feat(identity): add scoped Studio and membership administration

.claude/skills/add-ef-migration/SKILL.md

@@ -170,14 +170,11 @@ migrationBuilder.Sql("""
 **Session variable names** are canonical: `app.tenant_id` / `app.organization_id` /
 `app.scope` / `app.resolving_host`. Always pass the second `true` argument so an unset
 context filters the row out instead of raising on a pooled connection. Write the
-`app.scope` term into the policy even though **nothing sets it**: the flag derives from
-the actor's role and roles arrive in
-[Phase 03](../../../docs/roadmap/phase-03-identity-admin.md), which is the earliest
-phase that can own the carrier
-([Security Standards § Tenant Context](../../../docs/standards/11-security.md#tenant-context)),
-so the cross-organization read hatch is unreachable at runtime until then — the correct
-default, and the reason the two `AS RESTRICTIVE` guards need a test that sets the
-variable by hand.
+`app.scope` term into the policy. Only the operation-bound live-authorized read
+witness may announce tenant-wide read authority; an actor Role, endpoint field
+or successful Organization clause alone cannot. Follow the current
+[Security contract](../../../docs/standards/11-security.md#live-authorization-contract)
+and qualify the two restrictive write guards through real app-role controls.
 
 **Roles.** Migrations run as `learnstack_migration` (the table owner);
 the application connects as `learnstack_app` (`NOBYPASSRLS`, not the owner). Grant the
@@ -267,8 +264,9 @@ The ordinary API job runtime cannot receive migration credentials or execute thi
 backfill. The migration-owned loop sets `app.tenant_id` per tenant on its own
 **migration** connection:
 
-> This loop is a migration-time backfill, not a ninth entry in ADR-0040's closed
-> eight-setter set. Application code never opens its own connection to set the
+> This loop is a migration-time backfill, not another runtime logical setter.
+> The current closed census lives in Security 11. Application code never opens
+> its own connection to set the
 > variable — it goes through `IUnitOfWork.SetTenantContextAsync` on the ambient
 > transaction ([ADR-0040](../../../docs/decisions/0040-ambient-unit-of-work.md)).
 

.claude/skills/add-integration-test/SKILL.md

@@ -70,9 +70,8 @@ architecture test) plus any other invariant the change touches. See
 > what almost every test wants: **every** migration chain applied — through
 > `MigrationChains.ApplyAllAsync`, never a list a fixture keeps itself — and every
 > table populated under its role and table class, with two tenants and a second
-> organization under tenant A for tenant-owned data. There
-> are five chains and 42 data tables (47 including migration histories). Every
-> discovered public table must match an exact class in
+> organization under tenant A for tenant-owned data. Every discovered public
+> table must match an exact class in
 > [SchemaTableClasses](../../../backend/tests/LearnStack.Tests.Integration/Database/SchemaTableClasses.cs).
 > Vendor/control SELECTs as `learnstack_app` must raise `42501`; a zero count or
 > an excluded table does not prove the required denial. Discover
@@ -93,8 +92,9 @@ providers and restore case-owned changes before returning.
 Its generated CA is trusted only by the fixture's HTTPS clients, with normal
 hostname validation and a wrong-root refusal control. Never install a fixture CA
 in the host trust store or bypass TLS/cookie rules to get a passing login.
-Use real code/S256 authentication, keep credentials/tokens out of assertions and
-logs, and never follow the unimplemented BFF callback to claim session coverage.
+Use real code/S256 authentication and keep credentials/tokens out of assertions
+and logs. Stopping at the provider redirect does not establish BFF session/cookie
+publication; the named native HTTPS/session fixtures own that separate proof.
 This fixture does not replace application-role isolation proofs. Every consuming
 test class has the Docker trait, including classes outside `Database/`.
 Real-token API qualification uses the separate nonparallel
@@ -241,11 +241,14 @@ public async Task Org_X_cannot_read_Org_Y_within_TenantA()
 And one more, which the org-scoped template needs and an ordinary session cannot
 reach: with `app.scope = 'tenant'` set, the **read** widens across organizations
 and neither write does. Without that case both `AS RESTRICTIVE` guards can be
-deleted with the suite green — measured, in Packet 6. Set the variable in the test
-itself; nothing sets it at runtime, because the flag derives from the actor's role
-and roles arrive in
-[Phase 03](../../../docs/roadmap/phase-03-identity-admin.md), after Phase 02b's
-authenticated principal. See
+deleted with the suite green — measured, in Packet 6. Set the variable directly
+only for the raw RLS control. Production scope comes from the closed operation-bound
+read witness or fixed-seed verification sources in
+[Database Standards](../../../docs/standards/05-database.md), never from an actor's
+role alone. Exercise each producer's invocation, owner, lifetime and cleanup
+controls separately. The
+[Phase 03 Status](../../../docs/roadmap/phase-03-identity-admin.md) owns packet
+activation. See
 `TenancySchemaTests.TheTenantScopeHatchWidensReadsAndNeitherWrite`.
 
 The Packet 7 half of these cases goes through the **request**, and it needs no

.claude/skills/add-mediatr-handler/SKILL.md

@@ -289,17 +289,15 @@ See [add-permission](../add-permission/SKILL.md).
 
 ### Step 6: Idempotency (if applicable)
 
-If the command triggers external side effects (LiveKit room creation, Stripe
-charge, email send), the controller layer adds the `Idempotency-Key` header
-requirement, and the handler:
-
-1. Reads the idempotency key from the request context.
-2. Checks the per-module `idempotency_keys` table for a prior result; returns it
-   if found.
-3. Otherwise runs the handler, writes the (key → result) row in the same
-   transaction.
-
-The pattern is detailed in [04-api-design.md § Idempotency](../../../docs/standards/04-api-design.md).
+Use the canonical controller/filter and `IIdempotencyStore` ownership from
+[API Standards § Idempotency](../../../docs/standards/04-api-design.md#idempotency).
+Do not add handler-owned replay or a per-module receipt table. The store claims
+before business dispatch and records the outcome after actual business-owner
+disposal; this is not atomic exactly-once execution. ADR-0079's protected set adds
+its exact precondition fingerprint and fresh original-target receipt-read gate.
+Tenantless bootstrap uses ADR-0078's natural-key convergence and rejects a
+tenant-keyed Idempotency-Key. Check current implementation/qualification before
+using a newly Accepted adapter or protected consumer.
 
 ### Step 7: Endpoint shell
 

.claude/skills/add-permission/SKILL.md

@@ -189,8 +189,8 @@ denied coverage; verify its current catalogue status and nonempty subjects.
 - Check `Permission_Keys_Match_Convention`,
   `Permission_Scope_Matches_Resource_Scope` and
   `Permission_Registry_Has_DeniedTest` against their current catalogue status.
-  Their P03-2 controls are Registered at acceptance; run the actual implemented
-  owners before claiming green, and never promote an absent proof.
+  Run their actual current proof owners before claiming green; a later Accepted
+  extension remains pending until its nonempty subjects are implemented and run.
 
 ## Common pitfalls
 

.claude/skills/code-review/SKILL.md

@@ -81,7 +81,7 @@ Walk every change against the project's
 | **Tenant + organization isolation** | New tenant-owned entity has `[TenantOwned]` + EF filter + RLS policy + canonical `app.tenant_id` session var. `[OrganizationScoped]` covered the same way. Any `IgnoreQueryFilters` outside platform-admin paths is a zero-tolerance blocker per [17-code-review.md § Zero Tolerance](../../../docs/standards/17-code-review.md). |
 | **4-step auth order** | Every write use case checks in order: (1) Authn → (2) Tenant membership → (3) Role / permission → (4) Resource scope. Failure at each step returns the right Problem Details code (`unauthorized` / `tenant_mismatch` / `forbidden` / `resource_scope_violation`). Source: [11-security.md § Authorization](../../../docs/standards/11-security.md), [19-permissions.md § Enforcement Points](../../../docs/standards/19-permissions.md). |
 | **Authn / authz** | Every new endpoint has `[Authorize(Policy=…)]` or `[AllowAnonymous]` with a comment. Policy keys exist in the permission registry. Resource-scope handlers (`instructor` edits own course only) present where needed. |
-| **Tenant id from the resolved context only** | Resolved per [ADR-0036](../../../docs/decisions/0036-tenant-resolution-trusted-inputs.md): from the host lookup of the effective host, or on a platform host from validated claims confirmed by live membership; off HTTP, from the validated authoritative job row or the integration-event envelope. Never from a request body, query string, cookie or tenant header — `X-Tenant-Id` and `X-Organization-Id` are assertions that can only reject, on every hop. Check command and DTO surfaces. |
+| **Tenant id from the resolved context only** | Resolved per [ADR-0036](../../../docs/decisions/0036-tenant-resolution-trusted-inputs.md): from the host lookup of the effective host, or on a platform host from validated claims confirmed by live membership; off HTTP, from the validated authoritative job row or the integration-event envelope. ADR-0078 adds only the separately credentialed native tuple with live API Membership/lifecycle and real-host checks; follow [Security 11](../../../docs/standards/11-security.md#native-scope-and-global-self-admission) and verify runtime qualification. Browser body/query/cookie fields never select it; `X-Tenant-Id` and `X-Organization-Id` remain refusal-only assertions on every hop. Check command and DTO surfaces. |
 | **SQL injection** | EF Core LINQ or `FromSqlInterpolated`; never raw string concatenation. Raw SQL has parameters. |
 | **XSS** | No `dangerouslySetInnerHTML` outside a sanitisation wrapper; CSP nonces in place; markdown via allowlist. Nothing sets a CSP today: the [standards index](../../../docs/standards/README.md#honest-status-today) row for Security Standards carves § HTTP Headers out to [Phase 11](../../../docs/roadmap/phase-11-production-hardening.md#security), so a missing nonce is not a Blocker until that phase sets one. Accepted P02d-6 G42 requires atomic four-color validation and a fixed style element, with whole-palette fallback; output must be safe without CSP. [The accepted package](../../../docs/roadmap/phase-02d-delivery-log.md#p02d-6-accepted-answers) owns its proof obligations; acceptance alone is not delivery. |
 | **CSRF** | ADR-0070's closed BFF POSTs require the exact verified Origin and explicit CSRF proof; OIDC callbacks require their bound state/nonce/PKCE transaction. Server Actions remain unadmitted until their owning phase authorizes them. |

.claude/skills/local-dev-setup/SKILL.md

@@ -52,7 +52,7 @@ the backend runs today calls them, so `make dev` starts 7 services and
 | Docker Desktop | Yes | Required for every container. |
 | .NET 10 SDK | Yes | `dotnet --version` returns `10.0.x`. |
 | OpenSSL CLI | Yes for frontend tests | Isolated TLS fixtures generate temporary certificates without installing trust. |
-| Node >=22.23.1 + pnpm | Yes | For the frontend; `frontend/package.json` sets the floor and CI pins `22.23.1`. |
+| Node 22.23.1 + pnpm 9.12.3 | Yes | The exact qualified tuple is enforced by the frontend installer and producer; see [ADR-0083](../../../docs/decisions/0083-owned-next-response-compression-cleanup.md). |
 | Deployment mode | Yes | `Development` (default) / `SaaS` / `Dedicated` / `SelfHostedOnline` / `SelfHostedAirGapped` (per [Standards 12 § Deployment Modes](../../../docs/standards/12-infrastructure.md)). |
 | Selected private `.env` (gitignored) | Yes before stack startup | `.env.example` is the template; preserve existing secrets and private file permissions. |
 
@@ -62,16 +62,15 @@ the backend runs today calls them, so `make dev` starts 7 services and
 
 ```bash
 dotnet --version       # 10.0.x
-node --version         # >=22.23.1
-pnpm --version
+node --version         # exactly 22.23.1
+pnpm --version         # exactly 9.12.3
 docker info >/dev/null && echo "docker OK"
 ```
 
 If any of these is missing, install:
 
 - .NET 10 SDK: <https://dotnet.microsoft.com/download>
-- Node: use Volta or fnm; `frontend/package.json` requires `>=22.23.1` and CI
-  pins `22.23.1`.
+- Node: use Volta or fnm; `frontend/package.json` requires exactly `22.23.1`.
 - pnpm: `corepack enable`; `frontend/package.json` pins `pnpm@9.12.3`.
 - Docker Desktop: <https://www.docker.com/products/docker-desktop>.
 
@@ -85,9 +84,13 @@ make .env                 # creates a missing local-only file with private permi
 # Before make dev, prepare KEYCLOAK_WEB_CLIENT_SECRET in that private file.
 
 (cd backend && dotnet restore LearnStack.slnx --locked-mode)
-(cd frontend && pnpm install --frozen-lockfile)
+node frontend/scripts/install-frontend.mjs
 ```
 
+Use the guarded installer for frontend restoration; raw `pnpm install` refuses
+before dependency mutation. Follow the [framework maintenance guide](../../../frontend/framework/next-response-cleanup/README.md)
+for an intentional lockfile update or correction regeneration.
+
 Never overwrite an existing private source or regenerate its BFF secret on a
 routine rerun. For a legacy source, first verify it is your regular, nonsymlink,
 single-link file, then explicitly set `chmod 600 .env` and add a missing key.
@@ -121,6 +124,39 @@ must match the root private source. README Quickstart owns the
 [closed local demo database grammar](../../../README.md#3-prepare-local-https-and-start-the-applications)
 and its supported field aliases; it does not promise general Npgsql parsing.
 
+**Native entry configuration.**
+[ADR-0078's exact callback/origin contract](../../../docs/decisions/0078-native-session-scope-and-self-entry.md#selection-refresh-and-host-transition)
+adds management hosts to the existing two public hosts. Explicit local hosts
+aliases and trusted TLS leaves must cover `demo-english.learnstack.local`,
+`demo-yoga.learnstack.local`, `manage.demo-english.learnstack.local` and
+`manage.demo-yoga.learnstack.local`; no script installs system aliases or CA
+trust. Provider callback/post-logout registrations and native origin admission
+must match those exact HTTPS origins, without wildcards. Follow the
+[realm guide](../../../infra/keycloak/README.md#tenant-client-contract) for the
+fixed native web scope and bounded warm reconciliation.
+
+With `LEARNSTACK_BFF_ENABLED=true`, the native loader requires
+`LEARNSTACK_BFF_ISSUER`, `KEYCLOAK_WEB_CLIENT_SECRET`, `Identity__AuthorityId` and
+`Identity__NativeSession__CurrentSecret`. Defined values in the private root
+`.env`, optional web `.env.local` and process environment must agree. The native
+source secret is a separate random 32-byte canonical base64url value, distinct
+from `LEARNSTACK_PUBLIC_HOP_SECRET`; the AuthorityId must match the installed API
+authority. Preserve existing values. These are private runtime inputs, never
+public configuration, build inputs or browser code.
+
+`make public-api` selects the exact native API keys from those same sources:
+`Identity__NativeSession__CurrentSecret`, `Identity__NativeSession__PreviousSecret`,
+`Identity__NativeSession__PreviousRetiresAt`, `Identity__NativeSession__HttpsPort`
+and `Identity__SelfBootstrap__Enabled`. Conflicting or blank supplied values
+refuse before launch; the API validates their formats and relationships.
+The launcher supplies HTTPS port 3000 when absent, but generates no native secret
+and does not enable self-bootstrap. The issuer/AuthorityId pair must also be
+complete in each source that supplies either key. Use
+[Security's qualified rotation contract](../../../docs/standards/11-security.md#native-scope-and-global-self-admission)
+for current/previous secret handling. The
+[phase Status block](../../../docs/roadmap/phase-03-identity-admin.md) owns native
+activation and qualification; configuration alone proves neither.
+
 **Ordinary API startup.** `dotnet run` does not load `.env`. For an API-only
 session, supply `ConnectionStrings:Default` (`learnstack_app`) and
 `ConnectionStrings:OutboxDispatcher` (`learnstack_outbox_admin`) through environment
@@ -248,7 +284,7 @@ P02d-7 also supplies isolated CI mode over the same production lifecycle. In a
 fresh checkout without root `.env`, web `.env.local` or `artifacts/public-demo`:
 
 ```bash
-(cd frontend && pnpm install --frozen-lockfile)
+node frontend/scripts/install-frontend.mjs
 (cd frontend && pnpm exec playwright install --with-deps chromium)
 make demo DEMO_MODE=ci
 ```