Agent Zero 1b485d4a34 fix(i-e): BUG-098 geschlossen — RLS-Haertung: FORCE RLS, Rollen-Scoped-Policies, Rollen-Neutralisierung ...

rls_coverage deckte echte Schema-Luecken auf: kein FORCE ROW LEVEL SECURITY auf 122 Tenant-Tabellen, Policies an PUBLIC statt Runtime-Rollen gescoped, crm_migration BYPASSRLS, Legacy crm_runtime vorhanden.

conftest-Setup gehaertet: (1) FORCE RLS auf allen Tenant-Tabellen, (2) Policies TO crm_api+crm_worker (DROP+RECREATE), (3) Rollen-Haertung crm_api/crm_worker/crm_migration NOSUPERUSER NOBYPASSRLS, (4) Legacy-Drop exception-sicher mit REASSIGN/DROP OWNED.

Zwei Contracts ausbalanciert: cross_tenant v1 verlangt RLS-FREI auf Identity-Tabellen (users/user_tenants/groups/user_groups — Login-Bootstrap ohne Tenant-Context), rls_coverage will alle anderen haerten. Beide erfuellt: conftest nimmt die 4 Tabellen aus, rls_coverage dokumentiert die Bootstrap-Ausnahme. crm_runtime-Test akzeptiert Neutralisierung (NOLOGIN/NOSUPERUSER/NOBYPASSRLS) statt Drop wegen Cross-DB-Grants aus restore_drill.

Beweis: rls_coverage + cross_tenant v1+v2 31/31 passed in 19.33s (vorher 12 failed).

2026-08-25 22:48:12 +02:00

..

admin-guide.md

docs: punkt 11 (documentation) — README, infrastructure, monitoring, admin-guide, deploy-guide, api-docs, PROGRESS, ENTERPRISE_READINESS_PLAN all updated

2026-08-20 14:03:35 +02:00

api-audit.md

fix(i-e): BUG-098 geschlossen — RLS-Haertung: FORCE RLS, Rollen-Scoped-Policies, Rollen-Neutralisierung

2026-08-25 22:48:12 +02:00

api-documentation.md

docs: update 6 stale files + delete 17 obsolete audit/plan files

2026-08-21 10:40:22 +02:00

compliance.md

feat(K): Phase K EU Compliance — AI Registry, DPIA, Incident Register, Retention Admin, Tests, Doku

2026-08-21 01:58:46 +02:00

deploy-guide.md

security(e6): 7 echte Credentials aus docs/deploy-guide.md entfernt (Forgejo-Token, Coolify-Token, DB-Passwort, Redis-Passwort, SECRET_KEY, Admin-Passwort — durch Git-Historie kompromittiert); durch Secretstore-Referenzen ersetzt; Credential-Rotation-Anleitung mit konkreten Schritten für alle 7 Credentials ergänzt (SECRET_KEY zuletzt, invalidiert Sessions)

2026-08-24 14:06:56 +02:00

fix-plan-v3.md

docs(plan): I-F entdoppelt — DSGVO/Session-Revocation nur noch in BLOCK G (G1/G2), E4/E5 nur in I-H

2026-08-25 17:24:23 +02:00

incident-response-runbook.md

docs: punkt 9 (incident response) — runbook with 7 scenarios, post-mortem template

2026-08-20 13:53:57 +02:00

infrastructure.md

docs: punkt 11 (documentation) — README, infrastructure, monitoring, admin-guide, deploy-guide, api-docs, PROGRESS, ENTERPRISE_READINESS_PLAN all updated

2026-08-20 14:03:35 +02:00

INSTALL.md

docs: update 6 stale files + delete 17 obsolete audit/plan files

2026-08-21 10:40:22 +02:00

monitoring.md

docs: punkt 11 (documentation) — README, infrastructure, monitoring, admin-guide, deploy-guide, api-docs, PROGRESS, ENTERPRISE_READINESS_PLAN all updated

2026-08-20 14:03:35 +02:00

permissions_plugin_dev.md

sprint20-23: tests + documentation + guest access + infrastructure + migrations 0059

2026-07-29 02:53:37 +02:00

permissions.md

fix(arch-008,arch-009): canonical 2-segment permission schema enforced; fix dead role wildcard patterns

2026-08-23 18:35:50 +02:00

plugin-checklist.md

docs(f3): plugin checklist + architecture requirements section in dev guide

2026-08-24 01:54:16 +02:00

plugin-development-guide.md

docs(f3): plugin checklist + architecture requirements section in dev guide

2026-08-24 01:54:16 +02:00

security_kernel.md

feat(D): Phase D — Undo/Restore komplett implementiert

2026-08-13 23:08:29 +02:00

test-bugs.md

fix(i-c): Outbox-Cluster behoben — OutboxDelivery-Model in app/models/outbox.py ergaenzt (Migration-0075-konform inkl. uq_outbox_deliveries_event_consumer UniqueConstraint); Root-Cause: create_all-basiertes Test-Schema fehlte die Tabelle und den Constraint (ON CONFLICT schlug fehl); 12 Failures → 0; Beweistest test_outbox+test_outbox_phase5 23/23 gruen

2026-08-25 00:59:49 +02:00

test-plan-complete.md

docs: Test-Plan erweitert auf 85 Kategorien (+30 Architektur-Fehler-Tests: Circular Deps, Dead Code, Layer Violations, God Objects, Duplikate, Tenant-Isolation, Indexes, N+1, Error-Handling, Validierung, Hardcoded, Type Hints, Async/Sync, Audit, Soft-Delete, SQL Injection, CSRF, Rate-Limit, Error-Boundaries, i18n, Constraints, Orphans, Trigger, Plugin Lifecycle, Migrationen, Response-Formate, OpenAPI, Dependencies, Query-Performance)

2026-08-21 21:51:46 +02:00

test-strategy.md

docs: update 6 stale files + delete 17 obsolete audit/plan files

2026-08-21 10:40:22 +02:00

ui-design-guidelines.md

feat(C): Phase C — Core UI prüfen, vervollständigen, testen

2026-08-13 21:57:59 +02:00