Auth-aware portal foundation

Protected routes require a configured session.

Phase 3 disabled Sign in

RBA client portal

Secure Portal Foundation

Phase 3 adds the portal-side auth, IAM, membership, role, and protected-route boundary while keeping production OAuth, FastAPI sessions, storage, billing, and analytics logic out of scope.

Phase 3 auth boundary

Client workspace

A client-facing shell for intake, uploads, reports, dashboards, action items, billing links, and settings.

Client routes now require a client membership and route-level permission.

Open client portal

Admin workspace

An internal shell for organization, project, intake, upload, run, report, dashboard, finding, action-item, and audit workflows.

Admin routes now require an internal RBA role and admin permission.

Open admin portal

Phase discipline

The shell preserves the boundary between the portal, the public website, and the separate sprint engine.

Auth boundary

Typed sessions, roles, permissions, and route guards are in place.

Mock local mode

Development personas are local-only and fail closed outside development.

No private files

R2 upload, signed access, and audit events are deferred.

No analytics engine

Python, SQLMesh, DuckDB, DuckLake, and job execution remain separate.