admin

Closed: ADM-2, ADM-4

Cloud SSE watch now handles framing, cursor resume, filters, aborts, and failures; the TUI adds RFC 8628 login, secure session persistence/refresh, token/cloud overrides, and a shell-free schema editor workflow. Concurrently owned web paths were untouched.

cloud

Closed: CLOUD-3, CLOUD-7, CLOUD-10, CLOUD-15

Stripe webhooks are signature-verified and persist tenant plan/status actions; Postgres queries enforce transactional tenant context and forced RLS; service tokens persist hashed with bounded caches; OTLP rotation invalidates cached old keys immediately; project PATCH is tenant-scoped. Tenant/export and schema work remain partial and open.

market

Closed: MKT-3, MKT-6, MKT-10, MKT-11

Filesystem and S3/R2 artifact storage, multipart upload integrity, child spans, optional Cloud usage events, and the postgres.js migration contract are complete. Production Postgres wiring and live signed-JWT proof remain open; concurrently owned web paths were untouched.

devops

Closed: DEVOPS-3

The live E2E workflow now makes its missing-token skip explicit and green, with regression coverage and Actions run 29446466987 as evidence.

infrastructure

deploy → Cloudflare runtime/R2 + Neon PostgreSQL, fully Terraform-owned; no live apply performed

Closed: INFRA-2, INFRA-3, INFRA-5

R2 remote-state bootstrap and locked runtime backends, Cloudflare/Neon hosted resources, and 1Password credential persistence are code-complete. Identity guards fail closed until dedicated Frauthy Cloudflare, Neon, and 1Password accounts exist.

sandbox

Closed: SBX-4, SBX-6

Vendored Go/Rust MemStores now prove wildcard and exclusion semantics without skips or seed fan-out. The Rust merge worker serves on :41024, Amalga delegates through an opt-in URL with exact four-persona parity and safe inline fallback, and the worker has a pinned Rust 1.86 Docker/CI contract. Concurrently owned UI paths were untouched.