Turn persisted findings into provenance-aware remediation work

[zgbrenner]

Summary

Closes the gap between a deterministic playbook failure and the human work needed to resolve it.

• adds lazy, provenance-aware remediation plans for persisted findings
• selects only firm-approved playbook or Clause Manager language, with deterministic ranking and scope warnings
• creates, reuses, or reopens one durable Inbox task per finding
• adds typed tenant-scoped linkage, Row-Level Security, concurrency protection, and identifier-only audit events
• removes the duplicate client-only Review checklist so persisted playbook findings are the single source of truth
• adds live and deterministic demo-mode frontend flows, tests, changelog, release notes, and cross-platform local verification scripts
• removes hosted GitHub Actions verification so this repository does not consume Actions minutes
• sets prerelease metadata for v0.1.0-alpha.1 (0.1.0a1 for Python packaging)

Safety and trust properties

• no LLM-generated remediation language
• no automatic Repository record edits
• no fuzzy source selection
• no legal text, evidence, guidance, source display names, counterparty data, or storage internals in audit details, link rows, or task metadata
• explicit organization scoping and direct-org PostgreSQL RLS
• generic Inbox routes cannot forge or relink remediation work
• a database uniqueness constraint and nested transaction prevent duplicate or orphan tasks under races
• superseded findings cannot create or reopen work

Research basis

The design borrows selectively from OpenContracts, DefectDojo, GitHub code scanning, Paperless-ngx, n8n, Activepieces, Documenso, and Cicero. The source-by-source rationale is recorded in docs/research/2026-08-04-review-to-action-open-source.md.

Verification

• focused pure remediation service suite: 11 tests passed before the final integration pass
• Python module compilation passed before the final integration pass
• focused backend and frontend regression suites are committed alongside the implementation
• scripts/verify-local.sh and scripts/verify-local.ps1 reproduce the former hosted gate locally: frontend tests/typecheck/build/audit, backend tests/lint/audit, service-worker safety check, and Compose validation
• final diff statically reviewed for migration ordering, tenancy, provenance, idempotency, stale-finding behavior, audit privacy, request cancellation, demo Inbox consistency, and absence of hosted workflows

Release

Prepared changelog and prerelease notes for v0.1.0-alpha.1. Merge method: squash.

[cloudflare-workers-and-pages]

Deploying whereas with    Cloudflare Pages

Latest commit:	3f98ba3
Status:	⚡️  Build in progress...

View logs