Harden backend ownership, ingestion and data lifecycles

.github/workflows/sentry-alerts.yml

@@ -15,8 +15,8 @@ name: Sentry production alerts
 # Setup (owner, once): a Sentry personal token with event:read, org:read and project:read,
 # stored as the repository secret SENTRY_ALERTS_TOKEN. The organisation and project are
 # discovered from the token; set the repository variables SENTRY_ORG / SENTRY_PROJECT only
-# if the account holds more than one of either. Without the secret every run is a warning
-# and nothing else.
+# if the account holds more than one of either. Without the secret the detector fails as
+# unavailable, so the daily summary cannot describe its silence as healthy.
 
 on:
   workflow_dispatch:
@@ -51,7 +51,7 @@ jobs:
           script: |
             const token = (process.env.SENTRY_ALERTS_TOKEN || "").trim();
             if (!token) {
-              core.warning("SENTRY_ALERTS_TOKEN is not set, so Sentry errors are not reaching the owner. See the header of sentry-alerts.yml.");
+              core.setFailed("SENTRY_ALERTS_TOKEN is not set; Sentry monitoring is unavailable.");
               return;
             }
 

data/repo-awareness-snapshot.json

@@ -4069,6 +4069,11 @@
         "section": "decisions",
         "catalogued": true
       },
+      {
+        "path": "docs/backend-audit-remediation-2026-11-05.md",
+        "section": "root",
+        "catalogued": false
+      },
       {
         "path": "docs/production-readiness.md",
         "section": "root",

docs/agents/document-drafts.md

@@ -20,8 +20,10 @@ Older workspaces can gain input snapshots by reconciling once while their inputs
 
 Export emits absolute `path`, current `before_sha256` and `after_base64` fields for the existing integrator. It is a proposal. The integrator must check claims and required gates, establish a serial write, compare the current original hash immediately before applying, and re-reconcile changed inputs. The helper has no apply command and grants no release, takeover, publication or additional authority. Keep governing-rule and substantive conflicts for their authorised decision-maker.
 
+On POSIX, new task workspaces are owned by the current user with mode 0700 and new copied artifacts use mode 0600. Existing broader-permission or another-owner workspaces are refused without changing them: preserve the old draft/candidate and reconcile it in a fresh private task-owned workspace. Windows filesystem ACL privacy still needs verification on its actual host. Per-file reads stop at the 10 MiB limit plus one byte before rejecting oversized input; this is not an OS adversarial-filesystem sandbox.
+
 Supported inputs: UTF-8 `.md`, `.txt`, `.rst`, `.adoc`; at most 100 exact paths and 10 MiB total. Traversal, hidden/sensitive/configuration names, links/reparse points, changed baselines, stale exports and busy locks fail closed. Filename screening does not certify contents safe. Never copy secrets, private sessions or data outside the task purpose/audience. Never reclaim an uncertain lock by age.
 
 Run the synthetic safety/merge checks with `python3 scripts/test-document-drafts.py`. The dedicated Document drafts workflow runs the same checks on a hosted Linux runner after relevant PR changes. That proves helper behaviour on that runner; it does not prove any chat loaded or followed the rules.
 
-This copy reuses the reviewed shared helper, SHA-256 `f9f919523098e8ac0a00d8082e593c0bfca969bb05163f5d1f957f31262c39fe`. Maintain helper and tests together; compare reviewed hashes before updating another copy. No private instruction source or Windows installation is required on cloud hosts. A cloud checkout must select this feature branch or a main revision containing it; a PR does not change existing checkouts. Coordinate only task-safe metadata through supported native task tools with destination authority. If a host is offline, preserve the draft and continue independent authorised work; do not collect raw sessions or create a replacement chat service.
+This copy includes locally reviewed private-workspace and bounded-read safeguards, SHA-256 `990e3017b9e0ccccd5800660cb87088f47c9c19ff003740d65592d0765c3d939`. The shared-helper predecessor was `f9f919523098e8ac0a00d8082e593c0bfca969bb05163f5d1f957f31262c39fe`. Maintain helper and tests together; compare reviewed hashes before updating another copy. No private instruction source or Windows installation is required on cloud hosts. A cloud checkout must select this feature branch or a main revision containing it; a PR does not change existing checkouts. Coordinate only task-safe metadata through supported native task tools with destination authority. If a host is offline, preserve the draft and continue independent authorised work; do not collect raw sessions or create a replacement chat service.

docs/audit/tenancy-defense-in-depth-review.md

@@ -516,7 +516,7 @@ staying quiet.
 | `src/lib/work-roles/hospital-sick.ts`                         | `work_hospital_teams`              | `readHospitalSickCalls`                                                                                  | Team links of that same hospital, after the same gate (DB-01).                                                                                                                                                                                                                                                                                                                           |
 | `src/lib/work-roles/hospital-starters.ts`                     | `work_hospitals`                   | `readHospitalStarters`                                                                                   | Hospital name after the `starters.view` gate (DB-01).                                                                                                                                                                                                                                                                                                                                    |
 | `src/lib/work-roles/hospital-starters.ts`                     | `work_hospital_teams`              | `readHospitalStarters`                                                                                   | Team links of that same hospital, after the same gate (DB-01).                                                                                                                                                                                                                                                                                                                           |
-| `src/lib/work-roles/people.ts`                                | `work_hospitals`                   | `hospitalsFor`, `moveTeam`, `renameHospital`, `archiveHospital`, `applyPeopleChange`                     | Organisation structure (hospital id and name), no person named. Every write is administrator-only; `hospitalsFor` keeps only hospitals `canManagePeople` allows (DB-01).                                                                                                                                                                                                                 |
+| `src/lib/work-roles/people.ts`                                | `work_hospitals`                   | `hospitalsFor`, `moveTeam`, `renameHospital`, `archiveHospital`, `applyPeopleChange`                     | Organisation structure (hospital id and name), no person named. Every write is administrator-only; link-team additionally reads only its exact destination id and live archive state after that administrator check, repeated by the database guard under a row lock. `hospitalsFor` keeps only hospitals `canManagePeople` allows (DB-01).                                              |
 | `src/lib/work-roles/people.ts`                                | `work_hospital_teams`              | `readPeople`, `readUnlinkedTeams`, `hospitalTeamIds`, `moveTeam`, `applyPeopleChange`                    | Team-to-hospital links, no person named. Reads follow the `canManagePeople` or administrator check; link and move are administrator-only (DB-01).                                                                                                                                                                                                                                        |
 | `src/lib/work-roles/server.ts`                                | `work_hospitals`                   | `addGrantedRoles`                                                                                        | Names and archive state of hospitals on the session user's own grants (`.eq("user_id", userId)`) (DB-01).                                                                                                                                                                                                                                                                                |
 | `src/lib/work-roles/server.ts`                                | `work_hospital_teams`              | `addGrantedRoles`                                                                                        | Team links of those same hospitals, to resolve the session user's own roles (DB-01).                                                                                                                                                                                                                                                                                                     |