feat(mcp): SaaS tenant-identity spine — authenticated tenant, no header override, default-deny - #66

Open

Basheirkh wants to merge 83 commits into

mainfrom

feat/saas-identity-spine

Commits on Jun 27, 2026

feat(mcp): SaaS tenant-identity spine — authenticated tenant, no header override, default-deny
AI Bot
committed
4b5d84b
feat(saas): encrypted secret vault + JWT claim verifier + per-tenant quotas
AI Bot
committed
86cabb8
feat(controlplane): one-call tenant provisioning + encrypted secret vault
AI Bot
committed
5cfb16d
feat(saas): JWKS verifier, workspace-scoped events/pending, tenant-scoped durable layer
AI Bot
committed
f503a7d
feat(saas): Temporal worker integration on the tenant-scoped durable layer (Phase 6)
AI Bot
committed
0f89f19

Commits on Jun 30, 2026

feat(channels): port Evolution WhatsApp client into nilscript
AI Bot
committed
1f36521
feat(cycle): Phase 1 — Cycle AST as SSOT, embeds governed WosoolProgram
AI Bot
committed
c3ed6f4
feat(cycle): Phase 2a — governed cycle registry (the visual surface registers THROUGH the kernel)
AI Bot
committed
26c4e01
feat(cycle): freeze the NIL Protocol Model (Cycle AST v0.2) — named steps over a hidden IR
AI Bot
committed
1304384
feat(cycle): .nil parser/printer + Protocol Registry + projections (Phases 4-5)
AI Bot
committed
8e9858b
feat(cycle): language services (LSP brain) + CP endpoints (Phase 6)
AI Bot
committed
6c408a5
fix(governance): root SaaS isolation for held proposals — real workspace column
AI Bot
committed
1add495

Commits on Jul 1, 2026

feat(governance): editable decision cards + universal adapter prerequisite mechanism
AI Bot
committed
0336546

Commits on Jul 2, 2026

feat(plans): governed dependent plans — planned steps, handoff resolution, materialize-on-commit
AI Bot
committed
fa8f849
feat(discovery): adapters DECLARE per-verb governance metadata in describe
AI Bot
committed
859f97e
feat(runtime): gates resume runs — row-backed parked runs, decision-driven resume
AI Bot
committed
8f8b1d5
feat(cycle): wait_for_event step — Cycle DSL v0.3 + row-backed event waits
AI Bot
committed
c1d40d7
feat(capability): capability/0.1 AST + .nil bijection + content-hash lock (M1a)
AI Bot
committed
c9117e7
feat(strategy): MVP-5 approval algebra + .nil bijection + V9 well-formedness (M1b)
AI Bot
committed
0ae8cb4
feat(registry): capability + strategy registries in the control plane (M2a)
AI Bot
committed
a4542d1
feat(wrap): auto-wrap generator — fail-closed v0 capabilities from cycles (M2b)
AI Bot
committed
7ec9091
feat(strategy): B3 interpreter — five approval forms + SoD over signature-slot rows (M3a)

AI Bot
and
claude
committed
a9ae47b
feat(prepared): B2 PreparedExecution + deterministic Permission Card + endpoints (M3b)

AI Bot
and
claude
committed
35f11b7

Commits on Jul 3, 2026

feat(prepared): GET /prepared list feed + persisted rejection reason
AI Bot
committed
fbefebe
feat(cycles): implements clause + V7 conformance — the capability binding refuses drift (M4)
AI Bot
committed
fdf92da
feat(runs): checkpoint step + per-phase rollback as ONE governed proposal (B5, M5)
AI Bot
committed
cd2e50e
feat(prepared): one-shot scheduled executions — /prepared/{id}/schedule + tick sweep (B7 nil_schedule substrate)
AI Bot
committed
a98b0f6
feat(mcp): the five-tool capability plane — nil_discover/inspect/prepare/execute/schedule (B7, Gate M6)
AI Bot
committed
ad38645
fix(cycle): print/parse ActionStep retry/on_error/compensate — restore the .nil bijection
AI Bot
committed
ce78ff1
test(gate): the P0 acceptance demo — one end-to-end walk of the MVP gate, permanent
AI Bot
committed
ef0d4f1
fix(compile): approval gate proposal handle is the step id, not the free-text title
AI Bot
committed
81f1cfc
fix(compile): gate proposal handle needs 8-128 chars — prefix the step id
AI Bot
committed
05900c7
feat(runs): full per-node observability trace + gates that actually pause
AI Bot
committed
cec5fd7
fix(runs): a parked human gate also holds a pending approval in Decisions
AI Bot
committed
3b7e821

Commits on Jul 4, 2026

fix(kernel): run-scope await_approval gate proposal id (kill cross-run gate collision)
AI Bot
committed
1173db9
feat(sdk): RoutingNilClient — one run spanning several adapters (verb→backend routing)
AI Bot
committed
058e032
feat(controlplane): route verbs across multiple active adapters in one run
AI Bot
committed
17d30dc
fix(controlplane): union active adapters in _live_skeleton (agent sees ALL routable verbs)
AI Bot
committed
56d8708
fix(mcp): multi-adapter routing — agent sees + invokes comms.* alongside crm.*
AI Bot
committed
115cb0d
feat(comms): SendMessage capability + implementing cycle — the RIGHT intent-driven path
AI Bot
committed
d4b44bc
Revert "fix(mcp): multi-adapter routing — agent sees + invokes comms.* alongside crm.*"
AI Bot
committed
bc7caed
Reapply "fix(mcp): multi-adapter routing — agent sees + invokes comms.* alongside crm.*"
AI Bot
committed
b91b072

Commits on Jul 5, 2026

feat(capabilities): seed the full governed capability catalog for ws_acme
AI Bot
committed
7fed311
feat(capabilities): auto-derive fail-closed draft capabilities from an adapter's verbs
AI Bot
committed
dc59bf9
feat(mcp): NIL_MCP_CAPABILITY_FIRST — hide the raw-verb surface from the agent
AI Bot
committed
687c769
fix(capabilities): implementing cycles get a REAL executable plan (was empty pipeline)
AI Bot
committed
a702cc0

Commits on Jul 6, 2026

feat(threads): business_ref identity on runs — PO-2026-00145, not cyc_order:v1:…
AI Bot
committed
fb73795
feat(threads): correlation_id on automation_runs (Phase 2 join key)
AI Bot
committed
5a4d32f
fix(kernel): undecided gate state must PARK the run, not crash it
AI Bot
committed
208daf8
docs(dsl): NIL DSL constitution + comparative study
AI Bot
committed
71e17cc

Commits on Jul 7, 2026

fix(kernel): a crashed run preserves its partial node trace (D1)
AI Bot
committed
282fb69
fix(sdk): normalize out-of-enum state on commit too (D2-sibling)
AI Bot
committed
67078a3
fix(threads): monotonic gap-free business_ref via ref_sequences (W1)
AI Bot
committed
4600154
feat(capability): registry-level invariants — SemVer·canonical·DAG gates (Wave 4 §14.2)

AI Bot
and
claude
committed
91f31b8
feat(capability): enforce registry invariants at registration (Wave 4 §14.2b)

AI Bot
and
claude
committed
2b6b45e
feat(domain): the Domain layer — curated imports + governed backend binding (Wave 4 §14.3)

AI Bot
and
claude
committed
2ffc201
feat(capability): the Skill layer + per-Skill governance envelope (Wave 4 §14.3b)

AI Bot
and
claude
committed
4fa1bdf
feat(bizspec): the Business Specification IR — Language 2 (Wave 4 §11)

AI Bot
and
claude
committed
9df7d3b
feat(compiler): deterministic L2->L3 lowering — BizSpec + Domain + registry -> CompiledPlan (Wave 4 §14.4b)

AI Bot
and
claude
committed
84887ac
feat(compiler): deterministic plan renderer — the L3 review surface (Wave 4 §14.4c pt.1)

AI Bot
and
claude
committed
5b4ee4a
feat(compiler): lower CompiledPlan to a runnable cycle Flow (Wave 4 §14.4c pt.2)

AI Bot
and
claude
committed
0afb2d9
docs: cyc_order migration analysis grounded in the live cycle (Wave 4 §14.5)

AI Bot
and
claude
committed
a08ad27
feat(compiler): business-level escalation on wait timeout — close the routing gap (Wave 4 §14.5a)

AI Bot
and
claude
committed
ad214b0
test(compiler): cyc_order parity proof — new architecture represents a live production cycle (Wave 4 §14.5b)

AI Bot
and
claude
committed
88a4441
feat(compiler): make verbs private — enforce Cycle→Capability→Skill→Verb (Wave 4 §14.5c)

AI Bot
and
claude
committed
b60e730
feat(phase3): End-to-end test suite + comprehensive verification docs

AI Bot
and
claude
committed
0e8d4bf
feat(wave7): Communication Engine — 5-layer correlation cascade + passive events + review queue + outbound governance

AI Bot
and
claude
committed
9d1c8a1
feat(waves5-8-healthcare): Complete SaaS platform foundation with 200+ tests

AI Bot
and
claude
committed
e28d2da
ci(deploy): Add GitHub Actions staging/production deployment pipeline for Control Plane
AI Bot
committed
9f5114f
feat(phase3): Implement execute_compiled_flow — instantiate LocalExecutor with D8 governance routing

AI Bot
and
claude
committed
f2fae58
build(docker): Add Dockerfile + build script for Control Plane

AI Bot
and
claude
committed
f19d24e
feat(discovery): add discovery_sessions, specifications, discovery_audit schema
AI Bot
committed
99ffe11
feat(discovery): add BusinessSpecification models with full validation and tests
AI Bot
committed
93a719c
feat(discovery): add BusinessDiscoverySession with lifecycle and extraction logic
AI Bot
committed
69cc5c6
feat(discovery): add control-plane API endpoints (start, answer, status, specification)
AI Bot
committed
b30188b
tests: add comprehensive end-to-end discovery integration tests
AI Bot
committed
490fd0a

Commits on Jul 9, 2026

Commits on Jul 10, 2026

fix(quota): raise PLAN_LIMITS to interactive-realistic write ceilings (Phase 5 mirror)
AI Bot
committed
e0cf9f6