[kartikmanimuthu]

Adds five major capability areas to the platform, plus the schema, infrastructure and
test coverage they depend on.

Dynamic RBAC/ABAC on CASL v7

Replaces the hardcoded Record<Module, Action[]> permission matrix with a
database-driven authorization engine.

• New framework-free libs/rbac library: rule compiler, condition schema, nav resolver
  and generated subject/action registry (53 unit tests)
• Attribute-based conditions with row-level filtering (rowFilter) threaded through the
  repository layer, so list queries return only rows the caller may read
• AbilityProvider + useCan() for client-side gating; route guard with enforce/shadow
  modes and parity counters for safe rollout
• IAM navigation module, subject nav paths, RBAC registry admin UI, rule change log
• Operational tooling: rbac:sync / rbac:check targets, permission and module backfill
  scripts, orphan subject-rule reaping, subject coverage assertion
• Upgrades to @casl/ability / @casl/react v7 and @casl/prisma v2

Scale Sentinel — capacity change auditing

Continuous, attestable record of every capacity change across the fleet.

• Capacity-change capture for ECS, ASG, RDS, MSK, ElastiCache and DocumentDB via both
  CloudTrail and direct AWS APIs, split into scheduled / target-tracking / other events
• Per-scope watermarks, coverage tracking and a chained daily seal that refuses to sign an
  incomplete or gap-bearing day
• Direct Connect and VPN availability + bandwidth monitoring, with throughput split by
  direction and per-link sampling
• Formatted Excel and vector-text PDF export, IST-correct date-range boundaries
• Per-account opt-in, respected end-to-end by the platform recorder
• Resilience: retry-with-backoff on CloudTrail throttling, UTC-hour window alignment,
  DX VIF metrics keyed on both ConnectionId and VirtualInterfaceId

Fargate Spot Guard

• Cross-account ECS event ingestion over a shared EventBridge bus and SQS
• Spot interruption events, guard actions, task sessions and alert de-duplication
• Service enable/disable flow with confirmation, notification delivery, tenant-isolated
  repositories

Capacity planning

• CloudWatch utilization sampling with per-tenant planning runs
• Dedicated capacity-planning worker job and a shared CloudWatch client

Deep agent rewrite

• Automatic pgvector memory recall/save middleware restored on the deep agent
• Deep streaming contract v3, agent file attachments, multi-turn planning fixes
• Chatbot persona support in Agent Ops

Platform, schema and infrastructure

• 29 additive Prisma migrations (29 new models; nothing dropped) covering the RBAC,
  scaling-audit, Spot Guard, capacity-planning, network-link and agent-file domains
• ensure-vector-indexes.sql safety net wired into the container entrypoint, predev,
  prestart and db:migrate, so pgvector HNSW and tsvector GIN indexes can no longer be
  silently dropped as schema drift
• Account type and per-account feature flags surfaced on the account details page
• Gateway channel adapters (API, Slack, Telegram) with secret reveal
• New sbx networking and compute Pulumi stacks; Scale Sentinel and Spot Guard enabled on
  prod, ABAC enforcement soaking on sbx first
• Coverage .gitignore anchored per project root, which had been silently excluding the
  real api/scaling-audit/coverage route from commits

Verification

• bun run build passes for both web-ui and workers (the workers target is a real tsc)
• libs/rbac: 53/53 tests pass
• workers: 838 tests, 755 passing; the only non-pre-existing failure is a
  (real Postgres) integration suite that needs a live database
• web-ui: 2,646 tests, 2,549 passing

Known follow-up: four web-ui test files (api/skills, api/agent-memories,
tests/tenant-isolation/knowledge-base, tests/tenant-isolation/spot-guard) assert
against pre-ABAC mocks and need updating for the new route guard and rowFilter
repository argument.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com