Release Portal v0.30.0 — Database-enforced tenant isolation and steadier dispatch · AndrewDryga/emisar

Tenant isolation moves into the database itself, and dispatch recovers more of its own edge cases.

Security

Database-enforced tenant isolation. Every runner-owned child row now carries a composite foreign key to its account, so a cross-tenant write is refused at the row, not only in application code.
CHECK backstops for the security-relevant enums. The database rejects out-of-range values for the enums that gate trust and dispatch, independent of the application layer.
CSP on every surface. The public, unauthenticated pages and the error responses now carry the same Content-Security-Policy as the rest of the site.
Sentry disclosed and scrubbed. Sentry is named as a subprocessor, and its events are scrubbed of personal data before they leave the process.
Signed-pack enforcement is visible over MCP. A runner that requires signed packs now announces that requirement to MCP clients.

Steadier dispatch. A runner at capacity redelivers the dispatches it refused, the stale-dispatch sweep drains the oldest queued first, and stuck pending runs advance instead of stranding.
One row per session. Active sessions each render as their own row with their own address, sign-in time, and revoke control.
Faster run search. A trigram index speeds run search on large accounts, replacing three now-covered indexes.
Sharper fleet alarms. Severe database and load-balancer conditions page directly, and the point-in-time recovery drill now measures actual RTO.