cleanup.The predecessor head
537b97c8passed A/B run41728267483,27/27 jobs each and50 verified original archives; that is historical evidence only and does not qualify this correction head.Post-merge delivery closeout is published on development at
e1339a39: P03-3 implementation is complete and merged; remaining evidence boundaries stay explicit; P03-4/G8 invitations are next. The follow-up changes only the two roadmap documents.Manual keyboard/focus/reflow/contrast/VoiceOver checks remain maintainer-deferred and unexecuted. Automated results do not represent manual accessibility approval.
Migration / Rollback
Native sign-in requires the separate server-only scope credential, stable authority/issuer pairing, exact management origins/callbacks and the documented TLS/DNS configuration. New user creation remains opt-in and grants neither membership nor a tenant session. Shared admission, replay and snapshot budgets refuse work when exhausted.
Apply the forward migrations without resetting existing identities or provider state. New Tenancy capabilities require explicit Role release adoption. Management-origin adoption advances only after qualified completion; subsequent repeats preserve valid administration changes.
Risk
This changes tenant/organization admission and RLS read-scope boundaries. Separate native credentials propose context; current Membership, host, lifecycle and operation authorization remain authoritative. New creation does not imply membership. See ADR-0078/0079 and the separate fixed-seed read authorities in ADR-0080/0081.
The exact Node/pnpm/Next tuple and checked patch carry maintenance obligations. macOS/Linux are supported; native Windows is refused. Uncertain physical ownership retains reservations. Product HTTP/readiness/shutdown policy and cleanup reserves remain unchanged.
A branch administrator's bounded Role-choice UI remains a Phase06 enhancement under the existing Role-read disclosure ceiling. This PR does not add Tenant Role-read authority to branch actors.
Related
Prepared with Codex.