Repository navigation
Conversation
Keep an exact lexical audit observation across handler completion and cancellation without reviving execution authority. Prevent absorbed inner refusals from escaping the outer durability barrier and close Step 4 after both independent review rounds and real owner-boundary controls. ADR: 0076, 0077 Module: Identity, Tenancy
Wire the canonical application and named HTTP policy boundaries with live membership reads and trusted evidence. Add the bounded administrative membership directory with mandatory pre-disclosure audit, qualify auxiliary startup sources, and preserve the AccountSite-only native transport. ADR: 0076, 0077 Module: Identity, Tenancy, Customization, Education
Bind auxiliary qualification to a live business transaction marker and preserve explicitly selected API credentials. Isolate legacy component probes without weakening production default deny and reconcile closed route and contract controls after the first independent review round. ADR: 0076, 0077 Module: Identity, Tenancy
Record the second independent review round and hand P03-2 to complete source-bound backend, provider, native and CI qualification. ADR: 0076, 0077 Module: Identity, Tenancy
Bind current provider, native revocation and permission-denial proofs to closed source and fixture inventories before whole-suite qualification. Keep auxiliary credentials in their existing composition boundary and retain exact guarded startup callers without widening the census. ADR: 0076, 0077 Module: Identity, Tenancy
Keep mechanism fixtures bound to exact test operations without relaxing live production authorization, and avoid extra I/O after evidence is acknowledged. ADR: 0076, 0077 Module: Identity, Tenancy
Keep unresolved public refusal semantics intact and align delivery and Seeder component setup with explicit authorization startup ownership. Reconcile active carriers without promoting unfinished qualification. ADR: 0064, 0076, 0077 Module: Identity, Tenancy, Audit
Retain independent passing timing sources and historical floors while rediscovering both complete layouts before final hosted qualification. ADR: 0063, 0075, 0076, 0077 Module: Identity, Tenancy, Audit
A failed cancellation assertion must dispose a successfully returned read owner before source shutdown joins actual cleanup. Preserve bounded test start observations separately from authoritative completion evidence so a future stalled producer can identify in-flight cases without provider data. Retain the incomplete hosted attempt and record the verified cleanup fault, its deliberate controls, independent review and exact 230-case local pass. Fresh full hosted A/B remains required with unchanged ceilings and plan. ADR: 0062, 0063, 0075, 0076, 0077
Refresh all Architecture method weights from six complete passing producer TRXs, retaining exact source/run/hash provenance and historical maxima. Remove only originally unreferenced source records from the active map; the prior plan and full records remain preserved in history and evidence. Keep counts, job ceilings, thread limits, reserve and ordinary ownership unchanged. Record both failed qualification attempts, independent reviews, actual filter rediscovery and the limits of advisory A/B projections. Fresh full hosted A/B remains required on this reviewed plan. ADR: 0062, 0063, 0075, 0076, 0077
Preserve established JSON field order so the reviewed semantic timing changes remain easy to inspect. The canonical plan digest is unchanged. ADR: 0063
Reduce repeated test-detector traversal and owner identity formatting without dropping clean, dirty or restored controls. Use existing per-scan name buckets before full declaring-type checks and bind lazy owner IDs to one read-only detector evaluation. Record the latest incomplete hosted attempt and the isolated advisory before/after result. Remaining affected controls, independent reviews and fresh full hosted A/B stay explicit qualification gates. ADR: 0063, 0076, 0077
Retain the independent semantic and evidence approvals, fresh Release build and passing affected mutation/index controls. Final-source hosted A/B and the second review round remain explicit gates. ADR: 0063, 0076, 0077
Retain two fresh second-round approvals and actual rediscovery of both complete assignments. Keep the unchanged plan and population explicit; final-source hosted A/B remains the qualification gate. ADR: 0063, 0076, 0077
Give admission, routing, generation binding, framework capabilities and provenance their own whole-method proofs in the existing collection. Preserve the complete control bodies and one shared capability inventory; leave detectors, production code and execution limits unchanged. Record exact source-token reconstruction and instrumented control/result multiset equality. Clean timing, plan review and full hosted A/B remain required; diagnostic instrumentation is restored and never ships. ADR: 0047, 0063, 0076, 0077
Retain all prior timing rows and add only actual complete passing new Facts, with clean source/tree/binary and raw TRX provenance. Review the new population and both complete assignment discoveries without changing counts, algorithms, concurrency, ceilings or cleanup reserve. Record the first independent review and measured-plan approval; second review and final-source hosted A/B remain open. ADR: 0047, 0063, 0076, 0077
Retain two fresh independent second-round approvals and the complete source/control/timing/discovery evidence. Keep final-source hosted A/B as the remaining qualification gate with unchanged execution limits. ADR: 0047, 0063, 0076, 0077
Expand each nonsealed helper once per detector evaluation while retaining all direct helper visits and existing clean, dirty and restored controls. The three focused controls pass before and after; local mutation duration falls from 122.297 to 6.486 seconds without changing the CI window. Preserve the latest failed hosted attempt and keep complete final-source A/B qualification open. ADR: 0046, 0063, 0069
Record independent semantic and evidence review plus both actual selector layouts without treating local speed measurements as hosted fit. ADR: 0063, 0069
Record the second fresh semantic and evidence reviews while retaining the existing complete hosted A/B qualification gate and CI limits. ADR: 0063, 0069
Include historical stock proofs in the existing closed failure projection. Observe provider SDK milestones and capture startup cancellation before cleanup without exporting raw errors or changing lifecycle authority. Preserve the failed full attempt, existing startup limits and incomplete qualification status. Native controls and a real HTTPS provider smoke pass. ADR: 0062, 0063, 0069
Record independent semantic and protocol review with repeated native controls and raw failed-attempt audit. Keep the provider cause unknown. ADR: 0062, 0063, 0069
Close the second independent review while retaining the unknown provider cause, unchanged bounds and mandatory complete hosted A/B qualification. ADR: 0062, 0063, 0069
Poll incomplete readiness within the existing startup allowance instead of admitting a numeric prefix or refusing an empty publication immediately. Preserve owner, cancellation, native-exit and closed-diagnostic boundaries. Add actual-file and counterfactual controls, preserve the failed hosted attempt, and keep complete clean-source qualification open. ADR: 0055, 0056, 0063, 0069
Retain independent source review and a complete clean-workspace frontend replay while keeping actual demo and hosted qualification separate. ADR: 0055, 0056, 0063, 0069
Keep real renewal and expired-window proof, then hold the next actual pacing callback while the positive Outcome completes. Preserve every assertion, allowed conservative refusal and existing lease/stage bound. Join real callbacks and factories on all exits; retain clean, refusal and isolated dirty-cleanup evidence without claiming hosted qualification. ADR: 0047, 0059, 0063, 0069
Retain independent source and raw-proof review while distinguishing the selected positive schedule from unknown historical CI interleavings. ADR: 0047, 0059, 0063, 0069
Record both fresh review closures and the clean managed browser proof before restarting complete hosted qualification on one stable source. Local evidence does not promote the packet or replace the full A/B pair. ADR: 0063, 0069, 0076, 0077
The final permission promotion leaves no Adopted standards. Preserve the existing status/index check while allowing its truthful zero count. An isolated future-document twin fails before and passes after this fix. ADR: 0069, 0076, 0077
Retain independent raw before/after and cancelled-attempt checks before the next review round and complete hosted source qualification. ADR: 0063, 0069, 0076, 0077
Require an explicitly true UUIDv7 conjunction after the second review found PostgreSQL NULL CHECK semantics admitted non-RFC values. Preserve the initial migration and apply a forward constraint correction. Prove all three identifier positions as learnstack_app alongside valid fixtures; 190 database and 48 affected architecture cases pass. ADR: 0093 Module: Identity
Record verified UUID correction closure and carry actual type-registry, receiptless failure and logging dependencies into the sender step. ADR: 0093 Module: Identity, Tenancy
Keep invitation secrets in authenticated encrypted custody and record actual SMTP outcomes separately from job checkpoints. Preserve uncertainty and retained physical ownership instead of repeating a possibly accepted send. Bind the closed sender to the existing typed job and audit owners. ADR: 0093
Give owned test hosts explicit synthetic email configuration while keeping production startup validation mandatory. Discover the four real job roots without widening grants, and retain honest partial-rule catalogue status. ADR: 0093
Keep the complete migration and external-custody inventory authoritative when invitation and SMTP storage arrive. Preserve strict missing-row and dirty controls without treating encryption as anonymisation or erasure. ADR: 0093
Record both independently verified correction closures and continue the accepted packet into real administrator producers without promoting the remaining process or final-source qualification obligations. ADR: 0093
Let current administrators create and withdraw offers or explicitly queue a fresh generation through the real encrypted delivery owner. Keep role delegation, fixed lifetime policy and original-target receipt disclosure independently authorized with truthful rollback and unavailable results. ADR: 0093 Module: Identity, Tenancy
Keep authorization dependency failures distinct from actual insufficient grants so a recovered recheck cannot publish an incomplete Role directory. Exercise the production HTTP pipeline and retained audit behavior. ADR: 0093
Record both independent review rounds and the bounded delegation fix, keep the accepted uncertain-outcome limitations explicit, and advance to recipient acceptance without promoting final qualification evidence. ADR: 0093
Bind recipient entry to the actual credential, offer and transaction so first Membership admission and invitation consumption share one audited outcome. Preserve current delegation, exact scope and original-result recovery without borrowing Membership authority or publishing a session. ADR: 0093 Module: Identity, Tenancy
Translate the same bounded nonretrying provider wrapper as the existing Identity writer so temporary statement faults retain atomic rollback and cannot expose provider payloads through diagnostic serialization. ADR: 0093
Keep stored-inviter assignments and grants in one committed snapshot so concurrent removal and restoration cannot manufacture a delegation ceiling. Match declared and streamed invitation body overflow to the published 413 contract, with real PostgreSQL race and HTTP boundary controls. ADR: 0076, 0093
Record both independent review rounds and their verified corrections, then continue the Accepted Studio and recipient experience step without promoting bounded receipts into final packet qualification. ADR: 0093
Make automatic invitations usable for administrators and new or existing recipients, including real provider email verification and explicit membership acceptance before separate native session admission. Preserve private continuation custody, current session lifetime and truthful already-member outcomes across recovery and late responses. ADR: 0093, 0070, 0078, 0027 Module: Identity, Tenancy I18n: admin.invitation_*, invitation.*
Keep delayed signout replies from erasing newer invitation custody and retain acceptance uncertainty across lost responses and fresh inspection. Preserve inherited quota statuses so retry guidance stays truthful. ADR: 0093, 0070, 0078 I18n: invitation.failure.unknown
Let recipients recover the original acceptance after native custody loss and obtain separately admitted sessions. Make the exact policy permission and required fields clear in both languages. Reconcile the architecture census with the existing guarded Identity save call chain. ADR: 0093, 0027, 0080 I18n: admin.permissions.settings, admin.invitations.required, invitation.common.required, invitation.confirm.*, invitation.failure.expired
Record verified closure of both review rounds while keeping unexecuted human evidence separate. Continue independent final provider/runtime qualification under the accepted external-prerequisite contract. ADR: 0093
Exercise retained provider capacity, real process loss, late receipt reconciliation and native receiptless finalization through actual Identity owners. Confine irrecoverable cleanup to joined test processes and keep source-bound evidence distinct from final hosted qualification. ADR: 0093, 0047, 0058, 0061
Name the actual enforcement owners and preserve local receipt boundaries without claiming unexecuted hosted or human qualification. Keep the final PR candidate stable while its source-bound CI evidence is collected. ADR: 0093, 0063, 0069
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @cemililik, this pull request is too large to review
It changes 367 files. Sourcery can review pull requests with up to 300 changed files.
Contributor
|
Caution Review failedAn error occurred during the review process. Please try again later.
|
Preserve the approved invitation boundaries in legacy test hosts and finite production/schema censuses. Apply the missing parent locks by forward migrations, retain exact provider metadata proofs and align the canonical job policies with the shipped chain. Rebalance advisory CI weights from original completed groups without changing any ceiling. ADR: 0063, 0093 Module: Identity, Tenancy
Record both independent review rounds and the verified evidence bounds. Keep fresh source qualification and actual human observations open for this publication candidate. ADR: 0063, 0093
Read the effective Platform migration chain so schema controls compare the latest installed guard without relaxing body or privilege checks. Preserve only closed phase diagnostics for the two invitation integration facts. ADR: 0093
The session completion path rejects a nonzero exit before recording completion, so the browser-only disposal label cannot describe either invitation fact. Pin its exclusion while retaining the existing browser diagnostic. ADR: 0093
Record the source-bound correction reviews and verified diagnostic finding without granting qualification to the failed attempt or pending human checks. ADR: 0093
Preserve each root and expansion state while avoiding repeated queue entries and path allocation in the authenticated HTTP guard. Keep full mutation coverage, prove late abstract acquisition and retain the failed hosted attempt without claiming qualification from local results. ADR: 0064, 0093
Record both independent review rounds and preserve the failed-source and human-evidence boundaries before publishing the next candidate. ADR: 0069, 0093
Avoid repeated whole-production projections and name scans while preserving exact predicates, occurrence order and fresh mutation scopes. Record the failed hosted attempt and bounded canonical verification without promoting local observations into qualification. ADR: 0062, 0093
Record both independent review rounds and retain the final-source CI and human evidence gates before publishing the next candidate. ADR: 0069, 0093
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Approach
Acceptance rechecks tenant/branch lifecycle, current inviter delegation and the verified recipient. Invitation, Membership and both central MUST audit events share one transaction; session admission remains separate. Encrypted SMTP custody, identifier-only jobs and immutable attempt receipts preserve conservative Unknown recovery. SMTP acceptance means submission acceptance, never inbox delivery.
The native English/Turkish flow captures a fragment-only code, supports no-JavaScript forms, and preserves existing session/CSRF/lifetime limits. No new general directory, permission pair or provider-admin credential is introduced.
Tests
The implementation baseline passed 3,589 Unit tests, ten Contract tests, guarded frontend (3,932 cases across 130 files/two packages), type checking and lint. Actual scoped PostgreSQL, provider, SMTP, native-browser and authority/schema checks are recorded in the delivery log. These historical scoped results are not final-source hosted qualification.
The latest test-only recurrence-index repair passes 57 distinct affected cases with zero skips, including all 48 recurrence cases, index lifetime/identity controls and five shared callers. All 153 source-input hashes match the tested candidate. Its focused case improves from 3.090 to 2.156 seconds in one local comparison; build-inclusive wall timing does not improve, and no hosted-fit guarantee follows. Two fresh independent review rounds approve the correction. Test coverage, timers, workers, VM/resource limits, weights and selectors are unchanged. The separate unchanged complete browser/session recheck passes once; its earlier positive DevTools startup failure remains unattributed.
Qualification for head
0fcc486ab7285f9d828e48b25511d81f860d3727(baseef344c0f77572e5b6e8009f9f8608cddd48ce41a, actual merge/workflow sourceb691a68fe0021bee8eaa6e1037f98d5cc177c3d3, tree721bf0df1a13a5499cf5a5ecdab8968ae212974f):Four earlier full automatic A attempts remain failed: first, second, third, fourth. All available original ZIPs (23/24/23/23) and original attempt-log archives were retained and checked before corrections. The fourth had 23 successful/four failed jobs and 8,280 Passed/one Failed/nine censored producer cases. No failed, censored or earlier-source fragments combine into qualification.
Risk
Tenant/organization isolation and pre-membership authority change only as bounded by ADR-0093. Dedicated database functions, ordered fences and real PostgreSQL/provider controls cover that boundary. Missing decryption keys, ambiguous submission or incomplete cleanup refuse or retain ownership; reissue cannot promise an older message will not arrive. Existing v2 Tenant
tenancy.setting.writeholders gain the exact invitation-lifetime setting; v1 has the default and no new grant.Draft while qualification is collected. P03-3's separate evidence/manual follow-ups retain their own status. No merge is requested.
Migration / Rollback
Apply the committed Identity and common Infrastructure migration chains through the existing migrator. They add Invitations, workflow-failure state, encrypted SMTP custody and the exact protected-receipt targets. Two additive forward migrations apply the missing parent lookup locks to existing installations while retaining prior guard bodies, models, relations and grants. Provider custody and retained receipts require a reviewed forward migration; do not drop uncertain attempts or rotate away required keys to roll back.
Configure the operator SMTP/TLS/encryption key ring and database diagnostic privacy before enabling invitation writes, following the Identity provider runbook. Keycloak's account-verification sender is separate. Local Mailpit is not production SMTP/TLS or inbox-delivery proof.
Related
Prepared with Codex.