docs: publish Web Foundations module landing

CHANGELOG.md

@@ -2,7 +2,35 @@
 
 # Changelog
 
-## Unreleased
+## v0.1.0-preview.9 — 2026-09-03
+
+- Add a documented root package and executable composition example so the
+  module landing page presents its purpose, package-selection guidance,
+  security model, and `net/http` integration rather than only a directory
+  index.
+- Add the repository's default MPL-2.0 licence at the conventional root path
+  so Go package tooling can identify the library licence while preserving the
+  existing file-level exceptions for starters and operational machinery.
+- Rework the public README around progressive adoption, explicit design
+  promises, package selection, assurance gates, and canonical project links.
+
+## v0.1.0-preview.8 — 2026-08-28
+
+- Preserve `http.Hijacker` through the request-evidence middleware so audited,
+  authenticated WebSocket and other HTTP upgrade handlers can operate without
+  bypassing request logging. Successful upgrades are recorded as HTTP 101;
+  upgraded-protocol bytes remain outside HTTP body-byte accounting.
+
+- Add revisioned active/archived lifecycles for organizations and teams,
+  invitation listing and revocation, membership suspension/removal, team-member
+  removal, and transactional organization-visible audit events.
+- Make archived organizations and teams ineffective during authorization and
+  preserve the final active direct owner during membership changes.
+- Allow invitations to carry one bounded direct role and reviewed team
+  memberships, applied atomically with single-use acceptance.
+- Add an atomic password-to-passkey migration ceremony that stores the first
+  passkey, retires the password credential, revokes all sessions, and records
+  the migration audit event in one transaction.
 
 ## v0.1.0-preview.6 — 2026-08-24
 

LICENSE

@@ -0,0 +1,375 @@
+SPDX-License-Identifier: MPL-2.0
+
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.

LICENSES.md

@@ -14,3 +14,7 @@ fails closed on missing or misplaced identifiers.
 Full texts are in `LICENSES/`. Combining these MPL-covered packages with an
 application does not change the licence of the application's own files; changes
 to covered files remain subject to the MPL. This summary is not legal advice.
+
+The root [`LICENSE`](LICENSE) contains the default MPL-2.0 text for package
+indexers and repository tooling. More specific file-level SPDX identifiers in
+the paths above remain authoritative.

README.md

@@ -2,106 +2,140 @@
 
 # Gamertan Web Foundations
 
-> Status: `v0.1.0-preview.6` public preview. APIs may change before a stable
+[![Go Reference](https://pkg.go.dev/badge/gamertan.com/web.svg)](https://pkg.go.dev/gamertan.com/web)
-> release; Linux is the maintained release platform.
+[![Verify](https://gitea.speelman.ca/gamertan/web/actions/workflows/verify.yml/badge.svg?branch=main)](https://gitea.speelman.ca/gamertan/web/actions?workflow=verify.yml)
 
-Small, composable Go packages for the unglamorous boundaries of a careful web
+**Security-conscious building blocks for ordinary `net/http` applications.**
-application: request identity, structured request logs, browser security,
-passwords, passkeys, sessions, permissions, SQLite persistence, and private
-analytics.
 
-This is a toolkit, not an application framework. Your application keeps its
+Web Foundations provides small, composable Go packages for the unglamorous
-router, HTTP policy, HTML, authorization decisions, cache behavior, and
+boundaries of a careful web application: request identity, structured request
-deployment. Each package works with `net/http` and can be adopted independently.
+evidence, browser security, authentication, passkeys, permissions,
+organizations, SQLite persistence, abuse controls, and private analytics.
 
-The first preview targets modest Linux servers, local files, SQLite, and normal
+It is a toolkit, not an application framework. Your application keeps its
-Go binaries. It requires no Redis, message broker, hosted identity provider,
+router, handlers, HTML, authorization decisions, cache behavior, and
-telemetry service, or JavaScript framework.
+deployment. Adopt one boundary at a time; Go compiles and links only the
+packages you import.
+
+> **Public preview:** `v0.1.0-preview.9`. APIs may change before a stable
+> release. Linux is the maintained release platform.
+
+## Why Web Foundations?
+
+| Design promise | What it means in an application |
+| --- | --- |
+| `net/http` native | Keep the standard router or any compatible router; there is no framework lifecycle. |
+| Explicit security boundaries | Trusted proxies, sensitive log fields, browser origins, and scoped authority are configured deliberately. |
+| Bounded and fail-closed | Untrusted inputs are size-limited, and security-critical configuration or storage failures do not quietly weaken policy. |
+| Storage-neutral core | Interfaces separate identity and access policy from the optional no-CGO SQLite adapter. |
+| Self-hosted by default | No Redis, message broker, hosted identity provider, telemetry service, or JavaScript framework is required. |
+
+## Start with one boundary
+
+| Application need | Begin with |
+| --- | --- |
+| Request IDs and trustworthy client addresses | [`requestmeta`](requestmeta) |
+| Bounded structured request evidence | [`requestmeta`](requestmeta) + [`requestlog`](requestlog) |
+| Browser and HTTP security primitives | [`websec`](websec) |
+| Users, credentials, permissions, and sessions | [`auth`](auth) + [`authhttp`](authhttp) |
+| Passkey-only authentication | [`authwebauthn`](authwebauthn) |
+| Private SQLite persistence | [`authsqlite`](authsqlite) |
+| Organizations, teams, and invitations | [`organizations`](organizations) |
+| Organization-scoped roles and temporary access | [`access`](access) |
+| Application-classified request abuse | [`abuse`](abuse) |
+| Disposable request-log summaries | [`analytics`](analytics) |
+
+The [getting-started guide](docs/GETTING_STARTED.md) explains what each package
+owns—and, just as importantly, what remains application policy.
 
 ## Install
 
-Pin the preview in an application module, then import only the packages that
+Pin the preview in an application module:
-application needs:
 
 ```bash
-go get gamertan.com/web@v0.1.0-preview.6
+go get gamertan.com/web@v0.1.0-preview.9
 go mod verify
 ```
 
-An application may also name the first package it intends to adopt:
+An application may name the first package it intends to adopt:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.6
+go get gamertan.com/web/requestmeta@v0.1.0-preview.9
 ```
 
-The version belongs to the `gamertan.com/web` module. Go compiles and links
+The version belongs to the `gamertan.com/web` module. See the
-only the packages the application imports. See the [getting-started guide](docs/GETTING_STARTED.md)
+[module-boundary policy](docs/MODULES.md) before selecting a first slice.
-and [module-boundary policy](docs/MODULES.md) before choosing a first slice.
 
-Canonical source, issues, security policy, and release notes live on
+## Compose a request path
-[Gamertan Gitea](https://gitea.speelman.ca/gamertan/web). GitHub is a read-only
-discovery snapshot rather than a second release origin.
 
-Linux is the required and supported release platform. WSL may be used as a
+Build middleware from the application outward. The request metadata resolver
-Linux development environment. Native Windows is not a release gate or support
+is outermost so every package inside it observes the same request identity:
-promise; downstream users may evaluate the ordinary Go packages elsewhere
-without turning that portability into a maintained compatibility claim.
 
-## Packages
+```text
+request
+  └─ requestmeta ─ websec ─ requestlog ─ your router and handlers
+```
 
-- [`requestmeta`](requestmeta): trusted-proxy resolution, HTTPS/origin metadata,
+```go
-  and request IDs.
+var handler http.Handler = router
-- [`requestlog`](requestlog): bounded versioned records, middleware, sinks, and
+handler = requestlog.Middleware(sink, logPolicy)(handler)
-  private JSONL.
+handler = websec.Headers(headerPolicy)(handler)
-- [`websec`](websec): headers, origin checks, CSRF, redirects, body limits, and
+handler = resolver.Middleware(handler)
-  rate limits.
+```
-- [`abuse`](abuse): application-classified request abuse with pluggable persistence.
-- [`auth`](auth), [`authhttp`](authhttp), and [`authsqlite`](authsqlite):
-  passwords, forced first-login rotation, local administrative recovery,
-  session revocation, platform-level permissions, cookies, and a no-CGO SQLite
-  adapter.
-- [`authwebauthn`](authwebauthn): passkey-only registration, discoverable
-  login, fresh-operation approval, local recovery tokens, and an ES256-first
-  WebAuthn policy. See the [passkey integration guide](docs/PASSKEYS.md).
-- [`organizations`](organizations) and [`access`](access): organizations,
-  teams, invitations, resource hierarchy, scoped roles, and audited temporary
-  access without turning platform operation into tenant-data access.
-- [`analytics`](analytics): safe and sensitive aggregate projections over request
-  records.
 
-The copyable starter under `starters/basic` demonstrates the packages without
+The copyable [`starters/basic`](starters/basic) server demonstrates that
-turning them into a router or template system.
+composition with loopback binding, graceful shutdown, and optional private
+JSONL logging.
+
+## Identity and access
+
+- [`auth`](auth) defines storage-neutral users, password credentials, opaque
+  sessions, platform permissions, and audit events.
+- [`authhttp`](authhttp) connects those sessions to secure browser cookies and
+  request context without owning login routes or pages.
+- [`authwebauthn`](authwebauthn) provides discoverable passkey login,
+  passkey-only enrollment, fresh-operation approval, and bounded recovery.
+- [`organizations`](organizations) and [`access`](access) keep platform
+  operation separate from organization-data authority while supporting teams,
+  invitations, scoped roles, and audited temporary access.
+
+See the [passkey integration guide](docs/PASSKEYS.md) and
+[organization/access model](docs/ORGANIZATIONS.md) before exposing account or
+administration routes.
+
+## Security and assurance
+
+Client addresses are accepted from forwarding headers only when the immediate
+peer and every skipped proxy are explicitly trusted. Sensitive request fields
+are off by default. Cryptographic entropy failures fail closed. Logs and
+account databases remain private application data and never belong in source
+releases.
+
+Every change is checked with formatting, tests, the race detector, vet,
+dependency policy, licence policy, public-snapshot allowlisting, and a
+reproducible starter build. Scheduled assurance adds vulnerability scanning and
+bounded fuzz campaigns.
+
+Read [SECURITY.md](SECURITY.md), the [threat model](docs/THREAT_MODEL.md),
+[adoption contract](docs/ADOPTION.md), and
+[dependency boundary](docs/DEPENDENCIES.md) before production adoption.
 
 ## HTML and templates
 
 Web Foundations deliberately does not provide a template language. Sandwich
 Hime is the preferred companion for Gamertan applications that want HTML-first,
-typed, ahead-of-time Go templates. The two projects remain independently
+typed, ahead-of-time Go templates. The projects remain independently usable.
-usable: this module does not import the `sando` runtime, and Sandwich Hime does
-not own middleware, authentication, logging, routing, or deployment.
 
-See [HTML with Sandwich Hime](docs/SANDWICH_HIME.md), then follow the official
+See [HTML with Sandwich Hime](docs/SANDWICH_HIME.md) and the official
-[first site tutorial](https://sandwichhime.com/docs/tutorial/) and
+[first-site tutorial](https://sandwichhime.com/docs/tutorial/).
-[application integration tutorial](https://sandwichhime.com/docs/tutorial/application/).
 
-## Security boundary
+## Source, support, and licensing
 
-Client addresses are accepted from forwarding headers only when the immediate
+Canonical source, issues, security policy, and release notes live on
-peer and every skipped proxy are explicitly trusted. Sensitive request fields
+[Speelman Forge](https://gitea.speelman.ca/gamertan/web). GitHub is a read-only
-are off by default. Cryptographic entropy failures fail closed. Logs and account
+discovery snapshot rather than a second release origin.
-databases remain private application data and never belong in source releases.
 
-See [SECURITY.md](SECURITY.md), [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md),
+The libraries and adapters are MPL-2.0. Starters and reusable examples are
-the [application adoption contract](docs/ADOPTION.md), and
+0BSD. Future standalone services and operational machinery are
-[docs/SERVICES_ROADMAP.md](docs/SERVICES_ROADMAP.md).
+AGPL-3.0-only. Exact file-level SPDX identifiers remain authoritative; see the
-
+[licensing map](LICENSES.md) and [third-party notices](THIRD_PARTY_NOTICES.md).
-## Licensing
-
-This is a multi-license repository with exact file-level SPDX identifiers:
-
-- embeddable packages and adapters: MPL-2.0;
-- future standalone network services and operational machinery: AGPL-3.0-only;
-- starters, examples, and reusable configuration: 0BSD.
-
-See [LICENSES.md](LICENSES.md). No standalone auth or logging server is included
-in this preview.

authsqlite/access.go

@@ -53,9 +53,9 @@ func (store *Store) Grant(ctx context.Context, binding access.Binding) error {
 	}
 	defer tx.Rollback()
 	var exists int
-	query := `SELECT COUNT(*) FROM gwf_organization_memberships WHERE organization_id=? AND user_id=? AND status='active'`
+	query := `SELECT COUNT(*) FROM gwf_organization_memberships m JOIN gwf_organizations o ON o.id=m.organization_id AND o.status='active' WHERE m.organization_id=? AND m.user_id=? AND m.status='active'`
 	if binding.SubjectKind == access.Team {
-		query = `SELECT COUNT(*) FROM gwf_teams WHERE organization_id=? AND id=?`
+		query = `SELECT COUNT(*) FROM gwf_teams t JOIN gwf_organizations o ON o.id=t.organization_id AND o.status='active' WHERE t.organization_id=? AND t.id=? AND t.status='active'`
 	}
 	if err = tx.QueryRowContext(ctx, query, binding.Scope.OrganizationID, binding.SubjectID).Scan(&exists); err != nil {
 		return err
@@ -63,7 +63,7 @@ func (store *Store) Grant(ctx context.Context, binding access.Binding) error {
 	if exists != 1 {
 		return errors.New("authsqlite: access subject is not active in organization")
 	}
-	if err = tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_organization_memberships WHERE organization_id=? AND user_id=? AND status='active'`, binding.Scope.OrganizationID, binding.GrantedBy).Scan(&exists); err != nil || exists != 1 {
+	if err = tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_organization_memberships m JOIN gwf_organizations o ON o.id=m.organization_id AND o.status='active' WHERE m.organization_id=? AND m.user_id=? AND m.status='active'`, binding.Scope.OrganizationID, binding.GrantedBy).Scan(&exists); err != nil || exists != 1 {
 		if err != nil {
 			return err
 		}
@@ -110,9 +110,10 @@ func (store *Store) EffectiveBindings(ctx context.Context, organizationID, userI
 	}
 	rows, err := store.db.QueryContext(ctx, `SELECT b.id,b.subject_kind,b.subject_id,b.role_name,b.project_id,b.environment_id,b.service_id,b.granted_by_user_id,b.granted_at
 		FROM gwf_access_bindings b
+		JOIN gwf_organizations o ON o.id=b.organization_id AND o.status='active'
 		WHERE b.organization_id=? AND b.revoked_at IS NULL
 		AND EXISTS (SELECT 1 FROM gwf_organization_memberships m WHERE m.organization_id=b.organization_id AND m.user_id=? AND m.status='active')
-		AND ((b.subject_kind='user' AND b.subject_id=?) OR (b.subject_kind='team' AND EXISTS (SELECT 1 FROM gwf_team_members tm JOIN gwf_teams t ON t.id=tm.team_id WHERE tm.team_id=b.subject_id AND tm.user_id=? AND t.organization_id=b.organization_id)))
+		AND ((b.subject_kind='user' AND b.subject_id=?) OR (b.subject_kind='team' AND EXISTS (SELECT 1 FROM gwf_team_members tm JOIN gwf_teams t ON t.id=tm.team_id WHERE tm.team_id=b.subject_id AND tm.user_id=? AND t.organization_id=b.organization_id AND t.status='active')))
 		ORDER BY b.id`, organizationID, userID, userID, userID)
 	if err != nil {
 		return nil, err
@@ -142,6 +143,13 @@ func (store *Store) CreateBreakGlass(ctx context.Context, grant access.BreakGlas
 		return err
 	}
 	defer tx.Rollback()
+	var active int
+	if err = tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_organizations o JOIN gwf_organization_memberships m ON m.organization_id=o.id WHERE o.id=? AND o.status='active' AND m.user_id=? AND m.status='active'`, grant.OrganizationID, grant.UserID).Scan(&active); err != nil {
+		return err
+	}
+	if active != 1 {
+		return errors.New("authsqlite: break-glass principal is not active in organization")
+	}
 	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_break_glass(id,organization_id,user_id,permission_name,reason,created_at,expires_at) VALUES(?,?,?,?,?,?,?)`, grant.ID, grant.OrganizationID, grant.UserID, grant.Permission, grant.Reason, grant.CreatedAt.Unix(), grant.ExpiresAt.Unix()); err != nil {
 		return err
 	}
@@ -155,7 +163,7 @@ func (store *Store) ActiveBreakGlass(ctx context.Context, organizationID, userID
 	if !opaqueID(organizationID) || !opaqueID(userID) || now.IsZero() {
 		return nil, errors.New("authsqlite: invalid break-glass query")
 	}
-	rows, err := store.db.QueryContext(ctx, `SELECT id,permission_name,reason,created_at,expires_at FROM gwf_break_glass WHERE organization_id=? AND user_id=? AND expires_at>? ORDER BY expires_at`, organizationID, userID, now.Unix())
+	rows, err := store.db.QueryContext(ctx, `SELECT b.id,b.permission_name,b.reason,b.created_at,b.expires_at FROM gwf_break_glass b JOIN gwf_organizations o ON o.id=b.organization_id AND o.status='active' JOIN gwf_organization_memberships m ON m.organization_id=b.organization_id AND m.user_id=b.user_id AND m.status='active' WHERE b.organization_id=? AND b.user_id=? AND b.expires_at>? ORDER BY b.expires_at`, organizationID, userID, now.Unix())
 	if err != nil {
 		return nil, err
 	}

authsqlite/organizations.go

@@ -5,14 +5,15 @@ package authsqlite
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 	"errors"
 	"time"
 
 	"gamertan.com/web/organizations"
 )
 
-func (store *Store) CreateOrganization(ctx context.Context, organization organizations.Organization, owner organizations.Membership) error {
+func (store *Store) CreateOrganization(ctx context.Context, organization organizations.Organization, owner organizations.Membership, audit organizations.AuditEvent) error {
-	if !opaqueID(organization.ID) || !slugValue(organization.Slug) || !text(organization.Name, 128, false) || organization.CreatedAt.IsZero() || owner.OrganizationID != organization.ID || !opaqueID(owner.UserID) || owner.Status != "active" || owner.JoinedAt.IsZero() {
+	if !validOrganization(organization) || owner.OrganizationID != organization.ID || !opaqueID(owner.UserID) || owner.Status != "active" || owner.JoinedAt.IsZero() || !validOrganizationAudit(audit, organization.ID) {
 		return errors.New("authsqlite: invalid organization")
 	}
 	tx, err := store.db.BeginTx(ctx, nil)
@@ -24,38 +25,64 @@ func (store *Store) CreateOrganization(ctx context.Context, organization organiz
 	if organization.Personal {
 		personalOwner = owner.UserID
 	}
-	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_organizations(id,slug,name,personal,personal_owner_user_id,created_at) VALUES(?,?,?,?,?,?)`, organization.ID, organization.Slug, organization.Name, organization.Personal, personalOwner, organization.CreatedAt.Unix()); err != nil {
+	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_organizations(id,slug,name,personal,personal_owner_user_id,created_at,status,revision,updated_at) VALUES(?,?,?,?,?,?,?,?,?)`, organization.ID, organization.Slug, organization.Name, organization.Personal, personalOwner, organization.CreatedAt.Unix(), organization.Status, organization.Revision, organization.UpdatedAt.Unix()); err != nil {
 		return err
 	}
 	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_organization_memberships(organization_id,user_id,status,joined_at) VALUES(?,?,?,?)`, owner.OrganizationID, owner.UserID, owner.Status, owner.JoinedAt.Unix()); err != nil {
 		return err
 	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
 	return tx.Commit()
 }
 
-func (store *Store) CreateTeam(ctx context.Context, team organizations.Team) error {
+func (store *Store) CreateTeam(ctx context.Context, team organizations.Team, audit organizations.AuditEvent) error {
-	if !opaqueID(team.ID) || !opaqueID(team.OrganizationID) || !slugValue(team.Slug) || !text(team.Name, 128, false) || team.CreatedAt.IsZero() {
+	if !validTeam(team) || !validOrganizationAudit(audit, team.OrganizationID) {
 		return errors.New("authsqlite: invalid team")
 	}
-	_, err := store.db.ExecContext(ctx, `INSERT INTO gwf_teams(id,organization_id,slug,name,created_at) VALUES(?,?,?,?,?)`, team.ID, team.OrganizationID, team.Slug, team.Name, team.CreatedAt.Unix())
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
 		return err
 	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `INSERT INTO gwf_teams(id,organization_id,slug,name,created_at,status,revision,updated_at) SELECT ?,?,?,?,?,?,?,? FROM gwf_organizations WHERE id=? AND status='active'`, team.ID, team.OrganizationID, team.Slug, team.Name, team.CreatedAt.Unix(), team.Status, team.Revision, team.UpdatedAt.Unix(), team.OrganizationID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrOrganizationNotFound
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
 
-func (store *Store) AddTeamMember(ctx context.Context, membership organizations.TeamMembership) error {
+func (store *Store) AddTeamMember(ctx context.Context, membership organizations.TeamMembership, audit organizations.AuditEvent) error {
-	if !opaqueID(membership.TeamID) || !opaqueID(membership.UserID) || membership.JoinedAt.IsZero() {
+	if !opaqueID(membership.TeamID) || !opaqueID(membership.UserID) || membership.JoinedAt.IsZero() || !validOrganizationAudit(audit, audit.OrganizationID) {
 		return errors.New("authsqlite: invalid team membership")
 	}
-	result, err := store.db.ExecContext(ctx, `INSERT INTO gwf_team_members(team_id,user_id,joined_at)
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `INSERT INTO gwf_team_members(team_id,user_id,joined_at)
 		SELECT t.id,?,? FROM gwf_teams t
 		JOIN gwf_organization_memberships m ON m.organization_id=t.organization_id AND m.user_id=? AND m.status='active'
-		WHERE t.id=? ON CONFLICT(team_id,user_id) DO UPDATE SET joined_at=gwf_team_members.joined_at`, membership.UserID, membership.JoinedAt.Unix(), membership.UserID, membership.TeamID)
+		JOIN gwf_organizations o ON o.id=t.organization_id AND o.status='active'
+		WHERE t.id=? AND t.status='active' AND t.organization_id=? ON CONFLICT(team_id,user_id) DO UPDATE SET joined_at=gwf_team_members.joined_at`, membership.UserID, membership.JoinedAt.Unix(), membership.UserID, membership.TeamID, audit.OrganizationID)
 	if err != nil {
 		return err
 	}
 	if changed, _ := result.RowsAffected(); changed != 1 {
 		return organizations.ErrMembershipNotFound
 	}
-	return nil
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
 }
 
 func (store *Store) CreateProject(ctx context.Context, project organizations.Project) error {
@@ -96,20 +123,35 @@ func (store *Store) CreateApplicationService(ctx context.Context, application or
 	return nil
 }
 
-func (store *Store) CreateInvitation(ctx context.Context, invitation organizations.Invitation) error {
+func (store *Store) CreateInvitation(ctx context.Context, invitation organizations.Invitation, audit organizations.AuditEvent) error {
-	if zeroDigest(invitation.Digest) || !opaqueID(invitation.OrganizationID) || !text(invitation.Email, 320, false) || !opaqueID(invitation.InvitedByUserID) || invitation.CreatedAt.IsZero() || !invitation.ExpiresAt.After(invitation.CreatedAt) || !invitation.UsedAt.IsZero() {
+	if !opaqueID(invitation.ID) || zeroDigest(invitation.Digest) || !opaqueID(invitation.OrganizationID) || !text(invitation.Email, 320, false) || !opaqueID(invitation.InvitedByUserID) || invitation.DirectRole != "" && !safeName(invitation.DirectRole) || !validInvitationTeamIDs(invitation.TeamIDs) || invitation.CreatedAt.IsZero() || !invitation.ExpiresAt.After(invitation.CreatedAt) || !invitation.UsedAt.IsZero() || !invitation.RevokedAt.IsZero() || !validOrganizationAudit(audit, invitation.OrganizationID) {
 		return errors.New("authsqlite: invalid invitation")
 	}
-	result, err := store.db.ExecContext(ctx, `INSERT INTO gwf_organization_invitations(token_hash,organization_id,email_normalized,invited_by_user_id,created_at,expires_at)
+	teamIDs, err := json.Marshal(invitation.TeamIDs)
-		SELECT ?,?,?,?,?,? FROM gwf_organization_memberships
+	if err != nil {
-		WHERE organization_id=? AND user_id=? AND status='active'`, invitation.Digest[:], invitation.OrganizationID, normalize(invitation.Email), invitation.InvitedByUserID, invitation.CreatedAt.Unix(), invitation.ExpiresAt.Unix(), invitation.OrganizationID, invitation.InvitedByUserID)
+		return err
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if err = validateInvitationTeams(ctx, tx, invitation.OrganizationID, invitation.TeamIDs); err != nil {
+		return err
+	}
+	result, err := tx.ExecContext(ctx, `INSERT INTO gwf_organization_invitations(token_hash,organization_id,email_normalized,invited_by_user_id,created_at,expires_at,id,direct_role,team_ids_json)
+		SELECT ?,?,?,?,?,?,?,?,? FROM gwf_organization_memberships m JOIN gwf_organizations o ON o.id=m.organization_id
+		WHERE m.organization_id=? AND m.user_id=? AND m.status='active' AND o.status='active'`, invitation.Digest[:], invitation.OrganizationID, normalize(invitation.Email), invitation.InvitedByUserID, invitation.CreatedAt.Unix(), invitation.ExpiresAt.Unix(), invitation.ID, invitation.DirectRole, teamIDs, invitation.OrganizationID, invitation.InvitedByUserID)
 	if err != nil {
 		return err
 	}
 	if changed, _ := result.RowsAffected(); changed != 1 {
 		return organizations.ErrMembershipNotFound
 	}
-	return nil
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
 }
 
 func (store *Store) InvitationByDigest(ctx context.Context, digest [32]byte, now time.Time) (organizations.Invitation, error) {
@@ -118,7 +160,8 @@ func (store *Store) InvitationByDigest(ctx context.Context, digest [32]byte, now
 	}
 	var invitation organizations.Invitation
 	var created, expires int64
-	err := store.db.QueryRowContext(ctx, `SELECT organization_id,email_normalized,invited_by_user_id,created_at,expires_at FROM gwf_organization_invitations WHERE token_hash=? AND used_at IS NULL AND expires_at>?`, digest[:], now.Unix()).Scan(&invitation.OrganizationID, &invitation.Email, &invitation.InvitedByUserID, &created, &expires)
+	var teamIDs []byte
+	err := store.db.QueryRowContext(ctx, `SELECT id,organization_id,email_normalized,invited_by_user_id,direct_role,team_ids_json,created_at,expires_at FROM gwf_organization_invitations WHERE token_hash=? AND used_at IS NULL AND revoked_at IS NULL AND expires_at>?`, digest[:], now.Unix()).Scan(&invitation.ID, &invitation.OrganizationID, &invitation.Email, &invitation.InvitedByUserID, &invitation.DirectRole, &teamIDs, &created, &expires)
 	if errors.Is(err, sql.ErrNoRows) {
 		return organizations.Invitation{}, organizations.ErrInvitationNotFound
 	}
@@ -126,13 +169,16 @@ func (store *Store) InvitationByDigest(ctx context.Context, digest [32]byte, now
 		return organizations.Invitation{}, err
 	}
 	invitation.Digest = digest
+	if err = json.Unmarshal(teamIDs, &invitation.TeamIDs); err != nil || !validInvitationTeamIDs(invitation.TeamIDs) {
+		return organizations.Invitation{}, organizations.ErrInvitationNotFound
+	}
 	invitation.CreatedAt = time.Unix(created, 0).UTC()
 	invitation.ExpiresAt = time.Unix(expires, 0).UTC()
 	return invitation, nil
 }
 
-func (store *Store) AcceptInvitation(ctx context.Context, digest [32]byte, userID string, acceptedAt time.Time) error {
+func (store *Store) AcceptInvitation(ctx context.Context, digest [32]byte, userID string, acceptedAt time.Time, audit organizations.AuditEvent) error {
-	if zeroDigest(digest) || !opaqueID(userID) || acceptedAt.IsZero() {
+	if zeroDigest(digest) || !opaqueID(userID) || acceptedAt.IsZero() || !validOrganizationAudit(audit, audit.OrganizationID) {
 		return organizations.ErrInvitationNotFound
 	}
 	tx, err := store.db.BeginTx(ctx, nil)
@@ -140,8 +186,9 @@ func (store *Store) AcceptInvitation(ctx context.Context, digest [32]byte, userI
 		return err
 	}
 	defer tx.Rollback()
-	var organizationID string
+	var invitationID, organizationID, directRole, invitedBy string
-	err = tx.QueryRowContext(ctx, `SELECT i.organization_id FROM gwf_organization_invitations i JOIN gwf_users u ON u.id=? AND u.email_normalized=i.email_normalized WHERE i.token_hash=? AND i.used_at IS NULL AND i.expires_at>?`, userID, digest[:], acceptedAt.Unix()).Scan(&organizationID)
+	var teamIDsJSON []byte
+	err = tx.QueryRowContext(ctx, `SELECT i.id,i.organization_id,i.direct_role,i.team_ids_json,i.invited_by_user_id FROM gwf_organization_invitations i JOIN gwf_users u ON u.id=? AND u.email_normalized=i.email_normalized JOIN gwf_organizations o ON o.id=i.organization_id AND o.status='active' WHERE i.token_hash=? AND i.used_at IS NULL AND i.revoked_at IS NULL AND i.expires_at>?`, userID, digest[:], acceptedAt.Unix()).Scan(&invitationID, &organizationID, &directRole, &teamIDsJSON, &invitedBy)
 	if errors.Is(err, sql.ErrNoRows) {
 		return organizations.ErrInvitationNotFound
 	}
@@ -151,6 +198,30 @@ func (store *Store) AcceptInvitation(ctx context.Context, digest [32]byte, userI
 	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_organization_memberships(organization_id,user_id,status,joined_at) VALUES(?,?,'active',?) ON CONFLICT(organization_id,user_id) DO UPDATE SET status='active'`, organizationID, userID, acceptedAt.Unix()); err != nil {
 		return err
 	}
+	var teamIDs []string
+	if json.Unmarshal(teamIDsJSON, &teamIDs) != nil || !validInvitationTeamIDs(teamIDs) {
+		return organizations.ErrInvitationNotFound
+	}
+	if err = validateInvitationTeams(ctx, tx, organizationID, teamIDs); err != nil {
+		return organizations.ErrInvitationNotFound
+	}
+	for _, teamID := range teamIDs {
+		if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_team_members(team_id,user_id,joined_at) VALUES(?,?,?) ON CONFLICT(team_id,user_id) DO NOTHING`, teamID, userID, acceptedAt.Unix()); err != nil {
+			return err
+		}
+	}
+	if directRole != "" {
+		if !safeName(directRole) {
+			return organizations.ErrInvitationNotFound
+		}
+		result, err := tx.ExecContext(ctx, `INSERT INTO gwf_access_bindings(id,organization_id,subject_kind,subject_id,role_name,project_id,environment_id,service_id,granted_by_user_id,granted_at) SELECT ?,?,'user',?,?,NULL,NULL,NULL,?,? FROM gwf_access_roles WHERE name=?`, "invite-"+invitationID, organizationID, userID, directRole, invitedBy, acceptedAt.Unix(), directRole)
+		if err != nil {
+			return err
+		}
+		if changed, _ := result.RowsAffected(); changed != 1 {
+			return organizations.ErrInvitationNotFound
+		}
+	}
 	result, err := tx.ExecContext(ctx, `UPDATE gwf_organization_invitations SET used_at=? WHERE token_hash=? AND used_at IS NULL`, acceptedAt.Unix(), digest[:])
 	if err != nil {
 		return err
@@ -158,6 +229,12 @@ func (store *Store) AcceptInvitation(ctx context.Context, digest [32]byte, userI
 	if changed, _ := result.RowsAffected(); changed != 1 {
 		return organizations.ErrInvitationNotFound
 	}
+	if organizationID != audit.OrganizationID {
+		return organizations.ErrInvitationNotFound
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
 	return tx.Commit()
 }
 
@@ -188,7 +265,7 @@ func (store *Store) TeamsForUser(ctx context.Context, organizationID, userID str
 	if !opaqueID(organizationID) || !opaqueID(userID) {
 		return nil, errors.New("authsqlite: invalid team query")
 	}
-	rows, err := store.db.QueryContext(ctx, `SELECT t.id,t.slug,t.name,t.created_at FROM gwf_teams t JOIN gwf_team_members tm ON tm.team_id=t.id WHERE t.organization_id=? AND tm.user_id=? ORDER BY t.slug`, organizationID, userID)
+	rows, err := store.db.QueryContext(ctx, `SELECT t.id,t.slug,t.name,t.status,t.revision,t.created_at,t.updated_at FROM gwf_teams t JOIN gwf_team_members tm ON tm.team_id=t.id JOIN gwf_organizations o ON o.id=t.organization_id WHERE t.organization_id=? AND tm.user_id=? AND t.status='active' AND o.status='active' ORDER BY t.slug`, organizationID, userID)
 	if err != nil {
 		return nil, err
 	}
@@ -196,17 +273,309 @@ func (store *Store) TeamsForUser(ctx context.Context, organizationID, userID str
 	var result []organizations.Team
 	for rows.Next() {
 		var team organizations.Team
-		var created int64
+		var created, updated int64
-		if err = rows.Scan(&team.ID, &team.Slug, &team.Name, &created); err != nil {
+		if err = rows.Scan(&team.ID, &team.Slug, &team.Name, &team.Status, &team.Revision, &created, &updated); err != nil {
 			return nil, err
 		}
 		team.OrganizationID = organizationID
 		team.CreatedAt = time.Unix(created, 0).UTC()
+		team.UpdatedAt = time.Unix(updated, 0).UTC()
 		result = append(result, team)
 	}
 	return result, rows.Err()
 }
 
+func (store *Store) OrganizationByID(ctx context.Context, organizationID string) (organizations.Organization, error) {
+	if !opaqueID(organizationID) {
+		return organizations.Organization{}, organizations.ErrOrganizationNotFound
+	}
+	var value organizations.Organization
+	var personal int
+	var created, updated int64
+	err := store.db.QueryRowContext(ctx, `SELECT id,slug,name,status,personal,revision,created_at,updated_at FROM gwf_organizations WHERE id=?`, organizationID).Scan(&value.ID, &value.Slug, &value.Name, &value.Status, &personal, &value.Revision, &created, &updated)
+	if errors.Is(err, sql.ErrNoRows) {
+		return organizations.Organization{}, organizations.ErrOrganizationNotFound
+	}
+	if err != nil {
+		return organizations.Organization{}, err
+	}
+	value.Personal = personal == 1
+	value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+	return value, nil
+}
+
+func (store *Store) UpdateOrganization(ctx context.Context, value organizations.Organization, expectedRevision int64, audit organizations.AuditEvent) error {
+	if !validOrganization(value) || expectedRevision < 1 || value.Revision != expectedRevision+1 || !validOrganizationAudit(audit, value.ID) {
+		return errors.New("authsqlite: invalid organization update")
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `UPDATE gwf_organizations SET slug=?,name=?,status=?,revision=?,updated_at=? WHERE id=? AND revision=?`, value.Slug, value.Name, value.Status, value.Revision, value.UpdatedAt.Unix(), value.ID, expectedRevision)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrRevisionConflict
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func (store *Store) TeamByID(ctx context.Context, organizationID, teamID string) (organizations.Team, error) {
+	if !opaqueID(teamID) || organizationID != "" && !opaqueID(organizationID) {
+		return organizations.Team{}, organizations.ErrTeamNotFound
+	}
+	query := `SELECT id,organization_id,slug,name,status,revision,created_at,updated_at FROM gwf_teams WHERE id=?`
+	args := []any{teamID}
+	if organizationID != "" {
+		query += ` AND organization_id=?`
+		args = append(args, organizationID)
+	}
+	var value organizations.Team
+	var created, updated int64
+	err := store.db.QueryRowContext(ctx, query, args...).Scan(&value.ID, &value.OrganizationID, &value.Slug, &value.Name, &value.Status, &value.Revision, &created, &updated)
+	if errors.Is(err, sql.ErrNoRows) {
+		return organizations.Team{}, organizations.ErrTeamNotFound
+	}
+	if err != nil {
+		return organizations.Team{}, err
+	}
+	value.CreatedAt, value.UpdatedAt = time.Unix(created, 0).UTC(), time.Unix(updated, 0).UTC()
+	return value, nil
+}
+
+func (store *Store) UpdateTeam(ctx context.Context, value organizations.Team, expectedRevision int64, audit organizations.AuditEvent) error {
+	if !validTeam(value) || expectedRevision < 1 || value.Revision != expectedRevision+1 || !validOrganizationAudit(audit, value.OrganizationID) {
+		return errors.New("authsqlite: invalid team update")
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `UPDATE gwf_teams SET slug=?,name=?,status=?,revision=?,updated_at=? WHERE id=? AND organization_id=? AND revision=?`, value.Slug, value.Name, value.Status, value.Revision, value.UpdatedAt.Unix(), value.ID, value.OrganizationID, expectedRevision)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrRevisionConflict
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func (store *Store) RemoveTeamMember(ctx context.Context, teamID, userID string, audit organizations.AuditEvent) error {
+	if !opaqueID(teamID) || !opaqueID(userID) || !validOrganizationAudit(audit, audit.OrganizationID) {
+		return organizations.ErrMembershipNotFound
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `DELETE FROM gwf_team_members WHERE team_id=? AND user_id=? AND EXISTS (SELECT 1 FROM gwf_teams WHERE id=? AND organization_id=?)`, teamID, userID, teamID, audit.OrganizationID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrMembershipNotFound
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func (store *Store) SetMembershipStatus(ctx context.Context, organizationID, userID, status, ownerRole string, audit organizations.AuditEvent) error {
+	if !opaqueID(organizationID) || !opaqueID(userID) || (status != "active" && status != "suspended") || status != "active" && !safeName(ownerRole) || !validOrganizationAudit(audit, organizationID) {
+		return organizations.ErrMembershipNotFound
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if status != "active" {
+		if err = protectLastOwner(ctx, tx, organizationID, userID, ownerRole); err != nil {
+			return err
+		}
+	}
+	result, err := tx.ExecContext(ctx, `UPDATE gwf_organization_memberships SET status=? WHERE organization_id=? AND user_id=?`, status, organizationID, userID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrMembershipNotFound
+	}
+	if status != "active" {
+		if _, err = tx.ExecContext(ctx, `DELETE FROM gwf_team_members WHERE user_id=? AND team_id IN (SELECT id FROM gwf_teams WHERE organization_id=?)`, userID, organizationID); err != nil {
+			return err
+		}
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func (store *Store) RemoveMembership(ctx context.Context, organizationID, userID, ownerRole string, audit organizations.AuditEvent) error {
+	if !opaqueID(organizationID) || !opaqueID(userID) || !safeName(ownerRole) || !validOrganizationAudit(audit, organizationID) {
+		return organizations.ErrMembershipNotFound
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if err = protectLastOwner(ctx, tx, organizationID, userID, ownerRole); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `DELETE FROM gwf_team_members WHERE user_id=? AND team_id IN (SELECT id FROM gwf_teams WHERE organization_id=?)`, userID, organizationID); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `UPDATE gwf_access_bindings SET revoked_by_user_id=?,revoked_at=? WHERE organization_id=? AND subject_kind='user' AND subject_id=? AND revoked_at IS NULL`, audit.ActorUserID, audit.CreatedAt.Unix(), organizationID, userID); err != nil {
+		return err
+	}
+	result, err := tx.ExecContext(ctx, `DELETE FROM gwf_organization_memberships WHERE organization_id=? AND user_id=?`, organizationID, userID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrMembershipNotFound
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func protectLastOwner(ctx context.Context, tx *sql.Tx, organizationID, userID, ownerRole string) error {
+	var targetIsOwner int
+	if err := tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_access_bindings WHERE organization_id=? AND subject_kind='user' AND subject_id=? AND role_name=? AND project_id IS NULL AND environment_id IS NULL AND service_id IS NULL AND revoked_at IS NULL`, organizationID, userID, ownerRole).Scan(&targetIsOwner); err != nil {
+		return err
+	}
+	if targetIsOwner == 0 {
+		return nil
+	}
+	var activeOwners int
+	if err := tx.QueryRowContext(ctx, `SELECT COUNT(DISTINCT b.subject_id) FROM gwf_access_bindings b JOIN gwf_organization_memberships m ON m.organization_id=b.organization_id AND m.user_id=b.subject_id AND m.status='active' WHERE b.organization_id=? AND b.subject_kind='user' AND b.role_name=? AND b.project_id IS NULL AND b.environment_id IS NULL AND b.service_id IS NULL AND b.revoked_at IS NULL`, organizationID, ownerRole).Scan(&activeOwners); err != nil {
+		return err
+	}
+	if activeOwners <= 1 {
+		return organizations.ErrLastOwner
+	}
+	return nil
+}
+
+func (store *Store) Invitations(ctx context.Context, organizationID string, limit int) ([]organizations.Invitation, error) {
+	if !opaqueID(organizationID) || limit < 1 || limit > 1000 {
+		return nil, errors.New("authsqlite: invalid invitation query")
+	}
+	rows, err := store.db.QueryContext(ctx, `SELECT id,email_normalized,invited_by_user_id,direct_role,team_ids_json,created_at,expires_at,COALESCE(used_at,0),COALESCE(revoked_at,0) FROM gwf_organization_invitations WHERE organization_id=? ORDER BY created_at DESC LIMIT ?`, organizationID, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]organizations.Invitation, 0)
+	for rows.Next() {
+		var value organizations.Invitation
+		var created, expires, used, revoked int64
+		var teamIDs []byte
+		if err = rows.Scan(&value.ID, &value.Email, &value.InvitedByUserID, &value.DirectRole, &teamIDs, &created, &expires, &used, &revoked); err != nil {
+			return nil, err
+		}
+		if json.Unmarshal(teamIDs, &value.TeamIDs) != nil || !validInvitationTeamIDs(value.TeamIDs) {
+			return nil, errors.New("authsqlite: stored invitation is invalid")
+		}
+		value.OrganizationID = organizationID
+		value.CreatedAt, value.ExpiresAt = time.Unix(created, 0).UTC(), time.Unix(expires, 0).UTC()
+		if used != 0 {
+			value.UsedAt = time.Unix(used, 0).UTC()
+		}
+		if revoked != 0 {
+			value.RevokedAt = time.Unix(revoked, 0).UTC()
+		}
+		result = append(result, value)
+	}
+	return result, rows.Err()
+}
+
+func validInvitationTeamIDs(teamIDs []string) bool {
+	if len(teamIDs) > 16 {
+		return false
+	}
+	seen := make(map[string]struct{}, len(teamIDs))
+	for _, teamID := range teamIDs {
+		if !opaqueID(teamID) {
+			return false
+		}
+		if _, exists := seen[teamID]; exists {
+			return false
+		}
+		seen[teamID] = struct{}{}
+	}
+	return true
+}
+
+func validateInvitationTeams(ctx context.Context, tx *sql.Tx, organizationID string, teamIDs []string) error {
+	for _, teamID := range teamIDs {
+		var count int
+		if err := tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_teams WHERE id=? AND organization_id=? AND status='active'`, teamID, organizationID).Scan(&count); err != nil {
+			return err
+		}
+		if count != 1 {
+			return organizations.ErrTeamNotFound
+		}
+	}
+	return nil
+}
+
+func (store *Store) RevokeInvitation(ctx context.Context, organizationID, invitationID string, revokedAt time.Time, audit organizations.AuditEvent) error {
+	if !opaqueID(organizationID) || !opaqueID(invitationID) || revokedAt.IsZero() || !validOrganizationAudit(audit, organizationID) {
+		return organizations.ErrInvitationNotFound
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	result, err := tx.ExecContext(ctx, `UPDATE gwf_organization_invitations SET revoked_at=? WHERE organization_id=? AND id=? AND used_at IS NULL AND revoked_at IS NULL`, revokedAt.Unix(), organizationID, invitationID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return organizations.ErrInvitationNotFound
+	}
+	if err = appendOrganizationAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
+func validOrganization(value organizations.Organization) bool {
+	return opaqueID(value.ID) && slugValue(value.Slug) && text(value.Name, 128, false) && (value.Status == "active" || value.Status == "archived") && value.Revision > 0 && !value.CreatedAt.IsZero() && !value.UpdatedAt.IsZero()
+}
+
+func validTeam(value organizations.Team) bool {
+	return opaqueID(value.ID) && opaqueID(value.OrganizationID) && slugValue(value.Slug) && text(value.Name, 128, false) && (value.Status == "active" || value.Status == "archived") && value.Revision > 0 && !value.CreatedAt.IsZero() && !value.UpdatedAt.IsZero()
+}
+
+func validOrganizationAudit(value organizations.AuditEvent, organizationID string) bool {
+	return opaqueID(value.ID) && opaqueID(organizationID) && value.OrganizationID == organizationID && opaqueID(value.ActorUserID) && text(value.Action, 128, false) && text(value.ResourceType, 128, false) && text(value.ResourceID, 128, false) && text(value.RequestID, 128, true) && text(value.Summary, 512, false) && !value.CreatedAt.IsZero()
+}
+
+func appendOrganizationAudit(ctx context.Context, tx *sql.Tx, value organizations.AuditEvent) error {
+	_, err := tx.ExecContext(ctx, `INSERT INTO gwf_access_audit_events(id,organization_id,actor_user_id,action,resource_type,resource_id,request_id,summary,created_at) VALUES(?,?,?,?,?,?,NULLIF(?,''),?,?)`, value.ID, value.OrganizationID, value.ActorUserID, value.Action, value.ResourceType, value.ResourceID, value.RequestID, value.Summary, value.CreatedAt.Unix())
+	return err
+}
+
 func slugValue(value string) bool {
 	if len(value) < 2 || len(value) > 63 || (value[0] < 'a' || value[0] > 'z') && (value[0] < '0' || value[0] > '9') {
 		return false

authsqlite/passkey.go

@@ -93,6 +93,17 @@ func (store *Store) CredentialsByUserID(ctx context.Context, userID string) ([]a
 	return credentials, rows.Err()
 }
 
+func (store *Store) PasswordCredentialExists(ctx context.Context, userID string) (bool, error) {
+	if !opaqueID(userID) {
+		return false, auth.ErrUserNotFound
+	}
+	var count int
+	if err := store.db.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_password_credentials WHERE user_id=?`, userID).Scan(&count); err != nil {
+		return false, err
+	}
+	return count == 1, nil
+}
+
 func (store *Store) SaveCredential(ctx context.Context, credential authwebauthn.Credential, audit auth.AuditEvent) error {
 	if !validCredential(credential, true) || !validAuditEvent(audit) {
 		return errors.New("authsqlite: invalid passkey credential")
@@ -118,6 +129,56 @@ func (store *Store) SaveCredential(ctx context.Context, credential authwebauthn.
 	return tx.Commit()
 }
 
+func (store *Store) SaveCredentialAndRetirePassword(ctx context.Context, credential authwebauthn.Credential, audit auth.AuditEvent) error {
+	if !validCredential(credential, true) || !validAuditEvent(audit) || audit.ActorUserID != credential.UserID || audit.Action != "auth.passkey.migrate" {
+		return errors.New("authsqlite: invalid passkey migration")
+	}
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	var credentialCount, passwordCount int
+	if err = tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_passkey_credentials WHERE user_id=?`, credential.UserID).Scan(&credentialCount); err != nil {
+		return err
+	}
+	if credentialCount >= maxPasskeysPerUser {
+		return errors.New("authsqlite: passkey credential limit reached")
+	}
+	if err = tx.QueryRowContext(ctx, `SELECT COUNT(*) FROM gwf_password_credentials WHERE user_id=?`, credential.UserID).Scan(&passwordCount); err != nil {
+		return err
+	}
+	if passwordCount != 1 {
+		return authwebauthn.ErrPasswordNotAvailable
+	}
+	if _, err = tx.ExecContext(ctx, `INSERT INTO gwf_passkey_credentials(credential_id,user_id,label,credential_json,created_at,last_used_at) VALUES(?,?,?,?,?,NULL)`, credential.ID, credential.UserID, credential.Label, []byte(credential.Data), credential.CreatedAt.Unix()); err != nil {
+		return err
+	}
+	result, err := tx.ExecContext(ctx, `DELETE FROM gwf_password_credentials WHERE user_id=?`, credential.UserID)
+	if err != nil {
+		return err
+	}
+	if changed, _ := result.RowsAffected(); changed != 1 {
+		return authwebauthn.ErrPasswordNotAvailable
+	}
+	if _, err = tx.ExecContext(ctx, `UPDATE gwf_users SET password_change_required=0,updated_at=? WHERE id=?`, credential.CreatedAt.Unix(), credential.UserID); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `DELETE FROM gwf_auth_sessions WHERE user_id=?`, credential.UserID); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `DELETE FROM gwf_passkey_ceremonies WHERE user_id=?`, credential.UserID); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `DELETE FROM gwf_passkey_enrollment_tokens WHERE user_id=?`, credential.UserID); err != nil {
+		return err
+	}
+	if err = appendAudit(ctx, tx, audit); err != nil {
+		return err
+	}
+	return tx.Commit()
+}
+
 func (store *Store) UpdateCredential(ctx context.Context, credential authwebauthn.Credential) error {
 	if !validCredential(credential, false) || credential.LastUsedAt.IsZero() {
 		return errors.New("authsqlite: invalid passkey credential update")
@@ -311,9 +372,10 @@ func validCredential(credential authwebauthn.Credential, requireLabel bool) bool
 func validCeremony(ceremony authwebauthn.Ceremony) bool {
 	validKind := ceremony.Kind == authwebauthn.CeremonyRegistration || ceremony.Kind == authwebauthn.CeremonyLogin || ceremony.Kind == authwebauthn.CeremonyApproval
 	validUser := ceremony.Kind == authwebauthn.CeremonyLogin && ceremony.UserID == "" || opaqueID(ceremony.UserID)
-	validLabel := ceremony.Kind == authwebauthn.CeremonyRegistration && text(ceremony.Label, 80, false) || ceremony.Kind != authwebauthn.CeremonyRegistration && ceremony.Label == ""
+	registrationKind := ceremony.Kind == authwebauthn.CeremonyRegistration
+	validLabel := registrationKind && text(ceremony.Label, 80, false) || !registrationKind && ceremony.Label == ""
 	zeroBinding := zeroDigest(ceremony.BindingDigest)
-	validBinding := ceremony.Kind == authwebauthn.CeremonyApproval && !zeroBinding || ceremony.Kind != authwebauthn.CeremonyApproval && zeroBinding
+	validBinding := ceremony.Kind == authwebauthn.CeremonyApproval && !zeroBinding || ceremony.Kind == authwebauthn.CeremonyRegistration || ceremony.Kind == authwebauthn.CeremonyLogin && zeroBinding
 	return !zeroDigest(ceremony.Digest) && validKind && validUser && validLabel && validBinding && len(ceremony.SessionData) > 0 && len(ceremony.SessionData) <= maxCeremonySessionBytes && json.Valid(ceremony.SessionData) && !ceremony.CreatedAt.IsZero() && ceremony.ExpiresAt.After(ceremony.CreatedAt)
 }
 

authsqlite/passkey_test.go

@@ -92,6 +92,53 @@ func TestPasskeyCeremonyIsConsumedExactlyOnceConcurrently(t *testing.T) {
 	}
 }
 
+func TestPasskeyMigrationAtomicallyRetiresPasswordAndSessions(t *testing.T) {
+	store, err := Open(t.TempDir() + "/auth.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	now := time.Date(2026, 8, 27, 12, 0, 0, 0, time.UTC)
+	authService, err := auth.New(store, auth.Options{Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, err := authService.CreateUser(t.Context(), auth.CreateUser{Username: "migrate.me", Email: "migrate@example.test", DisplayName: "Migration Test", Password: "legacy password credential"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	session, _, err := authService.IssueSession(t.Context(), user.ID, time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := bytes.Repeat([]byte{7}, 32)
+	encoded, err := json.Marshal(wa.Credential{ID: id, PublicKey: []byte{1, 2, 3}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	credential := authwebauthn.Credential{ID: id, UserID: user.ID, Label: "Primary passkey", Data: encoded, CreatedAt: now}
+	audit := auth.AuditEvent{ID: "migration-audit", ActorUserID: user.ID, Action: "auth.passkey.migrate", ResourceType: "passkey", ResourceID: "credential", Summary: "migration", CreatedAt: now}
+	if err = store.SaveCredentialAndRetirePassword(t.Context(), credential, audit); err != nil {
+		t.Fatal(err)
+	}
+	if exists, existsErr := store.PasswordCredentialExists(t.Context(), user.ID); existsErr != nil || exists {
+		t.Fatalf("password exists=%v err=%v", exists, existsErr)
+	}
+	if _, _, err = authService.Authenticate(t.Context(), user.Username, "legacy password credential", time.Hour); !errors.Is(err, auth.ErrInvalidCredentials) {
+		t.Fatalf("legacy password still authenticates: %v", err)
+	}
+	if _, err = authService.Session(t.Context(), session); !errors.Is(err, auth.ErrSessionNotFound) {
+		t.Fatalf("session survived migration: %v", err)
+	}
+	credentials, err := store.CredentialsByUserID(t.Context(), user.ID)
+	if err != nil || len(credentials) != 1 || !bytes.Equal(credentials[0].ID, id) {
+		t.Fatalf("credentials=%+v err=%v", credentials, err)
+	}
+	if err = store.SaveCredentialAndRetirePassword(t.Context(), credential, audit); !errors.Is(err, authwebauthn.ErrPasswordNotAvailable) {
+		t.Fatalf("migration replay err=%v", err)
+	}
+}
+
 func testAudit(id, action, resourceID string, now time.Time) auth.AuditEvent {
 	return auth.AuditEvent{ID: id, Action: action, ResourceType: "user", ResourceID: resourceID, Summary: "test", CreatedAt: now}
 }

authsqlite/store.go

@@ -94,16 +94,16 @@ func (store *Store) Migrate(ctx context.Context) error {
 		`CREATE INDEX IF NOT EXISTS gwf_passkey_enrollment_expiry ON gwf_passkey_enrollment_tokens(expires_at)`,
 		`CREATE TABLE IF NOT EXISTS gwf_passkey_ceremonies (token_hash BLOB PRIMARY KEY, kind TEXT NOT NULL CHECK(kind IN ('registration','login','approval')), user_id TEXT REFERENCES gwf_users(id) ON DELETE CASCADE, label TEXT NOT NULL, session_json BLOB NOT NULL, binding_hash BLOB NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL)`,
 		`CREATE INDEX IF NOT EXISTS gwf_passkey_ceremonies_expiry ON gwf_passkey_ceremonies(expires_at)`,
-		`CREATE TABLE IF NOT EXISTS gwf_organizations (id TEXT PRIMARY KEY, slug TEXT NOT NULL UNIQUE, name TEXT NOT NULL, personal INTEGER NOT NULL CHECK(personal IN (0,1)), personal_owner_user_id TEXT UNIQUE REFERENCES gwf_users(id) ON DELETE CASCADE, created_at INTEGER NOT NULL)`,
+		`CREATE TABLE IF NOT EXISTS gwf_organizations (id TEXT PRIMARY KEY, slug TEXT NOT NULL UNIQUE, name TEXT NOT NULL, personal INTEGER NOT NULL CHECK(personal IN (0,1)), personal_owner_user_id TEXT UNIQUE REFERENCES gwf_users(id) ON DELETE CASCADE, status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active','archived')), revision INTEGER NOT NULL DEFAULT 1 CHECK(revision > 0), created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`,
 		`CREATE TABLE IF NOT EXISTS gwf_organization_memberships (organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, user_id TEXT NOT NULL REFERENCES gwf_users(id) ON DELETE CASCADE, status TEXT NOT NULL CHECK(status IN ('active','suspended')), joined_at INTEGER NOT NULL, PRIMARY KEY(organization_id,user_id))`,
 		`CREATE INDEX IF NOT EXISTS gwf_organization_memberships_user ON gwf_organization_memberships(user_id,organization_id)`,
-		`CREATE TABLE IF NOT EXISTS gwf_teams (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, slug TEXT NOT NULL, name TEXT NOT NULL, created_at INTEGER NOT NULL, UNIQUE(organization_id,slug))`,
+		`CREATE TABLE IF NOT EXISTS gwf_teams (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, slug TEXT NOT NULL, name TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active','archived')), revision INTEGER NOT NULL DEFAULT 1 CHECK(revision > 0), created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, UNIQUE(organization_id,slug))`,
 		`CREATE TABLE IF NOT EXISTS gwf_team_members (team_id TEXT NOT NULL REFERENCES gwf_teams(id) ON DELETE CASCADE, user_id TEXT NOT NULL REFERENCES gwf_users(id) ON DELETE CASCADE, joined_at INTEGER NOT NULL, PRIMARY KEY(team_id,user_id))`,
 		`CREATE INDEX IF NOT EXISTS gwf_team_members_user ON gwf_team_members(user_id,team_id)`,
 		`CREATE TABLE IF NOT EXISTS gwf_projects (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, slug TEXT NOT NULL, name TEXT NOT NULL, created_at INTEGER NOT NULL, UNIQUE(organization_id,slug))`,
 		`CREATE TABLE IF NOT EXISTS gwf_environments (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES gwf_projects(id) ON DELETE CASCADE, slug TEXT NOT NULL, name TEXT NOT NULL, created_at INTEGER NOT NULL, UNIQUE(project_id,slug))`,
 		`CREATE TABLE IF NOT EXISTS gwf_application_services (id TEXT PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, project_id TEXT NOT NULL REFERENCES gwf_projects(id) ON DELETE CASCADE, environment_id TEXT NOT NULL REFERENCES gwf_environments(id) ON DELETE CASCADE, slug TEXT NOT NULL, name TEXT NOT NULL, created_at INTEGER NOT NULL, UNIQUE(environment_id,slug))`,
-		`CREATE TABLE IF NOT EXISTS gwf_organization_invitations (token_hash BLOB PRIMARY KEY, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, email_normalized TEXT NOT NULL, invited_by_user_id TEXT NOT NULL REFERENCES gwf_users(id), created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, used_at INTEGER)`,
+		`CREATE TABLE IF NOT EXISTS gwf_organization_invitations (token_hash BLOB PRIMARY KEY, id TEXT NOT NULL UNIQUE, organization_id TEXT NOT NULL REFERENCES gwf_organizations(id) ON DELETE CASCADE, email_normalized TEXT NOT NULL, invited_by_user_id TEXT NOT NULL REFERENCES gwf_users(id), direct_role TEXT NOT NULL DEFAULT '', team_ids_json BLOB NOT NULL DEFAULT '[]', created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, used_at INTEGER, revoked_at INTEGER)`,
 		`CREATE INDEX IF NOT EXISTS gwf_organization_invitations_expiry ON gwf_organization_invitations(expires_at)`,
 		`CREATE TABLE IF NOT EXISTS gwf_access_roles (name TEXT PRIMARY KEY, description TEXT NOT NULL)`,
 		`CREATE TABLE IF NOT EXISTS gwf_access_permissions (name TEXT PRIMARY KEY, description TEXT NOT NULL)`,
@@ -129,6 +129,42 @@ func (store *Store) Migrate(ctx context.Context) error {
 			return err
 		}
 	}
+	for _, migration := range []struct {
+		table, column, definition string
+	}{
+		{"gwf_organizations", "status", `TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active','archived'))`},
+		{"gwf_organizations", "revision", `INTEGER NOT NULL DEFAULT 1 CHECK(revision > 0)`},
+		{"gwf_organizations", "updated_at", `INTEGER NOT NULL DEFAULT 0`},
+		{"gwf_teams", "status", `TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active','archived'))`},
+		{"gwf_teams", "revision", `INTEGER NOT NULL DEFAULT 1 CHECK(revision > 0)`},
+		{"gwf_teams", "updated_at", `INTEGER NOT NULL DEFAULT 0`},
+		{"gwf_organization_invitations", "id", `TEXT`},
+		{"gwf_organization_invitations", "revoked_at", `INTEGER`},
+		{"gwf_organization_invitations", "direct_role", `TEXT NOT NULL DEFAULT ''`},
+		{"gwf_organization_invitations", "team_ids_json", `BLOB NOT NULL DEFAULT '[]'`},
+	} {
+		exists, columnErr := sqliteColumnExists(ctx, tx, migration.table, migration.column)
+		if columnErr != nil {
+			return columnErr
+		}
+		if !exists {
+			if _, err = tx.ExecContext(ctx, `ALTER TABLE `+migration.table+` ADD COLUMN `+migration.column+` `+migration.definition); err != nil {
+				return err
+			}
+		}
+	}
+	if _, err = tx.ExecContext(ctx, `UPDATE gwf_organizations SET updated_at=created_at WHERE updated_at=0`); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `UPDATE gwf_teams SET updated_at=created_at WHERE updated_at=0`); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `UPDATE gwf_organization_invitations SET id=lower(hex(token_hash)) WHERE id IS NULL`); err != nil {
+		return err
+	}
+	if _, err = tx.ExecContext(ctx, `CREATE UNIQUE INDEX IF NOT EXISTS gwf_organization_invitations_id ON gwf_organization_invitations(id)`); err != nil {
+		return err
+	}
 	if _, err = tx.ExecContext(ctx, `INSERT OR IGNORE INTO gamertan_web_migrations(version,applied_at) VALUES(1,?)`, time.Now().UTC().Unix()); err != nil {
 		return err
 	}
@@ -141,6 +177,9 @@ func (store *Store) Migrate(ctx context.Context) error {
 	if _, err = tx.ExecContext(ctx, `INSERT OR IGNORE INTO gamertan_web_migrations(version,applied_at) VALUES(4,?)`, time.Now().UTC().Unix()); err != nil {
 		return err
 	}
+	if _, err = tx.ExecContext(ctx, `INSERT OR IGNORE INTO gamertan_web_migrations(version,applied_at) VALUES(5,?)`, time.Now().UTC().Unix()); err != nil {
+		return err
+	}
 	return tx.Commit()
 }
 

authsqlite/store_test.go

@@ -319,11 +319,11 @@ func TestOrganizationTeamResourceAndScopedAccessRoundTrip(t *testing.T) {
 	if err = organizationService.AcceptInvitation(t.Context(), raw, member.ID); err != nil {
 		t.Fatal(err)
 	}
-	team, err := organizationService.CreateTeam(t.Context(), organizations.CreateTeam{OrganizationID: organization.ID, Slug: "operators", Name: "Operators"})
+	team, err := organizationService.CreateTeam(t.Context(), organizations.CreateTeam{OrganizationID: organization.ID, Slug: "operators", Name: "Operators", ActorUserID: owner.ID})
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err = organizationService.AddTeamMember(t.Context(), team.ID, member.ID); err != nil {
+	if err = organizationService.AddTeamMember(t.Context(), team.ID, member.ID, owner.ID); err != nil {
 		t.Fatal(err)
 	}
 	project, err := organizationService.CreateProject(t.Context(), organizations.CreateProject{OrganizationID: organization.ID, Slug: "eql", Name: "EQL"})
@@ -366,11 +366,96 @@ func TestOrganizationTeamResourceAndScopedAccessRoundTrip(t *testing.T) {
 		t.Fatalf("break-glass decision=%+v err=%v", decision, err)
 	}
 	var audits int
-	if err = store.db.QueryRow(`SELECT COUNT(*) FROM gwf_access_audit_events WHERE organization_id=?`, organization.ID).Scan(&audits); err != nil || audits != 1 {
+	if err = store.db.QueryRow(`SELECT COUNT(*) FROM gwf_access_audit_events WHERE organization_id=?`, organization.ID).Scan(&audits); err != nil || audits != 6 {
 		t.Fatalf("audits=%d err=%v", audits, err)
 	}
 	auditEvents, err := accessService.Audit(t.Context(), organization.ID, 10)
-	if err != nil || len(auditEvents) != 1 || auditEvents[0].Action != "break_glass.activate" {
+	if err != nil || len(auditEvents) != 6 {
 		t.Fatalf("audit events=%+v err=%v", auditEvents, err)
 	}
+	foundBreakGlass := false
+	for _, event := range auditEvents {
+		foundBreakGlass = foundBreakGlass || event.Action == "break_glass.activate"
+	}
+	if !foundBreakGlass {
+		t.Fatalf("break-glass audit missing: %+v", auditEvents)
+	}
+}
+
+func TestInvitationAccessLifecycleAndLastOwnerProtection(t *testing.T) {
+	store, err := Open(filepath.Join(t.TempDir(), "accounts.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	now := time.Date(2026, 8, 27, 12, 0, 0, 0, time.UTC)
+	authService, err := auth.New(store, auth.Options{Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	owner, err := authService.CreateUser(t.Context(), auth.CreateUser{Username: "owner.lifecycle", Email: "owner-lifecycle@example.test", DisplayName: "Owner", Password: "correct horse battery staple"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	member, err := authService.CreateUser(t.Context(), auth.CreateUser{Username: "member.lifecycle", Email: "member-lifecycle@example.test", DisplayName: "Member", Password: "correct horse battery staple"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	organizationService, err := organizations.New(store, organizations.Options{Now: func() time.Time { return now }, OwnerRole: "organization.owner"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	organization, err := organizationService.CreateOrganization(t.Context(), organizations.CreateOrganization{Slug: "lifecycle-test", Name: "Lifecycle Test", OwnerUserID: owner.ID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	policy := access.Policy{Roles: map[string]string{"organization.owner": "Owner"}, Permissions: map[string]string{"telemetry.read": "Read"}, Grants: map[string][]string{"organization.owner": {"telemetry.read"}}}
+	accessService, err := access.New(store, policy, access.Options{Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = accessService.Seed(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = accessService.Grant(t.Context(), access.Grant{SubjectKind: access.User, SubjectID: owner.ID, Role: "organization.owner", Scope: access.Scope{OrganizationID: organization.ID}, GrantedBy: owner.ID}); err != nil {
+		t.Fatal(err)
+	}
+	if err = organizationService.SetMembershipStatus(t.Context(), organization.ID, owner.ID, "suspended", owner.ID, "request-last-owner"); !errors.Is(err, organizations.ErrLastOwner) {
+		t.Fatalf("last-owner suspension err=%v", err)
+	}
+	team, err := organizationService.CreateTeam(t.Context(), organizations.CreateTeam{OrganizationID: organization.ID, Slug: "operators", Name: "Operators", ActorUserID: owner.ID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, invitation, err := organizationService.InviteWithAccess(t.Context(), organizations.InviteWithAccess{OrganizationID: organization.ID, Email: member.Email, InvitedByUserID: owner.ID, DirectRole: "organization.owner", TeamIDs: []string{team.ID}, Lifetime: 7 * 24 * time.Hour})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if invitation.DirectRole != "organization.owner" || len(invitation.TeamIDs) != 1 {
+		t.Fatalf("invitation=%+v", invitation)
+	}
+	if err = organizationService.AcceptInvitation(t.Context(), raw, member.ID); err != nil {
+		t.Fatal(err)
+	}
+	decision, err := accessService.Authorize(t.Context(), member.ID, access.Scope{OrganizationID: organization.ID}, "telemetry.read")
+	if err != nil || !decision.Allowed {
+		t.Fatalf("member decision=%+v err=%v", decision, err)
+	}
+	teams, err := organizationService.Teams(t.Context(), organization.ID, member.ID)
+	if err != nil || len(teams) != 1 || teams[0].ID != team.ID {
+		t.Fatalf("member teams=%+v err=%v", teams, err)
+	}
+	if err = organizationService.SetMembershipStatus(t.Context(), organization.ID, owner.ID, "suspended", owner.ID, "request-suspend-owner"); err != nil {
+		t.Fatal(err)
+	}
+	if err = organizationService.RemoveMembership(t.Context(), organization.ID, member.ID, member.ID, "request-last-member"); !errors.Is(err, organizations.ErrLastOwner) {
+		t.Fatalf("sole active owner removal err=%v", err)
+	}
+	if _, err = organizationService.SetOrganizationStatus(t.Context(), organizations.SetOrganizationStatus{ID: organization.ID, Status: "archived", ActorUserID: member.ID, ExpectedRevision: organization.Revision, RequestID: "request-archive"}); err != nil {
+		t.Fatal(err)
+	}
+	decision, err = accessService.Authorize(t.Context(), member.ID, access.Scope{OrganizationID: organization.ID}, "telemetry.read")
+	if err != nil || decision.Allowed {
+		t.Fatalf("archived organization decision=%+v err=%v", decision, err)
+	}
 }

authwebauthn/service.go

@@ -190,7 +190,7 @@ func (service *Service) BeginEnrollment(ctx context.Context, enrollmentToken, la
 	if err != nil {
 		return BeginResult{}, err
 	}
-	return service.beginRegistration(ctx, user, label)
+	return service.beginRegistration(ctx, user, label, CeremonyRegistration, [32]byte{})
 }
 
 func (service *Service) BeginRegistration(ctx context.Context, userID, label string) (BeginResult, error) {
@@ -198,10 +198,28 @@ func (service *Service) BeginRegistration(ctx context.Context, userID, label str
 	if err != nil {
 		return BeginResult{}, err
 	}
-	return service.beginRegistration(ctx, user, label)
+	return service.beginRegistration(ctx, user, label, CeremonyRegistration, [32]byte{})
 }
 
-func (service *Service) beginRegistration(ctx context.Context, user auth.User, label string) (BeginResult, error) {
+// BeginPasswordMigration starts registration for an already authenticated
+// password-backed user. Completion atomically retires the password and revokes
+// all sessions, including the session that authorized this ceremony.
+func (service *Service) BeginPasswordMigration(ctx context.Context, userID, label string) (BeginResult, error) {
+	user, err := service.repository.UserByID(ctx, strings.TrimSpace(userID))
+	if err != nil {
+		return BeginResult{}, err
+	}
+	exists, err := service.repository.PasswordCredentialExists(ctx, user.ID)
+	if err != nil {
+		return BeginResult{}, err
+	}
+	if !exists {
+		return BeginResult{}, ErrPasswordNotAvailable
+	}
+	return service.beginRegistration(ctx, user, label, CeremonyRegistration, passwordMigrationBinding(user.ID))
+}
+
+func (service *Service) beginRegistration(ctx context.Context, user auth.User, label, kind string, binding [32]byte) (BeginResult, error) {
 	label, err := credentialLabel(label)
 	if err != nil {
 		return BeginResult{}, err
@@ -223,14 +241,35 @@ func (service *Service) beginRegistration(ctx context.Context, user auth.User, l
 	if err != nil {
 		return BeginResult{}, fmt.Errorf("authwebauthn: begin registration: %w", err)
 	}
-	return service.storeCeremony(ctx, CeremonyRegistration, user.ID, label, session, [32]byte{}, creation.Response, service.config.RegistrationTTL)
+	return service.storeCeremony(ctx, kind, user.ID, label, session, binding, creation.Response, service.config.RegistrationTTL)
 }
 
 func (service *Service) FinishRegistration(ctx context.Context, ceremonyToken string, response []byte) (Credential, error) {
+	return service.finishRegistration(ctx, ceremonyToken, CeremonyRegistration, [32]byte{}, response, false)
+}
+
+// FinishPasswordMigration verifies the new passkey and persists it together
+// with password retirement and session revocation in one storage transaction.
+func (service *Service) FinishPasswordMigration(ctx context.Context, ceremonyToken string, response []byte) (Credential, error) {
 	ceremony, err := service.takeCeremony(ctx, ceremonyToken, CeremonyRegistration)
 	if err != nil {
 		return Credential{}, err
 	}
+	return service.finishRegistrationCeremony(ctx, ceremony, passwordMigrationBinding(ceremony.UserID), response, true)
+}
+
+func (service *Service) finishRegistration(ctx context.Context, ceremonyToken, kind string, expectedBinding [32]byte, response []byte, retirePassword bool) (Credential, error) {
+	ceremony, err := service.takeCeremony(ctx, ceremonyToken, kind)
+	if err != nil {
+		return Credential{}, err
+	}
+	return service.finishRegistrationCeremony(ctx, ceremony, expectedBinding, response, retirePassword)
+}
+
+func (service *Service) finishRegistrationCeremony(ctx context.Context, ceremony Ceremony, expectedBinding [32]byte, response []byte, retirePassword bool) (Credential, error) {
+	if ceremony.BindingDigest != expectedBinding {
+		return Credential{}, ErrOperationBinding
+	}
 	if len(response) == 0 || len(response) > maxResponseBytes {
 		return Credential{}, errors.New("authwebauthn: registration response is invalid")
 	}
@@ -263,11 +302,20 @@ func (service *Service) FinishRegistration(ctx context.Context, ceremonyToken st
 	}
 	now := service.now().UTC()
 	record := Credential{ID: append([]byte(nil), verified.ID...), UserID: user.ID, Label: ceremony.Label, Data: encoded, CreatedAt: now}
-	audit, err := service.audit(user.ID, "auth.passkey.add", "passkey", base64.RawURLEncoding.EncodeToString(verified.ID), "A passkey was enrolled.")
+	action, summary := "auth.passkey.add", "A passkey was enrolled."
+	if retirePassword {
+		action, summary = "auth.passkey.migrate", "A passkey was enrolled and the legacy password credential was retired."
+	}
+	audit, err := service.audit(user.ID, action, "passkey", base64.RawURLEncoding.EncodeToString(verified.ID), summary)
 	if err != nil {
 		return Credential{}, err
 	}
-	if err = service.repository.SaveCredential(ctx, record, audit); err != nil {
+	if retirePassword {
+		err = service.repository.SaveCredentialAndRetirePassword(ctx, record, audit)
+	} else {
+		err = service.repository.SaveCredential(ctx, record, audit)
+	}
+	if err != nil {
 		return Credential{}, err
 	}
 	return record, nil
@@ -594,6 +642,10 @@ func credentialRemovalBinding(userID string, credentialID []byte) []byte {
 	return []byte("gamertan-web/passkey-remove/v1\x00" + userID + "\x00" + base64.RawURLEncoding.EncodeToString(credentialID))
 }
 
+func passwordMigrationBinding(userID string) [32]byte {
+	return BindingDigest([]byte("gamertan-web/password-to-passkey/v1\x00" + userID))
+}
+
 func validateOrigin(rpID, rawOrigin string) error {
 	if strings.TrimSpace(rpID) == "" || strings.TrimSpace(rawOrigin) == "" {
 		return errors.New("authwebauthn: relying-party ID and origin are required")

authwebauthn/service_test.go

@@ -4,6 +4,7 @@ package authwebauthn_test
 
 import (
 	"bytes"
+	"crypto/sha256"
 	"encoding/json"
 	"errors"
 	"io"
@@ -140,6 +141,51 @@ func TestRecoveryRevokesSessionsAndIssuesSingleUseEnrollment(t *testing.T) {
 	}
 }
 
+func TestPasswordMigrationCeremonyIsBoundAndUnavailableAfterRetirement(t *testing.T) {
+	now := time.Date(2026, 8, 27, 12, 0, 0, 0, time.UTC)
+	store, err := authsqlite.Open(t.TempDir() + "/auth.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+	authService, err := auth.New(store, auth.Options{Random: &counterReader{}, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, err := authService.CreateUser(t.Context(), auth.CreateUser{Username: "legacy.user", Email: "legacy@example.test", DisplayName: "Legacy User", Password: "legacy migration password"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	service, err := authwebauthn.New(store, authService, authwebauthn.Config{RPID: "observatory.test", RPDisplayName: "Observatory", Origin: "https://observatory.test", RequiredCredentialCount: 1, Random: &counterReader{}, Now: func() time.Time { return now }})
+	if err != nil {
+		t.Fatal(err)
+	}
+	begin, err := service.BeginPasswordMigration(t.Context(), user.ID, "Primary passkey")
+	if err != nil {
+		t.Fatal(err)
+	}
+	digest := sha256.Sum256([]byte(begin.CeremonyToken))
+	ceremony, err := store.TakeCeremony(t.Context(), digest, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ceremony.Kind != authwebauthn.CeremonyRegistration || ceremony.BindingDigest == ([32]byte{}) || ceremony.UserID != user.ID {
+		t.Fatalf("unexpected migration ceremony: %+v", ceremony)
+	}
+	credential := wa.Credential{ID: bytes.Repeat([]byte{9}, 32), PublicKey: []byte{1, 2, 3}}
+	encoded, err := json.Marshal(credential)
+	if err != nil {
+		t.Fatal(err)
+	}
+	audit := auth.AuditEvent{ID: "migration-direct", ActorUserID: user.ID, Action: "auth.passkey.migrate", ResourceType: "passkey", ResourceID: "credential", Summary: "migration", CreatedAt: now}
+	if err = store.SaveCredentialAndRetirePassword(t.Context(), authwebauthn.Credential{ID: credential.ID, UserID: user.ID, Label: "Primary", Data: encoded, CreatedAt: now}, audit); err != nil {
+		t.Fatal(err)
+	}
+	if _, err = service.BeginPasswordMigration(t.Context(), user.ID, "Replay"); !errors.Is(err, authwebauthn.ErrPasswordNotAvailable) {
+		t.Fatalf("retired password migration err=%v", err)
+	}
+}
+
 func TestConfigurationAndEntropyFailures(t *testing.T) {
 	store, err := authsqlite.Open(t.TempDir() + "/auth.db")
 	if err != nil {

authwebauthn/types.go

@@ -25,6 +25,7 @@ var (
 	ErrOperationBinding      = errors.New("authwebauthn: operation binding does not match")
 	ErrPasskeyReadiness      = errors.New("authwebauthn: at least two passkeys are required")
 	ErrUnsupportedCredential = errors.New("authwebauthn: credential algorithm is unsupported")
+	ErrPasswordNotAvailable  = errors.New("authwebauthn: password migration is not available")
 )
 
 const (
@@ -100,7 +101,9 @@ type Repository interface {
 	UserByIdentifier(context.Context, string) (auth.User, error)
 	UserByCredentialID(context.Context, []byte) (auth.User, error)
 	CredentialsByUserID(context.Context, string) ([]Credential, error)
+	PasswordCredentialExists(context.Context, string) (bool, error)
 	SaveCredential(context.Context, Credential, auth.AuditEvent) error
+	SaveCredentialAndRetirePassword(context.Context, Credential, auth.AuditEvent) error
 	UpdateCredential(context.Context, Credential) error
 	DeleteCredential(context.Context, string, []byte, int, auth.AuditEvent) error
 	CredentialCount(context.Context, string) (int, error)

doc.go

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MPL-2.0
+
+// Package web is the documentation root for Gamertan Web Foundations.
+//
+// Web Foundations is a collection of small, composable Go packages for the
+// security-sensitive edges of a web application: request identity, structured
+// request evidence, browser security, authentication, passkeys, permissions,
+// organizations, SQLite persistence, abuse controls, and private analytics.
+//
+// It is a toolkit rather than an application framework. Applications keep
+// their router, handlers, HTML, authorization decisions, deployment, and
+// operational policy. Packages use net/http and can be adopted independently.
+// No Redis, message broker, hosted identity provider, telemetry service, or
+// JavaScript framework is required.
+//
+// # Choose a first boundary
+//
+// Start with the smallest package that owns the boundary you need:
+//
+//   - [requestmeta] resolves request IDs, client addresses, and trusted-proxy
+//     metadata once for downstream security and logging.
+//   - [requestlog] records bounded, versioned request observations with
+//     sensitive fields disabled by default.
+//   - [websec] supplies HTTP headers, same-origin checks, CSRF protection,
+//     redirects, body limits, and rate limits.
+//   - [auth], [authhttp], [authwebauthn], and [authsqlite] provide
+//     storage-neutral identity, secure browser sessions, passkeys, and an
+//     optional no-CGO SQLite adapter.
+//   - [organizations] and [access] model organizations, teams, invitations,
+//     scoped roles, and audited temporary access.
+//   - [abuse] applies application-classified request-abuse decisions.
+//   - [analytics] creates bounded, disposable projections from requestlog
+//     records without becoming a telemetry service.
+//
+// # Compose with net/http
+//
+// Middleware is wrapped from the application outward. A request metadata
+// resolver should be outermost so packages inside it agree about request
+// identity. The package example shows a complete, executable composition.
+// A copyable server with graceful shutdown and optional private JSONL logging
+// is available in the repository's starters/basic directory.
+//
+// # Security model
+//
+// Untrusted values are bounded before storage or aggregation. Forwarding
+// headers affect identity only through explicitly trusted proxies. Sensitive
+// request fields require field-by-field opt-in. Security-relevant
+// configuration and persistence failures fail closed rather than silently
+// weakening policy.
+//
+// This root package intentionally exports no runtime API. Applications import
+// only the subpackages they use.
+//
+// [abuse]: https://pkg.go.dev/gamertan.com/web/abuse
+// [access]: https://pkg.go.dev/gamertan.com/web/access
+// [analytics]: https://pkg.go.dev/gamertan.com/web/analytics
+// [auth]: https://pkg.go.dev/gamertan.com/web/auth
+// [authhttp]: https://pkg.go.dev/gamertan.com/web/authhttp
+// [authsqlite]: https://pkg.go.dev/gamertan.com/web/authsqlite
+// [authwebauthn]: https://pkg.go.dev/gamertan.com/web/authwebauthn
+// [organizations]: https://pkg.go.dev/gamertan.com/web/organizations
+// [requestlog]: https://pkg.go.dev/gamertan.com/web/requestlog
+// [requestmeta]: https://pkg.go.dev/gamertan.com/web/requestmeta
+// [websec]: https://pkg.go.dev/gamertan.com/web/websec
+package web

docs/GETTING_STARTED.md

@@ -25,7 +25,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.6
+go get gamertan.com/web/requestmeta@v0.1.0-preview.9
 go mod verify
 ```
 

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.6
+go get gamertan.com/web/requestmeta@v0.1.0-preview.9
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless

docs/ORGANIZATIONS.md

@@ -8,10 +8,19 @@ environments; environments own application services. Teams are optional groups
 of active organization members.
 
 `organizations.Service` creates those resources and issues digest-backed,
-expiring, single-use invitations. Acceptance verifies that the authenticated
+expiring, single-use invitations. An invitation may carry one direct role and
-user's normalized email matches the invitation before activating membership.
+up to sixteen reviewed team memberships. Acceptance verifies that the
-Applications own invitation pages, email or out-of-band delivery, organization
+authenticated user's normalized email matches and applies the membership,
-deletion policy, and account recovery.
+role, teams, consumption marker, and audit event in one transaction.
+Applications own invitation pages, email or out-of-band delivery, active-source
+checks before archival, and account recovery.
+
+Organizations and teams use optimistic revisions and reversible
+`active`/`archived` states. Archived objects keep their history but contribute
+no effective authority. Memberships may be suspended, reactivated, or removed;
+team membership can be removed independently. Configure `OwnerRole` when
+constructing the service before exposing membership-removal operations. The
+SQLite adapter then refuses to suspend or remove the final active direct owner.
 
 `access.Service` evaluates a permission against a complete resource scope:
 
@@ -34,8 +43,8 @@ grant organization-data access. If an operator must inspect tenant data during
 an incident, use a reasoned break-glass grant. It expires within one hour and
 creates an append-only audit event in the same transaction.
 
-The SQLite adapter namespaces all tables, enforces organization membership and
+The SQLite adapter namespaces all tables, enforces active organization and team
-resource ancestry before accepting a binding, and keeps invitations and
+membership plus resource ancestry before accepting or evaluating a binding,
-sessions as digests. Applications remain responsible for database backup,
+and keeps invitations and sessions as digests. Applications remain responsible
-filesystem ownership, retention, and presenting audit history to organization
+for database backup, filesystem ownership, retention, and presenting audit
-owners.
+history to organization owners.

docs/PASSKEYS.md

@@ -37,6 +37,14 @@ timestamp, UUID, or counter for the random challenge.
 5. Sensitive operations call `BeginApproval` with a canonical application
    payload and `FinishApproval` with those exact same bytes. Any drift fails.
 
+For an existing password-backed account, call `BeginPasswordMigration` only
+from an authenticated account session and finish with
+`FinishPasswordMigration`. The registration ceremony is bound to that user.
+Successful completion stores the passkey, removes the password credential,
+clears the password-change flag, revokes every session and pending ceremony,
+and appends the audit event atomically. The application must clear the current
+session cookie and return the user to passkey login after success.
+
 `authhttp.WritePasskeyBegin` and `authhttp.ReadPasskeyFinish` provide bounded
 JSON framing only. They do not register routes, authorize requests, serve
 JavaScript, or set sessions automatically.

example_test.go

@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: MPL-2.0
+
+package web_test
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+
+	"gamertan.com/web/requestlog"
+	"gamertan.com/web/requestmeta"
+	"gamertan.com/web/websec"
+)
+
+func Example() {
+	resolver, err := requestmeta.New(requestmeta.Config{})
+	if err != nil {
+		panic(err)
+	}
+
+	router := http.NewServeMux()
+	router.HandleFunc("GET /", func(response http.ResponseWriter, _ *http.Request) {
+		response.WriteHeader(http.StatusNoContent)
+	})
+
+	var handler http.Handler = router
+	handler = requestlog.Middleware(nil, requestlog.Policy{
+		Route: func(*http.Request) string { return "home" },
+	})(handler)
+	handler = websec.Headers(func(*http.Request) websec.HeaderPolicy {
+		return websec.HeaderPolicy{
+			ContentSecurityPolicy: "default-src 'none'; frame-ancestors 'none'",
+			ReferrerPolicy:        "no-referrer",
+			FrameOptions:          "DENY",
+		}
+	})(handler)
+	handler = resolver.Middleware(handler)
+
+	request := httptest.NewRequest(http.MethodGet, "https://example.test/", nil)
+	request.RemoteAddr = "192.0.2.10:43120"
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, request)
+
+	fmt.Println(response.Code)
+	fmt.Println(response.Header().Get("X-Request-ID") != "")
+	fmt.Println(response.Header().Get("X-Content-Type-Options"))
+	// Output:
+	// 204
+	// true
+	// nosniff
+}

organizations/organizations.go

@@ -21,6 +21,11 @@ import (
 var (
 	ErrInvitationNotFound   = errors.New("organizations: invitation not found")
 	ErrMembershipNotFound   = errors.New("organizations: membership not found")
+	ErrOrganizationNotFound = errors.New("organizations: organization not found")
+	ErrTeamNotFound         = errors.New("organizations: team not found")
+	ErrRevisionConflict     = errors.New("organizations: revision conflict")
+	ErrPersonalOrganization = errors.New("organizations: personal organization lifecycle is fixed")
+	ErrLastOwner            = errors.New("organizations: the last active direct owner must be preserved")
 	slugPattern             = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{1,62}$`)
 	idPattern               = regexp.MustCompile(`^[A-Za-z0-9_-]{8,128}$`)
 )
@@ -29,8 +34,10 @@ type Organization struct {
 	ID                   string
 	Slug                 string
 	Name                 string
+	Status               string
 	Personal             bool
-	CreatedAt time.Time
+	Revision             int64
+	CreatedAt, UpdatedAt time.Time
 }
 
 type Membership struct {
@@ -41,8 +48,9 @@ type Membership struct {
 }
 
 type Team struct {
-	ID, OrganizationID, Slug, Name string
+	ID, OrganizationID, Slug, Name, Status string
-	CreatedAt                      time.Time
+	Revision                               int64
+	CreatedAt, UpdatedAt                   time.Time
 }
 
 type TeamMembership struct {
@@ -66,22 +74,39 @@ type ApplicationService struct {
 }
 
 type Invitation struct {
+	ID                                      string
 	Digest                                  [32]byte
 	OrganizationID                          string
 	Email, InvitedByUserID                  string
-	CreatedAt, ExpiresAt, UsedAt time.Time
+	DirectRole                              string
+	TeamIDs                                 []string
+	CreatedAt, ExpiresAt, UsedAt, RevokedAt time.Time
+}
+
+type AuditEvent struct {
+	ID, OrganizationID, ActorUserID, Action, ResourceType, ResourceID, RequestID, Summary string
+	CreatedAt                                                                             time.Time
 }
 
 type Repository interface {
-	CreateOrganization(context.Context, Organization, Membership) error
+	CreateOrganization(context.Context, Organization, Membership, AuditEvent) error
-	CreateTeam(context.Context, Team) error
+	OrganizationByID(context.Context, string) (Organization, error)
-	AddTeamMember(context.Context, TeamMembership) error
+	UpdateOrganization(context.Context, Organization, int64, AuditEvent) error
+	CreateTeam(context.Context, Team, AuditEvent) error
+	TeamByID(context.Context, string, string) (Team, error)
+	UpdateTeam(context.Context, Team, int64, AuditEvent) error
+	AddTeamMember(context.Context, TeamMembership, AuditEvent) error
+	RemoveTeamMember(context.Context, string, string, AuditEvent) error
+	SetMembershipStatus(context.Context, string, string, string, string, AuditEvent) error
+	RemoveMembership(context.Context, string, string, string, AuditEvent) error
 	CreateProject(context.Context, Project) error
 	CreateEnvironment(context.Context, Environment) error
 	CreateApplicationService(context.Context, ApplicationService) error
-	CreateInvitation(context.Context, Invitation) error
+	CreateInvitation(context.Context, Invitation, AuditEvent) error
 	InvitationByDigest(context.Context, [32]byte, time.Time) (Invitation, error)
-	AcceptInvitation(context.Context, [32]byte, string, time.Time) error
+	Invitations(context.Context, string, int) ([]Invitation, error)
+	RevokeInvitation(context.Context, string, string, time.Time, AuditEvent) error
+	AcceptInvitation(context.Context, [32]byte, string, time.Time, AuditEvent) error
 	MembershipsForUser(context.Context, string) ([]Membership, error)
 	TeamsForUser(context.Context, string, string) ([]Team, error)
 }
@@ -89,12 +114,14 @@ type Repository interface {
 type Options struct {
 	Random    io.Reader
 	Now       func() time.Time
+	OwnerRole string
 }
 
 type Service struct {
 	repository Repository
 	random     io.Reader
 	now        func() time.Time
+	ownerRole  string
 }
 
 func New(repository Repository, options Options) (*Service, error) {
@@ -107,7 +134,10 @@ func New(repository Repository, options Options) (*Service, error) {
 	if options.Now == nil {
 		options.Now = time.Now
 	}
-	return &Service{repository: repository, random: options.Random, now: options.Now}, nil
+	if options.OwnerRole != "" && !safeNamePattern.MatchString(options.OwnerRole) {
+		return nil, errors.New("organizations: owner role is invalid")
+	}
+	return &Service{repository: repository, random: options.Random, now: options.Now, ownerRole: options.OwnerRole}, nil
 }
 
 type CreateOrganization struct {
@@ -126,9 +156,13 @@ func (service *Service) CreateOrganization(ctx context.Context, input CreateOrga
 		return Organization{}, err
 	}
 	now := service.now().UTC()
-	organization := Organization{ID: id, Slug: input.Slug, Name: input.Name, Personal: input.Personal, CreatedAt: now}
+	organization := Organization{ID: id, Slug: input.Slug, Name: input.Name, Status: "active", Personal: input.Personal, Revision: 1, CreatedAt: now, UpdatedAt: now}
 	owner := Membership{OrganizationID: id, UserID: input.OwnerUserID, Status: "active", JoinedAt: now}
-	if err = service.repository.CreateOrganization(ctx, organization, owner); err != nil {
+	audit, err := service.audit(input.OwnerUserID, id, "organization.create", "organization", id, "Organization created")
+	if err != nil {
+		return Organization{}, err
+	}
+	if err = service.repository.CreateOrganization(ctx, organization, owner, audit); err != nil {
 		return Organization{}, err
 	}
 	return organization, nil
@@ -143,30 +177,43 @@ func (service *Service) CreatePersonalOrganization(ctx context.Context, userID,
 	return service.CreateOrganization(ctx, CreateOrganization{Slug: "personal-" + strings.ToLower(suffix), Name: strings.TrimSpace(displayName) + " — Personal", OwnerUserID: userID, Personal: true})
 }
 
-type CreateTeam struct{ OrganizationID, Slug, Name string }
+type CreateTeam struct{ OrganizationID, Slug, Name, ActorUserID string }
 
 func (service *Service) CreateTeam(ctx context.Context, input CreateTeam) (Team, error) {
 	input.Slug = strings.ToLower(strings.TrimSpace(input.Slug))
 	input.Name = strings.TrimSpace(input.Name)
-	if !idPattern.MatchString(input.OrganizationID) || !slugPattern.MatchString(input.Slug) || !bounded(input.Name, 128) {
+	if !idPattern.MatchString(input.OrganizationID) || !idPattern.MatchString(input.ActorUserID) || !slugPattern.MatchString(input.Slug) || !bounded(input.Name, 128) {
 		return Team{}, errors.New("organizations: invalid team")
 	}
 	id, err := token(service.random, 18)
 	if err != nil {
 		return Team{}, err
 	}
-	team := Team{ID: id, OrganizationID: input.OrganizationID, Slug: input.Slug, Name: input.Name, CreatedAt: service.now().UTC()}
+	now := service.now().UTC()
-	if err = service.repository.CreateTeam(ctx, team); err != nil {
+	team := Team{ID: id, OrganizationID: input.OrganizationID, Slug: input.Slug, Name: input.Name, Status: "active", Revision: 1, CreatedAt: now, UpdatedAt: now}
+	audit, err := service.audit(input.ActorUserID, input.OrganizationID, "team.create", "team", id, "Team created")
+	if err != nil {
+		return Team{}, err
+	}
+	if err = service.repository.CreateTeam(ctx, team, audit); err != nil {
 		return Team{}, err
 	}
 	return team, nil
 }
 
-func (service *Service) AddTeamMember(ctx context.Context, teamID, userID string) error {
+func (service *Service) AddTeamMember(ctx context.Context, teamID, userID, actorUserID string) error {
-	if !idPattern.MatchString(teamID) || !idPattern.MatchString(userID) {
+	if !idPattern.MatchString(teamID) || !idPattern.MatchString(userID) || !idPattern.MatchString(actorUserID) {
 		return errors.New("organizations: invalid team membership")
 	}
-	return service.repository.AddTeamMember(ctx, TeamMembership{TeamID: teamID, UserID: userID, JoinedAt: service.now().UTC()})
+	team, err := service.repository.TeamByID(ctx, "", teamID)
+	if err != nil {
+		return err
+	}
+	audit, err := service.audit(actorUserID, team.OrganizationID, "team.member.add", "team", teamID, "Team member added")
+	if err != nil {
+		return err
+	}
+	return service.repository.AddTeamMember(ctx, TeamMembership{TeamID: teamID, UserID: userID, JoinedAt: service.now().UTC()}, audit)
 }
 
 type CreateProject struct{ OrganizationID, Slug, Name string }
@@ -224,17 +271,37 @@ func (service *Service) CreateApplicationService(ctx context.Context, input Crea
 }
 
 func (service *Service) Invite(ctx context.Context, organizationID, email, invitedBy string, lifetime time.Duration) (string, Invitation, error) {
+	return service.InviteWithAccess(ctx, InviteWithAccess{OrganizationID: organizationID, Email: email, InvitedByUserID: invitedBy, Lifetime: lifetime})
+}
+
+type InviteWithAccess struct {
+	OrganizationID, Email, InvitedByUserID, DirectRole string
+	TeamIDs                                            []string
+	Lifetime                                           time.Duration
+}
+
+func (service *Service) InviteWithAccess(ctx context.Context, input InviteWithAccess) (string, Invitation, error) {
+	organizationID, email, invitedBy, lifetime := input.OrganizationID, input.Email, input.InvitedByUserID, input.Lifetime
 	email = strings.ToLower(strings.TrimSpace(email))
-	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(invitedBy) || !bounded(email, 320) || !strings.Contains(email, "@") || lifetime < 5*time.Minute || lifetime > 30*24*time.Hour {
+	input.DirectRole = strings.TrimSpace(input.DirectRole)
+	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(invitedBy) || !bounded(email, 320) || !strings.Contains(email, "@") || lifetime < 5*time.Minute || lifetime > 30*24*time.Hour || input.DirectRole != "" && !safeNamePattern.MatchString(input.DirectRole) || !validIDs(input.TeamIDs, 16) {
 		return "", Invitation{}, errors.New("organizations: invalid invitation")
 	}
+	id, err := token(service.random, 18)
+	if err != nil {
+		return "", Invitation{}, err
+	}
 	raw, err := token(service.random, 32)
 	if err != nil {
 		return "", Invitation{}, err
 	}
 	now := service.now().UTC()
-	invitation := Invitation{Digest: sha256.Sum256([]byte(raw)), OrganizationID: organizationID, Email: email, InvitedByUserID: invitedBy, CreatedAt: now, ExpiresAt: now.Add(lifetime)}
+	invitation := Invitation{ID: id, Digest: sha256.Sum256([]byte(raw)), OrganizationID: organizationID, Email: email, InvitedByUserID: invitedBy, DirectRole: input.DirectRole, TeamIDs: append([]string(nil), input.TeamIDs...), CreatedAt: now, ExpiresAt: now.Add(lifetime)}
-	if err = service.repository.CreateInvitation(ctx, invitation); err != nil {
+	audit, err := service.audit(invitedBy, organizationID, "invitation.create", "invitation", id, "Organization invitation created")
+	if err != nil {
+		return "", Invitation{}, err
+	}
+	if err = service.repository.CreateInvitation(ctx, invitation, audit); err != nil {
 		return "", Invitation{}, err
 	}
 	return raw, invitation, nil
@@ -246,10 +313,15 @@ func (service *Service) AcceptInvitation(ctx context.Context, rawToken, userID s
 	}
 	digest := sha256.Sum256([]byte(rawToken))
 	now := service.now().UTC()
-	if _, err := service.repository.InvitationByDigest(ctx, digest, now); err != nil {
+	invitation, err := service.repository.InvitationByDigest(ctx, digest, now)
+	if err != nil {
 		return err
 	}
-	return service.repository.AcceptInvitation(ctx, digest, userID, now)
+	audit, err := service.audit(userID, invitation.OrganizationID, "invitation.accept", "invitation", invitation.ID, "Organization invitation accepted")
+	if err != nil {
+		return err
+	}
+	return service.repository.AcceptInvitation(ctx, digest, userID, now, audit)
 }
 
 func (service *Service) Memberships(ctx context.Context, userID string) ([]Membership, error) {
@@ -266,8 +338,171 @@ func (service *Service) Teams(ctx context.Context, organizationID, userID string
 	return service.repository.TeamsForUser(ctx, organizationID, userID)
 }
 
+type UpdateOrganization struct {
+	ID, Slug, Name, ActorUserID, RequestID string
+	ExpectedRevision                       int64
+}
+
+func (service *Service) UpdateOrganization(ctx context.Context, input UpdateOrganization) (Organization, error) {
+	input.Slug, input.Name = strings.ToLower(strings.TrimSpace(input.Slug)), strings.TrimSpace(input.Name)
+	if !idPattern.MatchString(input.ID) || !idPattern.MatchString(input.ActorUserID) || !slugPattern.MatchString(input.Slug) || !bounded(input.Name, 128) || input.ExpectedRevision < 1 || !boundedOptional(input.RequestID, 128) {
+		return Organization{}, errors.New("organizations: invalid organization update")
+	}
+	value, err := service.repository.OrganizationByID(ctx, input.ID)
+	if err != nil {
+		return Organization{}, err
+	}
+	value.Slug, value.Name, value.Revision, value.UpdatedAt = input.Slug, input.Name, input.ExpectedRevision+1, service.now().UTC()
+	audit, err := service.auditWithRequest(input.ActorUserID, value.ID, "organization.update", "organization", value.ID, input.RequestID, "Organization details updated")
+	if err != nil {
+		return Organization{}, err
+	}
+	if err = service.repository.UpdateOrganization(ctx, value, input.ExpectedRevision, audit); err != nil {
+		return Organization{}, err
+	}
+	return value, nil
+}
+
+type SetOrganizationStatus struct {
+	ID, Status, ActorUserID, RequestID string
+	ExpectedRevision                   int64
+}
+
+func (service *Service) SetOrganizationStatus(ctx context.Context, input SetOrganizationStatus) (Organization, error) {
+	if !idPattern.MatchString(input.ID) || !idPattern.MatchString(input.ActorUserID) || (input.Status != "active" && input.Status != "archived") || input.ExpectedRevision < 1 || !boundedOptional(input.RequestID, 128) {
+		return Organization{}, errors.New("organizations: invalid organization status")
+	}
+	value, err := service.repository.OrganizationByID(ctx, input.ID)
+	if err != nil {
+		return Organization{}, err
+	}
+	if value.Personal {
+		return Organization{}, ErrPersonalOrganization
+	}
+	value.Status, value.Revision, value.UpdatedAt = input.Status, input.ExpectedRevision+1, service.now().UTC()
+	action := "organization.archive"
+	summary := "Organization archived"
+	if input.Status == "active" {
+		action, summary = "organization.reactivate", "Organization reactivated"
+	}
+	audit, err := service.auditWithRequest(input.ActorUserID, value.ID, action, "organization", value.ID, input.RequestID, summary)
+	if err != nil {
+		return Organization{}, err
+	}
+	if err = service.repository.UpdateOrganization(ctx, value, input.ExpectedRevision, audit); err != nil {
+		return Organization{}, err
+	}
+	return value, nil
+}
+
+type UpdateTeam struct {
+	OrganizationID, ID, Slug, Name, Status, ActorUserID, RequestID string
+	ExpectedRevision                                               int64
+}
+
+func (service *Service) UpdateTeam(ctx context.Context, input UpdateTeam) (Team, error) {
+	input.Slug, input.Name = strings.ToLower(strings.TrimSpace(input.Slug)), strings.TrimSpace(input.Name)
+	if !idPattern.MatchString(input.OrganizationID) || !idPattern.MatchString(input.ID) || !idPattern.MatchString(input.ActorUserID) || !slugPattern.MatchString(input.Slug) || !bounded(input.Name, 128) || (input.Status != "active" && input.Status != "archived") || input.ExpectedRevision < 1 || !boundedOptional(input.RequestID, 128) {
+		return Team{}, errors.New("organizations: invalid team update")
+	}
+	value, err := service.repository.TeamByID(ctx, input.OrganizationID, input.ID)
+	if err != nil {
+		return Team{}, err
+	}
+	priorStatus := value.Status
+	value.Slug, value.Name, value.Status, value.Revision, value.UpdatedAt = input.Slug, input.Name, input.Status, input.ExpectedRevision+1, service.now().UTC()
+	action, summary := "team.update", "Team details updated"
+	if input.Status != priorStatus {
+		action, summary = "team.archive", "Team archived"
+		if input.Status == "active" {
+			action, summary = "team.reactivate", "Team reactivated"
+		}
+	}
+	audit, err := service.auditWithRequest(input.ActorUserID, value.OrganizationID, action, "team", value.ID, input.RequestID, summary)
+	if err != nil {
+		return Team{}, err
+	}
+	if err = service.repository.UpdateTeam(ctx, value, input.ExpectedRevision, audit); err != nil {
+		return Team{}, err
+	}
+	return value, nil
+}
+
+func (service *Service) RemoveTeamMember(ctx context.Context, organizationID, teamID, userID, actorUserID, requestID string) error {
+	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(teamID) || !idPattern.MatchString(userID) || !idPattern.MatchString(actorUserID) || !boundedOptional(requestID, 128) {
+		return errors.New("organizations: invalid team membership removal")
+	}
+	audit, err := service.auditWithRequest(actorUserID, organizationID, "team.member.remove", "team", teamID, requestID, "Team member removed")
+	if err != nil {
+		return err
+	}
+	return service.repository.RemoveTeamMember(ctx, teamID, userID, audit)
+}
+
+func (service *Service) SetMembershipStatus(ctx context.Context, organizationID, userID, status, actorUserID, requestID string) error {
+	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(userID) || !idPattern.MatchString(actorUserID) || (status != "active" && status != "suspended") || !boundedOptional(requestID, 128) {
+		return errors.New("organizations: invalid membership status")
+	}
+	if status != "active" && service.ownerRole == "" {
+		return errors.New("organizations: owner role is required for membership lifecycle changes")
+	}
+	audit, err := service.auditWithRequest(actorUserID, organizationID, "membership."+status, "membership", userID, requestID, "Organization membership set to "+status)
+	if err != nil {
+		return err
+	}
+	return service.repository.SetMembershipStatus(ctx, organizationID, userID, status, service.ownerRole, audit)
+}
+
+func (service *Service) RemoveMembership(ctx context.Context, organizationID, userID, actorUserID, requestID string) error {
+	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(userID) || !idPattern.MatchString(actorUserID) || !boundedOptional(requestID, 128) {
+		return errors.New("organizations: invalid membership removal")
+	}
+	if service.ownerRole == "" {
+		return errors.New("organizations: owner role is required for membership lifecycle changes")
+	}
+	audit, err := service.auditWithRequest(actorUserID, organizationID, "membership.remove", "membership", userID, requestID, "Organization membership removed")
+	if err != nil {
+		return err
+	}
+	return service.repository.RemoveMembership(ctx, organizationID, userID, service.ownerRole, audit)
+}
+
+func (service *Service) Invitations(ctx context.Context, organizationID string, limit int) ([]Invitation, error) {
+	if !idPattern.MatchString(organizationID) || limit < 1 || limit > 1000 {
+		return nil, errors.New("organizations: invalid invitation query")
+	}
+	return service.repository.Invitations(ctx, organizationID, limit)
+}
+
+func (service *Service) RevokeInvitation(ctx context.Context, organizationID, invitationID, actorUserID, requestID string) error {
+	if !idPattern.MatchString(organizationID) || !idPattern.MatchString(invitationID) || !idPattern.MatchString(actorUserID) || !boundedOptional(requestID, 128) {
+		return errors.New("organizations: invalid invitation revocation")
+	}
+	now := service.now().UTC()
+	audit, err := service.auditWithRequest(actorUserID, organizationID, "invitation.revoke", "invitation", invitationID, requestID, "Organization invitation revoked")
+	if err != nil {
+		return err
+	}
+	return service.repository.RevokeInvitation(ctx, organizationID, invitationID, now, audit)
+}
+
 func (service *Service) Repository() Repository { return service.repository }
 
+func (service *Service) audit(actor, organizationID, action, resourceType, resourceID, summary string) (AuditEvent, error) {
+	return service.auditWithRequest(actor, organizationID, action, resourceType, resourceID, "", summary)
+}
+
+func (service *Service) auditWithRequest(actor, organizationID, action, resourceType, resourceID, requestID, summary string) (AuditEvent, error) {
+	if !idPattern.MatchString(actor) || !idPattern.MatchString(organizationID) || !bounded(action, 128) || !bounded(resourceType, 128) || !bounded(resourceID, 128) || !boundedOptional(requestID, 128) || !bounded(summary, 512) {
+		return AuditEvent{}, errors.New("organizations: invalid audit event")
+	}
+	id, err := token(service.random, 18)
+	if err != nil {
+		return AuditEvent{}, err
+	}
+	return AuditEvent{ID: id, OrganizationID: organizationID, ActorUserID: actor, Action: action, ResourceType: resourceType, ResourceID: resourceID, RequestID: requestID, Summary: summary, CreatedAt: service.now().UTC()}, nil
+}
+
 func token(random io.Reader, size int) (string, error) {
 	value := make([]byte, size)
 	if _, err := io.ReadFull(random, value); err != nil {
@@ -279,3 +514,26 @@ func token(random io.Reader, size int) (string, error) {
 func bounded(value string, limit int) bool {
 	return value != "" && len(value) <= limit && !strings.ContainsAny(value, "\x00\r\n")
 }
+
+func boundedOptional(value string, limit int) bool {
+	return len(value) <= limit && !strings.ContainsAny(value, "\x00\r\n")
+}
+
+func validIDs(values []string, limit int) bool {
+	if len(values) > limit {
+		return false
+	}
+	seen := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		if !idPattern.MatchString(value) {
+			return false
+		}
+		if _, exists := seen[value]; exists {
+			return false
+		}
+		seen[value] = struct{}{}
+	}
+	return true
+}
+
+var safeNamePattern = regexp.MustCompile(`^[a-z][a-z0-9._-]{1,127}$`)

organizations/organizations_test.go

@@ -54,18 +54,39 @@ type repositoryStub struct {
 	acceptedUser  string
 }
 
-func (repository *repositoryStub) CreateOrganization(_ context.Context, organization Organization, _ Membership) error {
+func (repository *repositoryStub) CreateOrganization(_ context.Context, organization Organization, _ Membership, _ AuditEvent) error {
 	repository.organization = organization
 	return nil
 }
-func (*repositoryStub) CreateTeam(context.Context, Team) error               { return nil }
+func (repository *repositoryStub) OrganizationByID(context.Context, string) (Organization, error) {
-func (*repositoryStub) AddTeamMember(context.Context, TeamMembership) error  { return nil }
+	return repository.organization, nil
+}
+func (*repositoryStub) UpdateOrganization(context.Context, Organization, int64, AuditEvent) error {
+	return nil
+}
+func (*repositoryStub) CreateTeam(context.Context, Team, AuditEvent) error { return nil }
+func (*repositoryStub) TeamByID(context.Context, string, string) (Team, error) {
+	return Team{}, nil
+}
+func (*repositoryStub) UpdateTeam(context.Context, Team, int64, AuditEvent) error { return nil }
+func (*repositoryStub) AddTeamMember(context.Context, TeamMembership, AuditEvent) error {
+	return nil
+}
+func (*repositoryStub) RemoveTeamMember(context.Context, string, string, AuditEvent) error {
+	return nil
+}
+func (*repositoryStub) SetMembershipStatus(context.Context, string, string, string, string, AuditEvent) error {
+	return nil
+}
+func (*repositoryStub) RemoveMembership(context.Context, string, string, string, AuditEvent) error {
+	return nil
+}
 func (*repositoryStub) CreateProject(context.Context, Project) error         { return nil }
 func (*repositoryStub) CreateEnvironment(context.Context, Environment) error { return nil }
 func (*repositoryStub) CreateApplicationService(context.Context, ApplicationService) error {
 	return nil
 }
-func (repository *repositoryStub) CreateInvitation(_ context.Context, invitation Invitation) error {
+func (repository *repositoryStub) CreateInvitation(_ context.Context, invitation Invitation, _ AuditEvent) error {
 	repository.invitation = invitation
 	return nil
 }
@@ -75,7 +96,13 @@ func (repository *repositoryStub) InvitationByDigest(context.Context, [32]byte,
 	}
 	return repository.invitation, nil
 }
-func (repository *repositoryStub) AcceptInvitation(_ context.Context, _ [32]byte, userID string, _ time.Time) error {
+func (*repositoryStub) Invitations(context.Context, string, int) ([]Invitation, error) {
+	return nil, nil
+}
+func (*repositoryStub) RevokeInvitation(context.Context, string, string, time.Time, AuditEvent) error {
+	return nil
+}
+func (repository *repositoryStub) AcceptInvitation(_ context.Context, _ [32]byte, userID string, _ time.Time, _ AuditEvent) error {
 	repository.acceptedUser = userID
 	return nil
 }

requestlog/requestlog.go

@@ -4,8 +4,10 @@
 package requestlog
 
 import (
+	"bufio"
 	"context"
 	"errors"
+	"net"
 	"net/http"
 	"strings"
 	"time"
@@ -208,3 +210,17 @@ func (capture *responseCapture) Write(body []byte) (int, error) {
 }
 
 func (capture *responseCapture) Unwrap() http.ResponseWriter { return capture.ResponseWriter }
+
+// Hijack preserves connection-upgrade support through the request evidence
+// wrapper. A successful upgrade is recorded as HTTP 101; bytes exchanged after
+// hijacking belong to the upgraded protocol and are intentionally not counted
+// as HTTP response-body bytes.
+func (capture *responseCapture) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	connection, buffer, err := http.NewResponseController(capture.ResponseWriter).Hijack()
+	if err != nil {
+		return nil, nil, err
+	}
+	capture.wroteHeader = true
+	capture.status = http.StatusSwitchingProtocols
+	return connection, buffer, nil
+}

requestlog/requestlog_test.go

@@ -3,8 +3,10 @@
 package requestlog
 
 import (
+	"bufio"
 	"context"
 	"encoding/json"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -24,6 +26,16 @@ type memorySink struct {
 	ctxErr  error
 }
 
+type hijackableRecorder struct {
+	*httptest.ResponseRecorder
+	connection net.Conn
+	buffer     *bufio.ReadWriter
+}
+
+func (recorder *hijackableRecorder) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	return recorder.connection, recorder.buffer, nil
+}
+
 func (sink *memorySink) WriteRecord(ctx context.Context, record Record) error {
 	sink.records = append(sink.records, record)
 	sink.ctxErr = ctx.Err()
@@ -208,3 +220,29 @@ func TestResponseStatusUsesFirstHeader(t *testing.T) {
 		t.Fatalf("status=%d", sink.records[0].Status)
 	}
 }
+
+func TestResponseCapturePreservesConnectionHijacking(t *testing.T) {
+	serverConnection, clientConnection := net.Pipe()
+	defer serverConnection.Close()
+	defer clientConnection.Close()
+	underlying := &hijackableRecorder{
+		ResponseRecorder: httptest.NewRecorder(),
+		connection:       serverConnection,
+		buffer:           bufio.NewReadWriter(bufio.NewReader(serverConnection), bufio.NewWriter(serverConnection)),
+	}
+	capture := &responseCapture{ResponseWriter: underlying, status: http.StatusOK}
+	hijacker, ok := any(capture).(http.Hijacker)
+	if !ok {
+		t.Fatal("request evidence wrapper does not expose http.Hijacker")
+	}
+	connection, buffer, err := hijacker.Hijack()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if connection != serverConnection || buffer != underlying.buffer {
+		t.Fatal("hijacked connection was not passed through")
+	}
+	if capture.status != http.StatusSwitchingProtocols || !capture.wroteHeader || capture.bytes != 0 {
+		t.Fatalf("capture after hijack=%+v", capture)
+	}
+}

scripts/public-snapshot.allow

@@ -6,6 +6,7 @@
 .gitignore
 CHANGELOG.md
 CONTRIBUTING.md
+LICENSE
 LICENSES.md
 LICENSES/0BSD.txt
 LICENSES/AGPL-3.0-only.txt
@@ -53,6 +54,8 @@ docs/PUBLIC_SNAPSHOT.md
 docs/SANDWICH_HIME.md
 docs/SERVICES_ROADMAP.md
 docs/THREAT_MODEL.md
+doc.go
+example_test.go
 go.mod
 go.sum
 requestlog/jsonl.go