Implement roadmap_aug10: authorization, storage parity, Iceberg conformance and the guardrails that catch them

.github/workflows/build-binaries.yml

@@ -29,7 +29,19 @@ jobs:
           path: deployment_assets/bin/linux-x86_64/*
 
   build-macos-intel:
-    runs-on: macos-13  # Intel runner
+    # `macos-15-intel`, not `macos-13`.
+    #
+    # The macOS 13 image was retired in December 2025. Every tagged release
+    # since has hung here: the job sat queued for the full 24-hour limit
+    # waiting for a runner that no longer exists, while linux, macos-arm and
+    # windows finished in 8-15 minutes, and `create-release` was skipped
+    # because it `needs:` all four. That is why v0.4.0 through v0.6.0 produced
+    # no GitHub release and no binaries - the workflow had never once
+    # succeeded.
+    #
+    # `macos-15-intel` is GitHub's documented replacement for workflows that
+    # genuinely need x86_64.
+    runs-on: macos-15-intel
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -98,8 +110,13 @@ jobs:
     steps:
       - uses: actions/download-artifact@v4
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
+          body: |
+            See [CHANGELOG.md](https://github.com/AlexMercedCoder/Pangolin/blob/main/CHANGELOG.md)
+            for the full list of changes, and
+            [SECURITY.md](https://github.com/AlexMercedCoder/Pangolin/blob/main/SECURITY.md)
+            for the security advisory and upgrade steps.
           files: |
             linux-binaries/*
             macos-intel-binaries/*

.gitignore

@@ -53,3 +53,14 @@ check_log.txt
 test_results.txt
 debug_output*.txt
 :memory:
+
+# Editor backup copies of source files (B45).
+#
+# `pangolin_store/src/memory.rs.bak` and `mongo.rs.bak` sat in the tree as ~4k
+# lines of divergent, dead query copies - a grep trap that returned plausible
+# but stale code for anyone searching the store layer.
+*.bak
+*.rs.bak
+
+# Logs live under logs/ directories that were previously tracked.
+logs/

AUDIT_EXECUTION_PLAN.md

@@ -24,8 +24,48 @@ Three findings define the current state:
 
 The good news is that the fixes are tractable and mostly independent. The critical security items are each a few dozen lines. The correctness items are contained in one file. The hygiene items are largely mechanical. **The single highest-leverage action is standing up CI**, because without it every fix below is one refactor away from silently regressing — which is precisely how the current state was reached.
 
+> ## Status as of 2026-08-11 — read this first
+>
+> This document is the **original audit of 2026-08-09**, kept as the historical
+> record of what was found. Much of it has since been fixed. Where this file and
+> the reconciled status below disagree, **the status below is correct**.
+>
+> Current state is tracked in:
+>
+> - [`STATUS.md`](STATUS.md) — the single reconciled view of done vs. outstanding
+> - [`CHANGELOG.md`](CHANGELOG.md) — what changed in each release, and why
+> - [`SECURITY.md`](SECURITY.md) — the advisory and the remaining security gaps
+> - [`docs/operations/`](docs/operations/) — backend parity, encryption, backup
+>   and recovery, performance, multiple replicas
+>
+> The scorecard immediately below has been updated in place; every other section
+> of this document is left as it was written on 2026-08-09.
+
 ### Readiness scorecard
 
+**Updated 2026-08-11.** Ratings in parentheses are the original 2026-08-09
+assessment, kept so the direction of travel is visible.
+
+| Dimension | Rating | One-line justification |
+|---|---|---|
+| Feature breadth | **Strong** (Strong) | Four backends, three clouds, branching/merge, RBAC, audit, SSO, SDK, UI |
+| Iceberg REST correctness | **Good** (Weak) | Requirements and updates enforced; `registerTable`, `listViews`, `viewExists`, `dropView` added. `commitTransaction` deliberately absent — see below |
+| Security (authn/authz) | **Adequate** (Critical) | OAuth exfiltration, default JWT secret, bypass path and the 0.7.0 authorization cluster all fixed; rate limiting and credential encryption added. OIDC is still not OIDC |
+| Error handling | **Adequate** (Weak) | Iceberg error envelope conforms; `unwrap()` counts unchanged in non-Iceberg paths |
+| Observability | **Good** (Absent) | `/metrics` with latency histograms, request tracing, `RUST_LOG` honoured, `/health/live` and `/health/ready` |
+| Reliability | **Good** (Weak) | Graceful shutdown, timeouts, body and concurrency limits, readiness that probes the store |
+| Data integrity | **Good** (Weak) | Postgres and SQLite wrap catalog delete, branch delete, merge, and branch-create-by-copy. MongoDB wraps the cascade where a session exists |
+| Test coverage | **Good** (Critical) | 63 targets / 415 tests green against live PostgreSQL, MongoDB and MinIO; 19 CI jobs including an authz matrix and a four-backend parity suite |
+| Code hygiene | **Adequate** (Weak) | `rustfmt` clean; clippy at a ratcheted budget of 30, down from 314 |
+| Enterprise readiness | **Partial** (Partial) | Credentials encrypted at rest, backup/restore drilled and measured, multi-replica constraints documented. No HA proof, no tamper-evident audit, no OIDC |
+| Deployment | **Good** (Partial) | Helm lints and templates; container runs non-root; release pipeline actually produces a release (it never had) |
+| Documentation | **Strong** (Strong user / Absent contributor) | CONTRIBUTING, SECURITY, CHANGELOG, and an operations set covering parity, encryption, backup, performance and replicas |
+
+**Still weak, stated plainly:** OIDC (no PKCE, no JWKS, no `id_token`
+validation), no tamper-evident audit trail, no point-in-time recovery,
+multi-replica operation untested under load, and `commitTransaction` absent
+because the store cannot commit several tables atomically.
+
 | Dimension | Rating | One-line justification |
 |---|---|---|
 | Feature breadth | **Strong** | Four backends, three clouds, branching/merge, RBAC, audit, SSO, SDK, UI |