feat(auth): add durable audit and operator lifecycle

.github/workflows/ci.yml

@@ -112,6 +112,20 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: buzz
+          POSTGRES_PASSWORD: buzz_dev
+          POSTGRES_DB: buzz
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U buzz -d buzz"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 30
     needs: [changes]
     if: github.event_name == 'push' || needs.changes.outputs.rust == 'true'
     permissions:
@@ -129,6 +143,8 @@ jobs:
           tool: cargo-nextest@0.9.136
       - name: Unit tests
         run: just test-unit
+        env:
+          BUZZ_TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
 
   desktop-core:
     name: Desktop Core

Justfile

@@ -263,6 +263,30 @@ desktop-e2e-smoke:
 desktop-e2e-integration: _ensure-migrations
     cd {{desktop_dir}} && pnpm test:e2e:integration
 
+# Start the isolated OSS-only authorization/lifecycle playground.
+oss-e2e-setup:
+    ./scripts/oss-e2e.sh setup
+
+# Run all synthetic OSS-only authorization/lifecycle scenarios.
+oss-e2e:
+    ./scripts/oss-e2e.sh run
+
+# Run one scenario ID, for example: `just oss-e2e-scenario O501`.
+oss-e2e-scenario SCENARIO:
+    ./scripts/oss-e2e.sh scenario {{SCENARIO}}
+
+# Delete only the isolated playground's synthetic volumes and restart it.
+oss-e2e-reset:
+    ./scripts/oss-e2e.sh reset
+
+# Stop the isolated playground while retaining its synthetic volumes.
+oss-e2e-stop:
+    ./scripts/oss-e2e.sh stop
+
+# Show isolated playground service health.
+oss-e2e-status:
+    ./scripts/oss-e2e.sh status
+
 # Run only the e2e specs changed vs origin/main (both projects) before pushing
 desktop-e2e-pre-push: _ensure-migrations
     git fetch origin main
@@ -277,20 +301,19 @@ ci: check test-unit desktop-test desktop-build desktop-tauri-check desktop-tauri
 test:
     ./scripts/run-tests.sh all
 
-# Run unit tests only (no infra needed)
+# Run unit tests. The O5 buzz-db gates require a reachable test PostgreSQL.
 test-unit:
     #!/usr/bin/env bash
     set -euo pipefail
     if command -v cargo-nextest &>/dev/null; then
         cargo nextest run -p buzz-core -p buzz-auth --lib
         cargo nextest run -p buzz-voice --lib
         cargo nextest run -p buzz-cli
-        # buzz-db migrator/lint tests: pure SQL-parsing unit tests (no infra).
-        # They guard the embedded-migrator invariant (exactly the consolidated
-        # 0001; cutover/backfill stays an operator script, not startup state)
-        # and the tenant-scoping lints. The Postgres-backed buzz-db tests are
-        # #[ignore]d, so --lib runs only the infra-free set. Without this gate a
-        # stray file in migrations/ or a broken lint ships green.
+        # buzz-db includes pure migration/lint tests and non-vacuous O5
+        # PostgreSQL atomicity/concurrency gates. CI supplies an isolated
+        # service; local callers must provide BUZZ_TEST_DATABASE_URL or the
+        # documented localhost test database. Without this gate, migration
+        # drift or an unreachable database could ship green.
         cargo nextest run -p buzz-db --lib
         # Multi-tenant conformance gate (buzz-conformance): the independent
         # replay checker + golden fixtures. No infra — pure in-process trace

README.md

@@ -244,6 +244,7 @@ A Rust workspace of focused crates. Single source of truth: the relay. See [ARCH
 - **[VISION.md](VISION.md)** · **[VISION_SOVEREIGN.md](VISION_SOVEREIGN.md)** · **[VISION_PROJECTS.md](VISION_PROJECTS.md)** · **[VISION_AGENT.md](VISION_AGENT.md)** — the four vision docs
 - **[ARCHITECTURE.md](ARCHITECTURE.md)** — system design, kind ranges, subsystem boundaries
 - **[TESTING.md](TESTING.md)** — multi-agent E2E test suite
+- **[Federated authorization deployment](docs/FEDERATED_AUTHORIZATION_DEPLOYMENT.md)** — custom providers, protected communities, lifecycle operations, and rollout safety
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** · **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)** · **[SECURITY.md](SECURITY.md)** · **[GOVERNANCE.md](GOVERNANCE.md)**
 
 <details>

crates/buzz-audit/Cargo.toml

@@ -20,3 +20,5 @@ thiserror   = { workspace = true }
 sha2         = { workspace = true }
 hex          = { workspace = true }
 futures-util = { workspace = true }
+hmac         = { workspace = true }
+zeroize      = { workspace = true }