Add optimistic membership lifecycle

2026-09-03 23:22:19 -04:00
parent fe6bd94c9a
commit 59827bf641
10 changed files with 368 additions and 20 deletions
@@ -2,6 +2,22 @@

 # Changelog

+## v0.1.0-preview.17 — 2026-09-04
+
+- Add optimistic organization-membership suspension, reactivation, and
+  removal for fresh-authentication administration flows. The exact displayed
+  membership state is rechecked after acquiring the SQLite write lock, so a
+  concurrent or stale ceremony fails without changing access or writing an
+  audit event.
+- Keep membership lifecycle consequences transactional: suspension removes
+  team membership, removal also revokes direct bindings, reactivation does not
+  silently restore former teams, and every successful change appends its
+  organization-visible audit before commit.
+- Strengthen last-owner protection to require another active direct owner
+  whose platform account is also active. Existing storage adapters retain the
+  legacy interface; security-sensitive applications fail closed unless their
+  repository implements the optimistic lifecycle extension.
+
 ## v0.1.0-preview.16 — 2026-09-03

 - Add bounded organization-member and direct user-role listings for