Public Integrations + External-System Boundaries surface
Added /integrations as a governance surface, not a marketplace. Ten external systems enumerated with full schema per entry: purpose, trust boundary, data-flow direction, authentication, ownership, failure-domain, observability, rollback, and maturity state. Dual-state integrations (Neon: complete + blocked; OpenTelemetry: scaffolded + not enabled) avoid marking shipped-but-dormant code as complete. The integration code was not modified — only documented.
PlanesFrontendDocumentationNetworkSpendRoutingAuditObservability
Rollbackreversible — single revert
Public Observability + Telemetry Posture surface
Added /observability as the symmetric companion to /status — describes how runtime visibility is approached. 8-capability matrix sourced to file:line, 6-row legend with a new Not enabled state, 9-row honest-gaps section, vendor-neutrality + telemetry-privacy posture stated explicitly. The existing observability code was not modified — only documented.
PlanesFrontendDocumentationObservability
Rollbackreversible — single revert
/security aligned with evidence-cited Trust Center posture
Replaced the prior generic SaaS marketing copy on /security with a plane-aligned summary of every documented control. Counts derive from docs/trust/security-architecture.md; honest-gaps and disclosure surfaces are now publicly visible.
Rollbackreversible — single revert
Public System Status page (/status)
Added a hand-authored, per-plane operational status surface. Five-state legend distinguishes operational, degraded, under observation, blocked by Production-Safety Stop, and planned external monitoring. No external probe yet; that fact is stated plainly.
Rollbackreversible — single revert
Trust Center frontend rollout
Six new public Trust Center routes (/trust, /trust/responsible-ai, /trust/reliability, /legal, /legal/dpa, /architecture) surface the canonical markdown evidence with restrained operational tone and plane-aligned vocabulary.
Rollbackreversible — single revert
Trust Center canonical markdown surface
Established the markdown source-of-truth that every public Trust Center page renders from: security architecture, data handling, governance, reliability, responsible AI, procurement questionnaire, DPA template, onboarding, responsibility boundaries, plane vocabulary.
Rollbackreversible — single revert
Phase 1 governance hardening
Activated non-database Phase 1 hardening: Dependabot, structured PR/issue templates, branch-protection activation runbook, CODEOWNERS team activation runbook. None mutate runtime behavior.
Rollbackreversible — single revert
Production-Safety Stop installed
After .env.production.local was proven to point at a development/test endpoint, the Stop was installed pausing all Phase B runtime advances (routing-schema migrations, SpendGuard rollout, audit-events activation) until live DATABASE_URL is verified via the Vercel/Neon dashboard. Existing production behavior is unaffected.
Rollbackexplicit procedure
Production operations runbooks
Documented incident response, key rotation, restore-from-backup (4 procedures), migration recovery (4 failure scenarios), and on-call. Each runbook describes preconditions, decision criteria, and explicit steps with command-line evidence.
Rollbackreversible — single revert
Procurement-ready disclosure policy
Rewrote SECURITY.md as a procurement-ready disclosure policy with explicit response SLAs and added an RFC 9116 /.well-known/security.txt route served by the production FastAPI surface.
PlanesNetworkDocumentationGovernance
Rollbackreversible — single revert
CODEOWNERS introduced — semantic ownership map
Plane-aligned ownership map encoded in .github/CODEOWNERS. Required-reviewer enforcement is gated on org-admin team activation and is named as an honest gap on /security.
Rollbackreversible — single revert
Public source-map exposure closed
Disabled Webpack source-map output for production and added a post-build gate that fails the build if any .map file is present in the public output. Every subsequent build asserts the gate.
Rollbackreversible — single revert