sun_employee_prepare_v28 and sun_employee_finalize_v28 - the RPCs
caterium-create-employee's whole authorization model rests on - were
applied directly to the production database and were never committed,
so the actual authorization logic wasn't auditable from the repo.
Recorded verbatim via pg_get_functiondef() against the live database
on 2026-09-12 (read-only; nothing was re-applied). Confirmed both
match what the security audit inferred from the Edge Function's
error-message handling: caller identity + workspace-owner/platform-admin
check + plan/feature gates + member limits, all enforced here rather
than in the Edge Function itself.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Full production-ready docker-compose stack (db, kong, auth, rest,
realtime, storage, imgproxy, meta, functions, studio) targeting
api.caterium.ru, plus bootstrap script for a fresh Cloud Server,
Caddy reverse-proxy config (HTTPS, WebSocket, upload limits), and
dump/restore/verify/storage-sync scripts for moving off the managed
Supabase project (cksuehzcimitsxmeloes). Does not touch public/ or
any live runtime behavior — frontend cutover is documented separately
in frontend-cutover.md and only applied after Etap 8 verification.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
caterium.ru and app.caterium.ru are separate Timeweb sites with separate
document roots. The apex domain's root is reserved for an unrelated future
site, so auto-detection must never be able to land there. Drop the generic
$HOME/public_html and unverified app.caterium.ru/public_html guesses in
favor of the confirmed real path ($HOME/caterium-app/public_html), and
require CATERIUM_WEB_ROOT explicitly in the documented cron command.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The documented cron command redirected to $HOME/.caterium-deploy/cron.log
before the script could create that directory, so the very first run
failed before executing. Document mkdir -p as a one-time setup step,
add $HOME/public_html to web-root auto-detection (the confirmed real
document root for this account), and note the CATERIUM_REPO_URL override
needed when the account's SSH config uses a non-default Host alias.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Introduce the first data layer, move order auto-completion to server cron with legacy/cloud compatibility, clean error telemetry, update PWA/versioning, and add regression coverage.
