ALIMCO (TCS) deployment — 202609-s1-rc3-alimco

Pins the exact commit deployed to the ALIMCO/TCS environment (blralimcoapp01).

Base: 202609-s1-rc3
Updated 2026-09-23: 2 additional commits since the previous pin.

202609-s1-rc2

Release candidate cut from main @ c29c465d.

Changes since 202609-s1-rc1: 17 commits. Full diff: 202609-s1-rc1...202609-s1-rc2

Promotion PR: #717

Release Notes

Auth / session — the headline change

• Browser sessions now sit behind an opaque, httpOnly sid cookie (BFF). Access and refresh tokens live in Redis and are refreshed server-side, so nothing a script can read is a credential. Unsafe methods on this channel require x-csrf-token (SameSite=Lax plus a per-session double-submit token compared with timingSafeEqual); the login flow is bound to the browser that started it via a short-lived oidc_flow cookie, so a forged callback cannot burn a login still in flight. (#690)
• A cross-app sign-in now names the aggregator account correctly. (#688)
• The UI ends the session when the server says it is gone, instead of retrying into a dead session. (#685, #686)

Security

• network/action/perform now requires peer auth. The peer HMAC is computed over raw request bytes, not a re-serialization of the parsed body — that mismatch had silently broken federation twice. Committed placeholder credentials removed. (#687)
• SSRF allowlist, consent-enum rate limit, refetch role gate, and no-store on sensitive responses. (#666)

Discovery / UI

• List view pages the whole network with an explicit sort, a single domain control, and a card metric that matches the ordering. (#665) Pairs with signals-search #152.
• The location-source switch stays put on the map view. (#691)
• Item cards are keyboard-activatable. (#658)

Housekeeping

• Sonar reliability backlog: the equivalent-by-construction half cleared. (#689)
• Mailpit healthcheck fixed. (#705)
• Weekly Dependabot batch, 2026-09-11. (#709)

In Plain Terms

The significant change is how the site remembers you're signed in. It used to hand your browser a key that any script running on the page could read; now it hands over a meaningless ticket stub and keeps the real key on the server, so a malicious script has nothing worth stealing. Alongside that, one instance of the system can no longer take another's word for who it is when performing an action, and the list view got a proper "sort by" control instead of guessing the order for you.

Deploy ordering

Deploy this repo BEFORE bluedots-automation #127, which sets PEER_AUTH_MODE=enforced in production. Flipping that flag before the peer-auth code (#687) ships will reject in-cluster peer traffic.

202609-s1-rc1

Release candidate cut from main @ 96e23748.

Changes since 202608-s2-rc1: 20 commits. Full diff: 202608-s2-rc1...202609-s1-rc1

Promotion PR: #682 — plus #693, which merged after that promotion and is therefore not covered by its notes.

Release Notes

Breaking — admin participant consent is now version-scoped (#692 / #693)

GET /api/v1/admin/participant previously reported any accepted consent version as accepted, with no version predicate. The migrated cohort holds ledger rows at document_version 1 while the live document is version 2, so the portal re-prompted them while this endpoint told the voice channel consent was complete — a consent-compliance gap, not a cosmetic one.

Response shape changed. The user_consent object is replaced by a compliance array, always present and always carrying every key:

"compliance": [
  { "key": "user_terms",   "value": false },
  { "key": "user_privacy", "value": false },
  { "key": "has_age",      "value": true }
]

• Flags now resolve the live version per category using the same three discriminators the write side uses — network, document set (adult vs u18_documents), and per-row brand. An unconfigured category reports false by design.
• POST /api/v1/admin/participant no longer accepts terms_accepted / privacy_accepted. Sending them is stripped, not rejected (still 200, consent_recorded: 0).
• New optional network query param; required only on instances whose SERVED_DOMAINS spans several networks.
• New errors: 400 U18_NOT_ALLOWED (minor + voice/network_service; aggregators exempt), 400 NETWORK_REQUIRED, 400 NETWORK_NOT_SERVED.

Consumer impact: voice-dpg must migrate from user_consent to compliance — a stale reader fails silently (undefined → falsy → re-prompts everyone, and loses has_age). aggregator-dpg and apps/ui need no change (verified: neither reads the removed fields). Migrated accounts will correctly start reporting false and be re-prompted, which will raise consent-flow call volume.

Deliberately deferred: consented_item_ids on /consent/profile-status is left version-blind, so the admin endpoint and the portal can still disagree on item-level consent.

Features

• Default aggregator tagging for uncontrolled inbound (SS-3, #659 / #662) — cold inbound signups with no attributable aggregator are now tagged to the instance's nominated default aggregator. Adds the append-only aggregator_default_audit table. Migrations 0013_default_aggregator_tagging, 0014_default_aggregator_triggers.
• One domain per account + per-domain default aggregators (#671) — every account is locked to a single declared domain, and the default aggregator is resolved per served domain instead of one per instance. Migrations 0015_backfill_user_domains, 0016_drop_single_default_index, 0017_nomination_requires_declared_domains.

Fixes

• Public legal page (#637 / #648) — layout, single /legal route, OTP subtitle, clearable and keyboard-navigable dropdowns.
• Security-scanner follow-ups (#668) — Trivy misconfig (#548), zizmor artipacked, support-reference RNG bias (#550).

Chores

• Dependency batches #654, #655, #657, #672, #673, #676, #678; vulnerable-transitive floors for fast-uri and qs (#675); openapi.json regenerated; Dependabot and scheduled scans moved to a monthly cadence (#679).

Deploy notes

• Migrations 0013→0017 apply in order. 0014 installs triggers and 0015 is a data backfill, so rolling back to a pre-0013 image is not clean — treat a bad release as forward-fix (-rc2).
• api and ui images must move together (apps/ui/src/pages/home-page.tsx changed).
• Post-deploy, per instance: nominate a default aggregator for each served domain (org metadata). It must be a real, approved aggregator — a system-generated org's owner is a disabled Keycloak user and can never log in.
• KA-Dharwad is at 0012, so it needs the same 0013–0017. Those run against the migrated JobStack population; rehearse 0015 and 0017 against a snapshot restore before pinning that cluster.

Deploy notes — consent (#693)

Before rollout, size the re-prompt cohort on each target instance (unverifiable from the repo):

select network, brand, consent_category, document_version, count(*)
from consent_record
where level = 'user'
group by 1, 2, 3, 4
order by 1, 3, 4;

Any cohort whose rows carry a different network string or a migration-era version integer flips to false and gets re-prompted. Both columns are NOT NULL, so there is no NULL hazard.

202608-s2-rc1

Sprint release candidate promoting develop → main (48 commits; smoke-tested on develop).

Promotion PR: #653

Release Notes

• Notifications: item-lifecycle + aggregator-onboarding emails (#531/#534); SMS template engine Phase 1 (#532/#535); per-domain self-signup welcome + aggregator-activation copy (seeker/provider); email CTAs now go to the recipient's own portal (#569).
• Consent: scroll-gated T&C acceptance (#636).
• UI: signals-search added to the local stack behind a search profile (#625); profile share link as a downloadable QR (#567); x-uri clickable links + URL validation (#576); blue_dot lockup logo + configurable EkStep sidebar-footer (#605); per-deployment UI settings now read via getRuntimeEnv/ui.runtimeConfig (languages, map centre/zoom, poll interval, fetch limit); View-profile modal scroll fix (#507).
• Data: Dharwad polytechnic + degree colleges (#606).
• Security / reliability: SonarQube vuln fixes S2819/S2245 (#590) + reliability bugs (#591); esbuild removed from the API prod runtime (#598); Sonar scope + DigiLocker unship (#624).
• CI / platform: hash-pin all Actions (#623) + shared security-scan ref pinned to a main SHA (#580); codeql-action v4 (#562); trivy-action bump (#563); API/UI on Docker Hardened Images (#545); skip SonarCloud without SONAR_TOKEN (#607); grouped dependabot bumps.

202608-s1-rc4

Merge pull request #584 from Blue-Dots-Economy/fix/keycloak-invite-on…