feat(scope): IdP-group server grants, one entitlement predicate, tenant session on core REST and Web UI (Spec 107 PR-C) - #1293

Merged

Dumbris merged 51 commits into

mainfrom

107-c-group-allowlist

Sep 18, 2026

Commits on Sep 16, 2026

docs(specs): Spec 107 — server edition SSO front door hardened for real IdPs
Dumbris
committed
9a079e2
test(spec-107): PR-A red tests, server-tag lint job and release notice
Dumbris
committed
9fdc58d
refactor(serveredition): freeze the latent credential-injection chain and normalise removed config keys (Spec 107 PR-A)
Dumbris
committed
43d301d
fix(storage): enforce the agent-token cap per owner, not per deployment (Spec 107 PR-A)
Dumbris
committed
c255986
fix(spec-107): address adversarial review of PR-A
Dumbris
committed
3bf4394
fix(spec-107): codex round 1 for PR-A
Dumbris
committed
36e0517
fix(spec-107): codex round 2 for PR-A
Dumbris
committed
e158121
fix(spec-107): codex round 3 for PR-A
Dumbris
committed
03ef19d
fix(spec-107): codex round 4 for PR-A
Dumbris
committed
7a4e8fe
Merge origin/main (b1777e865) into 107-a-freeze-cut
Dumbris
committed
fb389e6
docs(spec-107): PR-A verification and task ticks
Dumbris
committed
14611c9
docs(roadmap): link PR-A
Dumbris
committed
c741f82
test(oauthserver): fake OIDC identity provider and server-edition dev rig (Spec 107 PR-B)
Dumbris
committed
6cf5427
test(serveredition): red tests for the generic OIDC provider, subject binding and refusals (Spec 107 PR-B)
Dumbris
committed
412dc3a
feat(serveredition): generic OIDC provider with JWKS-verified ID tokens, groups capture and subject binding (Spec 107 PR-B)
Dumbris
committed
c74bfb2
test(serveredition): red tests for trusted proxies, public URL, cookie security and forced MCP auth (Spec 107 PR-B)
Dumbris
committed
1d88938
feat(serveredition): front door behind an ingress — public URL, trusted proxies, cookie security policy, forced MCP auth, provider probe (Spec 107 PR-B)
Dumbris
committed
07ff5c4
feat(config,telemetry): hot-reload clauses, docs and OAS for the PR-B keys; telemetry v13 server-edition fields (Spec 107 PR-B)
Dumbris
committed
45d302a
fix(spec-107): gate fixes for PR-B
Dumbris
committed
4b8baa3
docs(spec-107): PR-B automated-check evidence
Dumbris
committed
516606d
fix(spec-107): cross-review round 1 for PR-B
Dumbris
committed
fd27d27
fix(spec-107): cross-review round 2 for PR-B
Dumbris
committed
30a93bb
fix(spec-107): cross-review round 3 for PR-B
Dumbris
committed
732329c
fix(spec-107): cross-review round 3 for PR-B
Dumbris
committed
8666dab
fix(spec-107): cross-review round 4 for PR-B
Dumbris
committed
8f2e3d4
fix(spec-107): cross-review round 5 for PR-B
Dumbris
committed
1c976e7
fix(spec-107): cross-review round 6 for PR-B
Dumbris
committed
5ad3a08
docs(spec-107): PR-B real-instance verification, gate re-run, task ticks

Dumbris
and
claude
committed
873145b
docs(roadmap): link PR-B

Dumbris
and
claude
committed
f3103fd
fix(ci): pull forward the Windows heap-corruption + Pass-2 race fix (#1288)

Dumbris
and
claude
committed
717e580
docs(spec-107): record the CI red/fix cycle for PR-B

Dumbris
and
claude
committed
b4ab0f9
docs(spec-107): record PR-B CI green

Dumbris
and
claude
committed
152f5d5

Commits on Sep 17, 2026

Commits on Sep 18, 2026

Merge remote-tracking branch 'origin/main' into 107-c-group-allowlist
Dumbris
committed
9985d4a