feat(identity): transferable control-plane + strict master/system DB separation (AppBase v3 / Phase B)#44

Merged

windischb merged 10 commits into

feat/transferable-control-plane

Jun 2, 2026

Commits on Jun 2, 2026

feat(identity): transferable control-plane (stored IsControlPlane + transfer API)

windischb
and
claude
committed
feat(identity): strict master/system DB separation at boot

windischb
and
claude
committed
feat(identity): recover control-plane / adopt-tenant CLI + STARTUP_COMMAND

windischb
and
claude
committed
feat(identity): control-plane transfer UI (replace dead IsControlPlane checkbox)

windischb
and
claude
committed
fix(identity): EmailUniquenessMigration targets the system realm's own DB

windischb
and
claude
committed
test(identity): control-plane transfer tests + docs + APPBASE_VERSION v3.0.0

windischb
and
claude
committed
fix(identity): address adversarial review of the control-plane / system-DB diff

windischb
and
claude
committed
chore: set AppBase reconciliation watermark to v4.0.0

windischb
and
claude
committed
docs(security): triage the two new cs/log-forging alerts (PR #44)

windischb
and
claude
committed
ci(security): exclude cs/log-forging from CodeQL (structured-logging FP)

windischb
and
claude
committed