v1.7.3 — API contract + compliance drift bundle

v1.7.3 — API contract + compliance drift bundle

Patch release fixing five prod drift bugs surfaced by the #433
content-style test work. Each one was caught by a test in the new
pydantic schema / round-trip / audit-event coverage shipped across
PRs #556, #564, #565, #568, #569, #570; this release closes the loop.

Fixes

#555 — Update endpoints return detailed shape (PR #571)
Five API controllers (cdef_documents, control_catalogs,
control_mappings, profile_documents, document_base for SSP/SAR/
SAP/POAM) were calling serialize_*(@x) on #update. The compact
serialization omitted description, oscal_version,
controls_count, oscal_metadata, and back_matter_resources,
so callers could not perform read-after-write to confirm a change.
All five now pass detailed: true.

#557 — SSP/SAR status default (PR #571)
SSP and SAR status columns had no DB default — API-created
documents returned status: null while CDEF/POAM returned the
string "pending". New migration backfills NULL rows + sets
default: "pending". Belt-and-suspenders after_initialize on
both models for non-API code paths (Rails console, jobs).

#562 — federation_peers index uses standard pagination envelope (PR #571)
Was rendering its own meta: { count: N }; now uses the shared
paginate() helper so the response matches every other index
({page, pages, count, items}).

#566 — control_catalogs / control_mappings accept id OR slug (PR #571)
Create returns both id and slug, but show/update/destroy
historically only matched on slug — callers that built URLs from
id got 404s. set_catalog / set_mapping now detect a numeric
id and fall back to slug otherwise.

#567 — audit_log silent-swallow + 6 missing actions (PR #571)
Six API mutation actions (api_user_* x3, api_authorization_ boundary_* x3) were missing from AuditEvent::ACTIONS, so
audit_log calls failed validation. The rescue in
Api::V1::BaseController#audit_log silently swallowed every
failure, masking the bug entirely on prod — no audit trail
existed for those mutations. Now:
- 6 actions added to ACTIONS whitelist + categorized in
ACTION_CATEGORIES so the admin UI groups them correctly
- rescue re-raises in dev + test so specs catch missing-action
bugs immediately
- production still rescues + logs to avoid taking down API
requests on transient audit-log outages
AU-12 compliance posture restored.

Test infrastructure changes

• Removes 3 skip "blocked on #567" markers from users_spec.rb
• Removes #555 xfail markers across 6 tests/api/test_*_documents.py
  files (cdef, ssp, sar, sap, poam, profile)
• Tightens tests/api/schemas/base.py DocumentBase.status from
  str | None back to str now that #557 is fixed

Migration

db/migrate/20260526000000_default_status_on_ssp_sar_documents.rb
- UPDATE ssp_documents SET status = 'pending' WHERE status IS NULL
- UPDATE sar_documents SET status = 'pending' WHERE status IS NULL
- change_column_default to "pending" on both
Idempotent: skips if columns already match (no-op on re-deploy).

Container image

risksentinel/sparc:1.7.3

Compatibility

No env-var changes. No new API endpoints. API contract for Update
becomes more complete (returns more fields than before — backwards
compatible). Schema migration is additive + reversible. Drop-in
upgrade from v1.7.2.