Complete remaining P1 code remediation and retain notification evidence gate

[singhaditya21]

Summary

Completes the remaining code-level P1 remediation sequence and aligns the roadmap with the live issue state.

• fails closed for unauthenticated mobile production/store builds and removes sensitive preview routes
• removes the stale Go gateway and guards the already-removed unsigned legacy storage adapter
• adds repository hygiene enforcement for generated/session artifacts
• implements real notification adapters, atomic delivery claims, authenticated monotonic receipts, reconciliation, observability, and a credential-gated live-delivery drill
• adds tenant/user AI budgets, prompt/tool safety policy, retryable provider fallback, red-team evals, and a fail-closed external-agent release manifest
• restores native receipt/report-card PDFs and tenant-scoped user lifecycle management
• adds temporary-password and MFA enrollment flows, privileged-role MFA coverage, session-revision revocation, and impersonation validation
• makes role approvals one-time: the persisted approval is locked and revalidated, then atomically transitions APPROVED → EXECUTED with the role mutation, session revision, audit log, and execution event
• adds schema migrations, RLS coverage, CI evidence gates, and exact-version mitigations for newly published nanoid/image-size denial-of-service advisories

Root cause and impact

Earlier backend removals and prototype integrations left several production paths either missing, mock-backed, or insufficiently fail-closed. This change makes those boundaries explicit and testable. Unsupported deployment modes now stop packaging, privileged identity changes revoke stale sessions and cannot replay approvals, notification outcomes are reconciled safely, and AI ingress is bounded by tenant-aware controls.

Validation

• production build passed
• TypeScript and CI lint passed
• 58 unit suites / 354 tests passed
• mobile typecheck and release gate: 7/7
• AI safety evals: 10/10
• dependency audit: no unmitigated high/critical advisories
• secret, repository hygiene, static-debt, destructive-migration, and 145-table RLS matrix gates passed
• Drizzle migration check passed
• bundle budget and load-harness dry run passed
• independent [P1] Reimplement PDF generation + user/role management natively (removed Java backend) #42 identity/session/approval review found no in-scope blocker

Issue resolution

Closes #21
Closes #23
Closes #24
Closes #27
Closes #28
Closes #42

Progresses #25. Do not close #25: code remediation is complete, but acceptance still requires a credentialed provider-confirmed delivery drill with approved recipients.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
school-sis-web	Ready	Preview	Aug 8, 2026 5:08pm