7 Commits

Include renames

Author	SHA1	Message	Date
Matthew Meszaros	c26300ae5e	feat: backend half of the admin panel upgrade: delete the unrouted provisioning, releases, plan, discount and enterprise-inquiry admin handlers with their service and repository methods, retire the six admin permission bits nothing gated as reserved placeholders so live bit positions and existing masks are unchanged and IsSuperAdmin checks the live set, add forty admin endpoints for mailbox sync governor state with clear-throttle and restart-backfill, in-flight send reservations, cross-workspace dead letters with replay, task failures, webhook delivery health with reclaim, fleet capacity, the control loops decision log, dedicated bindings with release and the routed convert-to-dedicated, operator-driven workspace export and import, per-organization API keys and webhooks, warmup invalid-token abuse and action history, and signups by acquisition channel, and add a scheduled_job_runs table (migration 000135) with a jobrun package that every backend and consumer loop now records through and a run-now request the owning process picks up within fifteen seconds	2026-09-07 21:40:38 -07:00
Matthew Meszaros	84700bae8d	Merge remote-tracking branch 'origin/main' into fix/issue-241 ... # Conflicts: # cmd/consumer/main.go # docs/content/docs/guides/deliverability.mdx # internal/app/auth/login_risk.go # internal/app/auth/provision.go # internal/app/contact/import.go # internal/app/orgrisk/service.go	2026-08-28 23:06:07 -07:00
Matthew Meszaros	4ead1b200f	feat: answer the review on #251 by filing a signup's throwaway-domain finding separately from its soft ones so the aggregate score no longer carries one class, and by measuring import quality across everything a workspace has imported instead of the newest file, so a small clean upload cannot retract a large bad list whose addresses are still stored while the finding still fades as good data outweighs it, with the running counts kept as evidence on the finding and a finding filed before those counts existed folded in as the smallest list that could have flagged it	2026-08-28 22:51:23 -07:00
Matthew Meszaros	2b25e32f6b	feat: judge an organization's abuse posture on what it did rather than on what it looks like, so an agency opening client workspaces from one office under one operator identity and connecting the mailboxes in an afternoon lands on watch instead of restricted: findings now carry a circumstantial/substantive class, shape is capped at 40 points and can never move a band past watch, the signup address and identity clusters count once as one family, the signup finding is substantive only when the domain is really disposable, list_quality retracts on a later clean import, and the nightly sweep gains a recipient-outcome pass scoring 30-day bounce and complaint rates against the provider bands so a band still has evidence it may act on	2026-08-28 22:41:44 -07:00
Matthew Meszaros	61f7b9cd3e	feat: condense the correlate package and Run comments to the local constraint, moving the cross-account rationale out of production code	2026-08-28 12:21:59 -07:00
Matthew Meszaros	e31286d973	feat: retract findings that no longer hold, exclude private IPv6, and fix the containment operator that let loopback through: a cluster ageing out of the lookback or a mailbox burst ending left its weight on the workspace permanently, so the score could only ever climb, and each detector now clears itself from organizations that stopped matching before recording the current ones; the private-address filter covered only IPv4, so an IPv6-only self-hosted install would have clustered as a ring; and it used << rather than <<=, which is strictly-contained and therefore excludes an address from the prefix describing exactly it, so ::1 was never inside ::1/128	2026-08-28 12:12:28 -07:00
Matthew Meszaros	02a1ab524a	feat: sweep for cross-account patterns nightly, since every other control watches one subject	2026-08-28 11:58:49 -07:00