- Ya
- 24 Agosti 2026, 20:46 UTC
- Mwandishi
- Kamo
- Ahadi ya
- c4f2691
Six phases, each independently shippable, because pushing deploys: the host path keeps working until Phase 6 removes it. Phase 1 is the crux and is additive -- OrgResolutionService, the auth split (the password is already checked against users.password, so the members joins are membership gates that can move), session/select, and the removal of od.is_dns_verified from the access predicate. Self-review against the spec found two requirements with no task and both are now covered: orgs.alias needs a global unique index (it is already treated as a tenant key but is unconstrained, and colliding aliases across providers mean the index cannot be created blind), and the five repos no inventory agent opened need explicit dispositions rather than silence.