Dürüst açıklamalar — tarihli kayıt

Etki: Same-day follow-up to the controlled-beta-readiness post. Three soft-constraint sprints executed in succession (Sprint 38 closed B 2/6 → 5/6, Sprint 40 closed D 1/5 → 4/5, Sprint 35 absorb closed F 2/6 → 6/6). Master Index probe re-ran and reached 47/50 with 4/4 hard constraints green AND every soft constraint at or above threshold — verdict matrix outputs GO.

Kök neden: Initial scorecard under-counted because B / D / F audit was done from the launch-readiness post by estimate. Three honest re-audits revealed most criteria were already shipped; only B3 (RBAC sidebar plan filter) was a real bug. Sprint 40 + 35 absorb introduced drift gates + load matrix evidence without code change beyond Sprint 38's B3 fix.

Düzeltici aksiyon: Dedicated GA Verdict Update post published at /trust-center/launch-notes/2026-05-21-ga-verdict. Original controlled-beta-readiness post stays unchanged with a forward-pointer banner (KURAL 13 append-only). Runtime cadence items (B4 + B6 + D3 auth-DOM probes + F3/F4 30-min long-window) sit in the controlled-beta operational probe schedule; any slip lands here as a future disclosure.

commit: 1c90491e (Sprint 38) + 442348eb (Sprint 40) + 0bbd40a8 (Sprint 35 absorb)

Etki: Soft-launch decision: 50-criteria probe verified 37/50 with all 4 hard constraints (A marketing, C multi-tenant isolation, E security, G compliance/trust) green. 12 soft criteria (B authenticated product, D backend↔frontend sync, F performance/scale) marked open — require authenticated session probes + k6 load test to verify. Honest controlled-beta opens; public GA stays gated on those 12.

Kök neden: Pre-probe (2026-05-18 baseline) projected 22/50. Actual probe found 29/50 already shipped + G quick-fix lifted to 35/50 + E1 nuclei + E5 rate-limit visibility lifted to 37/50.

Düzeltici aksiyon: Dedicated launch-readiness post published at /trust-center/launch-notes/2026-05-21-controlled-beta-readiness with the full hard-gate evidence chain and the soft-gate close commitments (Sprint 35 + 38 + 40 within 4-6 weeks). Subsequent re-probe lands as a new dated disclosure entry.

commit: 39397461 (E1 audit) + a0d132b6 (E5 stamp) + f1a2fa80 (G quick-fix)

Etki: 7 of 8 workspace pane kinds rendered 'V1.1 sprintinde gerçek içerik bağlanacak' instead of real content. Operator caught it in production review same day. No customer impact because workbench was in operator-only beta.

Kök neden: Initial PaneBody implementation was scaffold-only with a 'wire real content later' note. The note survived past the iteration that was supposed to remove it.

Düzeltici aksiyon: PANE_TARGETS map shipped: each kind deep-links to its canonical surface (chat → /chat, terminal → /terminal, etc.). Embed-mode (?embed=1) hides nested chrome. KURAL 13 mock scanner added to P8 closure gate so a regression re-introducing scaffold language fails CI.

commit: 81ebd760, 175833f9

Etki: Operators authenticated via lydos_sid HttpOnly cookie saw persistent 401 on /api/llm/chat + /api/llm/conversations. The dashboard's auth-context surfaces the in-memory token as 'cookie-session' sentinel, which the chat page was sending as 'Authorization: Bearer cookie-session' — a non-empty invalid Bearer short-circuits require_auth's Sprint 36 cookie fallback (the fallback only fires when credentials is None).

Kök neden: Frontend treated the sentinel string as a real token. The Sprint 36 cookie fallback was added to require_auth on the backend, but the dashboard wasn't taught to recognize the sentinel.

Düzeltici aksiyon: Chat, files, projects, workspace-prefs pages now skip the Authorization header when token === 'cookie-session'. Same-origin cookie alone authenticates. No backend change needed; the fallback was correct as designed.

commit: 5240d12b

Etki: Operator opened /workbench → top banner showed 'HTTP 422'. Backend handler took an untyped 'request' parameter; FastAPI tried to bind it as a Pydantic body, and GET requests don't have bodies → 422 validation error before the handler ran.

Kök neden: lydos_workbench_routes.py predates the require_auth dependency-injection pattern. Untyped `request` was ambiguous to FastAPI route signature inference.

Düzeltici aksiyon: Typed as fastapi.Request + require_auth Depends. _require_user prefers the auth payload, falls back to request.state.user_id for legacy TenantMiddleware integration. Backend 401 now returned correctly on unauth.

commit: bd70cfd3

Etki: Workbench pane iframes failed with 'Framing lydos.ailydian.com violates frame-ancestors none'. Visible to operator immediately after the embed shipped. nginx security-headers.conf:106 emitted `add_header Content-Security-Policy 'frame-ancestors none' always` globally — browser intersects multiple CSP headers, strictest wins, so Next.js' 'self' was overridden by nginx 'none'.

Kök neden: X-Frame-Options + CSP frame-ancestors were applied uniformly across all routes. The workspace pane embedding pattern (same-origin iframe) wasn't accounted for.

Düzeltici aksiyon: nginx snippet now conditional via `if ($uri ~* '^/(chat|terminal|files|code|agents|integrations|lyd|projects)')`: SAMEORIGIN + 'self' for pane targets, DENY + 'none' for everything else. Third-party clickjacking still blocked. X-Lydos-Pane-Branch debug header added so a future regression is one curl away from being spotted. Config synced into deploy/nginx/snippets/.

commit: 37c87463, cfe06cac

Etki: Before the sovereign stack reports landed, marketing referenced '13 sovereign engines' without a public test verdict. Procurement could not verify the claim without checking the repo.

Kök neden: Engineering shipped the engines + tests but no public posture summary.

Düzeltici aksiyon: 11 architecture reports published (docs/*_REPORT.md). 174/174 sovereign-stack tests pass on live PG :5434 federation, re-runnable: `python3 -m pytest tests/test_{dpi,localsec,...,lsia,gci}.py`. Posture surfaced on Trust Center.

commit: 28cee022

Etki: LYDOS positioned passkey-first auth in early-2026 marketing materials but only shipped functional WebAuthn in Sprint 23. Operators relied on magic-link + password during the interim. The gap was real and lengthy.

Kök neden: Passkey infrastructure (WebAuthn registration + assertion ceremony, attestation handling, fallback flow) was de-prioritised behind sovereign-stack work and Q-engine velocity. Marketing did not update to reflect the slip.

Düzeltici aksiyon: Sprint 23 shipped passkey end-to-end (registration, fallback, KSL-bound device key). Trust Center now ships honest disclosure of every commitment-vs-shipment gap. This page itself is the structural answer: future gaps land here with dates.

commit: Sprint 23 closure