Protect owner invitation authority

2026-09-04 00:30:29 -04:00
parent d54d6a4ad1
commit 3fe1547a5b
10 changed files with 143 additions and 16 deletions
@@ -2,6 +2,18 @@

 # Changelog

+## v0.1.0-preview.20 — 2026-09-04
+
+- Extend the direct-owner transaction boundary to invitations. Creating or
+  revoking an invitation that grants the configured owner role now requires
+  the actor to remain an active direct owner after the SQLite write lock is
+  acquired.
+- Preserve application-owned permission policy for ordinary invitations while
+  preventing a broad access-management role, stale ceremony, or alternate
+  repository call from creating or cancelling owner access.
+- Pass the configured owner role explicitly through invitation repository
+  mutations so non-SQLite adapters cannot silently omit the invariant.
+
 ## v0.1.0-preview.19 — 2026-09-04

 - Require a current active direct owner for every direct-role transition to or