merge: agent session work

- Canonical /admin/onboarding entry point; legacy routes 404\n- Tenantless run viewer at /admin/operations/{run} with membership-based 404\n- RBAC UX (disabled controls + tooltips) and server-side 403\n- DB-only rendering/refresh; contract registry enforced\n- Adds migrations + tests + spec artifacts

.dockerignore

@@ -1,5 +1,6 @@
 node_modules/
 vendor/
+coverage/
 .git/
 .DS_Store
 Thumbs.db

app/Filament/Pages/Operations/TenantlessOperationRunViewer.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Pages\Operations;
+
+use App\Models\OperationRun;
+use App\Models\User;
+use App\Models\WorkspaceMembership;
+use Filament\Actions\Action;
+use Filament\Pages\Page;
+
+class TenantlessOperationRunViewer extends Page
+{
+    protected static string $layout = 'filament-panels::components.layout.simple';
+
+    protected static bool $shouldRegisterNavigation = false;
+
+    protected static bool $isDiscovered = false;
+
+    protected static ?string $title = 'Operation run';
+
+    protected string $view = 'filament.pages.operations.tenantless-operation-run-viewer';
+
+    public OperationRun $run;
+
+    /**
+     * @return array<Action>
+     */
+    protected function getHeaderActions(): array
+    {
+        return [
+            Action::make('refresh')
+                ->label('Refresh')
+                ->icon('heroicon-o-arrow-path')
+                ->color('gray')
+                ->url(fn (): string => url()->current()),
+        ];
+    }
+
+    public function mount(OperationRun $run): void
+    {
+        $user = auth()->user();
+
+        if (! $user instanceof User) {
+            abort(403);
+        }
+
+        $workspaceId = (int) ($run->workspace_id ?? 0);
+
+        if ($workspaceId <= 0) {
+            abort(404);
+        }
+
+        $isMember = WorkspaceMembership::query()
+            ->where('workspace_id', $workspaceId)
+            ->where('user_id', (int) $user->getKey())
+            ->exists();
+
+        if (! $isMember) {
+            abort(404);
+        }
+
+        $this->run = $run->loadMissing(['workspace', 'tenant', 'user']);
+    }
+}

app/Filament/Resources/OperationRunResource.php

@@ -3,7 +3,6 @@
 namespace App\Filament\Resources;
 
 use App\Filament\Resources\OperationRunResource\Pages;
-use App\Filament\Support\VerificationReportViewer;
 use App\Models\OperationRun;
 use App\Models\Tenant;
 use App\Support\Badges\BadgeDomain;
@@ -137,35 +136,12 @@ public static function infolist(Schema $schema): Schema
                     ->visible(fn (OperationRun $record): bool => ! empty($record->failure_summary))
                     ->columnSpanFull(),
 
-                Section::make('Verification report')
-                    ->schema([
-                        ViewEntry::make('verification_report')
-                            ->label('')
-                            ->view('filament.components.verification-report-viewer')
-                            ->state(fn (OperationRun $record): ?array => VerificationReportViewer::report($record))
-                            ->columnSpanFull(),
-                    ])
-                    ->visible(fn (OperationRun $record): bool => VerificationReportViewer::shouldRenderForRun($record))
-                    ->columnSpanFull(),
-
                 Section::make('Context')
                     ->schema([
                         ViewEntry::make('context')
                             ->label('')
                             ->view('filament.infolists.entries.snapshot-json')
-                            ->state(function (OperationRun $record): array {
+                            ->state(fn (OperationRun $record): array => $record->context ?? [])
-                                $context = $record->context ?? [];
-                                $context = is_array($context) ? $context : [];
-
-                                if (array_key_exists('verification_report', $context)) {
-                                    $context['verification_report'] = [
-                                        'redacted' => true,
-                                        'note' => 'Rendered in the Verification report section.',
-                                    ];
-                                }
-
-                                return $context;
-                            })
                             ->columnSpanFull(),
                     ])
                     ->columnSpanFull(),

app/Filament/Resources/ProviderConnectionResource.php

@@ -5,6 +5,7 @@
 use App\Filament\Concerns\ScopesGlobalSearchToTenant;
 use App\Filament\Resources\ProviderConnectionResource\Pages;
 use App\Jobs\ProviderComplianceSnapshotJob;
+use App\Jobs\ProviderConnectionHealthCheckJob;
 use App\Jobs\ProviderInventorySyncJob;
 use App\Models\OperationRun;
 use App\Models\ProviderConnection;
@@ -14,12 +15,12 @@
 use App\Services\Intune\AuditLogger;
 use App\Services\Providers\CredentialManager;
 use App\Services\Providers\ProviderOperationStartGate;
-use App\Services\Verification\StartVerification;
 use App\Support\Auth\Capabilities;
 use App\Support\Badges\BadgeDomain;
 use App\Support\Badges\BadgeRenderer;
 use App\Support\OperationRunLinks;
 use App\Support\Rbac\UiEnforcement;
+use App\Support\Workspaces\WorkspaceContext;
 use BackedEnum;
 use Filament\Actions;
 use Filament\Forms\Components\TextInput;
@@ -99,9 +100,16 @@ public static function table(Table $table): Table
     {
         return $table
             ->modifyQueryUsing(function (Builder $query): Builder {
+                $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId(request());
                 $tenantId = Tenant::current()?->getKey();
 
-                return $query->when($tenantId, fn (Builder $q) => $q->where('tenant_id', $tenantId));
+                if ($workspaceId === null) {
+                    return $query->whereRaw('1 = 0');
+                }
+
+                return $query
+                    ->where('workspace_id', (int) $workspaceId)
+                    ->when($tenantId, fn (Builder $q) => $q->where('tenant_id', $tenantId));
             })
             ->defaultSort('display_name')
             ->columns([
@@ -175,22 +183,29 @@ public static function table(Table $table): Table
                             ->icon('heroicon-o-check-badge')
                             ->color('success')
                             ->visible(fn (ProviderConnection $record): bool => $record->status !== 'disabled')
-                            ->action(function (ProviderConnection $record, StartVerification $verification): void {
+                            ->action(function (ProviderConnection $record, ProviderOperationStartGate $gate): void {
                                 $tenant = Tenant::current();
                                 $user = auth()->user();
 
-                                if (! $tenant instanceof Tenant) {
+                                if (! $tenant instanceof Tenant || ! $user instanceof User) {
-                                    abort(404);
+                                    return;
                                 }
 
-                                if (! $user instanceof User) {
+                                $initiator = $user;
-                                    abort(403);
-                                }
 
-                                $result = $verification->providerConnectionCheck(
+                                $result = $gate->start(
                                     tenant: $tenant,
                                     connection: $record,
-                                    initiator: $user,
+                                    operationType: 'provider.connection.check',
+                                    dispatcher: function (OperationRun $operationRun) use ($tenant, $initiator, $record): void {
+                                        ProviderConnectionHealthCheckJob::dispatch(
+                                            tenantId: (int) $tenant->getKey(),
+                                            userId: (int) $initiator->getKey(),
+                                            providerConnectionId: (int) $record->getKey(),
+                                            operationRun: $operationRun,
+                                        );
+                                    },
+                                    initiator: $initiator,
                                 );
 
                                 if ($result->status === 'scope_busy') {
@@ -633,9 +648,17 @@ public static function table(Table $table): Table
 
     public static function getEloquentQuery(): Builder
     {
+        $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId(request());
         $tenantId = Tenant::current()?->getKey();
 
-        return parent::getEloquentQuery()
+        $query = parent::getEloquentQuery();
+
+        if ($workspaceId === null) {
+            return $query->whereRaw('1 = 0');
+        }
+
+        return $query
+            ->where('workspace_id', (int) $workspaceId)
             ->when($tenantId, fn (Builder $query) => $query->where('tenant_id', $tenantId))
             ->latest('id');
     }

app/Filament/Resources/ProviderConnectionResource/Pages/CreateProviderConnection.php

@@ -22,6 +22,7 @@ protected function mutateFormDataBeforeCreate(array $data): array
         $this->shouldMakeDefault = (bool) ($data['is_default'] ?? false);
 
         return [
+            'workspace_id' => (int) $tenant->workspace_id,
             'tenant_id' => $tenant->getKey(),
             'provider' => 'microsoft',
             'entra_tenant_id' => $data['entra_tenant_id'],

app/Filament/Resources/ProviderConnectionResource/Pages/EditProviderConnection.php

@@ -4,6 +4,7 @@
 
 use App\Filament\Resources\ProviderConnectionResource;
 use App\Jobs\ProviderComplianceSnapshotJob;
+use App\Jobs\ProviderConnectionHealthCheckJob;
 use App\Jobs\ProviderInventorySyncJob;
 use App\Models\OperationRun;
 use App\Models\ProviderConnection;
@@ -13,7 +14,6 @@
 use App\Services\Intune\AuditLogger;
 use App\Services\Providers\CredentialManager;
 use App\Services\Providers\ProviderOperationStartGate;
-use App\Services\Verification\StartVerification;
 use App\Support\Auth\Capabilities;
 use App\Support\OperationRunLinks;
 use App\Support\Rbac\UiEnforcement;
@@ -167,7 +167,7 @@ protected function getHeaderActions(): array
                                 && $user->canAccessTenant($tenant)
                                 && $record->status !== 'disabled';
                         })
-                        ->action(function (ProviderConnection $record, StartVerification $verification): void {
+                        ->action(function (ProviderConnection $record, ProviderOperationStartGate $gate): void {
                             $tenant = Tenant::current();
                             $user = auth()->user();
 
@@ -185,9 +185,18 @@ protected function getHeaderActions(): array
 
                             $initiator = $user;
 
-                            $result = $verification->providerConnectionCheck(
+                            $result = $gate->start(
                                 tenant: $tenant,
                                 connection: $record,
+                                operationType: 'provider.connection.check',
+                                dispatcher: function (OperationRun $operationRun) use ($tenant, $initiator, $record): void {
+                                    ProviderConnectionHealthCheckJob::dispatch(
+                                        tenantId: (int) $tenant->getKey(),
+                                        userId: (int) $initiator->getKey(),
+                                        providerConnectionId: (int) $record->getKey(),
+                                        operationRun: $operationRun,
+                                    );
+                                },
                                 initiator: $initiator,
                             );
 

app/Filament/Support/VerificationReportViewer.php

@@ -1,44 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Filament\Support;
-
-use App\Models\OperationRun;
-use App\Support\Verification\VerificationReportSanitizer;
-use App\Support\Verification\VerificationReportSchema;
-
-final class VerificationReportViewer
-{
-    /**
-     * @return array<string, mixed>|null
-     */
-    public static function report(OperationRun $run): ?array
-    {
-        $context = is_array($run->context) ? $run->context : [];
-        $report = $context['verification_report'] ?? null;
-
-        if (! is_array($report)) {
-            return null;
-        }
-
-        $report = VerificationReportSanitizer::sanitizeReport($report);
-
-        if (! VerificationReportSchema::isValidReport($report)) {
-            return null;
-        }
-
-        return $report;
-    }
-
-    public static function shouldRenderForRun(OperationRun $run): bool
-    {
-        $context = is_array($run->context) ? $run->context : [];
-
-        if (array_key_exists('verification_report', $context)) {
-            return true;
-        }
-
-        return in_array((string) $run->type, ['provider.connection.check'], true);
-    }
-}

app/Http/Controllers/SwitchWorkspaceController.php

@@ -51,7 +51,7 @@ public function __invoke(Request $request): RedirectResponse
         $tenantCount = (int) $tenantsQuery->count();
 
         if ($tenantCount === 0) {
-            return redirect()->route('admin.workspace.managed-tenants.onboarding', ['workspace' => $workspace->slug ?? $workspace->getKey()]);
+            return redirect()->route('admin.onboarding');
         }
 
         if ($tenantCount === 1) {

app/Http/Middleware/EnsureWorkspaceSelected.php

@@ -32,6 +32,19 @@ public function handle(Request $request, Closure $next): Response
             return $next($request);
         }
 
+        if ($path === '/livewire/update') {
+            $refererPath = parse_url((string) $request->headers->get('referer', ''), PHP_URL_PATH) ?? '';
+            $refererPath = '/'.ltrim((string) $refererPath, '/');
+
+            if (preg_match('#^/admin/operations/[^/]+$#', $refererPath) === 1) {
+                return $next($request);
+            }
+        }
+
+        if (preg_match('#^/admin/operations/[^/]+$#', $path) === 1) {
+            return $next($request);
+        }
+
         if (in_array($path, ['/admin/no-access', '/admin/choose-workspace'], true)) {
             return $next($request);
         }

app/Jobs/ProviderConnectionHealthCheckJob.php

@@ -7,14 +7,11 @@
 use App\Models\ProviderConnection;
 use App\Models\Tenant;
 use App\Models\User;
-use App\Services\Audit\WorkspaceAuditLogger;
 use App\Services\OperationRunService;
 use App\Services\Providers\Contracts\HealthResult;
 use App\Services\Providers\MicrosoftProviderHealthCheck;
-use App\Support\Audit\AuditActionId;
 use App\Support\OperationRunOutcome;
 use App\Support\OperationRunStatus;
-use App\Support\Verification\VerificationReportWriter;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -86,64 +83,17 @@ public function handle(
 
         $this->updateRunTargetScope($this->operationRun, $connection, $entraTenantName);
 
-        $report = VerificationReportWriter::write(
-            run: $this->operationRun,
-            checks: [
-                [
-                    'key' => 'provider.connection.check',
-                    'title' => 'Provider connection check',
-                    'status' => $result->healthy ? 'pass' : 'fail',
-                    'severity' => $result->healthy ? 'info' : 'critical',
-                    'blocking' => ! $result->healthy,
-                    'reason_code' => $result->healthy ? 'ok' : ($result->reasonCode ?? 'unknown_error'),
-                    'message' => $result->healthy ? 'Connection is healthy.' : ($result->message ?? 'Health check failed.'),
-                    'evidence' => array_values(array_filter([
-                        [
-                            'kind' => 'provider_connection_id',
-                            'value' => (int) $connection->getKey(),
-                        ],
-                        [
-                            'kind' => 'entra_tenant_id',
-                            'value' => (string) $connection->entra_tenant_id,
-                        ],
-                        is_numeric($result->meta['http_status'] ?? null) ? [
-                            'kind' => 'http_status',
-                            'value' => (int) $result->meta['http_status'],
-                        ] : null,
-                        is_string($result->meta['organization_id'] ?? null) ? [
-                            'kind' => 'organization_id',
-                            'value' => (string) $result->meta['organization_id'],
-                        ] : null,
-                    ])),
-                    'next_steps' => $result->healthy
-                        ? []
-                        : [[
-                            'label' => 'Review provider connection',
-                            'url' => \App\Filament\Resources\ProviderConnectionResource::getUrl('edit', [
-                                'record' => (int) $connection->getKey(),
-                            ], tenant: $tenant),
-                        ]],
-                ],
-            ],
-            identity: [
-                'provider_connection_id' => (int) $connection->getKey(),
-                'entra_tenant_id' => (string) $connection->entra_tenant_id,
-            ],
-        );
-
         if ($result->healthy) {
-            $run = $runs->updateRun(
+            $runs->updateRun(
                 $this->operationRun,
                 status: OperationRunStatus::Completed->value,
                 outcome: OperationRunOutcome::Succeeded->value,
             );
 
-            $this->logVerificationCompletion($tenant, $user, $run, $report);
-
             return;
         }
 
-        $run = $runs->updateRun(
+        $runs->updateRun(
             $this->operationRun,
             status: OperationRunStatus::Completed->value,
             outcome: OperationRunOutcome::Failed->value,
@@ -153,8 +103,6 @@ public function handle(
                 'message' => $result->message ?? 'Health check failed.',
             ]],
         );
-
-        $this->logVerificationCompletion($tenant, $user, $run, $report);
     }
 
     private function resolveEntraTenantName(ProviderConnection $connection, HealthResult $result): ?string
@@ -197,34 +145,4 @@ private function applyHealthResult(ProviderConnection $connection, HealthResult
             'last_error_message' => $result->healthy ? null : $result->message,
         ]);
     }
-
-    /**
-     * @param  array<string, mixed>  $report
-     */
-    private function logVerificationCompletion(Tenant $tenant, User $actor, OperationRun $run, array $report): void
-    {
-        $workspace = $tenant->workspace;
-
-        if (! $workspace) {
-            return;
-        }
-
-        $counts = $report['summary']['counts'] ?? [];
-        $counts = is_array($counts) ? $counts : [];
-
-        app(WorkspaceAuditLogger::class)->log(
-            workspace: $workspace,
-            action: AuditActionId::VerificationCompleted->value,
-            context: [
-                'metadata' => [
-                    'operation_run_id' => (int) $run->getKey(),
-                    'counts' => $counts,
-                ],
-            ],
-            actor: $actor,
-            status: $run->outcome === OperationRunOutcome::Succeeded->value ? 'success' : 'failed',
-            resourceType: 'operation_run',
-            resourceId: (string) $run->getKey(),
-        );
-    }
 }

app/Models/OperationRun.php

@@ -26,6 +26,11 @@ public function tenant(): BelongsTo
         return $this->belongsTo(Tenant::class);
     }
 
+    public function workspace(): BelongsTo
+    {
+        return $this->belongsTo(Workspace::class);
+    }
+
     public function user(): BelongsTo
     {
         return $this->belongsTo(User::class);

app/Models/ProviderConnection.php

@@ -26,6 +26,11 @@ public function tenant(): BelongsTo
         return $this->belongsTo(Tenant::class);
     }
 
+    public function workspace(): BelongsTo
+    {
+        return $this->belongsTo(Workspace::class);
+    }
+
     public function credential(): HasOne
     {
         return $this->hasOne(ProviderCredential::class, 'provider_connection_id');

app/Models/Tenant.php

@@ -21,6 +21,14 @@ class Tenant extends Model implements HasName
     use HasFactory;
     use SoftDeletes;
 
+    public const STATUS_DRAFT = 'draft';
+
+    public const STATUS_ONBOARDING = 'onboarding';
+
+    public const STATUS_ACTIVE = 'active';
+
+    public const STATUS_ARCHIVED = 'archived';
+
     protected $guarded = [];
 
     protected $casts = [
@@ -69,7 +77,7 @@ protected static function booted(): void
             }
 
             if (empty($tenant->status)) {
-                $tenant->status = 'active';
+                $tenant->status = self::STATUS_ACTIVE;
             }
         });
 
@@ -84,12 +92,12 @@ protected static function booted(): void
                 return;
             }
 
-            $tenant->status = 'archived';
+            $tenant->status = self::STATUS_ARCHIVED;
             $tenant->saveQuietly();
         });
 
         static::restored(function (Tenant $tenant) {
-            $tenant->forceFill(['status' => 'active'])->saveQuietly();
+            $tenant->forceFill(['status' => self::STATUS_ACTIVE])->saveQuietly();
         });
     }
 
@@ -97,12 +105,12 @@ public static function activeQuery(): Builder
     {
         return static::query()
             ->whereNull('deleted_at')
-            ->where('status', 'active');
+            ->where('status', self::STATUS_ACTIVE);
     }
 
     public function makeCurrent(): void
     {
-        if ($this->trashed() || $this->status !== 'active') {
+        if ($this->trashed() || $this->status !== self::STATUS_ACTIVE) {
             throw new RuntimeException('Only active tenants can be made current.');
         }
 

app/Models/TenantOnboardingSession.php

@@ -13,6 +13,25 @@ class TenantOnboardingSession extends Model
 
     protected $table = 'managed_tenant_onboarding_sessions';
 
+    /**
+     * @var array<int, string>
+     */
+    public const STATE_ALLOWED_KEYS = [
+        'entra_tenant_id',
+        'tenant_id',
+        'tenant_name',
+        'environment',
+        'primary_domain',
+        'notes',
+        'provider_connection_id',
+        'selected_provider_connection_id',
+        'verification_operation_run_id',
+        'verification_run_id',
+        'bootstrap_operation_types',
+        'bootstrap_operation_runs',
+        'bootstrap_run_ids',
+    ];
+
     protected $guarded = [];
 
     protected $casts = [
@@ -20,6 +39,24 @@ class TenantOnboardingSession extends Model
         'completed_at' => 'datetime',
     ];
 
+    /**
+     * @param  array<string, mixed>|null  $value
+     */
+    public function setStateAttribute(?array $value): void
+    {
+        if ($value === null) {
+            $this->attributes['state'] = null;
+
+            return;
+        }
+
+        $allowed = array_intersect_key($value, array_flip(self::STATE_ALLOWED_KEYS));
+
+        $encoded = json_encode($allowed, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+        $this->attributes['state'] = $encoded !== false ? $encoded : json_encode([], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+    }
+
     /**
      * @return BelongsTo<Workspace, $this>
      */

app/Notifications/OperationRunQueued.php

@@ -33,8 +33,20 @@ public function toDatabase(object $notifiable): array
     {
         $tenant = $this->run->tenant;
 
+        $context = is_array($this->run->context) ? $this->run->context : [];
+        $wizard = $context['wizard'] ?? null;
+
+        $isManagedTenantOnboardingWizardRun = is_array($wizard)
+            && ($wizard['flow'] ?? null) === 'managed_tenant_onboarding';
+
         $operationLabel = OperationCatalog::label((string) $this->run->type);
 
+        $runUrl = match (true) {
+            $isManagedTenantOnboardingWizardRun => OperationRunLinks::tenantlessView($this->run),
+            $tenant instanceof Tenant => OperationRunLinks::view($this->run, $tenant),
+            default => null,
+        };
+
         return FilamentNotification::make()
             ->title("{$operationLabel} queued")
             ->body('Queued. Monitor progress in Monitoring → Operations.')
@@ -42,7 +54,7 @@ public function toDatabase(object $notifiable): array
             ->actions([
                 \Filament\Actions\Action::make('view_run')
                     ->label('View run')
-                    ->url($tenant instanceof Tenant ? OperationRunLinks::view($this->run, $tenant) : null),
+                    ->url($runUrl),
             ])
             ->getDatabaseMessage();
     }

app/Policies/OperationRunPolicy.php

@@ -3,8 +3,9 @@
 namespace App\Policies;
 
 use App\Models\OperationRun;
-use App\Models\Tenant;
 use App\Models\User;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
 use Illuminate\Auth\Access\HandlesAuthorization;
 use Illuminate\Auth\Access\Response;
 
@@ -14,31 +15,31 @@ class OperationRunPolicy
 
     public function viewAny(User $user): bool
     {
-        $tenant = Tenant::current();
+        $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId();
 
-        if (! $tenant) {
+        if ($workspaceId === null) {
             return false;
         }
 
-        return $user->canAccessTenant($tenant);
+        return WorkspaceMembership::query()
+            ->where('workspace_id', (int) $workspaceId)
+            ->where('user_id', (int) $user->getKey())
+            ->exists();
     }
 
     public function view(User $user, OperationRun $run): Response|bool
     {
-        $tenant = Tenant::current();
+        $workspaceId = (int) ($run->workspace_id ?? 0);
 
-        if (! $tenant) {
+        if ($workspaceId <= 0) {
-            return false;
-        }
-
-        if (! $user->canAccessTenant($tenant)) {
-            return false;
-        }
-
-        if ((int) $run->tenant_id !== (int) $tenant->getKey()) {
             return Response::denyAsNotFound();
         }
 
-        return true;
+        $isMember = WorkspaceMembership::query()
+            ->where('workspace_id', $workspaceId)
+            ->where('user_id', (int) $user->getKey())
+            ->exists();
+
+        return $isMember ? true : Response::denyAsNotFound();
     }
 }

app/Policies/ProviderConnectionPolicy.php

@@ -5,6 +5,8 @@
 use App\Models\ProviderConnection;
 use App\Models\Tenant;
 use App\Models\User;
+use App\Models\Workspace;
+use App\Support\Workspaces\WorkspaceContext;
 use Illuminate\Auth\Access\HandlesAuthorization;
 use Illuminate\Auth\Access\Response;
 use Illuminate\Support\Facades\Gate;
@@ -15,15 +17,31 @@ class ProviderConnectionPolicy
 
     public function viewAny(User $user): bool
     {
+        $workspace = $this->currentWorkspace();
+        if (! $workspace instanceof Workspace) {
+            return false;
+        }
+
         $tenant = Tenant::current();
 
-        return Gate::forUser($user)->allows('provider.view', $tenant);
+        return $tenant instanceof Tenant
+            && (int) $tenant->workspace_id === (int) $workspace->getKey()
+            && Gate::forUser($user)->allows('provider.view', $tenant);
     }
 
     public function view(User $user, ProviderConnection $connection): Response|bool
     {
+        $workspace = $this->currentWorkspace();
+        if (! $workspace instanceof Workspace) {
+            return Response::denyAsNotFound();
+        }
+
         $tenant = Tenant::current();
 
+        if (! $tenant instanceof Tenant || (int) $tenant->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         if (! Gate::forUser($user)->allows('provider.view', $tenant)) {
             return false;
         }
@@ -32,20 +50,40 @@ public function view(User $user, ProviderConnection $connection): Response|bool
             return Response::denyAsNotFound();
         }
 
+        if ((int) $connection->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         return true;
     }
 
     public function create(User $user): bool
     {
+        $workspace = $this->currentWorkspace();
+        if (! $workspace instanceof Workspace) {
+            return false;
+        }
+
         $tenant = Tenant::current();
 
-        return Gate::forUser($user)->allows('provider.manage', $tenant);
+        return $tenant instanceof Tenant
+            && (int) $tenant->workspace_id === (int) $workspace->getKey()
+            && Gate::forUser($user)->allows('provider.manage', $tenant);
     }
 
     public function update(User $user, ProviderConnection $connection): Response|bool
     {
+        $workspace = $this->currentWorkspace();
+        if (! $workspace instanceof Workspace) {
+            return Response::denyAsNotFound();
+        }
+
         $tenant = Tenant::current();
 
+        if (! $tenant instanceof Tenant || (int) $tenant->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         if (! Gate::forUser($user)->allows('provider.view', $tenant)) {
             return false;
         }
@@ -54,13 +92,26 @@ public function update(User $user, ProviderConnection $connection): Response|boo
             return Response::denyAsNotFound();
         }
 
+        if ((int) $connection->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         return true;
     }
 
     public function delete(User $user, ProviderConnection $connection): Response|bool
     {
+        $workspace = $this->currentWorkspace();
+        if (! $workspace instanceof Workspace) {
+            return Response::denyAsNotFound();
+        }
+
         $tenant = Tenant::current();
 
+        if (! $tenant instanceof Tenant || (int) $tenant->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         if (! Gate::forUser($user)->allows('provider.manage', $tenant)) {
             return false;
         }
@@ -69,6 +120,19 @@ public function delete(User $user, ProviderConnection $connection): Response|boo
             return Response::denyAsNotFound();
         }
 
+        if ((int) $connection->workspace_id !== (int) $workspace->getKey()) {
+            return Response::denyAsNotFound();
+        }
+
         return false;
     }
+
+    private function currentWorkspace(): ?Workspace
+    {
+        $workspaceId = app(WorkspaceContext::class)->currentWorkspaceId(request());
+
+        return is_int($workspaceId)
+            ? Workspace::query()->whereKey($workspaceId)->first()
+            : null;
+    }
 }

app/Services/Auth/WorkspaceRoleCapabilityMap.php

@@ -24,6 +24,14 @@ class WorkspaceRoleCapabilityMap
             Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
             Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
             Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE,
         ],
 
         WorkspaceRole::Manager->value => [
@@ -31,11 +39,23 @@ class WorkspaceRoleCapabilityMap
             Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
             Capabilities::WORKSPACE_MEMBERSHIP_MANAGE,
             Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
         ],
 
         WorkspaceRole::Operator->value => [
             Capabilities::WORKSPACE_VIEW,
             Capabilities::WORKSPACE_MEMBERSHIP_VIEW,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC,
+            Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP,
         ],
 
         WorkspaceRole::Readonly->value => [

app/Services/Graph/GraphContractRegistry.php

@@ -6,6 +6,25 @@
 
 class GraphContractRegistry
 {
+    public function probePath(string $key, array $replacements = []): ?string
+    {
+        $path = config("graph_contracts.probes.$key.path");
+
+        if (! is_string($path) || $path === '') {
+            return null;
+        }
+
+        foreach ($replacements as $placeholder => $value) {
+            if (! is_string($placeholder) || $placeholder === '') {
+                continue;
+            }
+
+            $path = str_replace($placeholder, urlencode((string) $value), $path);
+        }
+
+        return '/'.ltrim($path, '/');
+    }
+
     public function directoryGroupsPolicyType(): string
     {
         return 'directoryGroups';

app/Services/Graph/MicrosoftGraphClient.php

@@ -409,7 +409,20 @@ private function shouldApplySelectFallback(GraphResponse $graphResponse, array $
     public function getOrganization(array $options = []): GraphResponse
     {
         $context = $this->resolveContext($options);
-        $endpoint = 'organization';
+        $endpoint = $this->contracts->probePath('organization');
+
+        if (! is_string($endpoint) || $endpoint === '') {
+            return new GraphResponse(
+                success: false,
+                data: [],
+                status: 500,
+                errors: [[
+                    'message' => 'Graph contract missing for probe: organization',
+                ]],
+            );
+        }
+
+        $endpoint = ltrim($endpoint, '/');
         $clientRequestId = $options['client_request_id'] ?? (string) Str::uuid();
         $fullPath = $this->buildFullPath($endpoint);
 
@@ -479,14 +492,27 @@ public function getServicePrincipalPermissions(array $options = []): GraphRespon
         $clientRequestId = $options['client_request_id'] ?? (string) Str::uuid();
 
         // First, get the service principal object by clientId (appId)
-        $endpoint = "servicePrincipals?\$filter=appId eq '{$clientId}'";
+        $endpoint = $this->contracts->probePath('service_principal_by_app_id', ['{appId}' => $clientId]);
+
+        if (! is_string($endpoint) || $endpoint === '') {
+            return new GraphResponse(
+                success: false,
+                data: [],
+                status: 500,
+                errors: [[
+                    'message' => 'Graph contract missing for probe: service_principal_by_app_id',
+                ]],
+            );
+        }
+
+        $endpoint = ltrim($endpoint, '/');
 
         $this->logger->logRequest('get_service_principal', [
             'endpoint' => $endpoint,
             'client_id' => $clientId,
             'tenant' => $context['tenant'],
             'method' => 'GET',
-            'full_path' => $endpoint,
+            'full_path' => $this->buildFullPath($endpoint),
             'client_request_id' => $clientRequestId,
         ]);
 
@@ -528,14 +554,30 @@ public function getServicePrincipalPermissions(array $options = []): GraphRespon
         }
 
         // Now get the app role assignments (application permissions)
-        $assignmentsEndpoint = "servicePrincipals/{$servicePrincipalId}/appRoleAssignments";
+        $assignmentsEndpoint = $this->contracts->probePath(
+            'service_principal_app_role_assignments',
+            ['{servicePrincipalId}' => $servicePrincipalId],
+        );
+
+        if (! is_string($assignmentsEndpoint) || $assignmentsEndpoint === '') {
+            return new GraphResponse(
+                success: false,
+                data: [],
+                status: 500,
+                errors: [[
+                    'message' => 'Graph contract missing for probe: service_principal_app_role_assignments',
+                ]],
+            );
+        }
+
+        $assignmentsEndpoint = ltrim($assignmentsEndpoint, '/');
 
         $this->logger->logRequest('get_app_role_assignments', [
             'endpoint' => $assignmentsEndpoint,
             'service_principal_id' => $servicePrincipalId,
             'tenant' => $context['tenant'],
             'method' => 'GET',
-            'full_path' => $assignmentsEndpoint,
+            'full_path' => $this->buildFullPath($assignmentsEndpoint),
             'client_request_id' => $clientRequestId,
         ]);
 
@@ -549,9 +591,20 @@ public function getServicePrincipalPermissions(array $options = []): GraphRespon
                 $permissions = [];
 
                 // Get Microsoft Graph service principal to map role IDs to permission names
-                $graphSpEndpoint = "servicePrincipals?\$filter=appId eq '00000003-0000-0000-c000-000000000000'";
+                $graphSpEndpoint = $this->contracts->probePath(
-                $graphSpResponse = $this->send('GET', $graphSpEndpoint, [], $context);
+                    'service_principal_by_app_id',
-                $graphSps = $graphSpResponse->json('value', []);
+                    ['{appId}' => '00000003-0000-0000-c000-000000000000'],
+                );
+
+                $graphSpResponse = null;
+
+                if (is_string($graphSpEndpoint) && $graphSpEndpoint !== '') {
+                    $graphSpResponse = $this->send('GET', ltrim($graphSpEndpoint, '/'), [], $context);
+                }
+
+                $graphSps = $graphSpResponse instanceof Response
+                    ? $graphSpResponse->json('value', [])
+                    : [];
                 $appRoles = $graphSps[0]['appRoles'] ?? [];
 
                 // Map role IDs to permission names

app/Services/OperationRunService.php

@@ -5,6 +5,7 @@
 use App\Models\OperationRun;
 use App\Models\Tenant;
 use App\Models\User;
+use App\Models\Workspace;
 use App\Notifications\OperationRunCompleted as OperationRunCompletedNotification;
 use App\Notifications\OperationRunQueued as OperationRunQueuedNotification;
 use App\Services\Operations\BulkIdempotencyFingerprint;
@@ -60,12 +61,19 @@ public function ensureRun(
         array $inputs,
         ?User $initiator = null
     ): OperationRun {
+        $workspaceId = (int) ($tenant->workspace_id ?? 0);
+
+        if ($workspaceId <= 0) {
+            throw new InvalidArgumentException('Tenant must belong to a workspace to start an operation run.');
+        }
+
         $hash = $this->calculateHash($tenant->id, $type, $inputs);
 
         // Idempotency Check (Fast Path)
         // We check specific status to match the partial unique index
         $existing = OperationRun::query()
             ->where('tenant_id', $tenant->id)
+            ->where('workspace_id', $workspaceId)
             ->where('run_identity_hash', $hash)
             ->whereIn('status', OperationRunStatus::values())
             ->where('status', '!=', OperationRunStatus::Completed->value)
@@ -78,6 +86,7 @@ public function ensureRun(
         // Create new run (race-safe via partial unique index)
         try {
             return OperationRun::create([
+                'workspace_id' => $workspaceId,
                 'tenant_id' => $tenant->id,
                 'user_id' => $initiator?->id,
                 'initiator_name' => $initiator?->name ?? 'System',
@@ -97,6 +106,7 @@ public function ensureRun(
 
             $existing = OperationRun::query()
                 ->where('tenant_id', $tenant->id)
+                ->where('workspace_id', $workspaceId)
                 ->where('run_identity_hash', $hash)
                 ->whereIn('status', [OperationRunStatus::Queued->value, OperationRunStatus::Running->value])
                 ->first();
@@ -116,12 +126,19 @@ public function ensureRunWithIdentity(
         array $context,
         ?User $initiator = null
     ): OperationRun {
+        $workspaceId = (int) ($tenant->workspace_id ?? 0);
+
+        if ($workspaceId <= 0) {
+            throw new InvalidArgumentException('Tenant must belong to a workspace to start an operation run.');
+        }
+
         $hash = $this->calculateHash($tenant->id, $type, $identityInputs);
 
         // Idempotency Check (Fast Path)
         // We check specific status to match the partial unique index
         $existing = OperationRun::query()
             ->where('tenant_id', $tenant->id)
+            ->where('workspace_id', $workspaceId)
             ->where('run_identity_hash', $hash)
             ->whereIn('status', OperationRunStatus::values())
             ->where('status', '!=', OperationRunStatus::Completed->value)
@@ -134,6 +151,7 @@ public function ensureRunWithIdentity(
         // Create new run (race-safe via partial unique index)
         try {
             return OperationRun::create([
+                'workspace_id' => $workspaceId,
                 'tenant_id' => $tenant->id,
                 'user_id' => $initiator?->id,
                 'initiator_name' => $initiator?->name ?? 'System',
@@ -153,6 +171,7 @@ public function ensureRunWithIdentity(
 
             $existing = OperationRun::query()
                 ->where('tenant_id', $tenant->id)
+                ->where('workspace_id', $workspaceId)
                 ->where('run_identity_hash', $hash)
                 ->whereIn('status', [OperationRunStatus::Queued->value, OperationRunStatus::Running->value])
                 ->first();
@@ -227,6 +246,59 @@ public function enqueueBulkOperation(
         return $run;
     }
 
+    public function ensureWorkspaceRunWithIdentity(
+        Workspace $workspace,
+        string $type,
+        array $identityInputs,
+        array $context,
+        ?User $initiator = null,
+    ): OperationRun {
+        $hash = $this->calculateWorkspaceHash((int) $workspace->getKey(), $type, $identityInputs);
+
+        $existing = OperationRun::query()
+            ->where('workspace_id', (int) $workspace->getKey())
+            ->whereNull('tenant_id')
+            ->where('run_identity_hash', $hash)
+            ->whereIn('status', OperationRunStatus::values())
+            ->where('status', '!=', OperationRunStatus::Completed->value)
+            ->first();
+
+        if ($existing) {
+            return $existing;
+        }
+
+        try {
+            return OperationRun::create([
+                'workspace_id' => (int) $workspace->getKey(),
+                'tenant_id' => null,
+                'user_id' => $initiator?->id,
+                'initiator_name' => $initiator?->name ?? 'System',
+                'type' => $type,
+                'status' => OperationRunStatus::Queued->value,
+                'outcome' => OperationRunOutcome::Pending->value,
+                'run_identity_hash' => $hash,
+                'context' => $context,
+            ]);
+        } catch (QueryException $e) {
+            if (! in_array(($e->errorInfo[0] ?? null), ['23505', '23000'], true)) {
+                throw $e;
+            }
+
+            $existing = OperationRun::query()
+                ->where('workspace_id', (int) $workspace->getKey())
+                ->whereNull('tenant_id')
+                ->where('run_identity_hash', $hash)
+                ->whereIn('status', [OperationRunStatus::Queued->value, OperationRunStatus::Running->value])
+                ->first();
+
+            if ($existing) {
+                return $existing;
+            }
+
+            throw $e;
+        }
+    }
+
     public function updateRun(
         OperationRun $run,
         string $status,
@@ -518,6 +590,15 @@ protected function calculateHash(int $tenantId, string $type, array $inputs): st
         return hash('sha256', $tenantId.'|'.$type.'|'.$json);
     }
 
+    protected function calculateWorkspaceHash(int $workspaceId, string $type, array $inputs): string
+    {
+        $normalizedInputs = $this->normalizeInputs($inputs);
+
+        $json = json_encode($normalizedInputs, JSON_THROW_ON_ERROR | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+        return hash('sha256', 'workspace|'.$workspaceId.'|'.$type.'|'.$json);
+    }
+
     /**
      * Normalize inputs for stable identity hashing.
      *

app/Services/Verification/StartVerification.php

@@ -1,57 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Verification;
-
-use App\Jobs\ProviderConnectionHealthCheckJob;
-use App\Models\OperationRun;
-use App\Models\ProviderConnection;
-use App\Models\Tenant;
-use App\Models\User;
-use App\Services\Providers\ProviderOperationStartGate;
-use App\Services\Providers\ProviderOperationStartResult;
-use App\Support\Auth\Capabilities;
-use Illuminate\Support\Facades\Gate;
-use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
-
-final class StartVerification
-{
-    public function __construct(
-        private readonly ProviderOperationStartGate $providers,
-    ) {}
-
-    /**
-     * Start (or dedupe) a provider-connection verification run.
-     *
-     * @param  array<string, mixed>  $extraContext
-     */
-    public function providerConnectionCheck(
-        Tenant $tenant,
-        ProviderConnection $connection,
-        User $initiator,
-        array $extraContext = [],
-    ): ProviderOperationStartResult {
-        if (! $initiator->canAccessTenant($tenant)) {
-            throw new NotFoundHttpException;
-        }
-
-        Gate::forUser($initiator)->authorize(Capabilities::PROVIDER_RUN, $tenant);
-
-        return $this->providers->start(
-            tenant: $tenant,
-            connection: $connection,
-            operationType: 'provider.connection.check',
-            dispatcher: function (OperationRun $run) use ($tenant, $initiator, $connection): void {
-                ProviderConnectionHealthCheckJob::dispatch(
-                    tenantId: (int) $tenant->getKey(),
-                    userId: (int) $initiator->getKey(),
-                    providerConnectionId: (int) $connection->getKey(),
-                    operationRun: $run,
-                );
-            },
-            initiator: $initiator,
-            extraContext: $extraContext,
-        );
-    }
-}

app/Support/Audit/AuditActionId.php

@@ -27,6 +27,5 @@ enum AuditActionId: string
     case ManagedTenantOnboardingStart = 'managed_tenant_onboarding.start';
     case ManagedTenantOnboardingResume = 'managed_tenant_onboarding.resume';
     case ManagedTenantOnboardingVerificationStart = 'managed_tenant_onboarding.verification_start';
-
+    case ManagedTenantOnboardingActivation = 'managed_tenant_onboarding.activation';
-    case VerificationCompleted = 'verification.completed';
 }

app/Support/Auth/Capabilities.php

@@ -30,6 +30,22 @@ class Capabilities
     // Managed tenant onboarding
     public const WORKSPACE_MANAGED_TENANT_ONBOARD = 'workspace_managed_tenant.onboard';
 
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY = 'workspace_managed_tenant.onboard.identify';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW = 'workspace_managed_tenant.onboard.connection.view';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE = 'workspace_managed_tenant.onboard.connection.manage';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START = 'workspace_managed_tenant.onboard.verification.start';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC = 'workspace_managed_tenant.onboard.bootstrap.inventory_sync';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC = 'workspace_managed_tenant.onboard.bootstrap.policy_sync';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP = 'workspace_managed_tenant.onboard.bootstrap.backup_bootstrap';
+
+    public const WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE = 'workspace_managed_tenant.onboard.activate';
+
     // Tenants
     public const TENANT_VIEW = 'tenant.view';
 

app/Support/Badges/BadgeCatalog.php

@@ -36,9 +36,7 @@ final class BadgeCatalog
         BadgeDomain::RestoreResultStatus->value => Domains\RestoreResultStatusBadge::class,
         BadgeDomain::ProviderConnectionStatus->value => Domains\ProviderConnectionStatusBadge::class,
         BadgeDomain::ProviderConnectionHealth->value => Domains\ProviderConnectionHealthBadge::class,
-        BadgeDomain::VerificationCheckStatus->value => Domains\VerificationCheckStatusBadge::class,
+        BadgeDomain::ManagedTenantOnboardingVerificationStatus->value => Domains\ManagedTenantOnboardingVerificationStatusBadge::class,
-        BadgeDomain::VerificationCheckSeverity->value => Domains\VerificationCheckSeverityBadge::class,
-        BadgeDomain::VerificationReportOverall->value => Domains\VerificationReportOverallBadge::class,
     ];
 
     /**

app/Support/Badges/BadgeDomain.php

@@ -28,7 +28,5 @@ enum BadgeDomain: string
     case RestoreResultStatus = 'restore_result_status';
     case ProviderConnectionStatus = 'provider_connection.status';
     case ProviderConnectionHealth = 'provider_connection.health';
-    case VerificationCheckStatus = 'verification_check_status';
+    case ManagedTenantOnboardingVerificationStatus = 'managed_tenant_onboarding.verification_status';
-    case VerificationCheckSeverity = 'verification_check_severity';
-    case VerificationReportOverall = 'verification_report_overall';
 }

app/Support/Badges/Domains/ManagedTenantOnboardingVerificationStatusBadge.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Support\Badges\Domains;
+
+use App\Support\Badges\BadgeCatalog;
+use App\Support\Badges\BadgeMapper;
+use App\Support\Badges\BadgeSpec;
+
+final class ManagedTenantOnboardingVerificationStatusBadge implements BadgeMapper
+{
+    public function spec(mixed $value): BadgeSpec
+    {
+        $state = BadgeCatalog::normalizeState($value);
+
+        return match ($state) {
+            'not_started' => new BadgeSpec('Not started', 'gray', 'heroicon-m-minus-circle'),
+            'in_progress' => new BadgeSpec('In progress', 'info', 'heroicon-m-arrow-path'),
+            'needs_attention' => new BadgeSpec('Needs attention', 'warning', 'heroicon-m-exclamation-triangle'),
+            'blocked' => new BadgeSpec('Blocked', 'danger', 'heroicon-m-x-circle'),
+            'ready' => new BadgeSpec('Ready', 'success', 'heroicon-m-check-circle'),
+            default => BadgeSpec::unknown(),
+        };
+    }
+}

app/Support/Badges/Domains/VerificationCheckSeverityBadge.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Support\Badges\Domains;
-
-use App\Support\Badges\BadgeCatalog;
-use App\Support\Badges\BadgeMapper;
-use App\Support\Badges\BadgeSpec;
-use App\Support\Verification\VerificationCheckSeverity;
-
-final class VerificationCheckSeverityBadge implements BadgeMapper
-{
-    public function spec(mixed $value): BadgeSpec
-    {
-        $state = BadgeCatalog::normalizeState($value);
-
-        return match ($state) {
-            VerificationCheckSeverity::Info->value => new BadgeSpec('Info', 'gray', 'heroicon-m-information-circle'),
-            VerificationCheckSeverity::Low->value => new BadgeSpec('Low', 'info', 'heroicon-m-arrow-down'),
-            VerificationCheckSeverity::Medium->value => new BadgeSpec('Medium', 'warning', 'heroicon-m-exclamation-triangle'),
-            VerificationCheckSeverity::High->value => new BadgeSpec('High', 'danger', 'heroicon-m-exclamation-triangle'),
-            VerificationCheckSeverity::Critical->value => new BadgeSpec('Critical', 'danger', 'heroicon-m-x-circle'),
-            default => BadgeSpec::unknown(),
-        };
-    }
-}

app/Support/Badges/Domains/VerificationCheckStatusBadge.php

@@ -1,25 +0,0 @@
-<?php
-
-namespace App\Support\Badges\Domains;
-
-use App\Support\Badges\BadgeCatalog;
-use App\Support\Badges\BadgeMapper;
-use App\Support\Badges\BadgeSpec;
-use App\Support\Verification\VerificationCheckStatus;
-
-final class VerificationCheckStatusBadge implements BadgeMapper
-{
-    public function spec(mixed $value): BadgeSpec
-    {
-        $state = BadgeCatalog::normalizeState($value);
-
-        return match ($state) {
-            VerificationCheckStatus::Pass->value => new BadgeSpec('Pass', 'success', 'heroicon-m-check-circle'),
-            VerificationCheckStatus::Fail->value => new BadgeSpec('Fail', 'danger', 'heroicon-m-x-circle'),
-            VerificationCheckStatus::Warn->value => new BadgeSpec('Warn', 'warning', 'heroicon-m-exclamation-triangle'),
-            VerificationCheckStatus::Skip->value => new BadgeSpec('Skipped', 'gray', 'heroicon-m-minus-circle'),
-            VerificationCheckStatus::Running->value => new BadgeSpec('Running', 'info', 'heroicon-m-arrow-path'),
-            default => BadgeSpec::unknown(),
-        };
-    }
-}

app/Support/Badges/Domains/VerificationReportOverallBadge.php

@@ -1,24 +0,0 @@
-<?php
-
-namespace App\Support\Badges\Domains;
-
-use App\Support\Badges\BadgeCatalog;
-use App\Support\Badges\BadgeMapper;
-use App\Support\Badges\BadgeSpec;
-use App\Support\Verification\VerificationReportOverall;
-
-final class VerificationReportOverallBadge implements BadgeMapper
-{
-    public function spec(mixed $value): BadgeSpec
-    {
-        $state = BadgeCatalog::normalizeState($value);
-
-        return match ($state) {
-            VerificationReportOverall::Ready->value => new BadgeSpec('Ready', 'success', 'heroicon-m-check-circle'),
-            VerificationReportOverall::NeedsAttention->value => new BadgeSpec('Needs attention', 'warning', 'heroicon-m-exclamation-triangle'),
-            VerificationReportOverall::Blocked->value => new BadgeSpec('Blocked', 'danger', 'heroicon-m-x-circle'),
-            VerificationReportOverall::Running->value => new BadgeSpec('Running', 'info', 'heroicon-m-arrow-path'),
-            default => BadgeSpec::unknown(),
-        };
-    }
-}

app/Support/Middleware/EnsureFilamentTenantSelected.php

@@ -27,6 +27,23 @@ public function handle(Request $request, Closure $next): Response
 
         $path = '/'.ltrim($request->path(), '/');
 
+        if ($path === '/livewire/update') {
+            $refererPath = parse_url((string) $request->headers->get('referer', ''), PHP_URL_PATH) ?? '';
+            $refererPath = '/'.ltrim((string) $refererPath, '/');
+
+            if (preg_match('#^/admin/operations/[^/]+$#', $refererPath) === 1) {
+                $this->configureNavigationForRequest($panel);
+
+                return $next($request);
+            }
+        }
+
+        if (preg_match('#^/admin/operations/[^/]+$#', $path) === 1) {
+            $this->configureNavigationForRequest($panel);
+
+            return $next($request);
+        }
+
         if ($request->route()?->hasParameter('tenant')) {
             $user = $request->user();
 

app/Support/OperationRunLinks.php

@@ -21,6 +21,13 @@ public static function index(Tenant $tenant): string
         return OperationRunResource::getUrl('index', tenant: $tenant);
     }
 
+    public static function tenantlessView(OperationRun|int $run): string
+    {
+        $runId = $run instanceof OperationRun ? (int) $run->getKey() : (int) $run;
+
+        return route('admin.operations.view', ['run' => $runId]);
+    }
+
     public static function view(OperationRun|int $run, Tenant $tenant): string
     {
         return OperationRunResource::getUrl('view', ['record' => $run], tenant: $tenant);

app/Support/Verification/VerificationCheckSeverity.php

@@ -1,20 +0,0 @@
-<?php
-
-namespace App\Support\Verification;
-
-enum VerificationCheckSeverity: string
-{
-    case Info = 'info';
-    case Low = 'low';
-    case Medium = 'medium';
-    case High = 'high';
-    case Critical = 'critical';
-
-    /**
-     * @return array<int, string>
-     */
-    public static function values(): array
-    {
-        return array_map(static fn (self $case): string => $case->value, self::cases());
-    }
-}

app/Support/Verification/VerificationCheckStatus.php

@@ -1,20 +0,0 @@
-<?php
-
-namespace App\Support\Verification;
-
-enum VerificationCheckStatus: string
-{
-    case Pass = 'pass';
-    case Fail = 'fail';
-    case Warn = 'warn';
-    case Skip = 'skip';
-    case Running = 'running';
-
-    /**
-     * @return array<int, string>
-     */
-    public static function values(): array
-    {
-        return array_map(static fn (self $case): string => $case->value, self::cases());
-    }
-}

app/Support/Verification/VerificationReportOverall.php

@@ -1,19 +0,0 @@
-<?php
-
-namespace App\Support\Verification;
-
-enum VerificationReportOverall: string
-{
-    case Ready = 'ready';
-    case NeedsAttention = 'needs_attention';
-    case Blocked = 'blocked';
-    case Running = 'running';
-
-    /**
-     * @return array<int, string>
-     */
-    public static function values(): array
-    {
-        return array_map(static fn (self $case): string => $case->value, self::cases());
-    }
-}

app/Support/Verification/VerificationReportSanitizer.php

@@ -1,358 +0,0 @@
-<?php
-
-namespace App\Support\Verification;
-
-final class VerificationReportSanitizer
-{
-    /**
-     * @var array<int, string>
-     */
-    private const FORBIDDEN_KEY_SUBSTRINGS = [
-        'access_token',
-        'refresh_token',
-        'client_secret',
-        'authorization',
-        'password',
-        'cookie',
-        'set-cookie',
-    ];
-
-    /**
-     * @return array<string, mixed>
-     */
-    public static function sanitizeReport(array $report): array
-    {
-        $sanitized = [];
-
-        $schemaVersion = self::sanitizeShortString($report['schema_version'] ?? null, fallback: null);
-        if ($schemaVersion !== null) {
-            $sanitized['schema_version'] = $schemaVersion;
-        }
-
-        $flow = self::sanitizeShortString($report['flow'] ?? null, fallback: null);
-        if ($flow !== null) {
-            $sanitized['flow'] = $flow;
-        }
-
-        $generatedAt = self::sanitizeShortString($report['generated_at'] ?? null, fallback: null);
-        if ($generatedAt !== null) {
-            $sanitized['generated_at'] = $generatedAt;
-        }
-
-        if (is_array($report['identity'] ?? null)) {
-            $identity = self::sanitizeIdentity((array) $report['identity']);
-
-            if ($identity !== []) {
-                $sanitized['identity'] = $identity;
-            }
-        }
-
-        $summary = is_array($report['summary'] ?? null) ? (array) $report['summary'] : [];
-        $summary = self::sanitizeSummary($summary);
-
-        if ($summary !== null) {
-            $sanitized['summary'] = $summary;
-        }
-
-        $checks = is_array($report['checks'] ?? null) ? (array) $report['checks'] : [];
-        $checks = self::sanitizeChecks($checks);
-
-        if ($checks !== null) {
-            $sanitized['checks'] = $checks;
-        }
-
-        return $sanitized;
-    }
-
-    /**
-     * @param  array<string, mixed>  $identity
-     * @return array<string, int|string>
-     */
-    private static function sanitizeIdentity(array $identity): array
-    {
-        $sanitized = [];
-
-        foreach ($identity as $key => $value) {
-            if (! is_string($key) || trim($key) === '') {
-                continue;
-            }
-
-            if (self::containsForbiddenKeySubstring($key)) {
-                continue;
-            }
-
-            if (is_int($value)) {
-                $sanitized[$key] = $value;
-
-                continue;
-            }
-
-            if (! is_string($value)) {
-                continue;
-            }
-
-            $value = self::sanitizeValueString($value);
-
-            if ($value !== null) {
-                $sanitized[$key] = $value;
-            }
-        }
-
-        return $sanitized;
-    }
-
-    /**
-     * @param  array<string, mixed>  $summary
-     * @return array{overall: string, counts: array{total: int, pass: int, fail: int, warn: int, skip: int, running: int}}|null
-     */
-    private static function sanitizeSummary(array $summary): ?array
-    {
-        $overall = $summary['overall'] ?? null;
-
-        if (! is_string($overall) || ! in_array($overall, VerificationReportOverall::values(), true)) {
-            return null;
-        }
-
-        $counts = is_array($summary['counts'] ?? null) ? (array) $summary['counts'] : [];
-
-        foreach (['total', 'pass', 'fail', 'warn', 'skip', 'running'] as $key) {
-            if (! is_int($counts[$key] ?? null) || $counts[$key] < 0) {
-                return null;
-            }
-        }
-
-        return [
-            'overall' => $overall,
-            'counts' => [
-                'total' => $counts['total'],
-                'pass' => $counts['pass'],
-                'fail' => $counts['fail'],
-                'warn' => $counts['warn'],
-                'skip' => $counts['skip'],
-                'running' => $counts['running'],
-            ],
-        ];
-    }
-
-    /**
-     * @param  array<int, mixed>  $checks
-     * @return array<int, array<string, mixed>>|null
-     */
-    private static function sanitizeChecks(array $checks): ?array
-    {
-        if ($checks === []) {
-            return [];
-        }
-
-        $sanitized = [];
-
-        foreach ($checks as $check) {
-            if (! is_array($check)) {
-                continue;
-            }
-
-            $key = self::sanitizeShortString($check['key'] ?? null, fallback: null);
-            $title = self::sanitizeShortString($check['title'] ?? null, fallback: null);
-            $reasonCode = self::sanitizeShortString($check['reason_code'] ?? null, fallback: null);
-
-            if ($key === null || $title === null || $reasonCode === null) {
-                continue;
-            }
-
-            $status = $check['status'] ?? null;
-            if (! is_string($status) || ! in_array($status, VerificationCheckStatus::values(), true)) {
-                continue;
-            }
-
-            $severity = $check['severity'] ?? null;
-            if (! is_string($severity) || ! in_array($severity, VerificationCheckSeverity::values(), true)) {
-                continue;
-            }
-
-            $messageRaw = $check['message'] ?? null;
-            if (! is_string($messageRaw) || trim($messageRaw) === '') {
-                continue;
-            }
-
-            $blocking = is_bool($check['blocking'] ?? null) ? (bool) $check['blocking'] : false;
-
-            $sanitized[] = [
-                'key' => $key,
-                'title' => $title,
-                'status' => $status,
-                'severity' => $severity,
-                'blocking' => $blocking,
-                'reason_code' => $reasonCode,
-                'message' => self::sanitizeMessage($messageRaw),
-                'evidence' => self::sanitizeEvidence(is_array($check['evidence'] ?? null) ? (array) $check['evidence'] : []),
-                'next_steps' => self::sanitizeNextSteps(is_array($check['next_steps'] ?? null) ? (array) $check['next_steps'] : []),
-            ];
-        }
-
-        return $sanitized;
-    }
-
-    /**
-     * @param  array<int, mixed>  $evidence
-     * @return array<int, array{kind: string, value: int|string}>
-     */
-    private static function sanitizeEvidence(array $evidence): array
-    {
-        $sanitized = [];
-
-        foreach ($evidence as $pointer) {
-            if (! is_array($pointer)) {
-                continue;
-            }
-
-            $kind = $pointer['kind'] ?? null;
-            if (! is_string($kind) || trim($kind) === '') {
-                continue;
-            }
-
-            if (self::containsForbiddenKeySubstring($kind)) {
-                continue;
-            }
-
-            $value = $pointer['value'] ?? null;
-
-            if (is_int($value)) {
-                $sanitized[] = ['kind' => trim($kind), 'value' => $value];
-
-                continue;
-            }
-
-            if (! is_string($value)) {
-                continue;
-            }
-
-            $sanitizedValue = self::sanitizeValueString($value);
-
-            if ($sanitizedValue === null) {
-                continue;
-            }
-
-            $sanitized[] = ['kind' => trim($kind), 'value' => $sanitizedValue];
-        }
-
-        return $sanitized;
-    }
-
-    /**
-     * @param  array<int, mixed>  $nextSteps
-     * @return array<int, array{label: string, url: string}>
-     */
-    private static function sanitizeNextSteps(array $nextSteps): array
-    {
-        $sanitized = [];
-
-        foreach ($nextSteps as $step) {
-            if (! is_array($step)) {
-                continue;
-            }
-
-            $label = self::sanitizeShortString($step['label'] ?? null, fallback: null);
-            $url = self::sanitizeShortString($step['url'] ?? null, fallback: null);
-
-            if ($label === null || $url === null) {
-                continue;
-            }
-
-            $sanitized[] = [
-                'label' => $label,
-                'url' => $url,
-            ];
-        }
-
-        return $sanitized;
-    }
-
-    private static function sanitizeMessage(mixed $message): string
-    {
-        if (! is_string($message)) {
-            return '—';
-        }
-
-        $message = trim(str_replace(["\r", "\n"], ' ', $message));
-
-        $message = preg_replace('/\bAuthorization\s*:\s*[^\s]+(?:\s+[^\s]+)?/i', '[REDACTED_AUTH]', $message) ?? $message;
-        $message = preg_replace('/\bBearer\s+[A-Za-z0-9\-\._~\+\/]+=*\b/i', '[REDACTED_AUTH]', $message) ?? $message;
-
-        $message = preg_replace('/\b(access_token|refresh_token|client_secret|password)\b\s*[:=]\s*[^\s,;]+/i', '[REDACTED_SECRET]', $message) ?? $message;
-        $message = preg_replace('/"(access_token|refresh_token|client_secret|password)"\s*:\s*"[^"]*"/i', '"[REDACTED]":"[REDACTED]"', $message) ?? $message;
-
-        $message = preg_replace('/\b[A-Za-z0-9\-\._~\+\/]{64,}\b/', '[REDACTED]', $message) ?? $message;
-
-        $message = str_ireplace(
-            ['client_secret', 'access_token', 'refresh_token', 'authorization', 'bearer '],
-            '[REDACTED]',
-            $message,
-        );
-
-        $message = trim($message);
-
-        return $message === '' ? '—' : substr($message, 0, 240);
-    }
-
-    private static function sanitizeShortString(mixed $value, ?string $fallback): ?string
-    {
-        if (! is_string($value)) {
-            return $fallback;
-        }
-
-        $value = trim($value);
-
-        if ($value === '') {
-            return $fallback;
-        }
-
-        if (self::containsForbiddenKeySubstring($value)) {
-            return $fallback;
-        }
-
-        return substr($value, 0, 200);
-    }
-
-    private static function sanitizeValueString(string $value): ?string
-    {
-        $value = trim($value);
-
-        if ($value === '') {
-            return null;
-        }
-
-        if (preg_match('/\bBearer\s+[A-Za-z0-9\-\._~\+\/]+=*\b/i', $value)) {
-            return null;
-        }
-
-        if (strlen($value) > 512) {
-            return null;
-        }
-
-        if (preg_match('/\b[A-Za-z0-9\-\._~\+\/]{128,}\b/', $value)) {
-            return null;
-        }
-
-        $lower = strtolower($value);
-        foreach (self::FORBIDDEN_KEY_SUBSTRINGS as $needle) {
-            if (str_contains($lower, $needle)) {
-                return null;
-            }
-        }
-
-        return $value;
-    }
-
-    private static function containsForbiddenKeySubstring(string $value): bool
-    {
-        $lower = strtolower($value);
-
-        foreach (self::FORBIDDEN_KEY_SUBSTRINGS as $needle) {
-            if (str_contains($lower, $needle)) {
-                return true;
-            }
-        }
-
-        return false;
-    }
-}

app/Support/Verification/VerificationReportSchema.php

@@ -1,235 +0,0 @@
-<?php
-
-namespace App\Support\Verification;
-
-use DateTimeImmutable;
-
-final class VerificationReportSchema
-{
-    public const string CURRENT_SCHEMA_VERSION = '1.0.0';
-
-    /**
-     * @return array<string, mixed>|null
-     */
-    public static function normalizeReport(mixed $report): ?array
-    {
-        if (! is_array($report)) {
-            return null;
-        }
-
-        if (! self::isValidReport($report)) {
-            return null;
-        }
-
-        return $report;
-    }
-
-    /**
-     * @param  array<string, mixed>  $report
-     */
-    public static function isValidReport(array $report): bool
-    {
-        $schemaVersion = self::schemaVersion($report);
-        if ($schemaVersion === null || ! self::isSupportedSchemaVersion($schemaVersion)) {
-            return false;
-        }
-
-        if (! self::isNonEmptyString($report['flow'] ?? null)) {
-            return false;
-        }
-
-        if (! self::isIsoDateTimeString($report['generated_at'] ?? null)) {
-            return false;
-        }
-
-        if (array_key_exists('identity', $report) && ! is_array($report['identity'])) {
-            return false;
-        }
-
-        $summary = $report['summary'] ?? null;
-        if (! is_array($summary)) {
-            return false;
-        }
-
-        $overall = $summary['overall'] ?? null;
-        if (! is_string($overall) || ! in_array($overall, VerificationReportOverall::values(), true)) {
-            return false;
-        }
-
-        $counts = $summary['counts'] ?? null;
-        if (! is_array($counts)) {
-            return false;
-        }
-
-        foreach (['total', 'pass', 'fail', 'warn', 'skip', 'running'] as $key) {
-            if (! self::isNonNegativeInt($counts[$key] ?? null)) {
-                return false;
-            }
-        }
-
-        $checks = $report['checks'] ?? null;
-        if (! is_array($checks)) {
-            return false;
-        }
-
-        foreach ($checks as $check) {
-            if (! is_array($check) || ! self::isValidCheckResult($check)) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    /**
-     * @param  array<string, mixed>  $report
-     */
-    public static function schemaVersion(array $report): ?string
-    {
-        $candidate = $report['schema_version'] ?? null;
-
-        if (! is_string($candidate)) {
-            return null;
-        }
-
-        $candidate = trim($candidate);
-
-        if ($candidate === '') {
-            return null;
-        }
-
-        if (! preg_match('/^\d+\.\d+\.\d+$/', $candidate)) {
-            return null;
-        }
-
-        return $candidate;
-    }
-
-    public static function isSupportedSchemaVersion(string $schemaVersion): bool
-    {
-        $parts = explode('.', $schemaVersion, 3);
-
-        if (count($parts) !== 3) {
-            return false;
-        }
-
-        $major = (int) $parts[0];
-
-        return $major === 1;
-    }
-
-    /**
-     * @param  array<string, mixed>  $check
-     */
-    private static function isValidCheckResult(array $check): bool
-    {
-        if (! self::isNonEmptyString($check['key'] ?? null)) {
-            return false;
-        }
-
-        if (! self::isNonEmptyString($check['title'] ?? null)) {
-            return false;
-        }
-
-        $status = $check['status'] ?? null;
-        if (! is_string($status) || ! in_array($status, VerificationCheckStatus::values(), true)) {
-            return false;
-        }
-
-        $severity = $check['severity'] ?? null;
-        if (! is_string($severity) || ! in_array($severity, VerificationCheckSeverity::values(), true)) {
-            return false;
-        }
-
-        if (! is_bool($check['blocking'] ?? null)) {
-            return false;
-        }
-
-        if (! self::isNonEmptyString($check['reason_code'] ?? null)) {
-            return false;
-        }
-
-        if (! self::isNonEmptyString($check['message'] ?? null)) {
-            return false;
-        }
-
-        $evidence = $check['evidence'] ?? null;
-        if (! is_array($evidence)) {
-            return false;
-        }
-
-        foreach ($evidence as $pointer) {
-            if (! is_array($pointer) || ! self::isValidEvidencePointer($pointer)) {
-                return false;
-            }
-        }
-
-        $nextSteps = $check['next_steps'] ?? null;
-        if (! is_array($nextSteps)) {
-            return false;
-        }
-
-        foreach ($nextSteps as $step) {
-            if (! is_array($step) || ! self::isValidNextStep($step)) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    /**
-     * @param  array<string, mixed>  $pointer
-     */
-    private static function isValidEvidencePointer(array $pointer): bool
-    {
-        if (! self::isNonEmptyString($pointer['kind'] ?? null)) {
-            return false;
-        }
-
-        $value = $pointer['value'] ?? null;
-
-        return is_int($value) || self::isNonEmptyString($value);
-    }
-
-    /**
-     * @param  array<string, mixed>  $step
-     */
-    private static function isValidNextStep(array $step): bool
-    {
-        if (! self::isNonEmptyString($step['label'] ?? null)) {
-            return false;
-        }
-
-        if (! self::isNonEmptyString($step['url'] ?? null)) {
-            return false;
-        }
-
-        return true;
-    }
-
-    private static function isNonEmptyString(mixed $value): bool
-    {
-        return is_string($value) && trim($value) !== '';
-    }
-
-    private static function isNonNegativeInt(mixed $value): bool
-    {
-        return is_int($value) && $value >= 0;
-    }
-
-    private static function isIsoDateTimeString(mixed $value): bool
-    {
-        if (! self::isNonEmptyString($value)) {
-            return false;
-        }
-
-        try {
-            new DateTimeImmutable((string) $value);
-
-            return true;
-        } catch (\Throwable) {
-            return false;
-        }
-    }
-}

app/Support/Verification/VerificationReportWriter.php

@@ -1,343 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Support\Verification;
-
-use App\Models\OperationRun;
-
-final class VerificationReportWriter
-{
-    /**
-     * Baseline reason code taxonomy (v1).
-     *
-     * @var array<int, string>
-     */
-    private const array BASELINE_REASON_CODES = [
-        'ok',
-        'not_applicable',
-        'missing_configuration',
-        'permission_denied',
-        'authentication_failed',
-        'throttled',
-        'dependency_unreachable',
-        'invalid_state',
-        'unknown_error',
-    ];
-
-    /**
-     * @param  array<int, array<string, mixed>>  $checks
-     * @param  array<string, mixed>  $identity
-     * @return array<string, mixed>
-     */
-    public static function write(OperationRun $run, array $checks, array $identity = []): array
-    {
-        $flow = is_string($run->type) && trim($run->type) !== '' ? (string) $run->type : 'unknown';
-
-        $report = self::build($flow, $checks, $identity);
-        $report = VerificationReportSanitizer::sanitizeReport($report);
-
-        if (! VerificationReportSchema::isValidReport($report)) {
-            $report = VerificationReportSanitizer::sanitizeReport(self::buildFallbackReport($flow));
-        }
-
-        $context = is_array($run->context) ? $run->context : [];
-        $context['verification_report'] = $report;
-
-        $run->update(['context' => $context]);
-
-        return $report;
-    }
-
-    /**
-     * @param  array<int, array<string, mixed>>  $checks
-     * @param  array<string, mixed>  $identity
-     * @return array<string, mixed>
-     */
-    public static function build(string $flow, array $checks, array $identity = []): array
-    {
-        $flow = trim($flow);
-        $flow = $flow !== '' ? $flow : 'unknown';
-
-        $normalizedChecks = [];
-
-        foreach ($checks as $check) {
-            if (! is_array($check)) {
-                continue;
-            }
-
-            $normalizedChecks[] = self::normalizeCheckResult($check);
-        }
-
-        $counts = self::deriveCounts($normalizedChecks);
-
-        $report = [
-            'schema_version' => VerificationReportSchema::CURRENT_SCHEMA_VERSION,
-            'flow' => $flow,
-            'generated_at' => now()->toISOString(),
-            'summary' => [
-                'overall' => self::deriveOverall($normalizedChecks, $counts),
-                'counts' => $counts,
-            ],
-            'checks' => $normalizedChecks,
-        ];
-
-        if ($identity !== []) {
-            $report['identity'] = $identity;
-        }
-
-        return $report;
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private static function buildFallbackReport(string $flow): array
-    {
-        return [
-            'schema_version' => VerificationReportSchema::CURRENT_SCHEMA_VERSION,
-            'flow' => $flow !== '' ? $flow : 'unknown',
-            'generated_at' => now()->toISOString(),
-            'summary' => [
-                'overall' => VerificationReportOverall::NeedsAttention->value,
-                'counts' => [
-                    'total' => 0,
-                    'pass' => 0,
-                    'fail' => 0,
-                    'warn' => 0,
-                    'skip' => 0,
-                    'running' => 0,
-                ],
-            ],
-            'checks' => [],
-        ];
-    }
-
-    /**
-     * @param  array<string, mixed>  $check
-     * @return array{
-     *   key: string,
-     *   title: string,
-     *   status: string,
-     *   severity: string,
-     *   blocking: bool,
-     *   reason_code: string,
-     *   message: string,
-     *   evidence: array<int, array{kind: string, value: int|string}>,
-     *   next_steps: array<int, array{label: string, url: string}>
-     * }
-     */
-    private static function normalizeCheckResult(array $check): array
-    {
-        $key = self::normalizeNonEmptyString($check['key'] ?? null, fallback: 'unknown_check');
-        $title = self::normalizeNonEmptyString($check['title'] ?? null, fallback: 'Check');
-
-        return [
-            'key' => $key,
-            'title' => $title,
-            'status' => self::normalizeCheckStatus($check['status'] ?? null),
-            'severity' => self::normalizeCheckSeverity($check['severity'] ?? null),
-            'blocking' => is_bool($check['blocking'] ?? null) ? (bool) $check['blocking'] : false,
-            'reason_code' => self::normalizeReasonCode($check['reason_code'] ?? null),
-            'message' => self::normalizeNonEmptyString($check['message'] ?? null, fallback: '—'),
-            'evidence' => self::normalizeEvidence($check['evidence'] ?? null),
-            'next_steps' => self::normalizeNextSteps($check['next_steps'] ?? null),
-        ];
-    }
-
-    private static function normalizeCheckStatus(mixed $status): string
-    {
-        if (! is_string($status)) {
-            return VerificationCheckStatus::Fail->value;
-        }
-
-        $status = strtolower(trim($status));
-
-        return in_array($status, VerificationCheckStatus::values(), true)
-            ? $status
-            : VerificationCheckStatus::Fail->value;
-    }
-
-    private static function normalizeCheckSeverity(mixed $severity): string
-    {
-        if (! is_string($severity)) {
-            return VerificationCheckSeverity::Info->value;
-        }
-
-        $severity = strtolower(trim($severity));
-
-        return in_array($severity, VerificationCheckSeverity::values(), true)
-            ? $severity
-            : VerificationCheckSeverity::Info->value;
-    }
-
-    private static function normalizeReasonCode(mixed $reasonCode): string
-    {
-        if (! is_string($reasonCode)) {
-            return 'unknown_error';
-        }
-
-        $reasonCode = strtolower(trim($reasonCode));
-
-        if ($reasonCode === '') {
-            return 'unknown_error';
-        }
-
-        if (str_starts_with($reasonCode, 'ext.')) {
-            return $reasonCode;
-        }
-
-        $reasonCode = match ($reasonCode) {
-            'graph_throttled' => 'throttled',
-            'graph_timeout', 'provider_outage' => 'dependency_unreachable',
-            'provider_auth_failed' => 'authentication_failed',
-            'validation_error', 'conflict_detected' => 'invalid_state',
-            'unknown' => 'unknown_error',
-            default => $reasonCode,
-        };
-
-        return in_array($reasonCode, self::BASELINE_REASON_CODES, true) ? $reasonCode : 'unknown_error';
-    }
-
-    /**
-     * @return array<int, array{kind: string, value: int|string}>
-     */
-    private static function normalizeEvidence(mixed $evidence): array
-    {
-        if (! is_array($evidence)) {
-            return [];
-        }
-
-        $normalized = [];
-
-        foreach ($evidence as $pointer) {
-            if (! is_array($pointer)) {
-                continue;
-            }
-
-            $kind = self::normalizeNonEmptyString($pointer['kind'] ?? null, fallback: null);
-            $value = $pointer['value'] ?? null;
-
-            if ($kind === null) {
-                continue;
-            }
-
-            if (! is_int($value) && ! is_string($value)) {
-                continue;
-            }
-
-            if (is_string($value) && trim($value) === '') {
-                continue;
-            }
-
-            $normalized[] = [
-                'kind' => $kind,
-                'value' => is_int($value) ? $value : trim($value),
-            ];
-        }
-
-        return $normalized;
-    }
-
-    /**
-     * @return array<int, array{label: string, url: string}>
-     */
-    private static function normalizeNextSteps(mixed $steps): array
-    {
-        if (! is_array($steps)) {
-            return [];
-        }
-
-        $normalized = [];
-
-        foreach ($steps as $step) {
-            if (! is_array($step)) {
-                continue;
-            }
-
-            $label = self::normalizeNonEmptyString($step['label'] ?? null, fallback: null);
-            $url = self::normalizeNonEmptyString($step['url'] ?? null, fallback: null);
-
-            if ($label === null || $url === null) {
-                continue;
-            }
-
-            $normalized[] = [
-                'label' => $label,
-                'url' => $url,
-            ];
-        }
-
-        return $normalized;
-    }
-
-    /**
-     * @param  array<int, array{status: string, blocking: bool}>  $checks
-     * @return array{total: int, pass: int, fail: int, warn: int, skip: int, running: int}
-     */
-    private static function deriveCounts(array $checks): array
-    {
-        $counts = [
-            'total' => count($checks),
-            'pass' => 0,
-            'fail' => 0,
-            'warn' => 0,
-            'skip' => 0,
-            'running' => 0,
-        ];
-
-        foreach ($checks as $check) {
-            $status = $check['status'] ?? null;
-
-            if (! is_string($status) || ! array_key_exists($status, $counts)) {
-                continue;
-            }
-
-            $counts[$status] += 1;
-        }
-
-        return $counts;
-    }
-
-    /**
-     * @param  array<int, array{status: string, blocking: bool}>  $checks
-     * @param  array{total: int, pass: int, fail: int, warn: int, skip: int, running: int}  $counts
-     */
-    private static function deriveOverall(array $checks, array $counts): string
-    {
-        if (($counts['running'] ?? 0) > 0) {
-            return VerificationReportOverall::Running->value;
-        }
-
-        if (($counts['total'] ?? 0) === 0) {
-            return VerificationReportOverall::NeedsAttention->value;
-        }
-
-        foreach ($checks as $check) {
-            if (($check['status'] ?? null) === VerificationCheckStatus::Fail->value && ($check['blocking'] ?? false) === true) {
-                return VerificationReportOverall::Blocked->value;
-            }
-        }
-
-        if (($counts['fail'] ?? 0) > 0 || ($counts['warn'] ?? 0) > 0) {
-            return VerificationReportOverall::NeedsAttention->value;
-        }
-
-        return VerificationReportOverall::Ready->value;
-    }
-
-    private static function normalizeNonEmptyString(mixed $value, ?string $fallback): ?string
-    {
-        if (! is_string($value)) {
-            return $fallback;
-        }
-
-        $value = trim($value);
-
-        if ($value === '') {
-            return $fallback;
-        }
-
-        return $value;
-    }
-}

config/graph_contracts.php

@@ -11,6 +11,17 @@
     | and drift checks.
     |
     */
+    'probes' => [
+        'organization' => [
+            'path' => 'organization',
+        ],
+        'service_principal_by_app_id' => [
+            'path' => "servicePrincipals?\$filter=appId eq '{appId}'",
+        ],
+        'service_principal_app_role_assignments' => [
+            'path' => 'servicePrincipals/{servicePrincipalId}/appRoleAssignments',
+        ],
+    ],
     'types' => [
         'directoryGroups' => [
             'resource' => 'groups',

database/factories/OperationRunFactory.php

@@ -5,6 +5,7 @@
 use App\Models\OperationRun;
 use App\Models\Tenant;
 use App\Models\User;
+use App\Models\Workspace;
 use App\Support\OperationRunOutcome;
 use App\Support\OperationRunStatus;
 use App\Support\OperationRunType;
@@ -20,7 +21,29 @@ class OperationRunFactory extends Factory
     public function definition(): array
     {
         return [
-            'tenant_id' => Tenant::factory(),
+            'tenant_id' => Tenant::factory()->for(Workspace::factory()),
+            'workspace_id' => function (array $attributes): int {
+                $tenantId = $attributes['tenant_id'] ?? null;
+
+                if (! is_numeric($tenantId)) {
+                    return (int) Workspace::factory()->create()->getKey();
+                }
+
+                $tenant = Tenant::query()->whereKey((int) $tenantId)->first();
+
+                if (! $tenant instanceof Tenant) {
+                    return (int) Workspace::factory()->create()->getKey();
+                }
+
+                if ($tenant->workspace_id === null) {
+                    $workspaceId = (int) Workspace::factory()->create()->getKey();
+                    $tenant->forceFill(['workspace_id' => $workspaceId])->save();
+
+                    return $workspaceId;
+                }
+
+                return (int) $tenant->workspace_id;
+            },
             'user_id' => User::factory(),
             'initiator_name' => fake()->name(),
             'type' => fake()->randomElement(OperationRunType::values()),

database/factories/ProviderConnectionFactory.php

@@ -4,6 +4,7 @@
 
 use App\Models\ProviderConnection;
 use App\Models\Tenant;
+use App\Models\Workspace;
 use Illuminate\Database\Eloquent\Factories\Factory;
 
 /**
@@ -16,7 +17,29 @@ class ProviderConnectionFactory extends Factory
     public function definition(): array
     {
         return [
-            'tenant_id' => Tenant::factory(),
+            'tenant_id' => Tenant::factory()->for(Workspace::factory()),
+            'workspace_id' => function (array $attributes): int {
+                $tenantId = $attributes['tenant_id'] ?? null;
+
+                if (! is_numeric($tenantId)) {
+                    return (int) Workspace::factory()->create()->getKey();
+                }
+
+                $tenant = Tenant::query()->whereKey((int) $tenantId)->first();
+
+                if (! $tenant instanceof Tenant) {
+                    return (int) Workspace::factory()->create()->getKey();
+                }
+
+                if ($tenant->workspace_id === null) {
+                    $workspaceId = (int) Workspace::factory()->create()->getKey();
+                    $tenant->forceFill(['workspace_id' => $workspaceId])->save();
+
+                    return $workspaceId;
+                }
+
+                return (int) $tenant->workspace_id;
+            },
             'provider' => 'microsoft',
             'entra_tenant_id' => fake()->uuid(),
             'display_name' => fake()->company(),

database/migrations/2026_02_04_090010_update_tenant_onboarding_sessions_constraints.php

@@ -0,0 +1,246 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('managed_tenant_onboarding_sessions')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            Schema::disableForeignKeyConstraints();
+
+            Schema::rename('managed_tenant_onboarding_sessions', 'managed_tenant_onboarding_sessions_old');
+
+            foreach ([
+                'managed_tenant_onboarding_sessions_workspace_id_tenant_id_unique',
+                'managed_tenant_onboarding_sessions_tenant_id_index',
+            ] as $indexName) {
+                DB::statement("DROP INDEX IF EXISTS {$indexName}");
+            }
+
+            Schema::create('managed_tenant_onboarding_sessions', function (Blueprint $table) {
+                $table->id();
+                $table->foreignId('workspace_id')->constrained()->cascadeOnDelete();
+                $table->foreignId('tenant_id')->nullable()->constrained()->cascadeOnDelete();
+                $table->string('entra_tenant_id');
+                $table->string('current_step')->nullable();
+                $table->json('state')->nullable();
+                $table->foreignId('started_by_user_id')->nullable()->constrained('users')->nullOnDelete();
+                $table->foreignId('updated_by_user_id')->nullable()->constrained('users')->nullOnDelete();
+                $table->timestamp('completed_at')->nullable();
+                $table->timestamps();
+
+                $table->index('tenant_id');
+                $table->index('entra_tenant_id');
+            });
+
+            DB::table('managed_tenant_onboarding_sessions_old')
+                ->orderBy('id')
+                ->chunkById(500, function ($rows): void {
+                    foreach ($rows as $row) {
+                        $state = is_string($row->state) ? json_decode($row->state, true) : null;
+                        $state = is_array($state) ? $state : [];
+
+                        $entraTenantId = $row->entra_tenant_id ?? null;
+
+                        if (! is_string($entraTenantId) || trim($entraTenantId) === '') {
+                            $entraTenantId = $state['entra_tenant_id'] ?? $state['tenant_id'] ?? null;
+                        }
+
+                        if (! is_string($entraTenantId) || trim($entraTenantId) === '') {
+                            $entraTenantId = DB::table('tenants')
+                                ->where('id', $row->tenant_id)
+                                ->value('tenant_id');
+                        }
+
+                        $entraTenantId = is_string($entraTenantId) ? trim($entraTenantId) : '';
+
+                        if ($entraTenantId === '') {
+                            $entraTenantId = sprintf('unknown-%d', (int) $row->id);
+                        }
+
+                        DB::table('managed_tenant_onboarding_sessions')->insert([
+                            'id' => $row->id,
+                            'workspace_id' => $row->workspace_id,
+                            'tenant_id' => $row->tenant_id,
+                            'entra_tenant_id' => $entraTenantId,
+                            'current_step' => $row->current_step,
+                            'state' => $row->state,
+                            'started_by_user_id' => $row->started_by_user_id,
+                            'updated_by_user_id' => $row->updated_by_user_id,
+                            'completed_at' => $row->completed_at,
+                            'created_at' => $row->created_at,
+                            'updated_at' => $row->updated_at,
+                        ]);
+                    }
+                }, 'id');
+
+            Schema::drop('managed_tenant_onboarding_sessions_old');
+
+            DB::statement('CREATE UNIQUE INDEX managed_tenant_onboarding_sessions_active_workspace_entra_unique ON managed_tenant_onboarding_sessions (workspace_id, entra_tenant_id) WHERE completed_at IS NULL');
+            DB::statement('CREATE UNIQUE INDEX managed_tenant_onboarding_sessions_active_tenant_unique ON managed_tenant_onboarding_sessions (tenant_id) WHERE completed_at IS NULL AND tenant_id IS NOT NULL');
+
+            Schema::enableForeignKeyConstraints();
+
+            return;
+        }
+
+        if (! Schema::hasColumn('managed_tenant_onboarding_sessions', 'entra_tenant_id')) {
+            Schema::table('managed_tenant_onboarding_sessions', function (Blueprint $table) {
+                $table->string('entra_tenant_id')->nullable()->after('tenant_id');
+            });
+        }
+
+        $this->backfillEntraTenantId($driver);
+
+        if ($driver === 'pgsql') {
+            DB::statement('ALTER TABLE managed_tenant_onboarding_sessions ALTER COLUMN tenant_id DROP NOT NULL');
+            DB::statement('ALTER TABLE managed_tenant_onboarding_sessions ALTER COLUMN entra_tenant_id SET NOT NULL');
+        }
+
+        Schema::table('managed_tenant_onboarding_sessions', function (Blueprint $table) {
+            $table->dropUnique(['workspace_id', 'tenant_id']);
+            $table->index('entra_tenant_id');
+        });
+
+        DB::statement('CREATE UNIQUE INDEX IF NOT EXISTS managed_tenant_onboarding_sessions_active_workspace_entra_unique ON managed_tenant_onboarding_sessions (workspace_id, entra_tenant_id) WHERE completed_at IS NULL');
+        DB::statement('CREATE UNIQUE INDEX IF NOT EXISTS managed_tenant_onboarding_sessions_active_tenant_unique ON managed_tenant_onboarding_sessions (tenant_id) WHERE completed_at IS NULL AND tenant_id IS NOT NULL');
+    }
+
+    public function down(): void
+    {
+        if (! Schema::hasTable('managed_tenant_onboarding_sessions')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            Schema::disableForeignKeyConstraints();
+
+            Schema::rename('managed_tenant_onboarding_sessions', 'managed_tenant_onboarding_sessions_new');
+
+            foreach ([
+                'managed_tenant_onboarding_sessions_active_workspace_entra_unique',
+                'managed_tenant_onboarding_sessions_active_tenant_unique',
+                'managed_tenant_onboarding_sessions_tenant_id_index',
+                'managed_tenant_onboarding_sessions_entra_tenant_id_index',
+            ] as $indexName) {
+                DB::statement("DROP INDEX IF EXISTS {$indexName}");
+            }
+
+            Schema::create('managed_tenant_onboarding_sessions', function (Blueprint $table) {
+                $table->id();
+                $table->foreignId('workspace_id')->constrained()->cascadeOnDelete();
+                $table->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+                $table->string('current_step')->nullable();
+                $table->json('state')->nullable();
+                $table->foreignId('started_by_user_id')->nullable()->constrained('users')->nullOnDelete();
+                $table->foreignId('updated_by_user_id')->nullable()->constrained('users')->nullOnDelete();
+                $table->timestamp('completed_at')->nullable();
+                $table->timestamps();
+
+                $table->unique(['workspace_id', 'tenant_id']);
+                $table->index(['tenant_id']);
+            });
+
+            DB::table('managed_tenant_onboarding_sessions_new')
+                ->whereNotNull('tenant_id')
+                ->orderBy('id')
+                ->chunkById(500, function ($rows): void {
+                    foreach ($rows as $row) {
+                        DB::table('managed_tenant_onboarding_sessions')->insert([
+                            'id' => $row->id,
+                            'workspace_id' => $row->workspace_id,
+                            'tenant_id' => $row->tenant_id,
+                            'current_step' => $row->current_step,
+                            'state' => $row->state,
+                            'started_by_user_id' => $row->started_by_user_id,
+                            'updated_by_user_id' => $row->updated_by_user_id,
+                            'completed_at' => $row->completed_at,
+                            'created_at' => $row->created_at,
+                            'updated_at' => $row->updated_at,
+                        ]);
+                    }
+                }, 'id');
+
+            Schema::drop('managed_tenant_onboarding_sessions_new');
+            Schema::enableForeignKeyConstraints();
+
+            return;
+        }
+
+        foreach ([
+            'managed_tenant_onboarding_sessions_active_workspace_entra_unique',
+            'managed_tenant_onboarding_sessions_active_tenant_unique',
+        ] as $indexName) {
+            DB::statement("DROP INDEX IF EXISTS {$indexName}");
+        }
+
+        if (Schema::hasColumn('managed_tenant_onboarding_sessions', 'entra_tenant_id')) {
+            Schema::table('managed_tenant_onboarding_sessions', function (Blueprint $table) {
+                $table->dropIndex(['entra_tenant_id']);
+                $table->dropColumn('entra_tenant_id');
+                $table->unique(['workspace_id', 'tenant_id']);
+            });
+        }
+    }
+
+    private function backfillEntraTenantId(string $driver): void
+    {
+        if ($driver === 'pgsql') {
+            DB::statement(<<<'SQL'
+                UPDATE managed_tenant_onboarding_sessions
+                SET entra_tenant_id = COALESCE(managed_tenant_onboarding_sessions.entra_tenant_id, tenants.tenant_id, managed_tenant_onboarding_sessions.state->>'tenant_id')
+                FROM tenants
+                WHERE managed_tenant_onboarding_sessions.entra_tenant_id IS NULL
+                  AND managed_tenant_onboarding_sessions.tenant_id = tenants.id
+            SQL);
+
+            DB::statement(<<<'SQL'
+                UPDATE managed_tenant_onboarding_sessions
+                SET entra_tenant_id = state->>'tenant_id'
+                WHERE entra_tenant_id IS NULL
+            SQL);
+
+            return;
+        }
+
+        DB::table('managed_tenant_onboarding_sessions')
+            ->whereNull('entra_tenant_id')
+            ->orderBy('id')
+            ->chunkById(500, function ($rows): void {
+                foreach ($rows as $row) {
+                    $state = is_string($row->state) ? json_decode($row->state, true) : null;
+                    $state = is_array($state) ? $state : [];
+
+                    $entraTenantId = $state['entra_tenant_id'] ?? $state['tenant_id'] ?? null;
+
+                    if (! is_string($entraTenantId) || trim($entraTenantId) === '') {
+                        $entraTenantId = DB::table('tenants')
+                            ->where('id', $row->tenant_id)
+                            ->value('tenant_id');
+                    }
+
+                    $entraTenantId = is_string($entraTenantId) ? trim($entraTenantId) : '';
+
+                    if ($entraTenantId === '') {
+                        $entraTenantId = sprintf('unknown-%d', (int) $row->id);
+                    }
+
+                    DB::table('managed_tenant_onboarding_sessions')
+                        ->where('id', $row->id)
+                        ->update(['entra_tenant_id' => $entraTenantId]);
+                }
+            }, 'id');
+    }
+};

database/migrations/2026_02_04_090020_make_provider_connections_workspace_owned.php

@@ -0,0 +1,134 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('provider_connections')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            if (! Schema::hasColumn('provider_connections', 'workspace_id')) {
+                Schema::table('provider_connections', function (Blueprint $table): void {
+                    $table->unsignedBigInteger('workspace_id')->nullable()->after('id');
+                });
+            }
+
+            DB::statement(<<<'SQL'
+                UPDATE provider_connections
+                SET workspace_id = (
+                    SELECT tenants.workspace_id
+                    FROM tenants
+                    WHERE tenants.id = provider_connections.tenant_id
+                )
+                WHERE workspace_id IS NULL
+            SQL);
+
+            Schema::table('provider_connections', function (Blueprint $table): void {
+                $table->index(['workspace_id', 'provider', 'status']);
+                $table->index(['workspace_id', 'provider', 'health_status']);
+            });
+
+            return;
+        }
+
+        if (! Schema::hasColumn('provider_connections', 'workspace_id')) {
+            Schema::table('provider_connections', function (Blueprint $table) use ($driver): void {
+                $column = $table->foreignId('workspace_id')->nullable();
+
+                if ($driver !== 'sqlite') {
+                    $column->after('id')->constrained('workspaces')->cascadeOnDelete();
+                }
+
+                $table->index('workspace_id');
+            });
+        }
+
+        $this->backfillWorkspaceId($driver);
+
+        if ($driver === 'pgsql') {
+            DB::statement('ALTER TABLE provider_connections ALTER COLUMN workspace_id SET NOT NULL');
+        }
+
+        if ($driver === 'mysql') {
+            DB::statement('ALTER TABLE provider_connections MODIFY workspace_id BIGINT UNSIGNED NOT NULL');
+        }
+
+        Schema::table('provider_connections', function (Blueprint $table): void {
+            $table->index(['workspace_id', 'provider', 'status']);
+            $table->index(['workspace_id', 'provider', 'health_status']);
+        });
+    }
+
+    public function down(): void
+    {
+        if (! Schema::hasTable('provider_connections')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            return;
+        }
+
+        if (! Schema::hasColumn('provider_connections', 'workspace_id')) {
+            return;
+        }
+
+        Schema::table('provider_connections', function (Blueprint $table): void {
+            $table->dropIndex(['workspace_id']);
+            $table->dropIndex(['workspace_id', 'provider', 'status']);
+            $table->dropIndex(['workspace_id', 'provider', 'health_status']);
+            $table->dropConstrainedForeignId('workspace_id');
+        });
+    }
+
+    private function backfillWorkspaceId(string $driver): void
+    {
+        if ($driver === 'pgsql') {
+            DB::statement(<<<'SQL'
+                UPDATE provider_connections
+                SET workspace_id = tenants.workspace_id
+                FROM tenants
+                WHERE provider_connections.workspace_id IS NULL
+                  AND provider_connections.tenant_id = tenants.id
+            SQL);
+
+            return;
+        }
+
+        DB::table('provider_connections')
+            ->whereNull('workspace_id')
+            ->orderBy('id')
+            ->chunkById(500, function ($rows): void {
+                foreach ($rows as $row) {
+                    $workspaceId = DB::table('tenants')
+                        ->where('id', $row->tenant_id)
+                        ->value('workspace_id');
+
+                    if ($workspaceId === null) {
+                        $workspaceId = DB::table('tenant_memberships')
+                            ->join('workspace_memberships', 'workspace_memberships.user_id', '=', 'tenant_memberships.user_id')
+                            ->where('tenant_memberships.tenant_id', (int) $row->tenant_id)
+                            ->orderByRaw("CASE tenant_memberships.role WHEN 'owner' THEN 0 WHEN 'manager' THEN 1 WHEN 'operator' THEN 2 ELSE 3 END")
+                            ->value('workspace_memberships.workspace_id');
+                    }
+
+                    if ($workspaceId !== null) {
+                        DB::table('provider_connections')
+                            ->where('id', $row->id)
+                            ->update(['workspace_id' => (int) $workspaceId]);
+                    }
+                }
+            }, 'id');
+    }
+};

database/migrations/2026_02_04_090030_add_workspace_id_to_operation_runs_table.php

@@ -0,0 +1,267 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! Schema::hasTable('operation_runs')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            Schema::disableForeignKeyConstraints();
+
+            Schema::rename('operation_runs', 'operation_runs_old');
+
+            foreach ([
+                'operation_runs_active_unique',
+                'operation_runs_tenant_id_type_created_at_index',
+                'operation_runs_tenant_id_created_at_index',
+            ] as $indexName) {
+                DB::statement("DROP INDEX IF EXISTS {$indexName}");
+            }
+
+            Schema::create('operation_runs', function (Blueprint $table) {
+                $table->id();
+                $table->foreignId('workspace_id')->constrained()->cascadeOnDelete();
+                $table->foreignId('tenant_id')->nullable()->constrained()->cascadeOnDelete();
+                $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+                $table->string('initiator_name');
+                $table->string('type');
+                $table->string('status');
+                $table->string('outcome')->default('pending');
+                $table->string('run_identity_hash');
+                $table->json('summary_counts')->default('{}');
+                $table->json('failure_summary')->default('[]');
+                $table->json('context')->default('{}');
+                $table->timestamp('started_at')->nullable();
+                $table->timestamp('completed_at')->nullable();
+                $table->timestamps();
+
+                $table->index(['workspace_id', 'type', 'created_at']);
+                $table->index(['workspace_id', 'created_at']);
+                $table->index(['tenant_id', 'type', 'created_at']);
+                $table->index(['tenant_id', 'created_at']);
+            });
+
+            DB::table('operation_runs_old')
+                ->orderBy('id')
+                ->chunkById(500, function ($rows): void {
+                    foreach ($rows as $row) {
+                        $workspaceId = DB::table('tenants')
+                            ->where('id', (int) $row->tenant_id)
+                            ->value('workspace_id');
+
+                        DB::table('operation_runs')->insert([
+                            'id' => (int) $row->id,
+                            'workspace_id' => (int) $workspaceId,
+                            'tenant_id' => $row->tenant_id,
+                            'user_id' => $row->user_id,
+                            'initiator_name' => $row->initiator_name,
+                            'type' => $row->type,
+                            'status' => $row->status,
+                            'outcome' => $row->outcome,
+                            'run_identity_hash' => $row->run_identity_hash,
+                            'summary_counts' => $row->summary_counts,
+                            'failure_summary' => $row->failure_summary,
+                            'context' => $row->context,
+                            'started_at' => $row->started_at,
+                            'completed_at' => $row->completed_at,
+                            'created_at' => $row->created_at,
+                            'updated_at' => $row->updated_at,
+                        ]);
+                    }
+                }, 'id');
+
+            Schema::drop('operation_runs_old');
+
+            DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique_tenant ON operation_runs (tenant_id, run_identity_hash) WHERE tenant_id IS NOT NULL AND status IN ('queued', 'running')");
+            DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique_workspace ON operation_runs (workspace_id, run_identity_hash) WHERE tenant_id IS NULL AND status IN ('queued', 'running')");
+
+            Schema::enableForeignKeyConstraints();
+
+            return;
+        }
+
+        if (! Schema::hasColumn('operation_runs', 'workspace_id')) {
+            Schema::table('operation_runs', function (Blueprint $table) use ($driver): void {
+                $column = $table->foreignId('workspace_id')->nullable();
+
+                if ($driver !== 'sqlite') {
+                    $column->after('id')->constrained()->cascadeOnDelete();
+                }
+
+                $table->index(['workspace_id', 'type', 'created_at']);
+                $table->index(['workspace_id', 'created_at']);
+            });
+        }
+
+        $this->backfillWorkspaceId($driver);
+
+        if ($driver === 'pgsql') {
+            DB::statement('ALTER TABLE operation_runs ALTER COLUMN tenant_id DROP NOT NULL');
+            DB::statement('ALTER TABLE operation_runs ALTER COLUMN workspace_id SET NOT NULL');
+        }
+
+        if ($driver === 'mysql') {
+            DB::statement('ALTER TABLE operation_runs MODIFY tenant_id BIGINT UNSIGNED NULL');
+            DB::statement('ALTER TABLE operation_runs MODIFY workspace_id BIGINT UNSIGNED NOT NULL');
+        }
+
+        DB::statement('DROP INDEX IF EXISTS operation_runs_active_unique');
+
+        DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique_tenant ON operation_runs (tenant_id, run_identity_hash) WHERE tenant_id IS NOT NULL AND status IN ('queued', 'running')");
+        DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique_workspace ON operation_runs (workspace_id, run_identity_hash) WHERE tenant_id IS NULL AND status IN ('queued', 'running')");
+    }
+
+    public function down(): void
+    {
+        if (! Schema::hasTable('operation_runs')) {
+            return;
+        }
+
+        $driver = Schema::getConnection()->getDriverName();
+
+        if ($driver === 'sqlite') {
+            Schema::disableForeignKeyConstraints();
+
+            Schema::rename('operation_runs', 'operation_runs_with_workspace');
+
+            foreach ([
+                'operation_runs_active_unique_tenant',
+                'operation_runs_active_unique_workspace',
+                'operation_runs_workspace_id_type_created_at_index',
+                'operation_runs_workspace_id_created_at_index',
+                'operation_runs_tenant_id_type_created_at_index',
+                'operation_runs_tenant_id_created_at_index',
+            ] as $indexName) {
+                DB::statement("DROP INDEX IF EXISTS {$indexName}");
+            }
+
+            Schema::create('operation_runs', function (Blueprint $table) {
+                $table->id();
+                $table->foreignId('tenant_id')->constrained()->cascadeOnDelete();
+                $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+                $table->string('initiator_name');
+                $table->string('type');
+                $table->string('status');
+                $table->string('outcome')->default('pending');
+                $table->string('run_identity_hash');
+                $table->json('summary_counts')->default('{}');
+                $table->json('failure_summary')->default('[]');
+                $table->json('context')->default('{}');
+                $table->timestamp('started_at')->nullable();
+                $table->timestamp('completed_at')->nullable();
+                $table->timestamps();
+
+                $table->index(['tenant_id', 'type', 'created_at']);
+                $table->index(['tenant_id', 'created_at']);
+            });
+
+            DB::table('operation_runs_with_workspace')
+                ->whereNotNull('tenant_id')
+                ->orderBy('id')
+                ->chunkById(500, function ($rows): void {
+                    foreach ($rows as $row) {
+                        DB::table('operation_runs')->insert([
+                            'id' => (int) $row->id,
+                            'tenant_id' => (int) $row->tenant_id,
+                            'user_id' => $row->user_id,
+                            'initiator_name' => $row->initiator_name,
+                            'type' => $row->type,
+                            'status' => $row->status,
+                            'outcome' => $row->outcome,
+                            'run_identity_hash' => $row->run_identity_hash,
+                            'summary_counts' => $row->summary_counts,
+                            'failure_summary' => $row->failure_summary,
+                            'context' => $row->context,
+                            'started_at' => $row->started_at,
+                            'completed_at' => $row->completed_at,
+                            'created_at' => $row->created_at,
+                            'updated_at' => $row->updated_at,
+                        ]);
+                    }
+                }, 'id');
+
+            Schema::drop('operation_runs_with_workspace');
+
+            DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique ON operation_runs (tenant_id, run_identity_hash) WHERE status IN ('queued', 'running')");
+
+            Schema::enableForeignKeyConstraints();
+
+            return;
+        }
+
+        DB::statement('DROP INDEX IF EXISTS operation_runs_active_unique_tenant');
+        DB::statement('DROP INDEX IF EXISTS operation_runs_active_unique_workspace');
+        DB::statement('DROP INDEX IF EXISTS operation_runs_active_unique');
+
+        DB::statement("CREATE UNIQUE INDEX operation_runs_active_unique ON operation_runs (tenant_id, run_identity_hash) WHERE status IN ('queued', 'running')");
+
+        if ($driver === 'pgsql') {
+            DB::statement('ALTER TABLE operation_runs ALTER COLUMN tenant_id SET NOT NULL');
+            DB::statement('ALTER TABLE operation_runs ALTER COLUMN workspace_id DROP NOT NULL');
+        }
+
+        if ($driver === 'mysql') {
+            DB::statement('ALTER TABLE operation_runs MODIFY tenant_id BIGINT UNSIGNED NOT NULL');
+            DB::statement('ALTER TABLE operation_runs MODIFY workspace_id BIGINT UNSIGNED NULL');
+        }
+
+        Schema::table('operation_runs', function (Blueprint $table): void {
+            $table->dropIndex(['workspace_id', 'type', 'created_at']);
+            $table->dropIndex(['workspace_id', 'created_at']);
+            $table->dropConstrainedForeignId('workspace_id');
+        });
+    }
+
+    private function backfillWorkspaceId(string $driver): void
+    {
+        if ($driver === 'pgsql') {
+            DB::statement(<<<'SQL'
+                UPDATE operation_runs
+                SET workspace_id = tenants.workspace_id
+                FROM tenants
+                WHERE operation_runs.workspace_id IS NULL
+                  AND operation_runs.tenant_id = tenants.id
+            SQL);
+
+            return;
+        }
+
+        if ($driver === 'mysql') {
+            DB::statement(<<<'SQL'
+                UPDATE operation_runs
+                JOIN tenants ON tenants.id = operation_runs.tenant_id
+                SET operation_runs.workspace_id = tenants.workspace_id
+                WHERE operation_runs.workspace_id IS NULL
+            SQL);
+
+            return;
+        }
+
+        DB::table('operation_runs')
+            ->whereNull('workspace_id')
+            ->orderBy('id')
+            ->chunkById(500, function ($rows): void {
+                foreach ($rows as $row) {
+                    $workspaceId = DB::table('tenants')
+                        ->where('id', (int) $row->tenant_id)
+                        ->value('workspace_id');
+
+                    if ($workspaceId !== null) {
+                        DB::table('operation_runs')
+                            ->where('id', (int) $row->id)
+                            ->update(['workspace_id' => (int) $workspaceId]);
+                    }
+                }
+            }, 'id');
+    }
+};

resources/views/filament/components/verification-report-viewer.blade.php

@@ -1,178 +0,0 @@
-@php
-    $report = isset($getState) ? $getState() : ($report ?? null);
-    $report = is_array($report) ? $report : null;
-
-    $summary = $report['summary'] ?? null;
-    $summary = is_array($summary) ? $summary : null;
-
-    $counts = $summary['counts'] ?? null;
-    $counts = is_array($counts) ? $counts : [];
-
-    $checks = $report['checks'] ?? null;
-    $checks = is_array($checks) ? $checks : [];
-@endphp
-
-<div class="space-y-4">
-    @if ($report === null || $summary === null)
-        <div class="rounded-lg border border-gray-200 bg-white p-4 text-sm text-gray-600 shadow-sm dark:border-gray-800 dark:bg-gray-900 dark:text-gray-300">
-            <div class="font-medium text-gray-900 dark:text-white">
-                Verification report unavailable
-            </div>
-            <div class="mt-1">
-                This run doesn’t have a report yet. If it’s still running, refresh in a moment. If it already completed, start verification again.
-            </div>
-        </div>
-    @else
-        @php
-            $overallSpec = \App\Support\Badges\BadgeRenderer::spec(
-                \App\Support\Badges\BadgeDomain::VerificationReportOverall,
-                $summary['overall'] ?? null,
-            );
-        @endphp
-
-        <div class="flex flex-wrap items-center gap-2">
-            <x-filament::badge :color="$overallSpec->color" :icon="$overallSpec->icon">
-                {{ $overallSpec->label }}
-            </x-filament::badge>
-
-            <x-filament::badge color="gray">
-                {{ (int) ($counts['total'] ?? 0) }} total
-            </x-filament::badge>
-            <x-filament::badge color="success">
-                {{ (int) ($counts['pass'] ?? 0) }} pass
-            </x-filament::badge>
-            <x-filament::badge color="danger">
-                {{ (int) ($counts['fail'] ?? 0) }} fail
-            </x-filament::badge>
-            <x-filament::badge color="warning">
-                {{ (int) ($counts['warn'] ?? 0) }} warn
-            </x-filament::badge>
-            <x-filament::badge color="gray">
-                {{ (int) ($counts['skip'] ?? 0) }} skip
-            </x-filament::badge>
-            <x-filament::badge color="info">
-                {{ (int) ($counts['running'] ?? 0) }} running
-            </x-filament::badge>
-        </div>
-
-        @if ($checks === [])
-            <div class="rounded-lg border border-gray-200 bg-white p-4 text-sm text-gray-600 shadow-sm dark:border-gray-800 dark:bg-gray-900 dark:text-gray-300">
-                No checks found in this report. Start verification again to generate a fresh report.
-            </div>
-        @else
-            <div class="space-y-3">
-                @foreach ($checks as $check)
-                    @php
-                        $check = is_array($check) ? $check : [];
-
-                        $title = $check['title'] ?? 'Check';
-                        $title = is_string($title) && trim($title) !== '' ? $title : 'Check';
-
-                        $message = $check['message'] ?? null;
-                        $message = is_string($message) && trim($message) !== '' ? $message : null;
-
-                        $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                            \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                            $check['status'] ?? null,
-                        );
-
-                        $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
-                            \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
-                            $check['severity'] ?? null,
-                        );
-
-                        $evidence = $check['evidence'] ?? [];
-                        $evidence = is_array($evidence) ? $evidence : [];
-
-                        $nextSteps = $check['next_steps'] ?? [];
-                        $nextSteps = is_array($nextSteps) ? $nextSteps : [];
-                    @endphp
-
-                    <details class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                        <summary class="flex cursor-pointer items-start justify-between gap-4">
-                            <div class="space-y-1">
-                                <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                    {{ $title }}
-                                </div>
-                                @if ($message)
-                                    <div class="text-sm text-gray-600 dark:text-gray-300">
-                                        {{ $message }}
-                                    </div>
-                                @endif
-                            </div>
-
-                            <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
-                                <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
-                                    {{ $severitySpec->label }}
-                                </x-filament::badge>
-                                <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                    {{ $statusSpec->label }}
-                                </x-filament::badge>
-                            </div>
-                        </summary>
-
-                        @if ($evidence !== [] || $nextSteps !== [])
-                            <div class="mt-4 space-y-4">
-                                @if ($evidence !== [])
-                                    <div>
-                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                            Evidence
-                                        </div>
-                                        <ul class="mt-2 space-y-1 text-sm text-gray-700 dark:text-gray-200">
-                                            @foreach ($evidence as $pointer)
-                                                @php
-                                                    $pointer = is_array($pointer) ? $pointer : [];
-                                                    $kind = $pointer['kind'] ?? null;
-                                                    $value = $pointer['value'] ?? null;
-                                                @endphp
-
-                                                @if (is_string($kind) && $kind !== '' && (is_string($value) || is_int($value)))
-                                                    <li>
-                                                        <span class="font-medium">{{ $kind }}:</span>
-                                                        <span>{{ is_int($value) ? $value : $value }}</span>
-                                                    </li>
-                                                @endif
-                                            @endforeach
-                                        </ul>
-                                    </div>
-                                @endif
-
-                                @if ($nextSteps !== [])
-                                    <div>
-                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                            Next steps
-                                        </div>
-                                        <ul class="mt-2 space-y-1 text-sm">
-                                            @foreach ($nextSteps as $step)
-                                                @php
-                                                    $step = is_array($step) ? $step : [];
-                                                    $label = $step['label'] ?? null;
-                                                    $url = $step['url'] ?? null;
-                                                    $isExternal = is_string($url) && (str_starts_with($url, 'http://') || str_starts_with($url, 'https://'));
-                                                @endphp
-
-                                                @if (is_string($label) && $label !== '' && is_string($url) && $url !== '')
-                                                    <li>
-                                                        <a
-                                                            href="{{ $url }}"
-                                                            class="text-primary-600 hover:underline dark:text-primary-400"
-                                                            @if ($isExternal)
-                                                                target="_blank" rel="noreferrer"
-                                                            @endif
-                                                        >
-                                                            {{ $label }}
-                                                        </a>
-                                                    </li>
-                                                @endif
-                                            @endforeach
-                                        </ul>
-                                    </div>
-                                @endif
-                            </div>
-                        @endif
-                    </details>
-                @endforeach
-            </div>
-        @endif
-    @endif
-</div>

resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php

@@ -0,0 +1,136 @@
+@php
+    $fieldWrapperView = $getFieldWrapperView();
+
+    $run = $run ?? null;
+    $run = is_array($run) ? $run : null;
+
+    $runUrl = $runUrl ?? null;
+    $runUrl = is_string($runUrl) && $runUrl !== '' ? $runUrl : null;
+
+    $status = $run['status'] ?? null;
+    $status = is_string($status) ? $status : null;
+
+    $outcome = $run['outcome'] ?? null;
+    $outcome = is_string($outcome) ? $outcome : null;
+
+    $targetScope = $run['target_scope'] ?? [];
+    $targetScope = is_array($targetScope) ? $targetScope : [];
+
+    $failures = $run['failures'] ?? [];
+    $failures = is_array($failures) ? $failures : [];
+
+    $completedAt = $run['completed_at'] ?? null;
+    $completedAt = is_string($completedAt) && $completedAt !== '' ? $completedAt : null;
+
+    $completedAtLabel = null;
+
+    if ($completedAt !== null) {
+        try {
+            $completedAtLabel = \Carbon\CarbonImmutable::parse($completedAt)->format('Y-m-d H:i');
+        } catch (\Throwable) {
+            $completedAtLabel = $completedAt;
+        }
+    }
+@endphp
+
+<x-dynamic-component :component="$fieldWrapperView" :field="$field">
+    <div class="space-y-4">
+        <x-filament::section
+            heading="Verification report"
+            :description="$completedAtLabel ? ('Completed: ' . $completedAtLabel) : 'Stored details for the latest verification run.'"
+        >
+            @if ($run === null)
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    No verification run has been started yet.
+                </div>
+            @elseif ($status !== 'completed')
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    Report unavailable while the run is in progress. Use “Refresh” to re-check stored status.
+                </div>
+            @elseif ($outcome === 'succeeded')
+                <div class="text-sm text-gray-700 dark:text-gray-200">
+                    All verification checks passed.
+                </div>
+            @elseif ($failures === [])
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    Report unavailable. The run completed, but no failure details were recorded.
+                </div>
+            @else
+                <div class="space-y-3">
+                    <div class="text-sm font-medium text-gray-900 dark:text-white">
+                        Findings
+                    </div>
+
+                    <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-200">
+                        @foreach ($failures as $failure)
+                            @php
+                                $reasonCode = is_array($failure) ? ($failure['reason_code'] ?? null) : null;
+                                $message = is_array($failure) ? ($failure['message'] ?? null) : null;
+
+                                $reasonCode = is_string($reasonCode) && $reasonCode !== '' ? $reasonCode : null;
+                                $message = is_string($message) && $message !== '' ? $message : null;
+                            @endphp
+
+                            @if ($reasonCode !== null || $message !== null)
+                                <li class="rounded-lg border border-gray-200 bg-white p-3 dark:border-gray-800 dark:bg-gray-900">
+                                    @if ($reasonCode !== null)
+                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                            {{ $reasonCode }}
+                                        </div>
+                                    @endif
+                                    @if ($message !== null)
+                                        <div class="mt-1 text-sm text-gray-700 dark:text-gray-200">
+                                            {{ $message }}
+                                        </div>
+                                    @endif
+                                </li>
+                            @endif
+                        @endforeach
+                    </ul>
+                </div>
+            @endif
+
+            @if ($targetScope !== [])
+                <div class="mt-4">
+                    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                        Target scope
+                    </div>
+                    <div class="mt-2 flex flex-col gap-1 text-sm text-gray-700 dark:text-gray-200">
+                        @php
+                            $entraTenantId = $targetScope['entra_tenant_id'] ?? null;
+                            $entraTenantName = $targetScope['entra_tenant_name'] ?? null;
+
+                            $entraTenantId = is_string($entraTenantId) && $entraTenantId !== '' ? $entraTenantId : null;
+                            $entraTenantName = is_string($entraTenantName) && $entraTenantName !== '' ? $entraTenantName : null;
+                        @endphp
+
+                        @if ($entraTenantName !== null)
+                            <div>
+                                <span class="text-gray-500 dark:text-gray-400">Entra tenant:</span>
+                                <span class="font-medium text-gray-900 dark:text-gray-100">{{ $entraTenantName }}</span>
+                            </div>
+                        @endif
+
+                        @if ($entraTenantId !== null)
+                            <div>
+                                <span class="text-gray-500 dark:text-gray-400">Entra tenant ID:</span>
+                                <span class="font-medium text-gray-900 dark:text-gray-100">{{ $entraTenantId }}</span>
+                            </div>
+                        @endif
+                    </div>
+                </div>
+            @endif
+
+            @if ($runUrl !== null)
+                <div class="mt-4">
+                    <a
+                        href="{{ $runUrl }}"
+                        class="text-sm font-medium text-primary-600 hover:underline dark:text-primary-400"
+                    >
+                        Open run details
+                    </a>
+                </div>
+            @endif
+        </x-filament::section>
+    </div>
+</x-dynamic-component>

resources/views/filament/pages/operations/tenantless-operation-run-viewer.blade.php

@@ -0,0 +1,137 @@
+<x-filament-panels::page>
+    @php
+        $context = is_array($this->run->context ?? null) ? $this->run->context : [];
+        $targetScope = $context['target_scope'] ?? [];
+        $targetScope = is_array($targetScope) ? $targetScope : [];
+
+        $failures = is_array($this->run->failure_summary ?? null) ? $this->run->failure_summary : [];
+    @endphp
+
+    <div class="space-y-6">
+        <x-filament::section heading="Summary">
+            <div class="grid grid-cols-1 gap-3 text-sm text-gray-700 dark:text-gray-200 md:grid-cols-2">
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Run ID:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (int) $this->run->getKey() }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Workspace:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (string) ($this->run->workspace?->name ?? '—') }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Operation:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (string) $this->run->type }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Initiator:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (string) $this->run->initiator_name }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Status:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (string) $this->run->status }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Outcome:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ (string) $this->run->outcome }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Started:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ $this->run->started_at?->format('Y-m-d H:i') ?? '—' }}</span>
+                </div>
+
+                <div>
+                    <span class="text-gray-500 dark:text-gray-400">Completed:</span>
+                    <span class="font-medium text-gray-900 dark:text-gray-100">{{ $this->run->completed_at?->format('Y-m-d H:i') ?? '—' }}</span>
+                </div>
+            </div>
+        </x-filament::section>
+
+        <x-filament::section heading="Target scope" :collapsed="false">
+            @php
+                $entraTenantId = $targetScope['entra_tenant_id'] ?? null;
+                $entraTenantName = $targetScope['entra_tenant_name'] ?? null;
+
+                $entraTenantId = is_string($entraTenantId) && $entraTenantId !== '' ? $entraTenantId : null;
+                $entraTenantName = is_string($entraTenantName) && $entraTenantName !== '' ? $entraTenantName : null;
+            @endphp
+
+            @if ($entraTenantId === null && $entraTenantName === null)
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    No target scope details were recorded for this run.
+                </div>
+            @else
+                <div class="flex flex-col gap-2 text-sm text-gray-700 dark:text-gray-200">
+                    @if ($entraTenantName !== null)
+                        <div>
+                            <span class="text-gray-500 dark:text-gray-400">Entra tenant:</span>
+                            <span class="font-medium text-gray-900 dark:text-gray-100">{{ $entraTenantName }}</span>
+                        </div>
+                    @endif
+
+                    @if ($entraTenantId !== null)
+                        <div>
+                            <span class="text-gray-500 dark:text-gray-400">Entra tenant ID:</span>
+                            <span class="font-medium text-gray-900 dark:text-gray-100">{{ $entraTenantId }}</span>
+                        </div>
+                    @endif
+                </div>
+            @endif
+        </x-filament::section>
+
+        <x-filament::section heading="Report">
+            @if ((string) $this->run->status !== 'completed')
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    Report unavailable while the run is in progress. Use “Refresh” to re-check stored status.
+                </div>
+            @elseif ((string) $this->run->outcome === 'succeeded')
+                <div class="text-sm text-gray-700 dark:text-gray-200">
+                    No failures were reported.
+                </div>
+            @elseif ($failures === [])
+                <div class="text-sm text-gray-600 dark:text-gray-300">
+                    Report unavailable. The run completed, but no failure details were recorded.
+                </div>
+            @else
+                <div class="space-y-3">
+                    <div class="text-sm font-medium text-gray-900 dark:text-white">
+                        Findings
+                    </div>
+
+                    <ul class="space-y-2 text-sm text-gray-700 dark:text-gray-200">
+                        @foreach ($failures as $failure)
+                            @php
+                                $reasonCode = is_array($failure) ? ($failure['reason_code'] ?? null) : null;
+                                $message = is_array($failure) ? ($failure['message'] ?? null) : null;
+
+                                $reasonCode = is_string($reasonCode) && $reasonCode !== '' ? $reasonCode : null;
+                                $message = is_string($message) && $message !== '' ? $message : null;
+                            @endphp
+
+                            @if ($reasonCode !== null || $message !== null)
+                                <li class="rounded-lg border border-gray-200 bg-white p-3 dark:border-gray-800 dark:bg-gray-900">
+                                    @if ($reasonCode !== null)
+                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                            {{ $reasonCode }}
+                                        </div>
+                                    @endif
+                                    @if ($message !== null)
+                                        <div class="mt-1 text-sm text-gray-700 dark:text-gray-200">
+                                            {{ $message }}
+                                        </div>
+                                    @endif
+                                </li>
+                            @endif
+                        @endforeach
+                    </ul>
+                </div>
+            @endif
+        </x-filament::section>
+    </div>
+</x-filament-panels::page>
+

resources/views/filament/pages/workspaces/managed-tenants-landing.blade.php

@@ -21,7 +21,7 @@
                             type="button"
                             color="primary"
                             tag="a"
-                            href="{{ route('admin.workspace.managed-tenants.onboarding', ['workspace' => $this->workspace->slug ?? $this->workspace->getKey()]) }}"
+                            href="{{ route('admin.onboarding') }}"
                         >
                             Start onboarding
                         </x-filament::button>

routes/web.php

@@ -66,7 +66,7 @@
         $tenantCount = (int) $tenantsQuery->count();
 
         if ($tenantCount === 0) {
-            return redirect()->route('admin.workspace.managed-tenants.onboarding', ['workspace' => $workspace->slug ?? $workspace->getKey()]);
+            return redirect()->to('/admin/onboarding');
         }
 
         if ($tenantCount === 1) {
@@ -128,10 +128,21 @@
     DisableBladeIconComponents::class,
     DispatchServingFilamentEvent::class,
     FilamentAuthenticate::class,
-    'ensure-workspace-member',
 ])
-    ->get('/admin/w/{workspace}/managed-tenants/onboarding', \App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard::class)
+    ->get('/admin/onboarding', \App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard::class)
-    ->name('admin.workspace.managed-tenants.onboarding');
+    ->name('admin.onboarding');
+
+Route::middleware([
+    'web',
+    'panel:admin',
+    'ensure-correct-guard:web',
+    DenyNonMemberTenantAccess::class,
+    DisableBladeIconComponents::class,
+    DispatchServingFilamentEvent::class,
+    FilamentAuthenticate::class,
+])
+    ->get('/admin/operations/{run}', \App\Filament\Pages\Operations\TenantlessOperationRunViewer::class)
+    ->name('admin.operations.view');
 
 Route::middleware([
     'web',

specs/073-unified-managed-tenant-onboarding-wizard/checklists/requirements.md

@@ -1,7 +1,7 @@
-# Specification Quality Checklist: Unified Managed Tenant Onboarding Wizard (073)
+# Specification Quality Checklist: Managed Tenant Onboarding Wizard V1 (Enterprise)
 
 **Purpose**: Validate specification completeness and quality before proceeding to planning
-**Created**: 2026-02-03  
+**Created**: 2026-02-04
 **Feature**: [spec.md](../spec.md)
 
 ## Content Quality
@@ -31,6 +31,5 @@ ## Feature Readiness
 
 ## Notes
 
-- All checklist items pass.
+- Clarifications resolved: global Entra Tenant ID uniqueness (bound to one workspace), owner-only activation override with reason + audit, workspace-owned provider connections bound to a tenant by default (reuse off by default).
-- The constitution-alignment paragraphs reference platform primitives (e.g., `OperationRun`) and domain integrations (e.g., Microsoft Graph) as required by this repository’s constitution.
+- Spec is ready for `/speckit.plan`.
-- Items marked incomplete require spec updates before `/speckit.clarify` or `/speckit.plan`

specs/073-unified-managed-tenant-onboarding-wizard/contracts/http.openapi.yaml

@@ -3,43 +3,39 @@ info:
   title: TenantPilot — Managed Tenant Onboarding (073)
   version: 0.1.0
   description: |
-    Workspace-scoped onboarding wizard routes. These are UI endpoints (Filament/Livewire),
+    Onboarding wizard + tenantless operation run viewer routes.
-    but documented here for contract clarity.
+
+    These are UI endpoints (Filament/Livewire), documented here for contract clarity.
 servers:
   - url: https://example.invalid
 paths:
-  /admin/w/{workspace}/managed-tenants:
+  /admin/onboarding:
     get:
-      summary: Managed tenants landing (workspace-scoped)
+      summary: Managed tenant onboarding wizard (canonical entry point)
-      parameters:
-        - name: workspace
-          in: path
-          required: true
-          schema:
-            type: string
       responses:
         '200':
-          description: Renders managed tenants landing page.
+          description: Renders onboarding wizard page in the current workspace context.
-        '403':
+        '302':
-          description: Workspace member missing required capability (where applicable).
+          description: Redirects to workspace chooser when no workspace is selected.
-        '404':
-          description: Workspace not found or user not a member (deny-as-not-found).
-  /admin/w/{workspace}/managed-tenants/onboarding:
-    get:
-      summary: Managed tenant onboarding wizard (workspace-scoped)
-      parameters:
-        - name: workspace
-          in: path
-          required: true
-          schema:
-            type: string
-      responses:
-        '200':
-          description: Renders onboarding wizard page.
         '403':
           description: Workspace member missing onboarding capability.
         '404':
-          description: Workspace not found or user not a member (deny-as-not-found).
+          description: Workspace not found or user is not a member (deny-as-not-found).
+
+  /admin/operations/{run}:
+    get:
+      summary: Tenantless operation run viewer
+      parameters:
+        - name: run
+          in: path
+          required: true
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: Renders operation run details.
+        '404':
+          description: Run not found or actor is not a member of the run workspace (deny-as-not-found).
 
   /admin/register-tenant:
     get:
@@ -48,3 +44,19 @@ paths:
       responses:
         '404':
           description: Must be removed / behave as not found (FR-001).
+
+  /admin/new:
+    get:
+      summary: Legacy onboarding entry point
+      deprecated: true
+      responses:
+        '404':
+          description: Must not exist and must behave as not found (FR-004).
+
+  /admin/managed-tenants/onboarding:
+    get:
+      summary: Legacy onboarding entry point
+      deprecated: true
+      responses:
+        '404':
+          description: Must not exist and must behave as not found (FR-004).

specs/073-unified-managed-tenant-onboarding-wizard/contracts/onboarding-actions.md

@@ -1,32 +1,34 @@
 # Onboarding Wizard — Action Contracts (073)
 
-These are conceptual contracts for the wizard’s server-side actions (Livewire/Filament).
+These are conceptual contracts for the wizard’s server-side actions (Filament / Livewire).
 They define inputs/outputs and authorization semantics.
 
 ## Identify tenant
 
-- **Purpose:** Upsert or resume a tenant onboarding session and ensure a single tenant record exists per `(workspace_id, entra_tenant_id)`.
+- **Purpose:** Upsert or resume onboarding and ensure the managed tenant identity (Entra Tenant ID) is globally unique and bound to a single workspace.
 - **Inputs:**
   - `entra_tenant_id` (string)
+  - `environment` (string)
   - `name` (string)
-  - `domain` (string|null)
+  - `primary_domain` (string|null)
+  - `notes` (string|null)
 - **Outputs:**
-  - `tenant_id` (internal DB id)
+  - `managed_tenant_id` (internal DB id)
   - `onboarding_session_id`
   - `current_step`
 - **Errors:**
-  - 404: workspace not found or actor not a workspace member
+  - 404: workspace not found, actor not a workspace member, or Entra Tenant ID exists in a different workspace (deny-as-not-found)
   - 403: actor is a workspace member but lacks onboarding capability
 
 ## Select or create Provider Connection
 
-- **Purpose:** Attach an existing default connection (if present) or create/select another connection for the tenant.
+- **Purpose:** Select an existing provider connection in the workspace or create a new one (secrets captured safely).
 - **Inputs:**
   - `provider_connection_id` (int|null)
   - (optional) connection creation fields (non-secret identifiers only)
 - **Outputs:**
   - `provider_connection_id`
-  - `is_default`
+  - `is_default` (bool)
 - **Errors:**
   - 404: connection/tenant not in workspace scope
   - 403: member missing capability
@@ -43,6 +45,10 @@ ## Start verification
   - 404: tenant/connection not in workspace scope
   - 403: member missing capability
 
+**View run link contract:**
+- The UI must expose a tenantless “View run” URL: `/admin/operations/{run}`.
+- Access is granted only if the actor is a member of the run’s workspace; otherwise 404 (deny-as-not-found).
+
 ## Optional bootstrap actions
 
 - **Purpose:** Start selected post-verify operations as separate runs.
@@ -51,6 +57,23 @@ ## Optional bootstrap actions
 - **Errors:**
   - 403/404 semantics as above
 
+## Activate (Complete)
+
+- **Purpose:** Activate the managed tenant, making it available in the tenant switcher.
+- **Preconditions:** Provider connection exists; verification is not Blocked unless overridden by an owner.
+- **Inputs:**
+  - `override_blocked` (bool, optional)
+  - `override_reason` (string, required if override)
+- **Outputs:**
+  - `managed_tenant_id`
+  - `status` (active)
+- **Errors:**
+  - 404: managed tenant not in workspace scope / actor not a member
+  - 403: actor is a member but not an owner (owner-only activation); or missing capability
+
+**Audit requirement:**
+- Any override must record an audit event including the human-entered reason.
+
 ## Security & data minimization
 
 - Stored secrets must never be returned.

specs/073-unified-managed-tenant-onboarding-wizard/data-model.md

@@ -1,60 +1,82 @@
-# Data Model — Unified Managed Tenant Onboarding Wizard (073)
+# Data Model — Managed Tenant Onboarding Wizard V1 (Enterprise) (073)
 
 ## Entities
 
 ### Workspace
 
-Existing entity. Onboarding is always initiated within a selected workspace.
+Existing entity: `App\Models\Workspace`
+
+- Onboarding is always initiated within a selected workspace context.
+- Workspace membership is the primary isolation boundary for wizard + tenantless operations viewing.
 
 ### Tenant (Managed Tenant)
 
 Existing model: `App\Models\Tenant`
 
-**Key fields (existing or to be confirmed/extended):**
+**Key fields (existing or to extend):**
 
 - `id` (PK)
-- `workspace_id` (FK to workspaces)
+- `workspace_id` (FK → workspaces)
-- `tenant_id` (string; Entra tenant ID) — spec’s `entra_tenant_id`
+- `tenant_id` (string; Entra Tenant ID) — spec’s `entra_tenant_id` (globally unique)
-- `external_id` (string; globally unique route key used by Filament tenancy)
+- `external_id` (string; Filament tenant route key; currently used in `/admin/t/{tenant}`)
 - `name` (string)
-- `domain` (string|null)
+- `primary_domain` (string|null)
+- `notes` (text|null)
+- `environment` (string)
 - `status` (string) — v1 lifecycle:
-  - `pending` (created / onboarding)
+  - `draft`
-  - `active` (ready)
+  - `onboarding`
-  - `archived` (no longer managed)
+  - `active`
+  - `archived`
 
 **Indexes / constraints (design intent):**
 
-- Unique: `(workspace_id, tenant_id)`
+- Unique: `tenant_id` (global uniqueness; binds the tenant to exactly one workspace)
-- Keep `external_id` globally unique (for `/admin/t/{tenant}` routing) and do **not** force it to equal `tenant_id`.
+- `external_id` must remain globally unique for Filament tenancy routing
 
 **State transitions:**
 
-- `pending` → `active` after successful verification
+- `draft` → `onboarding` after identification is recorded
-- `active` → `archived` on soft-delete (existing behavior)
+- `onboarding` → `active` on owner activation
-- `archived` → `active` on restore (existing behavior)
+- `active` → `archived` via archive/deactivate workflow
 
-### ProviderConnection
+### Provider Connection
 
-Existing model: `App\Models\ProviderConnection`
+Existing model today: `App\Models\ProviderConnection` (currently tenant-owned)
 
-- Belongs to `Tenant`
+**Spec-aligned ownership model (design intent):**
-- Contains `entra_tenant_id` (string) and default/active flags.
 
-### TenantOnboardingSession (new)
+- Provider connections are workspace-owned.
+- Default binding: provider connection bound to exactly one managed tenant.
+- Reuse across managed tenants is disabled by default and policy-gated.
 
-New model/table to persist resumable onboarding state. Must never persist or return secrets.
+**Proposed key fields (target):**
+
+- `id` (PK)
+- `workspace_id` (FK → workspaces)
+- `managed_tenant_id` (FK → tenants.id; required in v1 default binding)
+- `provider` (string)
+- `entra_tenant_id` (string)
+- `is_default` (bool)
+- `metadata` (json)
+
+### Tenant Onboarding Session (new)
+
+New model/table to persist resumable onboarding state for a workspace + Entra Tenant ID.
+Must never persist secrets and must render DB-only.
 
 **Proposed fields:**
 
 - `id` (PK)
 - `workspace_id` (FK)
-- `tenant_id` (FK to tenants.id) — nullable until tenant is created, depending on wizard flow
+- `managed_tenant_id` (FK → tenants.id; nullable until tenant is created)
-- `entra_tenant_id` (string) — denormalized for upsert/idempotency before tenant exists
+- `entra_tenant_id` (string; denormalized identity key; globally unique across the system but still stored for idempotency)
-- `current_step` (string; e.g., `identify`, `connection`, `verify`, `bootstrap`, `complete`)
+- `current_step` (string; `identify`, `connection`, `verify`, `bootstrap`, `complete`)
-- `state` (jsonb/json) — safe fields only (no secrets)
+- `state` (jsonb) — safe fields only (no secrets)
   - `tenant_name`
-  - `tenant_domain`
+  - `environment`
+  - `primary_domain`
+  - `notes`
   - `selected_provider_connection_id`
   - `verification_run_id` (OperationRun id)
   - `bootstrap_run_ids` (array)
@@ -65,20 +87,34 @@ ### TenantOnboardingSession (new)
 
 **Constraints:**
 
-- Unique: `(workspace_id, entra_tenant_id)`
+- Unique: `entra_tenant_id` (global uniqueness) OR (if sessions are separate from tenants) unique `(workspace_id, entra_tenant_id)` with an additional global “tenant exists elsewhere” guard to enforce deny-as-not-found.
 
-**State transitions:**
+### Operation Run
 
-- `in_progress` (implied by `completed_at = null`) → `completed` (`completed_at != null`)
+Existing model: `App\Models\OperationRun`
+
+**Spec-aligned visibility model (design intent):**
+
+- Runs are viewable tenantlessly at `/admin/operations/{run}`.
+- Access is granted only to members of the run’s workspace; non-member → deny-as-not-found (404).
+
+**Proposed schema changes:**
+
+- Add `workspace_id` (FK → workspaces), required.
+- Allow `tenant_id` to be nullable for pre-activation runs.
+- Maintain DB-level active-run idempotency:
+  - `UNIQUE (tenant_id, run_identity_hash) WHERE tenant_id IS NOT NULL AND status IN ('queued', 'running')`
+  - `UNIQUE (workspace_id, run_identity_hash) WHERE tenant_id IS NULL AND status IN ('queued', 'running')`
 
 ## Validation rules (high level)
 
-- `entra_tenant_id` (`tenant_id`) must be a non-empty string; validate as GUID format if enforced elsewhere.
+- `entra_tenant_id`: required, non-empty, validate GUID format.
-- Tenant name required to create tenant.
+- Tenant identification requires: `name`, `environment`, `entra_tenant_id`.
-- ProviderConnection selection must belong to the same tenant/workspace.
+- Provider connection selected/created must be in the same workspace.
+- Onboarding session `state` must be strictly whitelisted fields (no secrets).
 
 ## Authorization boundaries
 
-- Workspace scope: non-members denied as 404.
+- Workspace membership boundary: non-member → 404 (deny-as-not-found) for onboarding and tenantless operations run viewing.
-- Workspace member but missing onboarding capability: 403.
+- Capability boundary (within membership): action attempts without capability → 403.
-- Tenant scope: once tenant exists/selected, tenant membership rules apply as currently implemented.
+- Owner-only boundary: activation and blocked override require workspace owner; override requires reason + audit.

specs/073-unified-managed-tenant-onboarding-wizard/plan.md

@@ -1,50 +1,45 @@
-# Implementation Plan: Unified Managed Tenant Onboarding Wizard (073)
+# Implementation Plan: Managed Tenant Onboarding Wizard V1 (Enterprise)
 
-**Branch**: `073-unified-managed-tenant-onboarding-wizard` | **Date**: 2026-02-03 | **Spec**: specs/073-unified-managed-tenant-onboarding-wizard/spec.md
+**Branch**: `073-unified-managed-tenant-onboarding-wizard` | **Date**: 2026-02-04 | **Spec**: specs/073-unified-managed-tenant-onboarding-wizard/spec.md
-**Input**: Feature specification from `specs/073-unified-managed-tenant-onboarding-wizard/spec.md`
+**Input**: Feature specification from specs/073-unified-managed-tenant-onboarding-wizard/spec.md
-
-**Note**: This template is filled in by the `/speckit.plan` command. See `.specify/scripts/` for helper scripts.
 
 ## Summary
 
-Deliver a single, resumable onboarding wizard for Managed Tenants that: (1) identifies/upserts a managed tenant within the current workspace, (2) attaches or configures a Provider Connection, (3) runs verification asynchronously as an `OperationRun` with sanitized outcomes, and (4) optionally kicks off bootstrap operations.
+Deliver a single onboarding entry point at `/admin/onboarding` that is workspace-first and tenantless until activation. Verification and optional bootstrap actions run asynchronously as `OperationRun`s and are viewable via a tenantless URL `/admin/operations/{run}` with workspace-membership based 404 semantics.
 
-Implementation approach: reuse existing primitives (`App\Models\Tenant`, Provider Connections, `provider.connection.check` operation type, workspace + tenant isolation middleware, canonical capability registries) and replace legacy tenant registration/redirect entry points with a single workspace-scoped wizard route.
+This requires:
+- Updating onboarding routing and removing legacy entry points.
+- Making the operations run viewer safe and usable without a selected workspace and without tenant routing.
+- Ensuring RBAC-UX semantics (non-member → 404, member missing capability → 403) while keeping UI discoverability (disabled+tooltip).
 
 ## Technical Context
 
-<!--
+**Language/Version**: PHP 8.4 (Laravel 12)
-  ACTION REQUIRED: Replace the content in this section with the technical details
+**Primary Dependencies**: Filament v5, Livewire v4
-  for the project. The structure here is presented in advisory capacity to guide
+**Storage**: PostgreSQL (Sail)
-  the iteration process.
+**Testing**: Pest v4
--->
+**Target Platform**: macOS dev + Sail containers; deployed in containers (Dokploy)
-
+**Project Type**: Web application
-**Language/Version**: PHP 8.4.x (Composer constraint: `^8.2`)  
+**Performance Goals**: Wizard + Monitoring pages render DB-only (no external calls); queued work for Graph
-**Primary Dependencies**: Laravel 12, Filament 5, Livewire 4+, Pest 4, Sail 1.x  
+**Constraints**:
-**Storage**: PostgreSQL (Sail) + SQLite in tests where applicable  
+- Canonical entry `/admin/onboarding` only
-**Testing**: Pest (via `vendor/bin/sail artisan test`)  
+- Tenantless operations viewer `/admin/operations/{run}` must not require selected workspace and must not auto-switch workspaces
-**Target Platform**: Web app (Sail for local dev; container-based deploy on Linux)  
+- Secrets never rendered after capture; no secrets in operation run failures/audits
-**Project Type**: Web application (Laravel monolith)  
+**Scale/Scope**: Multi-workspace admin app; onboarding must be safe, resumable, and regression-tested
-**Performance Goals**: Onboarding UI renders DB-only; all Graph calls occur in queued work tracked by `OperationRun`; avoid N+1 via eager loading for any list/detail.  
-**Constraints**: Tenant isolation (404 vs 403 semantics); no secret material ever returned to the UI/logs; idempotent run-start and onboarding session resume; destructive-like actions require confirmation.  
-**Scale/Scope**: Workspace-scoped onboarding; expected low volume but high correctness/safety requirements.
 
 ## Constitution Check
 
 *GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
 
-
+- Inventory-first: Not directly impacted.
-GATE RESULT: PASS (no planned constitution violations).
+- Read/write separation: activation + overrides are write paths → audit + tests.
-
+- Graph contract path: verification/bootstrap Graph calls only via `GraphClientInterface` and `config/graph_contracts.php` (including connectivity probes like `organization` and service-principal permission lookups).
-- Inventory-first: onboarding writes only tenant metadata + configuration pointers; no inventory/snapshot side effects.
+- Deterministic capabilities: wizard uses canonical capability registry; no role-string checks.
-- Read/write separation: onboarding creates/updates records and starts operations; all mutating actions are authorized, audited, and tested.
+- RBAC-UX: enforce 404/403 semantics; server-side authorizes all actions; UI disabled state is informational only.
-- Graph contract path: verification uses existing `GraphClientInterface` methods (e.g., `getOrganization()`), and runs only in queued jobs.
+- Authorization planes: tenant plane (Entra users) only; no platform plane (`/system`) routes or cross-plane behavior.
-- Deterministic capabilities: use `App\Support\Auth\Capabilities` + `WorkspaceRoleCapabilityMap`; add a dedicated onboarding capability granted to Owner+Manager.
+- Run observability: verification/bootstrap runs use `OperationRun`; render remains DB-only.
-- RBAC-UX semantics: workspace membership enforced via `ensure-workspace-member`; tenant membership enforced via `EnsureFilamentTenantSelected` / `DenyNonMemberTenantAccess` with deny-as-not-found (404). Missing capability returns 403.
+- Data minimization: never persist secrets in session/state/report/audit.
-- Destructive confirmation: any archive/delete/credential-rotation actions involved in onboarding must be `->action(...)->requiresConfirmation()`.
+- Badge semantics: status chips use centralized badge mapping.
-- Run observability: verification + optional bootstrap actions start via `OperationRun` and enqueue only; monitoring pages remain DB-only.
-- Data minimization: onboarding session stores only non-secret fields; run failures store reason codes + sanitized messages.
-- BADGE-001: introduce/extend Managed Tenant status badges via `BadgeCatalog` domain mapping (no per-page mapping).
 
 ## Project Structure
 
@@ -52,112 +47,72 @@ ### Documentation (this feature)
 
 ```text
 specs/073-unified-managed-tenant-onboarding-wizard/
-├── plan.md              # This file (/speckit.plan command output)
+├── plan.md
-├── research.md          # Phase 0 output (/speckit.plan command)
+├── research.md
-├── data-model.md        # Phase 1 output (/speckit.plan command)
+├── data-model.md
-├── quickstart.md        # Phase 1 output (/speckit.plan command)
+├── quickstart.md
-├── contracts/           # Phase 1 output (/speckit.plan command)
+├── contracts/
-└── tasks.md             # Phase 2 output (/speckit.tasks command - NOT created by /speckit.plan)
+│   ├── http.openapi.yaml
+│   └── onboarding-actions.md
+└── tasks.md
 ```
 
 ### Source Code (repository root)
-<!--
-  ACTION REQUIRED: Replace the placeholder tree below with the concrete layout
-  for this feature. Delete unused options and expand the chosen structure with
-  real paths (e.g., apps/admin, packages/something). The delivered plan must
-  not include Option labels.
--->
 
 ```text
 app/
-├── Filament/
+├── Filament/Pages/
-│   ├── Pages/
+├── Filament/Resources/
-│   │   └── Workspaces/
+├── Http/Middleware/
-│   │       ├── ManagedTenantsLanding.php
-│   │       └── (new) ManagedTenantOnboardingWizard.php
-│   └── Pages/Tenancy/
-│       └── RegisterTenant.php   # legacy entry point to remove/disable
-├── Http/Controllers/
-│   └── TenantOnboardingController.php # legacy admin-consent helper; evaluate usage
-├── Jobs/
-│   └── ProviderConnectionHealthCheckJob.php # verification via OperationRun
 ├── Models/
-│   ├── Tenant.php
+├── Policies/
-│   ├── ProviderConnection.php
+├── Services/
-│   └── (new) TenantOnboardingSession.php
+└── Support/
-└── Services/
-  ├── Auth/
-  │   ├── WorkspaceCapabilityResolver.php
-  │   └── WorkspaceRoleCapabilityMap.php
-  ├── Providers/
-  │   ├── ProviderOperationRegistry.php
-  │   └── ProviderGateway.php
-  └── Graph/
-    └── GraphClientInterface.php
 
 database/migrations/
-├── (new) *_add_workspace_scoped_unique_tenant_id.php
-└── (new) *_create_tenant_onboarding_sessions_table.php
-
-routes/web.php
-
 tests/Feature/
-└── (new) ManagedTenantOnboardingWizardTest.php
 ```
 
-**Structure Decision**: Laravel web application (monolith). Onboarding wizard is a Filament page mounted on a workspace-scoped route under `/admin/w/{workspace}/...` (no tenant context required to start).
+**Structure Decision**: Implement onboarding as a Filament Page under `app/Filament/Pages` and keep operations viewing on `OperationRunResource`, but change authorization/middleware to support tenantless viewing.
+
+## Phase 0 — Research
+
+See: specs/073-unified-managed-tenant-onboarding-wizard/research.md
+
+## Phase 1 — Design & Contracts
+
+See:
+- specs/073-unified-managed-tenant-onboarding-wizard/data-model.md
+- specs/073-unified-managed-tenant-onboarding-wizard/contracts/http.openapi.yaml
+- specs/073-unified-managed-tenant-onboarding-wizard/contracts/onboarding-actions.md
+- specs/073-unified-managed-tenant-onboarding-wizard/quickstart.md
+
+## Phase 2 — Planning (implementation outline)
+
+1) Routing
+- Add `/admin/onboarding` (canonical, sole entry point).
+- Remove legacy entry points (404; no redirects): `/admin/new`, `/admin/managed-tenants/onboarding`, and any tenant-scoped onboarding/create entry points.
+
+2) Tenantless operations run viewer
+- Exempt `/admin/operations/{run}` from forced workspace selection (`EnsureWorkspaceSelected`) and from tenant auto-selection side effects when needed.
+- Authorize `OperationRun` viewing by workspace membership derived from the run (non-member → 404).
+
+3) OperationRun model + schema alignment
+- Add `operation_runs.workspace_id` and support tenantless runs (`tenant_id` nullable) if onboarding verification/bootstraps start before activation.
+- Preserve DB-level active-run dedupe with partial unique indexes for both tenant-bound and tenantless runs.
+
+4) Wizard authorization model
+- Gate wizard actions per canonical capabilities; keep controls visible-but-disabled with tooltip; server-side returns 403 for execution.
+- Activation is owner-only; blocked override requires reason + audit.
+
+5) Tests
+- Add/extend Pest feature tests for:
+  - canonical `/admin/onboarding` routing
+  - legacy entry points 404
+  - `/admin/operations/{run}` membership→404 behavior without selected workspace
+  - 403 for member action attempts without capability
+  - owner-only activation + override audit reason
 
 ## Complexity Tracking
 
-> **Fill ONLY if Constitution Check has violations that must be justified**
+No constitution violations expected; changes are localized and gated by tests.
-
-| Violation | Why Needed | Simpler Alternative Rejected Because |
-|-----------|------------|-------------------------------------|
-| [e.g., 4th project] | [current need] | [why 3 projects insufficient] |
-| [e.g., Repository pattern] | [specific problem] | [why direct DB access insufficient] |
-
-No constitution violations are anticipated for this feature.
-
-## Phase 0 — Outline & Research (complete)
-
-Outputs:
-
-- `research.md`: decisions + rationale + alternatives (no unresolved clarifications).
-
-Key research conclusions:
-
-- Reuse `App\Models\Tenant` as “Managed Tenant” (no new base concept), but introduce `pending` status for the onboarding lifecycle.
-- Replace legacy onboarding/registration routes (`/admin/register-tenant`, redirects under `/admin/managed-tenants/*`) with a single workspace-scoped onboarding wizard.
-- Use existing provider verification operation type (`provider.connection.check`) executed via `ProviderConnectionHealthCheckJob` with `OperationRun` tracking.
-
-## Phase 1 — Design & Contracts (complete)
-
-Outputs:
-
-- `data-model.md`: entities, fields, relationships, validation, state transitions.
-- `contracts/*`: documented HTTP routes + action contracts (OpenAPI-style where applicable).
-- `quickstart.md`: dev notes, env vars, how to run tests.
-
-Design highlights:
-
-- Data model
-  - Tenants: change status lifecycle to include `pending`, ensure `workspace_id` is NOT NULL + FK, and enforce global uniqueness of `tenant_id` (Entra tenant ID) bound to exactly one workspace.
-  - Onboarding sessions: new table/model for resumable state (strictly non-secret) keyed by `(workspace_id, tenant_id)`.
-- Authorization
-  - Introduce a workspace capability for onboarding (e.g., `workspace_managed_tenant.onboard`) and map it to Owner+Manager via `WorkspaceRoleCapabilityMap`.
-  - Enforce server-side authorization for every mutation and operation-start; 404 for non-members and cross-workspace access; 403 for members missing capability.
-- Runs
-  - Verification is a queued `OperationRun` using `provider.connection.check`.
-  - Optional bootstrap actions become separate `OperationRun` types (only if they exist in the ProviderOperationRegistry).
-
-## Phase 2 — Implementation Plan (to be executed by /speckit.tasks)
-
-This plan intentionally stops before creating `tasks.md`.
-
-Proposed sequencing for tasks:
-
-1) Introduce `TenantOnboardingSession` model + migration, and add workspace-scoped uniqueness for tenants.
-2) Implement `ManagedTenantOnboardingWizard` page mounted at `/admin/w/{workspace}/managed-tenants/onboarding`.
-3) Wire verification start to existing `ProviderConnectionHealthCheckJob` / `provider.connection.check` operation.
-4) Remove/disable legacy entry points (`RegisterTenant`, redirect routes) and ensure “not found” behavior.
-5) Add Pest feature tests for: 404 vs 403 semantics, idempotency, resumability, and sanitized run outcomes.

specs/073-unified-managed-tenant-onboarding-wizard/quickstart.md

@@ -12,21 +12,21 @@ ## Local setup
 ## Using the wizard (expected flow)
 
 1) Sign in to `/admin`.
-2) Choose a workspace at `/admin/choose-workspace`.
+2) Open `/admin/onboarding`.
-3) Open `/admin/w/{workspace}/managed-tenants`.
+3) If no workspace is selected, you are redirected to `/admin/choose-workspace`.
-4) Start onboarding at `/admin/w/{workspace}/managed-tenants/onboarding`.
+4) Complete Identify → Connection → Verify (queued) → optional Bootstrap → Activate.
-5) Complete Identify → Connection → Verify (queued) → optional Bootstrap.
 
 Notes:
 
 - The onboarding UI must render DB-only; Graph calls occur only in queued work.
-- Verification is tracked as an `OperationRun` (module `health_check`).
+- Verification/bootstrap are tracked as `OperationRun`s.
+- The “View run” link must open `/admin/operations/{run}` (tenantless). This page must be accessible without a selected workspace, but only to members of the run’s workspace.
 
 ## Tests
 
 Run targeted tests (expected file name when implemented):
 
-- `vendor/bin/sail artisan test --compact tests/Feature/ManagedTenantOnboardingWizardTest.php`
+- `vendor/bin/sail artisan test --compact --filter=Onboarding`
 
 ## Deploy / Ops
 

specs/073-unified-managed-tenant-onboarding-wizard/research.md

@@ -1,62 +1,67 @@
-# Research — Unified Managed Tenant Onboarding Wizard (073)
+# Research — Managed Tenant Onboarding Wizard V1 (Enterprise) (073)
 
-This document resolves planning unknowns and records key implementation decisions.
+This document resolves planning unknowns and records key implementation decisions aligned with the clarified spec.
 
 ## Decisions
 
 ### 1) Managed Tenant model = existing `Tenant`
 
-- **Decision:** Treat the existing `App\Models\Tenant` as the “Managed Tenant” concept.
+- **Decision:** Treat `App\Models\Tenant` as the “Managed Tenant” record.
-- **Rationale:** The admin panel tenancy, membership model, and most operational flows already key off `Tenant`.
+- **Rationale:** Filament tenancy, membership model, and tenant-scoped flows already depend on `Tenant`; duplicating a second tenant-like table would multiply authorization and routing complexity.
-- **Alternatives considered:**
+- **Alternatives considered:** Introduce a new `ManagedTenant` model/table.
-  - Introduce a new `ManagedTenant` model/table.
+- **Why rejected:** Duplicates tenancy and membership boundaries; increases cross-plane leak risk.
-  - Keep `Tenant` as-is and build onboarding as “just another page”.
-- **Why rejected:** A second tenant-like model would duplicate authorization, routing, and operational conventions.
 
-### 2) Workspace-scoped uniqueness + stable route key
+### 2) Entra Tenant ID uniqueness = global, bound to one workspace
 
-- **Decision:** Enforce uniqueness by `(workspace_id, tenant_id)` (where `tenant_id` is the Entra tenant ID), and ensure Filament’s route tenant key stays globally unique.
+- **Decision:** Enforce global uniqueness for `tenants.tenant_id` (Entra Tenant ID) and bind it to exactly one workspace (the workspace_id on the tenant).
-- **Rationale:** The feature spec explicitly defines the uniqueness key, and cross-workspace safety requires first-class scoping.
+- **Rationale:** Matches FR-011 and the clarification decision (“global uniqueness bound to one workspace”).
-- **Implementation note:** Today `tenants.external_id` is unique and is force-set to `tenant_id` in `Tenant::saving()`. If we allow the same `tenant_id` across workspaces, `external_id` must NOT be set to `tenant_id` anymore. Prefer a generated opaque stable `external_id` (UUID) and keep `tenant_id` strictly as the business identifier.
+- **Alternatives considered:** Allow the same Entra Tenant ID in multiple workspaces.
-- **Alternatives considered:**
+- **Why rejected:** Violates the clarified requirement and complicates deny-as-not-found behavior.
-  - Keep global uniqueness on `tenant_id` and keep using `external_id = tenant_id`.
-- **Why rejected:** Conflicts with the clarified uniqueness key and complicates “deny-as-not-found” behavior via DB constraint errors.
 
-### 3) Wizard route location = workspace-scoped (`/admin/w/{workspace}/...`)
+### 3) Canonical onboarding entry point = `/admin/onboarding` (only)
 
-- **Decision:** Mount onboarding at a workspace-scoped route: `/admin/w/{workspace}/managed-tenants/onboarding`.
+- **Decision:** Provide `/admin/onboarding` as the sole onboarding entry point.
-- **Rationale:** This path is explicitly exempted from forced tenant selection in `EnsureFilamentTenantSelected`, allowing onboarding before a tenant exists.
+- **Rationale:** Keeps a single user-facing URL for enterprise workflows; avoids fragmented legacy entry points.
-- **Alternatives considered:**
+- **Alternatives considered:** Workspace-scoped onboarding route (`/admin/w/{workspace}/...`).
-  - Tenant-scoped Filament routes (`/admin/t/{tenant}/...`).
+- **Why rejected:** Conflicts with clarified spec (canonical `/admin/onboarding` only).
-  - Reusing Filament’s built-in tenant registration page (`tenantRegistration`).
-- **Why rejected:** Tenant-scoped routes require a tenant to exist/selected; built-in registration is a legacy entry point we must remove.
 
-### 4) Verification implementation = existing provider operation (`provider.connection.check`)
+### 4) Tenantless operations viewer = existing `OperationRunResource` route `/admin/operations/{run}`
 
-- **Decision:** Use `provider.connection.check` (module `health_check`) executed via `ProviderConnectionHealthCheckJob` as the onboarding verification run.
+- **Decision:** Keep the route shape `/admin/operations/{run}` (already provided by `OperationRunResource` slug `operations`) and make it compliant by changing authorization + middleware behavior.
-- **Rationale:** It already uses `OperationRun`, writes sanitized outcomes, and performs Graph calls off-request.
+- **Rationale:** Minimizes routing surface area and leverages existing Monitoring → Operations UI.
-- **Alternatives considered:**
+- **Alternatives considered:** Create a separate “run viewer” page outside the resource.
-  - New onboarding-specific operation type.
+- **Why rejected:** Duplicates infolist rendering and complicates observability conventions.
-- **Why rejected:** Adds duplication without a clear benefit for v1.
 
-### 5) Authorization surface = workspace capability (Owner+Manager)
+### 5) `/admin/operations/{run}` must not require selected workspace or auto-switch
 
-- **Decision:** Add a dedicated workspace capability for onboarding (e.g., `workspace_managed_tenant.onboard`) and grant it to workspace Owner and Manager in `WorkspaceRoleCapabilityMap`.
+- **Decision:** Exempt `/admin/operations/{run}` from forced workspace selection and from any “auto selection” side effects that would prevent tenantless viewing.
-- **Rationale:** The spec requires Owner+Manager; existing workspace capabilities don’t exactly match this (e.g., `WORKSPACE_MANAGE` is Owner-only).
+- **Rationale:** Spec requires (a) no workspace in the URL, (b) no pre-selected workspace required, (c) no auto-switching.
-- **Alternatives considered:**
+- **Alternatives considered:** Keep current `EnsureWorkspaceSelected` behavior (redirect to choose workspace).
-  - Check workspace role strings (`owner/manager`) directly.
+- **Why rejected:** Violates FR-017a and can leak resource existence via redirects.
-  - Reuse an unrelated capability like `WORKSPACE_MEMBERSHIP_MANAGE`.
-- **Why rejected:** Constitution forbids role-string checks in feature code; reusing unrelated capability broadens authorization implicitly.
 
-### 6) Legacy entry points = removed/404 (no redirects)
+### 6) OperationRun authorization = workspace membership (non-member → 404)
 
-- **Decision:** Remove/disable these entry points and ensure 404 behavior:
+- **Decision:** Authorize viewing a run by checking membership in the run’s workspace; non-member gets deny-as-not-found (404).
-  - `/admin/register-tenant` (Filament registration page)
+- **Rationale:** FR-017a defines access semantics; runs must be viewable tenantlessly before activation.
-  - `/admin/managed-tenants*` legacy redirects
+- **Alternatives considered:** Authorize by `Tenant::current()` + matching `run.tenant_id`.
-  - `/admin/new` redirect
+- **Why rejected:** Requires tenant routing/selection and breaks tenantless viewing.
-  - `/admin/w/{workspace}/managed-tenants/onboarding` redirect stub
+
-- **Rationale:** FR-001 requires wizard-only entry and “not found” behavior.
+### 7) OperationRun schema = add `workspace_id`, allow tenantless runs, preserve idempotency
+
+- **Decision:** Add `operation_runs.workspace_id` (FK) and allow `tenant_id` to be nullable for pre-activation operations. Preserve DB-level dedupe using two partial unique indexes:
+  - Tenant-bound runs: `UNIQUE (tenant_id, run_identity_hash) WHERE tenant_id IS NOT NULL AND status IN ('queued', 'running')`
+  - Tenantless runs: `UNIQUE (workspace_id, run_identity_hash) WHERE tenant_id IS NULL AND status IN ('queued', 'running')`
+- **Rationale:** Enables tenantless operations while preserving race-safe idempotency guarantees.
+- **Alternatives considered:** Keep `tenant_id` required and always derive workspace via join.
+- **Why rejected:** Blocks tenantless flows and makes authorization join-dependent.
+
+### 8) Provider connection ownership = workspace-owned, default 1:1 binding
+
+- **Decision:** Align Provider Connections to be workspace-owned and (by default) bound to exactly one managed tenant; reuse is disabled by default and policy-gated.
+- **Rationale:** Matches FR-022/022a/022b and reduces blast radius of credential reuse.
+- **Alternatives considered:** Keep provider connections tenant-owned.
+- **Why rejected:** Conflicts with clarified spec ownership model.
 
 ## Open Questions
 
-- None. All technical unknowns required for planning are resolved.
+- None for planning; implementation will need to reconcile existing DB schema and policies with the decisions above.

specs/073-unified-managed-tenant-onboarding-wizard/spec.md

@@ -1,76 +1,84 @@
-# Feature Specification: Unified Managed Tenant Onboarding Wizard (073)
+# Feature Specification: Managed Tenant Onboarding Wizard V1 (Enterprise)
 
 **Feature Branch**: `073-unified-managed-tenant-onboarding-wizard`  
-**Created**: 2026-02-03  
+**Created**: 2026-02-04  
 **Status**: Draft  
-**Input**: User description: "Single, unified onboarding wizard for Managed Tenants (create/attach connection, verify, optional bootstrap), removing all legacy entry points."
+**Input**: User description: "Spec 073 — Managed Tenant Onboarding Wizard V1 (Enterprise): single workspace-first wizard as source of truth, tenantless until activation; legacy entry points removed; strict 404/403 semantics; verification checklist with tenantless run page; optional bootstrap; enterprise-grade UX and regression tests."
 
 ## Clarifications
 
-### Session 2026-02-03
+### Session 2026-02-04
 
-- Q: Which workspace roles can start the onboarding wizard? → A: Only `owner` and `manager`.
+- Q: Capability granularity for the wizard? → A: Per-step/per-action capabilities (least-privilege). Activation is owner-only; bootstrap actions are separately gated.
-- Q: If Provider Connections already exist, what should Step 2 do? → A: Auto-use the existing default connection (and allow switching).
+- Q: For members without capability, should actions be hidden or disabled? → A: Visible but disabled, with tooltip/explanation; server-side remains authoritative.
-- Q: What is the canonical uniqueness key for a Managed Tenant? → A: Unique globally by `tenant_id` (Entra tenant ID) and bound to exactly one workspace.
+- Q: What is the tenantless “View run” URL pattern? → A: `/admin/operations/{run}` (no workspace in path), access-controlled by run.workspace membership (non-member → 404), no auto workspace switching.
-- Q: Which Managed Tenant status values exist in v1? → A: `pending`, `active`, `archived`.
+- Q: What is the canonical onboarding entry point URL? → A: `/admin/onboarding` (sole entry point in V1; no aliases).
-- Q: Who can resume an existing onboarding session? → A: Any workspace `owner/manager` with the onboarding capability (shared session per tenant).
 
 ## User Scenarios & Testing *(mandatory)*
 
-### User Story 1 - Start Managed Tenant onboarding (Priority: P1)
+### User Story 1 - Start onboarding from a single entry point (Priority: P1)
 
-As a workspace member with the required capability, I can start a single guided onboarding flow that creates (or resumes) a Managed Tenant in the current workspace, so that the tenant is always created consistently and safely.
+As a workspace member, I can open a single onboarding entry point and start (or resume) onboarding for a Managed Tenant in the currently selected workspace, so that tenant onboarding is consistent, workspace-first, and safe.
 
-**Why this priority**: This is the primary entry point and eliminates inconsistent/unsafe creation paths.
+**Why this priority**: This is the foundation for all onboarding work and replaces fragmented legacy flows.
 
-**Independent Test**: Can be fully tested by starting the onboarding in an empty workspace, completing step 1, and confirming a single Managed Tenant exists and is bound to that workspace.
+**Independent Test**: Can be fully tested by visiting `/admin/onboarding` with and without a selected workspace, completing Step 1, and verifying that a single tenant is created or resumed without duplicates.
 
 **Acceptance Scenarios**:
 
-1. **Given** a user has selected a workspace and has permission to onboard tenants, **When** they complete “Identify Managed Tenant”, **Then** exactly one Managed Tenant record exists for that workspace and tenant identifier.
+1. **Given** no workspace is selected, **When** a user visits `/admin/onboarding`, **Then** they are redirected to choose a workspace.
-2. **Given** a user repeats the same step with the same tenant identifier, **When** they submit again, **Then** no duplicate Managed Tenant is created and the existing onboarding session is continued.
+2. **Given** a workspace is selected and has no active tenants, **When** a user visits the onboarding entry point, **Then** the onboarding wizard opens directly.
+3. **Given** a workspace is selected and has at least one active tenant, **When** a user visits the onboarding entry point, **Then** the onboarding wizard is still reachable via an “Add managed tenant” call-to-action.
+4. **Given** the user identifies a tenant using an Entra Tenant ID that already exists in the same workspace, **When** they submit Step 1 again, **Then** the wizard stays on Step 1 and shows a notification that the tenant already exists with a link to open it.
+5. **Given** the user provides an Entra Tenant ID that exists in a different workspace, **When** they submit Step 1, **Then** the system responds with deny-as-not-found behavior and the UI shows a generic “Not found” notification (no details leaked).
 
 ---
 
-### User Story 2 - Configure a connection and verify access (Priority: P2)
+### User Story 2 - Attach or create a provider connection safely (Priority: P2)
 
-As a workspace member with the required capability, I can configure (or attach) a Provider Connection for the Managed Tenant and trigger a verification run, so that connectivity and permissions are validated without exposing secrets.
+As a workspace member, I can choose an existing provider connection or create a new one during onboarding, so that the system has a valid technical connection without exposing secret material.
 
-**Why this priority**: Without a validated connection, the tenant cannot be safely managed.
+**Why this priority**: Without a valid connection, verification and activation cannot be completed safely.
 
-**Independent Test**: Can be tested by completing the “Connection” step and starting a verification run, then asserting the run is created with the expected scope and that no secrets appear in run outputs.
+**Independent Test**: Can be tested by selecting “Use existing connection” vs “Create new connection”, ensuring secrets are masked and never displayed again, and verifying that onboarding state stores no secrets.
 
 **Acceptance Scenarios**:
 
-1. **Given** a Managed Tenant exists in the current workspace, **When** a user configures a connection, **Then** the system stores the connection as configured without ever showing stored secret material back to the user.
+1. **Given** the user chooses “Use existing connection”, **When** they select a connection and proceed, **Then** onboarding records the chosen connection and continues.
-2. **Given** a user confirms they granted consent, **When** they trigger verification, **Then** a background verification run is started and is visible as “queued / running / succeeded / failed” with a sanitized outcome.
+2. **Given** the user chooses “Create new connection”, **When** they input connection details, **Then** any secret input is masked and is not retrievable from the UI later.
+3. **Given** the user starts Step 2 but leaves before finishing, **When** they resume onboarding later, **Then** only non-secret inputs are prefilled and secret material is never shown.
 
 ---
 
-### User Story 3 - Resume and complete onboarding (Priority: P3)
+### User Story 3 - Verify access and review results without tenant-scoped context (Priority: P3)
 
-As a workspace member, I can resume an incomplete onboarding session and complete optional bootstrap actions, so that interrupted onboarding does not create duplicates and finishes in a “ready” state.
+As a workspace member, I can start a verification run, manually refresh its status, and view a stored checklist report (including a tenantless “View run” page), so that verification works even before the tenant is activated and without using tenant-scoped routes.
 
-**Why this priority**: Real onboarding often pauses for consent/approvals; resumability reduces rework and errors.
+**Why this priority**: Verification is the safety gate that enables activation, and it must work in empty workspaces and pre-activation flows.
 
-**Independent Test**: Can be tested by starting onboarding, leaving it incomplete, resuming, and finishing; then verifying the tenant is “ready” and optional actions create separate runs.
+**Independent Test**: Can be tested by starting verification, asserting idempotent dedupe while a run is active, verifying the viewer renders using stored data only, and verifying the “View run” link is tenantless.
 
 **Acceptance Scenarios**:
 
-1. **Given** onboarding was started but not completed, **When** the user returns later, **Then** they can resume at the correct step with previously entered (non-secret) state.
+1. **Given** verification has not been started, **When** the user clicks “Start verification”, **Then** a new verification run is started and the UI shows that verification is in progress.
-2. **Given** verification succeeded, **When** the user chooses optional bootstrap actions, **Then** each selected action starts its own background run and onboarding can still be completed.
+2. **Given** a verification run is active, **When** the user clicks “Start verification” again, **Then** the system dedupes the request and does not create a second active run.
-
+3. **Given** a verification run is active, **When** the user clicks “Refresh”, **Then** the UI updates status using stored run state.
----
+4. **Given** verification completes with any blocking failures, **When** the report is shown, **Then** the step status is “Blocked”.
+5. **Given** verification completes with warnings but no blocking failures, **When** the report is shown, **Then** the step status is “Needs attention”.
+6. **Given** verification completes with no warnings and no failures, **When** the report is shown, **Then** the step status is “Ready”.
+7. **Given** the UI shows a “View run” link, **When** the user clicks it, **Then** it opens a tenantless operations URL (not a tenant-scoped URL).
 
 ### Edge Cases
 
-- Cross-workspace isolation: a tenant identifier that exists in a different workspace must not be attachable or discoverable (deny-as-not-found).
+- Visiting legacy entry points returns “not found” behavior (no redirects).
-- Missing capability: members without the required capability see disabled UI affordances, and server-side requests are denied.
+- A non-member of the selected workspace receives deny-as-not-found behavior for the onboarding entry point.
-- Roles and capabilities: `operator` and `readonly` members cannot start onboarding by default.
+- A workspace member without the required capability can see the page, but action controls are disabled and show a tooltip; server-side action attempts are denied with 403.
-- Resume permissions: onboarding can be resumed by any authorized workspace `owner/manager` (not only the initiator).
+- Activation is owner-only: non-owners can see Step 5 but cannot activate; the UI explains “Owner required”, and server-side attempts are denied.
-- Verification failures: outcomes must be actionable (reason code + safe message) and never leak tokens/secrets.
+- Bootstrap actions are optional and gated independently per action; non-authorized users cannot start them.
-- Idempotency: repeated submissions or refreshes must not create duplicate tenants, duplicate default connections, or a runaway number of active verification runs.
+- The wizard must not generate or require tenant-scoped links before activation.
-- Last-owner protections: demoting/removing the last owner (workspace or managed tenant) is blocked and recorded for audit.
+- Manual refresh should not trigger external network calls; it may only re-read stored status/report.
+- Verification report content must never contain secrets/tokens, raw headers, or credential material.
+- Completing onboarding while verification is blocked is prevented unless an explicit override policy applies.
 
 ## Requirements *(mandatory)*
 
@@ -91,95 +99,91 @@ ## Requirements *(mandatory)*
 - ensure destructive-like actions require confirmation (`->requiresConfirmation()`),
 - include at least one positive and one negative authorization test, and note any RBAC regression tests added/updated.
 
+**Authorization plane(s) involved (filled for this feature):**
+- **Tenant plane (Entra users)** only. This feature adds tenantless, workspace-scoped routes under `/admin/*` (`/admin/onboarding`, `/admin/operations/{run}`) that must still enforce tenant-plane membership and capability rules.
+- **Platform plane (`/system`) is out of scope**. No cross-plane navigation is introduced; deny-as-not-found (404) semantics remain the default for non-members / not entitled.
+
 **Constitution alignment (OPS-EX-AUTH-001):** OIDC/SAML login handshakes may perform synchronous outbound HTTP (e.g., token exchange)
 on `/auth/*` endpoints without an `OperationRun`. This MUST NOT be used for Monitoring/Operations pages.
 
 **Constitution alignment (BADGE-001):** If this feature changes status-like badges (status/outcome/severity/risk/availability/boolean),
 the spec MUST describe how badge semantics stay centralized (no ad-hoc mappings) and which tests cover any new/changed values.
 
-### Scope & Assumptions
-
-**In scope (v1)**
-
-- A single onboarding wizard to create or resume onboarding of a Managed Tenant within a selected workspace.
-- Configure or attach a Provider Connection, guide consent, start verification runs, and optionally start bootstrap runs.
-- Completion marks the tenant as ready/active and routes the user to the tenant details.
-- Removal of all legacy UI entry points for creating/onboarding tenants (no redirects).
-
-**Out of scope (v1)**
-
-- User invitation workflows.
-- Group-based auto-provisioning.
-- Full compliance/evidence reporting.
-- Cloud resource provisioning.
-
-**Dependencies**
-
-- Workspace selection/context and workspace membership.
-- A managed-tenant concept bound to exactly one workspace.
-- Provider Connections and secure credential storage.
-- A run system to track verification and bootstrap actions.
-- Audit logging and a canonical capability registry.
-
-**Assumptions**
-
-- Default policy: the onboarding initiator becomes workspace manager and managed-tenant owner (or the closest minimum-privilege equivalents).
-- “Not found” behavior is used to avoid leaking the existence of out-of-scope tenants.
-
-### Acceptance Coverage
-
-The following acceptance coverage is required to treat the feature as complete:
-
-- Legacy entry points removed (not found behavior).
-- Workspace isolation enforced (cross-workspace attach/visibility prevented).
-- Idempotency verified (no duplicates created by repeated submissions).
-- Verification run creation and sanitized failure reporting.
-- Last-owner protections enforced and auditable.
-
 ### Functional Requirements
 
-- **FR-001 (Single entry point)**: System MUST provide exactly one UI flow to onboard a Managed Tenant (the onboarding wizard), and all other “add tenant” entry points MUST be removed and behave as “not found”.
+- **FR-001 (Single onboarding entry point)**: The system MUST provide a single onboarding entry point at `/admin/onboarding` that is the source of truth for onboarding.
-- **FR-002 (Workspace-first enforcement)**: System MUST require an active workspace context for onboarding and tenant-scoped access.
+- **FR-002 (Workspace required)**: If no workspace is selected, the onboarding entry point MUST redirect the user to a workspace chooser.
-- **FR-003 (Hard isolation)**: System MUST deny-as-not-found (404 semantics) when a Managed Tenant does not belong to the current workspace, including for attempts to attach an existing tenant identifier from another workspace.
+- **FR-003 (Workspace landing behavior)**: With a selected workspace, the system MUST:
-- **FR-004 (Authorization semantics)**: System MUST enforce authorization server-side for all onboarding mutations and run-start actions. Non-member / not entitled to tenant scope MUST be treated as 404 semantics; a member lacking the required capability MUST be treated as 403 semantics. By default, only workspace `owner` and `manager` can start the onboarding wizard.
+  - open the wizard directly when the workspace has zero active tenants, and
-- **FR-005 (Capabilities-first)**: System MUST authorize via canonical capabilities (not role string comparisons in feature code).
+  - keep the wizard reachable via an “Add managed tenant” call-to-action when the workspace has one or more active tenants.
-- **FR-006 (Idempotent tenant identification)**: System MUST upsert tenant identification by a stable tenant identifier within the workspace, so repeating step 1 never creates duplicates.
+- **FR-004 (Remove legacy entry points)**: The following legacy entry points MUST NOT exist and MUST return “not found” behavior (no redirects):
-- **FR-006a (Tenant uniqueness key)**: System MUST enforce a single Managed Tenant globally per `tenant_id` (Entra tenant ID) and bind it to exactly one workspace.
+  - `/admin/new`
-- **FR-007 (Onboarding session resumability)**: System MUST persist onboarding state (excluding secret material) so the flow can be resumed after interruption without data inconsistency.
+  - any legacy tenant-scoped create entry point
-- **FR-007a (Shared resumability)**: An onboarding session MUST be resumable by any authorized workspace `owner/manager` with the onboarding capability (not only the user who started it).
+  - `/admin/managed-tenants/onboarding` (legacy)
-- **FR-008 (Connection handling)**: System MUST allow creating or attaching a Provider Connection during onboarding and MUST never display stored secret material back to users; UI MUST only show safe configuration indicators (e.g., configured yes/no, last rotation timestamp).
+- **FR-005 (Membership boundary)**: A non-member of the selected workspace MUST always receive deny-as-not-found behavior for onboarding and for any workspace-visible operations.
-- **FR-008a (Default connection selection)**: If one or more Provider Connections already exist for the Managed Tenant, Step 2 MUST auto-select the default connection and MAY allow the user to switch to a different existing connection.
+- **FR-006 (Capability boundary)**: A workspace member without the required capability MUST be able to view the page, but action controls MUST be disabled with an explanatory tooltip; server-side action attempts MUST be denied with 403.
-- **FR-009 (Verification as runs)**: System MUST start verification as a background run with clear status and a sanitized result (reason code + short safe message).
+- **FR-006d (Discoverability default)**: In V1, capability-gated controls SHOULD remain visible but disabled with an explanation (rather than being hidden), to support enterprise operator workflows.
-- **FR-010 (DB-only UI rendering)**: System MUST render onboarding UI using only stored data; any external calls required for verification MUST occur only in background work.
+- **FR-006a (Least-privilege capability model)**: The wizard MUST gate each step and each action by canonical capabilities (no ad-hoc role string checks).
-- **FR-011 (Operational clarity)**: System MUST display verification outcomes and missing requirements in a user-actionable way (what is missing, what to do next) without leaking sensitive details.
+- **FR-006b (Wizard capability breakdown)**: The system MUST support, at minimum, distinct capability gates for:
-- **FR-012 (Optional bootstrap actions)**: System MUST support optional post-verify bootstrap actions that each start their own background run and do not block completion unless explicitly selected.
+  - identifying / creating / resuming onboarding for a managed tenant,
-- **FR-013 (Completion state)**: System MUST mark the Managed Tenant as ready/active only after successful verification, and MUST redirect users to the Managed Tenant details view upon completion.
+  - viewing/selecting a provider connection,
-- **FR-013a (Status model)**: System MUST use a v1 Managed Tenant lifecycle with statuses: `pending` (created/onboarding), `active` (ready), `archived` (no longer managed).
+  - creating/editing a provider connection,
-- **FR-014 (Membership bootstrap)**: System MUST ensure the onboarding initiator receives the minimum required memberships in the workspace and the managed tenant scope according to policy (default: workspace manager + tenant owner).
+  - starting verification,
-- **FR-015 (Last-owner protections)**: System MUST block demotion/removal of the last owner at both workspace scope and managed tenant scope, and MUST record the blocked attempt for audit.
+  - running each optional bootstrap action (inventory sync, policy sync, backup bootstrap) independently,
-- **FR-016 (Auditability)**: System MUST record audit events for tenant creation, connection creation/rotation, verification start/result, membership changes, and last-owner blocks.
+  - activating a tenant.
+- **FR-006c (Viewer visibility)**: Viewing verification reports and operation-run results MUST be permitted to workspace members (subject to workspace membership), even when they cannot start runs.
+- **FR-007 (Workspace↔tenant match hard rule)**: For any tenant-scoped route, if the tenant does not belong to the currently selected workspace, the system MUST return deny-as-not-found behavior.
+- **FR-008 (Tenantless wizard until activation)**: The wizard MUST not require tenant-scoped pages, routes, or links before the final “Complete / Activate” step.
+- **FR-009 (Identify managed tenant inputs)**: Step 1 MUST capture, at minimum:
+  - tenant name,
+  - environment,
+  - Entra Tenant ID,
+  - optional primary domain,
+  - optional notes.
+- **FR-010 (Idempotent identification)**: Step 1 MUST be idempotent for the same tenant identifier within the same workspace and MUST resume an active onboarding session when applicable.
+- **FR-011 (Uniqueness of Entra Tenant ID)**: The system MUST enforce Entra Tenant ID uniqueness globally, and each Entra Tenant ID MUST be bound to exactly one workspace in V1.
+- **FR-012 (Tenant status model)**: Managed Tenants MUST support a v1 lifecycle including: `draft`, `onboarding`, `active`, `archived`.
+- **FR-013 (Provider connection choice)**: Step 2 MUST let the user either use an existing connection or create a new connection.
+- **FR-014 (Secret safety)**: Any secret material entered during connection creation MUST be masked, stored securely, and MUST never be displayed again. Onboarding session state MUST not store secret material.
+- **FR-015 (Verification run start)**: Step 3 MUST allow starting a verification run and MUST dedupe requests while an active verification run exists.
+- **FR-016 (Verification viewer behavior)**: Step 3 MUST display a stored checklist report with:
+  - an “in progress” banner while a run is active,
+  - a manual “Refresh” control,
+  - status mapping: blocking failures → Blocked; warnings-only → Needs attention; otherwise → Ready,
+  - “Next steps” as links only (no server-side actions in V1).
+- **FR-017 (Tenantless operations page)**: The wizard’s “View run” link MUST point to `/admin/operations/{run}` and MUST never use a tenant-scoped operations URL.
+- **FR-017a (Tenantless access semantics)**: Access to `/admin/operations/{run}` MUST be granted only if the user is a member of the run’s workspace; otherwise the system MUST respond with deny-as-not-found behavior. The page MUST NOT require a pre-selected workspace context and MUST NOT auto-switch workspaces.
+- **FR-018 (Workspace-visible operations)**: Operation runs started by the wizard MUST be safely viewable in a workspace context without tenant-scoped routing and MUST honor the same deny-as-not-found membership boundary.
+- **FR-019 (Optional bootstrap step)**: Step 4 MAY offer optional bootstrap actions (e.g., inventory sync, policy sync, baseline creation) with per-action capability gating; each selected action MUST start its own operation run and be viewable tenantlessly.
+- **FR-020 (Complete / Activate gate)**: The wizard MUST only allow activation when a provider connection exists and verification is not Blocked, except when a workspace owner explicitly overrides the block.
+- **FR-020a (Override requirements)**: When overriding a blocked verification, the system MUST require a human-entered reason and MUST record an audit event capturing the override decision and reason.
+- **FR-020b (Owner-only activation)**: Activation MUST be restricted to workspace owners (non-owner members may not activate, even if they can run earlier steps).
+- **FR-021 (Activation outcome)**: On activation, the tenant MUST become visible in the workspace tenant switcher and the user MUST be redirected either to the tenant home (open now) or back to the workspace managed tenant list.
+- **FR-022 (Connection ownership model)**: Provider connections MUST be workspace-owned.
+- **FR-022a (Safe default binding)**: By default in V1, a provider connection MUST be bound to exactly one managed tenant.
+- **FR-022b (Reuse safety gate)**: Reuse of an existing provider connection for additional managed tenants MUST be disabled by default and MUST only be possible via an explicit opt-in that clearly communicates risk and is policy-gated.
+- **FR-023 (Auditability)**: The system MUST record audit events for: tenant identification, connection creation/updates, verification start/completion, bootstrap run start/completion, and activation.
+- **FR-024 (DB-only rendering)**: The wizard and the verification viewer MUST render using stored data only; any external checks MUST run as background work.
+- **FR-025 (Badge semantics)**: Step-status and verification-result chips MUST use centralized badge semantics (no per-page ad-hoc mappings), and changes MUST be covered by automated tests.
+- **FR-026 (Graph contract path)**: Any Microsoft Graph call made by verification/bootstrap runs MUST go through the canonical contract registry path (`GraphClientInterface` + `config/graph_contracts.php`). Feature code MUST NOT hardcode ad-hoc endpoints; missing contracts MUST fail safe and be covered by automated tests.
 
 ### Key Entities *(include if feature involves data)*
 
-- **Workspace**: A portfolio/customer context that owns memberships and one or more Managed Tenants.
+- **Workspace**: A portfolio context that a user selects; controls membership and owns one or more managed tenants.
-- **Managed Tenant**: A managed Entra/Intune tenant, uniquely identified within a workspace by an external tenant identifier, with lifecycle status (e.g., pending/ready/archived).
+- **Managed Tenant**: A record representing a Microsoft tenant managed by the organization; includes identity (Entra Tenant ID), environment, and lifecycle status.
-- Uniqueness: exactly one globally per `tenant_id` (Entra tenant ID), bound to exactly one workspace.
+- **Onboarding Session**: A resumable record of onboarding progress and safe, non-secret state.
-- Status values (v1): `pending`, `active`, `archived`.
+- **Provider Connection**: A technical connection configuration used to access tenant data; includes secret material that must never be displayed after capture.
-- **Provider Connection**: A technical connection configuration that enables access to a Managed Tenant; includes secure credentials/configuration metadata and enabled/default flags.
+- **Operation Run**: A trackable background run started by the wizard (verification and optional bootstrap actions) with a stored report suitable for safe, tenantless viewing.
-- **Onboarding Session**: A persistent record of onboarding progress and safe state to support resumability and idempotency.
+- **Verification Report**: A stored checklist result with per-check statuses, safe messages, evidence pointers, and “next steps” links.
-- **Verification Run**: A background run that validates connectivity and required permissions and produces a sanitized outcome.
-- **Membership (Workspace-scoped / Tenant-scoped)**: Defines who can see and operate within a workspace and on a specific managed tenant.
 
 ## Success Criteria *(mandatory)*
 
 ### Measurable Outcomes
 
-- **SC-001 (Time-to-onboard)**: A workspace admin can complete the wizard up to starting verification in under 3 minutes (excluding external consent/approval waiting time).
+- **SC-001 (Single entry point adoption)**: 100% of managed-tenant onboarding starts from the single onboarding entry point; legacy URLs return “not found” behavior.
-- **SC-002 (Idempotency)**: Re-running any wizard step does not create duplicates (0 duplicate tenants per tenant identifier per workspace; 0 duplicate default connections per tenant).
+- **SC-002 (Time to first verification)**: A workspace admin can reach “verification started” within 3 minutes of opening onboarding (excluding external consent/approval wait time).
-- **SC-003 (Authorization correctness)**: For all onboarding endpoints/actions, non-members see no discoverability and get 404 semantics; members without capability get 403 semantics; authorized users can complete the flow.
+- **SC-003 (No pre-activation tenant-scoped routing)**: Before activation, the wizard never generates tenant-scoped URLs; this is validated by regression tests.
-- **SC-004 (Secret safety)**: No secrets/tokens are present in run outputs, notifications, audit entries, or error messages (validated by automated tests that assert redaction/sanitization behavior).
+- **SC-004 (Authorization correctness)**: Non-members consistently receive deny-as-not-found behavior; members lacking capability receive 403 on action attempts; authorized users complete onboarding.
-- **SC-005 (Operational clarity)**: When verification fails, users can identify the failure reason category (via reason code + safe message) and see the next step without contacting support.
+- **SC-005 (Idempotency)**: For repeated Step 1 submissions with the same Entra Tenant ID in the same workspace, no duplicates are created and the user resumes the existing onboarding session.
-
+- **SC-006 (Secret safety)**: No secret material appears in UI, reports, notifications, logs, or audit events; validated by automated tests.
-### Badge Semantics (BADGE-001)
+- **SC-007 (Operational clarity)**: When verification is blocked, at least 90% of users can identify the reason category and next step from the report without opening a support ticket (measured via internal feedback or support tagging).
-
-- Managed Tenant status badges MUST map from the canonical status set (`pending`, `active`, `archived`) using a centralized mapping (no ad-hoc per-page mapping).

specs/073-unified-managed-tenant-onboarding-wizard/tasks.md

@@ -1,159 +1,182 @@
 ---
 
-description: "Tasks for Unified Managed Tenant Onboarding Wizard (073)"
+description: "Tasks for Managed Tenant Onboarding Wizard V1 (Enterprise) (073)"
 ---
 
-# Tasks: Unified Managed Tenant Onboarding Wizard (073)
+# Tasks: Managed Tenant Onboarding Wizard V1 (Enterprise)
 
 **Input**: Design documents from `specs/073-unified-managed-tenant-onboarding-wizard/`
+**Prerequisites**: plan.md (required), spec.md (required), research.md, data-model.md, contracts/
 
 **Tests**: Required (Pest). Use `vendor/bin/sail artisan test --compact ...`.
 
-## Phase 1: Setup
+---
 
-- [X] T001 Confirm Sail is running and DB is reachable using docker-compose.yml (command: `vendor/bin/sail up -d`)
+## Phase 1: Setup (Shared Infrastructure)
-- [X] T002 Confirm baseline tests pass for the branch using phpunit.xml and tests/ (command: `vendor/bin/sail artisan test --compact`)
+
+**Purpose**: Confirm baseline environment is ready for implementing and testing runtime behavior changes.
+
+- [x] T001 Confirm Sail is running using docker-compose.yml (command: `vendor/bin/sail up -d`)
+- [x] T002 Run a baseline test subset using phpunit.xml and tests/ (command: `vendor/bin/sail artisan test --compact`)
 
 ---
 
 ## Phase 2: Foundational (Blocking Prerequisites)
 
-**Purpose**: Shared primitives required by all user stories (authz, data model, safety semantics).
+**Purpose**: Shared primitives required by all user stories (capabilities, resumable session model, tenant status semantics).
 
-- [X] T003 Add onboarding capability constant in app/Support/Auth/Capabilities.php
+- [x] T003 Define wizard capabilities (per-step/per-action) in app/Support/Auth/Capabilities.php
-- [X] T004 Add onboarding capability mapping for Owner+Manager in app/Services/Auth/WorkspaceRoleCapabilityMap.php
+- [x] T004 [P] Map wizard capabilities to roles (least privilege) in app/Services/Auth/WorkspaceRoleCapabilityMap.php
-- [X] T005 Implement Gate/Policy for onboarding authorization in app/Providers/AuthServiceProvider.php (enforce capabilities; no role-string checks)
+- [x] T005 Implement server-side authorization checks for wizard actions in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (no role-string checks)
-- [X] T006 [P] Create TenantOnboardingSession model in app/Models/TenantOnboardingSession.php
+- [x] T006 Ensure Tenant lifecycle supports `draft|onboarding|active|archived` in app/Models/Tenant.php
-- [X] T007 Create onboarding sessions migration in database/migrations/*_create_tenant_onboarding_sessions_table.php (unique workspace_id + tenant_id)
+- [x] T007 Update onboarding session schema to match data-model (safe state only) in app/Models/TenantOnboardingSession.php
-- [X] T008 Create tenant workspace binding migration in database/migrations/*_enforce_tenant_workspace_binding.php (ensure tenants.workspace_id is NOT NULL + FK; ensure tenants.tenant_id remains globally unique; deny cross-workspace duplicates)
+- [x] T008 Update onboarding session migration constraints for idempotency in database/migrations/2026_02_04_090010_update_tenant_onboarding_sessions_constraints.php
-- [X] T009 Verify tenant routing key strategy for v1: keep existing Filament tenant route-key stable (do NOT change external_id strategy in this feature); add a regression test that /admin/t/{tenant} continues to resolve the intended managed tenant
+- [x] T009 [P] Add foundational capability + tenant lifecycle tests in tests/Feature/Onboarding/OnboardingFoundationsTest.php
-- [X] T010 [P] Add foundational authorization + data-model tests in tests/Feature/ManagedTenantOnboardingWizardTest.php (capability known, mapping correct, migrations applied)
 
-**Checkpoint**: Foundational complete — user story work can begin.
+**Checkpoint**: Foundation ready — user story implementation can begin.
 
 ---
 
-## Phase 3: User Story 1 — Start Managed Tenant onboarding (Priority: P1) 🎯 MVP
+## Phase 3: User Story 1 — Single entry point onboarding (Priority: P1) 🎯 MVP
 
-**Goal**: Start or resume a workspace-scoped onboarding wizard and create exactly one Managed Tenant per global-unique `tenant_id` (Entra tenant ID), bound to exactly one workspace.
+**Goal**: Provide `/admin/onboarding` as the sole onboarding entry point, redirect to workspace chooser if none selected, and implement Step 1 idempotent identification with strict 404/403 semantics.
 
-**Independent Test**: Start onboarding in an empty workspace and complete “Identify Managed Tenant”; assert exactly one tenant exists and a session is created/resumed.
+**Independent Test**: Visit `/admin/onboarding` with and without a selected workspace, complete Step 1, and verify exactly one tenant/session is created and cross-workspace attempts behave as 404.
 
-- [X] T011 [P] [US1] Add wizard page class in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (Filament v5 / Livewire v4)
+### Tests (write first)
-- [X] T012 [P] [US1] Add wizard view in resources/views/filament/pages/workspaces/managed-tenant-onboarding-wizard.blade.php
-- [X] T013 [US1] Register wizard route in routes/web.php at `/admin/w/{workspace}/managed-tenants/onboarding` with `ensure-workspace-member` middleware and 404 semantics for non-members
-- [X] T014 [US1] Implement wizard mount + workspace loading in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (abort 404 for non-member, 403 for missing onboarding capability)
-- [X] T015 [US1] Implement Step 1 “Identify Managed Tenant” upsert in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (transactional; idempotent by workspace_id + tenant_id; tenant status `pending`)
-- [X] T015b [US1] Enforce cross-workspace uniqueness in Step 1: if a tenant with the same tenant_id exists in a different workspace, deny-as-not-found (404) and do not create/update anything
-- [X] T015c [US1] Membership bootstrap: after tenant upsert, ensure the initiating user has a Managed Tenant membership of role owner (create if missing); never allow tenant to end up with zero owners
-- [X] T016 [US1] Persist/resume onboarding session in app/Models/TenantOnboardingSession.php (no secrets in state)
-- [X] T017 [US1] Add audit events for onboarding start/resume in app/Services/Audit/WorkspaceAuditLogger.php (or existing audit service) and call from wizard actions
-- [X] T018 [P] [US1] Add happy-path tests in tests/Feature/ManagedTenantOnboardingWizardTest.php (owner/manager can start; tenant created; session created)
-- [X] T019 [P] [US1] Add negative auth tests in tests/Feature/ManagedTenantOnboardingWizardTest.php (non-member gets 404; member without capability gets 403)
-- [X] T020 [P] [US1] Add idempotency tests in tests/Feature/ManagedTenantOnboardingWizardTest.php (repeat step does not create duplicates)
-- [X] T020b [P] [US1] Add tests asserting membership bootstrap: newly created tenant has exactly one owner membership for the initiator; attempting to remove/demote the last owner is blocked (can be a minimal service/policy-level assertion)
-- [X] T020c [P] [US1] Add tests asserting cross-workspace protection: if tenant_id exists under another workspace, the wizard returns 404 and does not reveal the existence of that tenant
 
-### Remove legacy entry points (required by FR-001)
+- [x] T010 [P] [US1] Add entry-point routing tests in tests/Feature/Onboarding/OnboardingEntryPointTest.php
+- [x] T011 [P] [US1] Add RBAC semantics tests (404 non-member, disabled UI + 403 action) in tests/Feature/Onboarding/OnboardingRbacSemanticsTest.php
+- [x] T012 [P] [US1] Add idempotency + cross-workspace isolation tests in tests/Feature/Onboarding/OnboardingIdentifyTenantTest.php
 
-- [X] T021 [US1] Remove tenant registration from app/Providers/Filament/AdminPanelProvider.php (drop `->tenantRegistration(...)`)
+### Implementation
-- [X] T022 [US1] Remove `/admin/register-tenant` route from routes/web.php (must behave as not found)
-- [X] T023 [US1] Replace legacy onboarding redirects with 404 in routes/web.php (`/admin/managed-tenants`, `/admin/managed-tenants/onboarding`, `/admin/new`, workspace onboarding redirect stub)
-- [X] T024 [US1] Remove RegisterTenant references in app/Filament/Pages/ChooseTenant.php and app/Filament/Pages/Workspaces/ManagedTenantsLanding.php
-- [X] T025 [P] [US1] Add regression tests in tests/Feature/ManagedTenantOnboardingWizardTest.php asserting legacy endpoints return 404 (no redirects)
 
+- [x] T013 [US1] Make `/admin/onboarding` the canonical wizard route in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (set slug; remove workspace route parameter dependency)
+- [x] T014 [US1] Resolve the current workspace from session context in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (redirect when missing; 404 when non-member)
+- [x] T015 [US1] Keep page visible for members without capability (disable controls + tooltip) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T016 [US1] Implement Step 1 inputs per spec (tenant name, environment, Entra Tenant ID, optional domain/notes) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T017 [US1] Implement Step 1 idempotent upsert + onboarding session resume (deny-as-not-found if tenant exists in another workspace) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T018 [US1] Ensure no pre-activation tenant-scoped links are generated in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
 
-**Checkpoint**: US1 complete — wizard is the only entry point; onboarding start is safe + idempotent.
+### Remove legacy entry points (must be true 404, no redirects)
+
+- [x] T019 [US1] Remove tenant registration surface from app/Providers/Filament/AdminPanelProvider.php (drop `->tenantRegistration(...)` if present)
+- [x] T020 [US1] Remove/404 legacy routes in routes/web.php (`/admin/new`, `/admin/register-tenant`, `/admin/managed-tenants/onboarding`)
+- [x] T021 [P] [US1] Add legacy route regression tests in tests/Feature/Onboarding/OnboardingLegacyRoutesTest.php
+
+**Checkpoint**: US1 complete — `/admin/onboarding` is canonical, legacy entry points are 404, and Step 1 is safe + idempotent.
 
 ---
 
-## Phase 4: User Story 2 — Configure a connection and verify access (Priority: P2)
+## Phase 4: User Story 2 — Provider connection selection/creation (Priority: P2)
 
-**Goal**: Attach or create a Provider Connection and start verification as an `OperationRun` without leaking secrets.
+**Goal**: Allow selecting an existing workspace-owned provider connection or creating a new one, without ever re-displaying secrets.
 
-**Independent Test**: Select/create connection, start verification, assert an OperationRun is created and job is dispatched; assert no secret material is returned.
+**Independent Test**: Complete Step 2 in both modes (existing vs new), verify the onboarding session stores only non-secret state, and verify the provider connection is workspace-scoped and bound to the managed tenant by default.
 
-- [X] T026 [US2] Implement Step 2 connection selection in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (auto-select default connection; allow switching)
+### Tests (write first)
-- [X] T027 [US2] Implement connection creation path in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php using app/Models/ProviderConnection.php and app/Services/Providers/CredentialManager.php (never display stored secrets)
-- [X] T028 [US2] Persist selected connection id in app/Models/TenantOnboardingSession.php `state` (non-secret)
-- [X] T029 [US2] Implement “Start verification” action using app/Services/Providers/ProviderOperationStartGate.php with operation type `provider.connection.check`
-- [X] T029b [US2] Enforce/verify dedupe: clicking “Start verification” twice while an active run exists must return the active OperationRun (no second run created); add a focused test (Bus::fake + assert single run)
-- [X] T030 [US2] Ensure verification enqueues app/Jobs/ProviderConnectionHealthCheckJob.php and stores `operation_run_id` in onboarding session state
-- [X] T031 [US2] Add “View run” navigation to app/Filament/Resources/OperationRunResource.php (link from wizard action notification)
-- [X] T032 [P] [US2] Add tests in tests/Feature/ManagedTenantOnboardingWizardTest.php for connection default selection + switching
-- [X] T033 [P] [US2] Add tests in tests/Feature/ManagedTenantOnboardingWizardTest.php for verification run creation + job dispatch (Bus::fake)
-- [X] T034 [P] [US2] Add secret-safety tests in tests/Feature/ManagedTenantOnboardingWizardTest.php (no secret fields appear in response/session/run failure summary)
 
-**Checkpoint**: US2 complete — verification is observable via OperationRun and secrets are safe.
+- [x] T022 [P] [US2] Add connection selection/creation tests in tests/Feature/Onboarding/OnboardingProviderConnectionTest.php
+- [x] T023 [P] [US2] Add secret-safety regression tests in tests/Feature/Onboarding/OnboardingSecretSafetyTest.php
+
+### Implementation
+
+- [x] T024 [US2] Implement workspace-owned ProviderConnection schema changes in database/migrations/2026_02_04_090020_make_provider_connections_workspace_owned.php
+- [x] T025 [US2] Update ProviderConnection model relationships + scoping in app/Models/ProviderConnection.php
+- [x] T026 [US2] Update ProviderConnection authorization for workspace scope in app/Policies/ProviderConnectionPolicy.php
+- [x] T027 [US2] Update ProviderConnection admin resource scoping in app/Filament/Resources/ProviderConnectionResource.php
+- [x] T028 [US2] Update Step 2 schema + persistence (no secrets in onboarding session state) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T029 [US2] Store provider_connection_id in onboarding session safe state in app/Models/TenantOnboardingSession.php
+
+**Checkpoint**: US2 complete — Provider connections are workspace-owned, default-bound to one tenant, and secrets are never re-shown.
 
 ---
 
-## Phase 5: User Story 3 — Resume and complete onboarding (Priority: P3)
+## Phase 5: User Story 3 — Verification + tenantless run viewing + activation (Priority: P3)
 
-**Goal**: Resume an onboarding session, run optional bootstrap actions, and complete onboarding to activate the tenant.
+**Goal**: Start verification as an `OperationRun`, render DB-only reports with correct status mapping, and support tenantless viewing at `/admin/operations/{run}` without requiring selected workspace or tenant context.
 
-**Independent Test**: Start onboarding, leave incomplete, resume as a different authorized owner/manager, complete verification + bootstrap, then mark tenant active.
+**Independent Test**: Start verification from the wizard, dedupe active runs, open `/admin/operations/{run}` without a selected workspace, and enforce membership-based 404 semantics.
 
-- [X] T035 [US3] Implement session resume logic in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (load by workspace_id + tenant_id; shared resumability)
+### Tests (write first)
-- [X] T036 [US3] Implement Step gating in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (cannot complete until verification succeeded)
-- [X] T037 [US3] Implement optional bootstrap actions in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php (start operations listed in app/Services/Providers/ProviderOperationRegistry.php)
-- [X] T038 [US3] Persist bootstrap `operation_run_id`s in app/Models/TenantOnboardingSession.php `state`
-- [X] T039 [US3] Implement completion: set tenant status `active`, set onboarding session `completed_at`, redirect to tenant dashboard (app/Filament/Pages/TenantDashboard.php)
-- [X] T040 [P] [US3] Add tests in tests/Feature/ManagedTenantOnboardingWizardTest.php for resume by different authorized actor
-- [X] T041 [P] [US3] Add tests in tests/Feature/ManagedTenantOnboardingWizardTest.php for completion and tenant status transition `pending` → `active`
-- [X] T042 [P] [US3] Add tests in tests/Feature/ManagedTenantOnboardingWizardTest.php for bootstrap run creation (one OperationRun per selected action)
 
-**Checkpoint**: US3 complete — onboarding is resumable and completes safely.
+- [x] T030 [P] [US3] Add tenantless run viewer access tests in tests/Feature/Operations/TenantlessOperationRunViewerTest.php
+- [x] T031 [P] [US3] Add verification start + dedupe tests in tests/Feature/Onboarding/OnboardingVerificationTest.php
+- [x] T032 [P] [US3] Add owner-only activation + override audit tests in tests/Feature/Onboarding/OnboardingActivationTest.php
+- [x] T052 [P] [US3] Add Graph contract registry coverage tests (organization + service principal permission probes) in tests/Unit/GraphContractRegistryOnboardingProbesTest.php
+
+### Implementation — tenantless operation run viewer
+
+- [x] T033 [US3] Add OperationRun workspace scoping fields + idempotency indexes in database/migrations/2026_02_04_090030_add_workspace_id_to_operation_runs_table.php
+- [x] T034 [US3] Update OperationRun model for workspace relationship + nullable tenant_id in app/Models/OperationRun.php
+- [x] T035 [US3] Update run identity/dedupe logic for tenantless runs in app/Services/OperationRunService.php
+- [x] T036 [US3] Exempt `/admin/operations/{run}` from forced workspace selection in app/Http/Middleware/EnsureWorkspaceSelected.php
+- [x] T037 [US3] Prevent tenant auto-selection side effects for `/admin/operations/{run}` in app/Support/Middleware/EnsureFilamentTenantSelected.php
+- [x] T038 [US3] Authorize viewing runs by workspace membership (non-member → 404) in app/Policies/OperationRunPolicy.php
+- [x] T039 [US3] Implement tenantless `/admin/operations/{run}` viewer page + route with membership-based 404 semantics (app/Filament/Pages/Operations/TenantlessOperationRunViewer.php, routes/web.php)
+
+### Implementation — verification + report + activation
+
+- [x] T053 [US3] Register onboarding verification probe endpoints in config/graph_contracts.php (organization + service principal permission lookups)
+- [x] T054 [US3] Refactor verification probe calls to resolve endpoints via GraphContractRegistry (no ad-hoc Graph paths; fail safe if contract missing) in app/Services/Graph/MicrosoftGraphClient.php and app/Services/Providers/ProviderGateway.php
+- [x] T040 [US3] Implement Step 3 start verification (OperationRun + queued job) with 403 on capability denial in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T041 [US3] Implement active-run dedupe (queued/running) and persist run IDs in app/Models/TenantOnboardingSession.php
+- [x] T042 [US3] Implement DB-only “Refresh” and status mapping (Blocked/Needs attention/Ready) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T055 [US3] Render a stored verification report in Step 3 (clear empty-state + secondary “Open run details” link) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T056 [US3] Enhance tenantless operation run viewer UI (context + failures + timestamps + refresh) in app/Filament/Pages/Operations/TenantlessOperationRunViewer.php and resources/views/filament/pages/operations/tenantless-operation-run-viewer.blade.php
+- [x] T057 [P] [US3] Add UI regression tests for wizard report and tenantless viewer details in tests/Feature/Onboarding/OnboardingVerificationTest.php and tests/Feature/Operations/TenantlessOperationRunViewerTest.php
+- [x] T043 [US3] Ensure “View run” links are tenantless `/admin/operations/{run}` via app/Support/OperationRunLinks.php
+- [x] T044 [US3] Implement optional bootstrap actions (per-action capability gating) in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T045 [US3] Implement activation gating (owner-only) + blocked override reason + audit in app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [x] T046 [US3] Add required audit events (stable action IDs; no secrets) in app/Services/Audit/WorkspaceAuditLogger.php
+
+**Checkpoint**: US3 complete — verification is observable + deduped, runs are viewable tenantlessly, and activation is safe + audited.
 
 ---
 
 ## Phase 6: Polish & Cross-Cutting Concerns
 
-- [X] T043 Add Managed Tenant status badge mapping via BadgeCatalog/BadgeRenderer in app/Support/Badges/* (BADGE-001) and add mapping test in tests/Feature/Badges/TenantStatusBadgeTest.php
+**Purpose**: Centralize badge semantics, harden RBAC-UX, and run formatting/tests.
-- [X] T044 Verify/extend audit coverage for FR-016: use stable audit action IDs (enum/registry), ensure redaction, and add at least one concrete feature test asserting audit rows for onboarding start + verification start (no secrets in payload)
-- [X] T045 Verify last-owner protections cover both workspace + tenant memberships; extend policies if needed in app/Policies/* and add regression tests in tests/Feature/Rbac/*
-- [X] T046 Run formatter on touched files (command: `vendor/bin/sail bin pint --dirty`)
-- [X] T047 Run targeted test suite for onboarding (command: `vendor/bin/sail artisan test --compact tests/Feature/ManagedTenantOnboardingWizardTest.php`)
-
-### Post-spec hardening (Filament-native UX)
-
-- [X] T048 Refactor onboarding page to a Filament-native Wizard schema (replace header-action modals + step cards; persist per-step progress; keep strict RBAC and existing action methods)
-- [X] T049 Fix tenant identify UX: entering an existing tenant GUID must not surface a raw 404 modal; bind legacy unscoped tenants to the current workspace when safely inferable and add a regression test
 
+- [x] T047 Add centralized badge mapping for onboarding/verification statuses in app/Support/Badges/Domains/
+- [x] T048 [P] Add badge mapping tests in tests/Feature/Badges/OnboardingBadgeSemanticsTest.php
+- [x] T049 [P] Add RBAC regression coverage for wizard actions in tests/Feature/Rbac/OnboardingWizardUiEnforcementTest.php
+- [x] T050 Run formatter on touched files using composer.json scripts (command: `vendor/bin/sail bin pint --dirty`)
+- [x] T051 Run targeted test suites using phpunit.xml (command: `vendor/bin/sail artisan test --compact tests/Feature/Onboarding tests/Feature/Operations`)
 
 ---
 
 ## Dependencies & Execution Order
 
-### User Story completion order
+### Phase Dependencies
 
-1. US1 (P1) depends on Phase 2 only.
+- Setup (Phase 1) → Foundational (Phase 2) → US1 (Phase 3) → US2 (Phase 4) → US3 (Phase 5) → Polish (Phase 6)
-2. US2 (P2) depends on US1 (tenant/session + wizard scaffold).
-3. US3 (P3) depends on US2 (verification state + run linking).
 
-### Dependency graph
+### User Story Dependencies
 
-- Phase 1 → Phase 2 → US1 → US2 → US3 → Polish
+- US1 (P1) depends on Phase 2 only.
+- US2 (P2) depends on US1 (managed tenant + onboarding session in place).
+- US3 (P3) depends on US2 (provider connection exists) and adds OperationRun viewer changes.
+
+### Parallel Opportunities
+
+- [P] tasks can be executed in parallel (different files, minimal coupling).
+- Within each story: tests can be authored in parallel before implementation.
 
 ---
 
-## Parallel execution examples
+## Parallel Example: US1
 
-### US1 parallel work
+Run in parallel:
 
-- [P] T011 and T012 can be implemented in parallel (page class vs blade view).
+- T010 (entry point routing tests) in tests/Feature/Onboarding/OnboardingEntryPointTest.php
-- [P] T018–T020 can be written in parallel (distinct test cases).
+- T011 (RBAC semantics tests) in tests/Feature/Onboarding/OnboardingRbacSemanticsTest.php
-
+- T012 (idempotency tests) in tests/Feature/Onboarding/OnboardingIdentifyTenantTest.php
-### US2 parallel work
-
-- [P] T032–T034 can be written in parallel (selection tests vs run tests vs secret-safety tests).
-
-### US3 parallel work
-
-- [P] T040–T042 can be written in parallel (resume tests vs completion tests vs bootstrap tests).
 
 ---
 
-## Implementation Strategy (MVP)
+## Implementation Strategy
 
-- MVP scope is US1 only: wizard-only entry point + idempotent tenant identification + resumable session skeleton + required authorization semantics + tests.
+### MVP First
+
+MVP scope is US1 only: `/admin/onboarding` canonical entry point + Step 1 idempotent identification + strict 404/403 semantics + legacy routes 404 + tests.

specs/074-verification-checklist/checklists/requirements.md

@@ -1,34 +0,0 @@
-# Specification Quality Checklist: Verification Checklist Framework (Enterprise-Ready)
-
-**Purpose**: Validate specification completeness and quality before proceeding to planning
-**Created**: 2026-02-03
-**Feature**: [specs/074-verification-checklist/spec.md](../spec.md)
-
-## Content Quality
-
-- [x] No implementation details (languages, frameworks, APIs)
-- [x] Focused on user value and business needs
-- [x] Written for non-technical stakeholders
-- [x] All mandatory sections completed
-
-## Requirement Completeness
-
-- [x] No [NEEDS CLARIFICATION] markers remain
-- [x] Requirements are testable and unambiguous
-- [x] Success criteria are measurable
-- [x] Success criteria are technology-agnostic (no implementation details)
-- [x] All acceptance scenarios are defined
-- [x] Edge cases are identified
-- [x] Scope is clearly bounded
-- [x] Dependencies and assumptions identified
-
-## Feature Readiness
-
-- [x] All functional requirements have clear acceptance criteria
-- [x] User scenarios cover primary flows
-- [x] Feature meets measurable outcomes defined in Success Criteria
-- [x] No implementation details leak into specification
-
-## Notes
-
-- Validation pass (2026-02-03): Spec avoids framework specifics and focuses on contract + UX outcomes. Next step is planning to translate these requirements into a minimal set of deliverables (report schema, viewer, authorization semantics, audit events, and adoption points).

specs/074-verification-checklist/contracts/examples/fail.json

@@ -1,47 +0,0 @@
-{
-  "schema_version": "1.0.0",
-  "flow": "provider.connection.check",
-  "generated_at": "2026-02-03T22:00:00Z",
-  "identity": {
-    "provider_connection_id": 123
-  },
-  "summary": {
-    "overall": "blocked",
-    "counts": {
-      "total": 2,
-      "pass": 1,
-      "fail": 1,
-      "warn": 0,
-      "skip": 0,
-      "running": 0
-    }
-  },
-  "checks": [
-    {
-      "key": "provider_connection.token_acquisition",
-      "title": "Token acquisition works",
-      "status": "fail",
-      "severity": "high",
-      "blocking": true,
-      "reason_code": "authentication_failed",
-      "message": "The app cannot acquire a token with the configured credentials.",
-      "evidence": [
-        { "kind": "provider_connection_id", "value": 123 }
-      ],
-      "next_steps": [
-        { "label": "Review connection credentials", "url": "/admin/provider-connections/123/edit" }
-      ]
-    },
-    {
-      "key": "provider_connection.permissions",
-      "title": "Required permissions are granted",
-      "status": "pass",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "The configured app permissions meet the required baseline.",
-      "evidence": [],
-      "next_steps": []
-    }
-  ]
-}

specs/074-verification-checklist/contracts/examples/pass.json

@@ -1,29 +0,0 @@
-{
-  "schema_version": "1.0.0",
-  "flow": "provider.connection.check",
-  "generated_at": "2026-02-03T22:00:00Z",
-  "summary": {
-    "overall": "ready",
-    "counts": {
-      "total": 1,
-      "pass": 1,
-      "fail": 0,
-      "warn": 0,
-      "skip": 0,
-      "running": 0
-    }
-  },
-  "checks": [
-    {
-      "key": "provider_connection.health",
-      "title": "Provider connection is healthy",
-      "status": "pass",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "The provider connection passed all required health checks.",
-      "evidence": [],
-      "next_steps": []
-    }
-  ]
-}

specs/074-verification-checklist/contracts/examples/running.json

@@ -1,51 +0,0 @@
-{
-  "schema_version": "1.0.0",
-  "flow": "provider.connection.check",
-  "generated_at": "2026-02-03T22:00:00Z",
-  "summary": {
-    "overall": "running",
-    "counts": {
-      "total": 3,
-      "pass": 1,
-      "fail": 0,
-      "warn": 0,
-      "skip": 0,
-      "running": 2
-    }
-  },
-  "checks": [
-    {
-      "key": "provider_connection.token_acquisition",
-      "title": "Token acquisition works",
-      "status": "running",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "Check is currently running.",
-      "evidence": [],
-      "next_steps": []
-    },
-    {
-      "key": "provider_connection.permissions",
-      "title": "Required permissions are granted",
-      "status": "running",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "Check is currently running.",
-      "evidence": [],
-      "next_steps": []
-    },
-    {
-      "key": "provider_connection.health",
-      "title": "Provider connection is healthy",
-      "status": "pass",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "The provider connection passed all required health checks.",
-      "evidence": [],
-      "next_steps": []
-    }
-  ]
-}

specs/074-verification-checklist/contracts/examples/warn.json

@@ -1,42 +0,0 @@
-{
-  "schema_version": "1.0.0",
-  "flow": "provider.connection.check",
-  "generated_at": "2026-02-03T22:00:00Z",
-  "summary": {
-    "overall": "needs_attention",
-    "counts": {
-      "total": 2,
-      "pass": 1,
-      "fail": 0,
-      "warn": 1,
-      "skip": 0,
-      "running": 0
-    }
-  },
-  "checks": [
-    {
-      "key": "provider_connection.optional_metadata",
-      "title": "Optional metadata is present",
-      "status": "warn",
-      "severity": "medium",
-      "blocking": false,
-      "reason_code": "missing_configuration",
-      "message": "Some optional metadata is missing; this may reduce diagnostics quality.",
-      "evidence": [],
-      "next_steps": [
-        { "label": "Open provider connection settings", "url": "/admin/provider-connections" }
-      ]
-    },
-    {
-      "key": "provider_connection.health",
-      "title": "Provider connection is healthy",
-      "status": "pass",
-      "severity": "info",
-      "blocking": false,
-      "reason_code": "ok",
-      "message": "The provider connection passed all required health checks.",
-      "evidence": [],
-      "next_steps": []
-    }
-  ]
-}

specs/074-verification-checklist/contracts/reason-codes.md

@@ -1,26 +0,0 @@
-# Reason Codes (074)
-
-This file defines the baseline `reason_code` taxonomy for verification check results.
-
-## Rules
-
-- Reason codes are **stable** and **machine-readable**.
-- New codes must be appended (avoid renames) to keep support and automation stable.
-- Flow/check-specific codes must use the reserved namespace: `ext.*`.
-
-## Baseline Codes (v1)
-
-- `ok` — Check passed.
-- `not_applicable` — Check skipped because it doesn’t apply to this identity/scope.
-- `missing_configuration` — Required config is absent.
-- `permission_denied` — Insufficient permissions / consent missing.
-- `authentication_failed` — Token acquisition or auth precondition failed.
-- `throttled` — Remote dependency throttled (e.g., 429/503) and check could not complete.
-- `dependency_unreachable` — Remote dependency unavailable.
-- `invalid_state` — Local model state conflicts with required preconditions.
-- `unknown_error` — Failure could not be classified.
-
-## Reserved Extension Namespace
-
-- `ext.<flow>.<detail>` — Flow-specific extensions.
-  - Example: `ext.managed_tenant_onboarding.role_mapping_missing`

specs/074-verification-checklist/contracts/verification-report.schema.json

@@ -1,128 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://tenantpilot.local/contracts/verification-report.schema.json",
-  "title": "VerificationReport",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "schema_version",
-    "flow",
-    "generated_at",
-    "summary",
-    "checks"
-  ],
-  "properties": {
-    "schema_version": {
-      "type": "string",
-      "description": "Version of the verification report schema (SemVer)."
-    },
-    "flow": {
-      "type": "string",
-      "description": "Verification flow identifier (v1 aligns with OperationRun.type)."
-    },
-    "generated_at": {
-      "type": "string",
-      "format": "date-time"
-    },
-    "identity": {
-      "type": "object",
-      "description": "Scope identifiers for what is being verified.",
-      "additionalProperties": true
-    },
-    "summary": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["overall", "counts"],
-      "properties": {
-        "overall": {
-          "type": "string",
-          "enum": ["ready", "needs_attention", "blocked", "running"],
-          "description": "Overall state derived from check results."
-        },
-        "counts": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["total", "pass", "fail", "warn", "skip", "running"],
-          "properties": {
-            "total": {"type": "integer", "minimum": 0},
-            "pass": {"type": "integer", "minimum": 0},
-            "fail": {"type": "integer", "minimum": 0},
-            "warn": {"type": "integer", "minimum": 0},
-            "skip": {"type": "integer", "minimum": 0},
-            "running": {"type": "integer", "minimum": 0}
-          }
-        }
-      }
-    },
-    "checks": {
-      "type": "array",
-      "minItems": 0,
-      "items": {"$ref": "#/$defs/CheckResult"}
-    }
-  },
-  "$defs": {
-    "CheckResult": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "key",
-        "title",
-        "status",
-        "severity",
-        "blocking",
-        "reason_code",
-        "message",
-        "evidence",
-        "next_steps"
-      ],
-      "properties": {
-        "key": {"type": "string"},
-        "title": {"type": "string"},
-        "status": {
-          "type": "string",
-          "enum": ["pass", "fail", "warn", "skip", "running"]
-        },
-        "severity": {
-          "type": "string",
-          "enum": ["info", "low", "medium", "high", "critical"]
-        },
-        "blocking": {"type": "boolean"},
-        "reason_code": {"type": "string"},
-        "message": {"type": "string"},
-        "evidence": {
-          "type": "array",
-          "items": {"$ref": "#/$defs/EvidencePointer"}
-        },
-        "next_steps": {
-          "type": "array",
-          "description": "Navigation-only CTAs (links) in v1.",
-          "items": {"$ref": "#/$defs/NextStep"}
-        }
-      }
-    },
-    "EvidencePointer": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["kind", "value"],
-      "properties": {
-        "kind": {"type": "string"},
-        "value": {
-          "description": "Safe pointer value (ID/masked string/hash).",
-          "oneOf": [
-            {"type": "integer"},
-            {"type": "string"}
-          ]
-        }
-      }
-    },
-    "NextStep": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["label", "url"],
-      "properties": {
-        "label": {"type": "string"},
-        "url": {"type": "string"}
-      }
-    }
-  }
-}

specs/074-verification-checklist/data-model.md

@@ -1,61 +0,0 @@
-# Data Model: Verification Checklist Framework (074)
-
-## Overview
-
-This feature introduces a *versioned verification report document* attached to an existing `OperationRun`.
-No new database tables are required for v1.
-
-## Existing Entities Used
-
-### OperationRun (`operation_runs`)
-
-Selected fields:
-- `id`
-- `tenant_id`
-- `user_id`
-- `type` (used as the verification flow identifier)
-- `status` (`queued` | `running` | `completed`)
-- `outcome` (`pending` | `succeeded` | `failed`)
-- `summary_counts` (JSONB)
-- `failure_summary` (JSONB)
-- `context` (JSONB)
-- `started_at`, `completed_at`
-
-Idempotency:
-- DB-enforced dedupe for active runs via partial unique index on `(tenant_id, run_identity_hash)` where `status IN ('queued','running')`.
-
-## New Logical Data (stored inside OperationRun context)
-
-### VerificationReport (`operation_runs.context.verification_report`)
-
-- Stored as JSON in `context` under `verification_report`.
-- Versioned by `schema_version`.
-- Rendered DB-only (no external calls during view).
-
-High-level shape (see `contracts/verification-report.schema.json` for the canonical contract):
-- `schema_version`
-- `flow` (identifier; for v1 this can align with `operation_runs.type`)
-- `identity` (scope identifiers such as `tenant_id`, `provider_connection_id`, etc.)
-- `generated_at`
-- `summary` (counts, overall state)
-- `checks[]` (check results)
-
-### CheckResult (within `checks[]`)
-
-- `key`, `title`
-- `status`: `pass|fail|warn|skip|running`
-- `severity`: `info|low|medium|high|critical`
-- `blocking`: boolean
-- `reason_code`
-- `message`
-- `evidence[]`: safe pointers only
-- `next_steps[]`: links only in v1
-
-## Audit
-
-Verification start and completion are recorded in `audit_logs` using stable `action` identifiers (via `App\Support\Audit\AuditActionId`). Metadata is minimal and sanitized.
-
-## Notes / Constraints
-
-- Viewer must be DB-only: rendering the report must not dispatch jobs or perform HTTP.
-- Evidence must be redacted/safe: no secrets/tokens/payload dumps in stored or rendered report.

specs/074-verification-checklist/plan.md

@@ -1,127 +0,0 @@
-# Implementation Plan: Verification Checklist Framework (Enterprise-Ready)
-
-**Branch**: `074-verification-checklist` | **Date**: 2026-02-03 | **Spec**: [spec.md](./spec.md)
-**Input**: Feature specification from `/specs/074-verification-checklist/spec.md`
-
-**Note**: This file is generated from the plan template and then filled in by `/speckit.plan` workflow steps.
-
-## Summary
-
-- Introduce a versioned “verification report” contract that can be attached to an existing `OperationRun` and rendered consistently across multiple flows.
-- Provide a reusable, DB-only report viewer (no outbound calls during render/hydration/poll) that presents summary + per-check statuses + safe evidence pointers + navigation-only next steps.
-- Enforce enterprise semantics: stable reason codes, strict evidence redaction, deterministic active-run dedupe, and capability-first authorization aligned with RBAC-UX (non-members 404; members missing start capability 403).
-- Emit audit events for verification start + completion using stable action identifiers with redacted metadata.
-
-## Technical Context
-
-**Language/Version**: PHP 8.4 (Laravel 12)
-**Primary Dependencies**: Laravel 12 + Filament v5 + Livewire v4
-**Storage**: PostgreSQL (Sail) with JSONB (`operation_runs.context`)
-**Testing**: Pest (PHPUnit)
-**Target Platform**: Web application (Sail/Docker locally; container deploy via Dokploy)
-**Project Type**: web
-**Performance Goals**: Verification viewer renders fast from DB-only JSON (typical report ≤ 50 checks)
-**Constraints**: Viewer is read-only and must not trigger any outbound HTTP or job dispatch; evidence must not contain secrets/tokens/payloads; new status-like badges must use centralized BADGE-001 mapping.
-**Scale/Scope**: Multiple tenants/workspaces; many runs over time; verification used in onboarding + provider ops + future readiness flows
-
-## Constitution Check
-
-*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
-
-- Inventory-first, snapshots-second: PASS (this feature is run/report UX; no inventory semantics changed).
-- Read/write separation: PASS (viewer is read-only; start surfaces enqueue-only and already follow `OperationRun` patterns).
-- Graph contract path: PASS (viewer performs no Graph calls; verification execution remains in queued jobs that already follow provider gateway patterns).
-- Deterministic capabilities: PASS (start/view gates reference the existing capability registry; no role-string checks).
-- RBAC-UX: PASS (non-member tenant access is 404; member-but-missing-capability is 403; server-side gates enforce mutations/starts).
-- Run observability: PASS (verification is represented as `OperationRun`; active-run dedupe enforced by the existing partial unique index on `(tenant_id, run_identity_hash)` for active statuses).
-- Data minimization: PASS (report evidence constrained to safe pointers; audit metadata redacted; no secrets in stored report).
-- Badge semantics (BADGE-001): PASS (plan includes adding a centralized badge domain for check statuses/severity; no ad-hoc UI mappings).
-
-## Project Structure
-
-### Documentation (this feature)
-
-```text
-specs/074-verification-checklist/
-├── plan.md              # This file
-├── research.md          # Phase 0 output
-├── data-model.md        # Phase 1 output
-├── quickstart.md        # Phase 1 output
-├── contracts/           # Phase 1 output
-└── tasks.md             # Phase 2 output (/speckit.tasks)
-```
-
-### Source Code (repository root)
-
-```text
-app/
-├── Filament/
-├── Jobs/
-├── Models/
-├── Policies/
-├── Services/
-└── Support/
-
-config/
-database/
-resources/
-routes/
-tests/
-```
-
-**Structure Decision**: Single Laravel web application with Filament admin panel. The framework is implemented as:
-- contract + helpers under `app/Support/**`
-- report writer invoked from queued jobs under `app/Jobs/**` / `app/Services/**`
-- viewer UI as Filament schema components and Blade views under `app/Filament/**` and `resources/views/filament/**`
-- authorization via existing capabilities/gates/policies
-
-## Complexity Tracking
-
-No constitution violations required for this feature.
-
-## Phase 0 — Research (output: `research.md`)
-
-See: [research.md](./research.md)
-
-Goals:
-- Confirm the canonical storage location for the report (DB-only render) using existing `operation_runs.context` JSONB.
-- Confirm active-run dedupe behavior and ensure it matches the spec’s “dedupe while active only” requirement.
-- Confirm the correct approach for status-like UI badges in Filament (BADGE-001), so the viewer doesn’t introduce ad-hoc mappings.
-- Confirm the existing audit logger + redaction utilities and define stable action IDs for verification completion.
-
-## Phase 1 — Design & Contracts (outputs: `data-model.md`, `contracts/`, `quickstart.md`)
-
-See:
-- [data-model.md](./data-model.md)
-- [contracts/](./contracts/)
-- [quickstart.md](./quickstart.md)
-
-Design focus:
-- Report schema: versioned JSON document (checks + counts + timestamps + next steps) stored in `operation_runs.context.verification_report`.
-- Reason codes: baseline set + reserved `ext.*` namespace.
-- Evidence redaction: strict sanitizer so reports never store or render secrets/tokens/payloads.
-- Viewer: reusable Filament view entry / component that renders summary + per-check details without any outbound calls.
-- Authorization: view allowed for tenant-scoped members; start requires capability; non-member access is deny-as-not-found.
-- Auditing: start + completion events logged with minimal redacted metadata.
-
-## Phase 2 — Implementation Outline (tasks created in `/speckit.tasks`)
-
-- Contract: create a canonical report schema (JSON Schema + example) and a small baseline reason-code list.
-- Writer: add a `VerificationReportWriter` (or equivalent) that normalizes check results, enforces redaction rules, and writes the report into `OperationRun->context`.
-- Viewer: add a reusable Filament UI renderer (Blade view + helper) that displays summary, counts, statuses, and next steps (links-only).
-- Integration points:
-  - Show the verification report section in Monitoring → Operations run detail when present.
-  - Embed the same viewer in onboarding and provider connection verification flows.
-- RBAC & UX:
-  - Enforce “view vs start” split (view allowed for tenant members; start capability required).
-  - Preserve RBAC-UX semantics (non-members 404; members missing capability 403).
-- Audit:
-  - Keep existing start audit event; add a completion audit event emitted when the verification run finalizes.
-- Tests (Pest):
-  - Viewer is DB-only (Http::fake + render assertion).
-  - Evidence redaction rules (report contains no forbidden keys/values).
-  - Dedupe semantics reuse active run (leveraging the existing partial unique index behavior).
-
-## Constitution Check (Post-Design)
-
-Re-check result: PASS. Design artifacts keep verification viewing DB-only, align with run observability + dedupe, enforce RBAC-UX semantics, and centralize status badge mappings.

specs/074-verification-checklist/quickstart.md

@@ -1,79 +0,0 @@
-# Quickstart: Verification Checklist Framework (074)
-
-This quickstart explains how to *write* and *render* a verification report attached to an `OperationRun`.
-
-## 1) Writing a report (queued job / service)
-
-**Goal**: produce a `verification_report` JSON document and store it in `OperationRun->context`.
-
-Guidelines:
-- Generate reports inside queued execution (not in a Filament page render).
-- Keep evidence pointer-only (IDs/masked/hashes), never raw payloads or tokens.
-- Keep next steps navigation-only in v1.
-
-Pseudo-code sketch:
-
-```php
-$context = is_array($run->context) ? $run->context : [];
-
-$context['verification_report'] = [
-    'schema_version' => '1.0',
-    'flow' => $run->type,
-    'generated_at' => now('UTC')->toIso8601String(),
-    'identity' => [
-        'tenant_id' => (int) $run->tenant_id,
-        'provider_connection_id' => (int) data_get($run->context, 'provider_connection_id', 0),
-    ],
-    'summary' => [
-        'overall' => 'needs_attention',
-        'counts' => [
-            'total' => 5,
-            'pass' => 3,
-            'fail' => 2,
-            'warn' => 0,
-            'skip' => 0,
-            'running' => 0,
-        ],
-    ],
-    'checks' => [
-        [
-            'key' => 'provider_connection.token_acquisition',
-            'title' => 'Token acquisition works',
-            'status' => 'fail',
-            'severity' => 'high',
-            'blocking' => true,
-            'reason_code' => 'permission_denied',
-            'message' => 'The app cannot acquire a token with the configured credentials.',
-            'evidence' => [
-                ['kind' => 'provider_connection_id', 'value' => (int) data_get($run->context, 'provider_connection_id')],
-            ],
-            'next_steps' => [
-                ['label' => 'Review connection credentials', 'url' => '/admin/...'],
-                ['label' => 'Microsoft docs: app permissions', 'url' => 'https://learn.microsoft.com/...'],
-            ],
-        ],
-    ],
-];
-
-$run->update(['context' => $context]);
-```
-
-## 2) Rendering the report (Filament, DB-only)
-
-Recommended integration points:
-- Monitoring → Operations: in the `OperationRun` view page, show a “Verification report” section when `context.verification_report` exists.
-- Flow pages (e.g., onboarding wizard): embed the same viewer component using the run ID stored in wizard state.
-
-**Hard requirement**: rendering must not trigger any outbound HTTP (no Graph calls, no jobs dispatched, no side effects).
-
-## 3) Authorization split
-
-- Viewing a report: allowed for tenant-scoped members.
-- Starting verification: requires a specific capability.
-- Non-members: deny-as-not-found (404) for tenant-scoped pages and actions.
-
-## 4) Tests to add
-
-- Viewer DB-only render test: `Http::fake()` + assert no requests during render.
-- Evidence redaction test: report JSON contains none of `access_token`, `client_secret`, `Authorization`, bearer tokens, or raw payload dumps.
-- Dedupe test: repeated starts while active reuse the same run.

specs/074-verification-checklist/research.md

@@ -1,86 +0,0 @@
-# Research: Verification Checklist Framework (074)
-
-**Date**: 2026-02-03  
-**Phase**: Phase 0 (Foundational Research)  
-**Status**: Complete
-
----
-
-## Decisions
-
-### D-001 — Canonical storage location for verification reports
-
-**Decision**: Store the verification report in `operation_runs.context.verification_report` (JSONB).
-
-**Rationale**:
-- Monitoring pages must be DB-only at render time (constitution: Operations / Run Observability Standard).
-- `OperationRun` is the canonical operational record; keeping the report attached avoids new tables/indexing for v1.
-- The existing UI already renders `OperationRun.context` safely as JSON, so we can progressively enhance into a structured viewer.
-
-**Alternatives considered**:
-- Dedicated `verification_reports` table: rejected for v1 to keep adoption lightweight; can be introduced later if querying/indexing becomes necessary.
-
----
-
-### D-002 — Idempotency / dedupe mechanism
-
-**Decision**: Use the existing `OperationRunService::ensureRunWithIdentity()` mechanism and the DB partial unique index on `(tenant_id, run_identity_hash)` for active statuses (`queued`, `running`).
-
-**Rationale**:
-- This repo already enforces active-run dedupe at the DB level via `operation_runs_active_unique`.
-- Matches the clarified spec policy: dedupe only while a run is active; completed runs allow a new run.
-
-**Alternatives considered**:
-- Application-only locks/dedupe: rejected as non-race-safe.
-
----
-
-### D-003 — Flow identifier and identity scope
-
-**Decision**: Treat `OperationRun.type` as the primary flow identifier for the verification run, and keep additional flow details (wizard step, etc.) in `context`.
-
-**Rationale**:
-- Existing operations already key UX semantics (labels, polling, related links) off `OperationRun.type`.
-- Dedupe identity hashing already includes `type`, making flow part of the dedupe boundary.
-
-**Alternatives considered**:
-- Separate `flow_id` column: rejected for v1 (schema change not required).
-
----
-
-### D-004 — Reason code taxonomy and extensions
-
-**Decision**: Maintain a small baseline set of cross-cutting reason codes, and reserve `ext.*` for flow/check-specific extensions.
-
-**Rationale**:
-- Prevents brittle UI parsing and enables future automation.
-- Keeps room for flow-specific details without polluting the baseline vocabulary.
-
-**Alternatives considered**:
-- Free-form codes everywhere: rejected due to support/automation cost.
-
----
-
-### D-005 — Evidence policy (strict safe pointers)
-
-**Decision**: Evidence fields in check results are *strictly* structured safe pointers only (IDs, masked strings, hashes). No payloads, tokens, claims, headers, or full error bodies.
-
-**Rationale**:
-- Aligns with constitution data-minimization and safe logging rules.
-- Avoids accidentally persisting secrets inside run context.
-
-**Alternatives considered**:
-- Storing raw error payloads: rejected for security and compliance risk.
-
----
-
-### D-006 — UI semantics for statuses and badges
-
-**Decision**: Render status-like values (check status, severity) via centralized badge semantics (BADGE-001), not ad-hoc mappings in feature pages.
-
-**Rationale**:
-- Prevents drift in meaning/colors across the suite.
-- Enables straightforward regression tests for new/changed status values.
-
-**Alternatives considered**:
-- Inline color mapping inside a Blade view: rejected (violates BADGE-001).

specs/074-verification-checklist/spec.md

@@ -1,186 +0,0 @@
-# Feature Specification: Verification Checklist Framework (Enterprise-Ready)
-
-**Feature Branch**: `074-verification-checklist`  
-**Created**: 2026-02-03  
-**Status**: Draft  
-**Input**: User description: "Replace binary verification UX with a structured, reusable verification checklist attached to verification runs; DB-only viewing; enterprise semantics (reason codes, audit, idempotency, RBAC)."
-
-## Clarifications
-
-### Session 2026-02-03
-
-- Q: What idempotency policy do we want for “Start verification”? → A: Dedupe only while a run is active (queued/running); once completed/failed, “Start verification” creates a new run.
-- Q: Who should be allowed to view verification reports? → A: Any authenticated workspace member with access to the tenant scope may view reports; starting verification requires a separate capability.
-- Q: What policy should we use for `reason_code` taxonomy? → A: Versioned central taxonomy with a small baseline set + reserved `ext.*` namespace for feature-specific extensions.
-- Q: What’s the required evidence/redaction policy for `evidence` in check results? → A: Evidence is strictly structured safe pointers only (internal IDs, masked strings, hashes); never raw payloads, tokens, claims, headers, or full error bodies.
-- Q: Should “Next steps” CTAs be links only, or can they trigger server-side actions? → A: Links only (navigation-only) in v1.
-
-## User Scenarios & Testing *(mandatory)*
-
-<!--
-  IMPORTANT: User stories should be PRIORITIZED as user journeys ordered by importance.
-  Each user story/journey must be INDEPENDENTLY TESTABLE - meaning if you implement just ONE of them,
-  you should still have a viable MVP (Minimum Viable Product) that delivers value.
-  
-  Assign priorities (P1, P2, P3, etc.) to each story, where P1 is the most critical.
-  Think of each story as a standalone slice of functionality that can be:
-  - Developed independently
-  - Tested independently
-  - Deployed independently
-  - Demonstrated to users independently
--->
-
-### User Story 1 - Operator sees what’s wrong (Priority: P1)
-
-As a workspace member onboarding or operating a managed tenant, I can run “Verify access” and see a structured checklist that clearly shows which checks passed, which failed, and what to do next.
-
-**Why this priority**: This is the primary value of verification: reduce ambiguity and enable fast, correct remediation.
-
-**Independent Test**: Seed a verification run with a report containing mixed outcomes and confirm the viewer renders an accurate summary, per-check status, and next steps without making any external calls.
-
-**Acceptance Scenarios**:
-
-1. **Given** a completed verification run with 2 failed checks, **When** I open the verification report viewer, **Then** I see an overall summary (“Needs attention” or “Blocked”), counts, and the two failed checks with actionable next steps.
-2. **Given** a verification run that is still in progress, **When** I open the viewer, **Then** I see a “Running” state and partial results (if available) without errors.
-
----
-
-### User Story 2 - Deterministic starts (idempotency / dedupe) (Priority: P2)
-
-As an operator, if I click “Start verification” multiple times for the same tenant + provider connection + flow, the system behaves deterministically: it does not start duplicate active runs and guides me to the already-running run.
-
-**Why this priority**: Prevents confusing duplicates, reduces load, and makes support/debugging repeatable.
-
-**Independent Test**: Attempt to start verification twice for the same identity and assert that only one active run exists and the UI returns a consistent “already running” outcome.
-
-**Acceptance Scenarios**:
-
-1. **Given** an active verification run exists for the same identity, **When** I click “Start verification”, **Then** no duplicate run is started and I am directed to view the active run/report.
-2. **Given** no active verification run exists (including when the most recent run is completed or failed), **When** I click “Start verification”, **Then** a new run starts and I can view its report as it progresses.
-
----
-
-### User Story 3 - Least-privilege and safe disclosure (Priority: P3)
-
-As a workspace member with access to the tenant scope (including read-only), I can view verification reports but cannot start verification unless I have the start capability. As a non-member, I cannot discover that a tenant or report exists.
-
-**Why this priority**: Verification data can leak operational posture; access must follow least-privilege and “deny-as-not-found” for non-members.
-
-**Independent Test**: Validate both authorization paths: read-only can view but cannot start; non-member receives a not-found response for all tenant-scoped verification routes.
-
-**Acceptance Scenarios**:
-
-1. **Given** I am a workspace member without the “start verification” capability, **When** I open the verification page, **Then** I can view past reports but the “Start verification” action is disabled and cannot be executed.
-2. **Given** I am not a member of the workspace/tenant scope, **When** I attempt to access the verification report route, **Then** I receive a not-found response with no identifying hints.
-
----
-
-### Edge Cases
-
-- Report missing or malformed (e.g., run exists but report is absent or partial) → viewer shows a safe “Report unavailable” state and guidance.
-- Unknown check keys or unknown reason codes (newer schema written by a newer verifier) → viewer degrades gracefully, still showing status/message/next steps when present.
-- Large reports (near upper bound, e.g., 50 checks) → viewer remains responsive and summary counts remain correct.
-- A run transitions from running → complete while the user is viewing → the viewer refreshes safely or the user can re-open without inconsistent states.
-- Evidence contains unexpected fields → redaction rules prevent sensitive values from being displayed.
-
-## Out of Scope
-
-- Introducing a separate monitoring/observability platform beyond the existing run tracking and audit log.
-- Any workflow that requires client-side handling of secrets.
-- A full overhaul of onboarding wizards beyond replacing/embedding verification status with the checklist viewer.
-- Provider job orchestration redesign unrelated to running verification checks.
-- Server-side actions triggered directly from the checklist viewer (v1 is navigation-only).
-
-## Requirements *(mandatory)*
-
-**Constitution alignment (required):** If this feature introduces any external provider calls, any write/change behavior,
-or any long-running/background work, the spec MUST describe safety gates (preview/confirmation/audit), tenant isolation,
-run observability (run identity, visibility, and outcomes), and tests. If security-relevant DB-only actions intentionally
-skip run tracking, the spec MUST describe the audit log entries.
-
-**Constitution alignment (RBAC-UX):** If this feature introduces or changes authorization behavior, the spec MUST:
-- state which authorization plane(s) are involved (tenant-scoped admin area vs platform/system admin area),
-- ensure any cross-plane access is deny-as-not-found (404),
-- explicitly define 404 vs 403 semantics:
-  - non-member / not entitled to tenant scope → 404 (deny-as-not-found)
-  - member but missing capability → 403
-- describe how authorization is enforced server-side (Gates/Policies) for every mutation/operation-start/credential change,
-- reference the canonical capability registry (no raw capability strings; no role-string checks in feature code),
-- ensure global search is tenant-scoped and non-member-safe (no hints; inaccessible results treated as 404 semantics),
-- ensure destructive-like actions require explicit user confirmation,
-- include at least one positive and one negative authorization test, and note any RBAC regression tests added/updated.
-
-**Constitution alignment (OPS-EX-AUTH-001):** OIDC/SAML login handshakes may perform synchronous outbound HTTP (e.g., token exchange)
-on `/auth/*` endpoints without an `OperationRun`. This MUST NOT be used for Monitoring/Operations pages.
-
-**Constitution alignment (BADGE-001):** If this feature changes status-like badges (status/outcome/severity/risk/availability/boolean),
-the spec MUST describe how badge semantics stay centralized (no ad-hoc mappings) and which tests cover any new/changed values.
-
-### Functional Requirements
-
-- **FR-001 — Canonical verification report contract**: The system MUST generate a versioned “Verification Report” document for each verification run, including: schema version, flow identifier, identity/scope, generated timestamp, summary counts, and a list of check results.
-
-- **FR-002 — Check result contract**: Each check result MUST include: stable key, title, status (pass/fail/warn/skip/running), severity (info/low/medium/high/critical), blocking flag, reason code, human-readable message, safe evidence pointers, and one or more “next steps” actions (where applicable).
-
-  Evidence MUST be strictly limited to structured safe pointers (internal IDs, masked strings, hashes) and MUST NOT contain raw payloads, tokens, claims, headers, or full error bodies.
-
-  Next steps in v1 MUST be navigation-only (links to internal pages or external documentation) and MUST NOT trigger server-side actions.
-
-- **FR-003 — Stable reason code taxonomy**: The system MUST use stable, documented reason codes for failed/warned/skipped outcomes so that support, automation, and future UI changes remain consistent.
-
-  The taxonomy MUST include a small baseline set of cross-cutting codes and MUST reserve an `ext.*` namespace for flow-specific or check-specific extensions.
-
-- **FR-004 — DB-only viewing**: Viewing a verification checklist MUST be read-only and MUST NOT trigger any external calls (e.g., no provider API calls, no HTTP calls, no background jobs started as a side effect of rendering).
-
-- **FR-005 — Start verification creates a run**: Starting verification MUST create (or reuse, per dedupe policy) a new verification run record and begin executing the verification checks using existing background processing.
-
-- **FR-006 — Dedupe / idempotency**: If a verification run is already active for the same identity (tenant + provider connection + flow), the system MUST NOT start a duplicate active run; it MUST present a clear “already running” outcome and an affordance to view the active run/report.
-
-  If no run is active (including when the most recent run is completed or failed), “Start verification” MUST create a new run.
-
-- **FR-007 — Capability-first authorization**: Permission checks for viewing and starting verification MUST reference the canonical capability registry (no string-literal capability checks in feature code).
-
-- **FR-008 — RBAC UX semantics**: Non-members attempting to access tenant-scoped verification pages/routes MUST receive not-found responses. Members lacking the “start” capability MUST be able to view reports but MUST NOT be able to start verification (UI disabled + server-side enforcement).
-
-  Viewing reports MUST NOT require the start capability.
-
-- **FR-009 — Standardized UI semantics**: The viewer MUST render consistent status labels, a summary banner (e.g., Ready / Needs attention / Blocked), and per-check expandable details with standardized “Next steps” calls-to-action.
-
-- **FR-010 — Reuse across suite**: The framework MUST be adoptable by multiple verification flows without re-implementing viewer logic, including: managed tenant onboarding verification, provider connection verification, RBAC setup verification, consent & permission verification, and future readiness/health checks.
-
-- **FR-011 — Auditing**: Starting and completing verification MUST emit audit events with stable action identifiers and redaction rules, recording minimal metadata (workspace/tenant identifiers, run identifier, and result counts).
-
-### Key Entities *(include if feature involves data)*
-
-- **Verification Flow**: A named verification context (e.g., managed tenant onboarding) that defines which checks run.
-- **Verification Identity (Scope)**: The set of identifiers that uniquely represent “what is being verified” (tenant + provider connection + flow).
-- **Verification Run**: A single execution attempt for a given identity that produces a report (and is auditable).
-- **Verification Report**: A versioned, structured document attached to a run, containing summary and check results.
-- **Check Definition**: A reusable definition of an atomic readiness check (key, title, expected preconditions, severity, blocking behavior).
-- **Check Result**: The outcome of executing a check within a report.
-- **Reason Code**: A stable, machine-readable classification of why a check is pass/fail/warn/skip.
-- **Next Step**: An actionable remediation hint (label + optional destination/action) that helps the operator resolve a failed check.
-- **Evidence Pointer**: Safe references that support diagnostics (IDs, masked strings, hashes), without exposing secrets.
-
-### Assumptions
-
-- A run-tracking mechanism already exists and can store an attached, versioned verification report per run.
-- A canonical capability registry exists and is the source of truth for permission checks.
-- An audit logging mechanism exists that can record start/complete events with redaction.
-- Verification execution uses existing background processing patterns (no new observability platform is introduced).
-
-### Dependencies
-
-- Workspace membership and tenant-scoped authorization boundaries are already modeled.
-- Run visibility rules support “deny-as-not-found” behavior for non-members.
-- UI surfaces exist (or can be added) where “Next steps” can route users for remediation.
-
-## Success Criteria *(mandatory)*
-
-### Measurable Outcomes
-
-- **SC-001 (Clarity)**: In a usability test with a pre-seeded failed report, 90% of operators can identify the top blocking failure and the recommended next step within 60 seconds.
-- **SC-002 (Determinism)**: When “Start verification” is triggered repeatedly for the same identity while a run is active, the system starts at most 1 active run (0 duplicates) and always provides a path to view the active run.
-- **SC-003 (Safety / data minimization)**: Verification reports contain no secrets or tokens; evidence is limited to safe pointers (validated by automated tests and/or static checks).
-- **SC-004 (Performance)**: The verification report viewer renders within 200ms server time for a typical report of up to 50 checks.
-- **SC-005 (Authorization)**: Non-member access to tenant-scoped verification pages results in not-found responses in 100% of tested cases; members without the start capability cannot execute start actions in 100% of tested cases.

specs/074-verification-checklist/tasks.md

@@ -1,120 +0,0 @@
-# Tasks: 074 Verification Checklist Framework
-
-**Input**: Design documents from `/specs/074-verification-checklist/`
-**Prerequisites**: plan.md (required), spec.md (required for user stories), research.md, data-model.md, contracts/
-
-**Tests**: Required (Pest).
-
----
-
-## Phase 1: Foundational (Blocking Prerequisites)
-
-- [x] T001 [US1] Add example reports under specs: `specs/074-verification-checklist/contracts/examples/*.json` (pass/fail/warn/running) aligned to `contracts/verification-report.schema.json`.
-- [x] T002 [P] [US1] Add a small schema validation helper for reports (pure PHP, no external deps) in `app/Support/Verification/VerificationReportSchema.php` (version parsing + shape validation + graceful fallback).
-- [x] T003 [P] [US1] Add report redaction/sanitization utility in `app/Support/Verification/VerificationReportSanitizer.php` (denylist keys/values; enforce evidence pointers only).
-- [x] T004 [US1] Add value objects (or typed arrays) for report/check concepts in `app/Support/Verification/*` (status/severity enums or constants) to avoid ad-hoc strings throughout UI.
-
-**RBAC & UX prereqs**
-
-- [x] T005 [US3] Decide and document the start capability used per verification flow (v1: use `Capabilities::PROVIDER_RUN` for `provider.connection.check`; prefer existing constants in `app/Support/Auth/Capabilities.php`).
-- [x] T006 [US3] Add/confirm central UI enforcement helper usage for “visible-but-disabled with tooltip” in verification start UI (use tenant-scoped `app/Support/Rbac/UiEnforcement.php` with a resolved `Tenant` record).
-
-**Badges (BADGE-001)**
-
-- [x] T007 [P] [US1] Add badge domains for verification status/severity in `app/Support/Badges/BadgeDomain.php`.
-- [x] T008 [P] [US1] Add domain mappers in `app/Support/Badges/Domains/*` (e.g., `VerificationCheckStatusBadge`, `VerificationCheckSeverityBadge`).
-- [x] T009 [US1] Register domains in `app/Support/Badges/BadgeCatalog.php`.
-- [x] T010 [US1] Add mapping tests for new badge domains in `tests/Unit/Badges/*`.
-
-**Checkpoint**: Report contract + sanitizer + badge domains exist; UI work can start.
-
----
-
-## Phase 2: User Story 1 — Operator sees what’s wrong (Priority: P1)
-
-**Goal**: Render a structured, DB-only verification report viewer for a run.
-
-**Independent Test**: Seed an `OperationRun` with `context.verification_report` and assert the viewer renders the correct summary + per-check details, with no outbound HTTP.
-
-### Tests (write first)
-
-- [x] T011 [US1] Add a viewer DB-only test (no outbound HTTP, no job dispatch) in `tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php` using `Http::fake()` + `Bus::fake()` and asserting no requests / no dispatch during page render (including a second render to cover Livewire refresh/poll paths).
-- [x] T012 [US1] Add a redaction test in `tests/Feature/Verification/VerificationReportRedactionTest.php` to ensure forbidden keys/values never appear in stored/rendered evidence.
-- [x] T013 [US1] Add a “malformed/missing report” viewer test in `tests/Feature/Verification/VerificationReportMissingOrMalformedTest.php` (safe empty state).
-
-### Implementation
-
-- [x] T014 [US1] Create a reusable viewer Blade partial in `resources/views/filament/components/verification-report-viewer.blade.php` (summary banner + counts + collapsible checks + next steps links-only).
-- [x] T015 [US1] Create a Filament view entry/helper to render the viewer from an `OperationRun` in `app/Filament/Support/VerificationReportViewer.php` (or existing Filament helpers location), using only DB values.
-- [x] T016 [US1] Integrate viewer into Monitoring → Operations run view page: update `app/Filament/Resources/OperationRunResource.php` (infolist) to show the verification report section when `context.verification_report` exists.
-
-**Checkpoint**: A seeded report is readable in Monitoring; viewer is DB-only.
-
----
-
-## Phase 3: User Story 2 — Deterministic starts (Priority: P2)
-
-**Goal**: Starting verification is idempotent while active (dedupe) and guides users to the active run.
-
-**Independent Test**: Start verification twice for the same identity and assert a single active run is used.
-
-### Tests
-
-- [x] T017 [US2] Add a dedupe regression test in `tests/Feature/Verification/VerificationStartDedupeTest.php` asserting repeated starts reuse the same active run (leveraging the existing `OperationRunService::ensureRunWithIdentity()` behavior).
-- [x] T018 [US2] Add a “new run after completion” test in `tests/Feature/Verification/VerificationStartAfterCompletionTest.php`.
-
-### Implementation
-
-- [x] T019 [US2] Add (or adapt) a small “start verification” service wrapper in `app/Services/Verification/StartVerification.php` that: authorizes, creates/reuses a run identity, enqueues a verifier job, and returns the run.
-- [x] T020 [US2] Update the managed tenant onboarding verification step to route through the shared starter and replace the binary status UI with the shared verification report viewer (or a safe empty state) in `app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php`.
-- [x] T021 [US2] Update provider connection verification start surface(s) (where present) to route through the same shared starter.
-
-**Checkpoint**: Starts are deterministic and route users to the active run.
-
----
-
-## Phase 4: User Story 3 — Least-privilege and safe disclosure (Priority: P3)
-
-**Goal**: View vs start capability split; non-members get 404; members lacking start capability get 403 on execution.
-
-**Independent Test**: Readonly member can view report but cannot start; non-member cannot discover tenant/run.
-
-### Tests
-
-- [x] T022 [US3] Add authorization tests for view vs start in `tests/Feature/Verification/VerificationAuthorizationTest.php` covering:
-  - tenant non-member → 404 on view + start
-  - tenant member without start capability → can view, start returns forbidden (403)
-  - tenant member with start capability → can start
-
-### Implementation
-
-- [x] T023 [US3] Ensure start actions enforce server-side authorization via Gate/Policy (no UI-only enforcement) and use capability constants from `app/Support/Auth/Capabilities.php`.
-- [x] T024 [US3] Ensure tenant-scope non-membership yields deny-as-not-found behavior for verification routes/actions (align with existing tenant routing patterns and helpers).
-
-**Checkpoint**: Authorization behavior matches RBAC-UX contract.
-
----
-
-## Phase 5: Audit & Completion Events (Cross-cutting)
-
-- [x] T025 [US1] Add a stable audit action ID for verification completion in `app/Support/Audit/AuditActionId.php`.
-- [x] T026 [US1] Emit a completion audit event when a verification run finalizes (where run completion is set) using `app/Services/Audit/WorkspaceAuditLogger.php` with redacted metadata (run id + counts only).
-- [x] T030 [US1] Add a report writer in `app/Support/Verification/VerificationReportWriter.php` that builds `context.verification_report`, derives `summary.overall` deterministically, enforces reason codes + evidence pointer-only policy, and runs sanitizer before persistence.
-- [x] T031 [US1] Integrate the report writer into `app/Jobs/ProviderConnectionHealthCheckJob.php` so `provider.connection.check` writes a compliant `verification_report` to the run (both success and failure paths) before marking the run completed.
-- [x] T032 [US1] Add a report-writing integration test in `tests/Feature/Verification/ProviderConnectionHealthCheckWritesReportTest.php` ensuring the run ends with a valid, sanitized `context.verification_report` (and no forbidden evidence fields).
-
----
-
-## Phase 6: Polish & Regression Guards
-
-- [x] T027 [P] Add UI polish for empty/missing report state in the viewer (no leaks of internal details).
-- [x] T028 Run formatting: `vendor/bin/sail bin pint --dirty`.
-- [x] T029 Run targeted tests: `vendor/bin/sail artisan test --compact tests/Feature/Verification`.
-
----
-
-## Dependencies & Execution Order
-
-- Phase 1 (Foundational) blocks all other phases.
-- US1 can start after Phase 1; US2/US3 can proceed after Phase 1 but should reuse US1 primitives (viewer + sanitizer + badges).
-- Audit completion (Phase 5) depends on the shared verification job/service that finalizes runs.

tests/Feature/Badges/OnboardingBadgeSemanticsTest.php

@@ -0,0 +1,26 @@
+<?php
+
+use App\Support\Badges\BadgeCatalog;
+use App\Support\Badges\BadgeDomain;
+
+it('maps onboarding verification status blocked to a Blocked danger badge', function (): void {
+    $spec = BadgeCatalog::spec(BadgeDomain::ManagedTenantOnboardingVerificationStatus, 'blocked');
+
+    expect($spec->label)->toBe('Blocked');
+    expect($spec->color)->toBe('danger');
+    expect($spec->icon)->toBe('heroicon-m-x-circle');
+});
+
+it('maps onboarding verification status ready to a Ready success badge', function (): void {
+    $spec = BadgeCatalog::spec(BadgeDomain::ManagedTenantOnboardingVerificationStatus, 'ready');
+
+    expect($spec->label)->toBe('Ready');
+    expect($spec->color)->toBe('success');
+    expect($spec->icon)->toBe('heroicon-m-check-circle');
+});
+
+it('normalizes onboarding verification status input before mapping', function (): void {
+    $spec = BadgeCatalog::spec(BadgeDomain::ManagedTenantOnboardingVerificationStatus, 'NEEDS ATTENTION');
+
+    expect($spec->label)->toBe('Needs attention');
+});

tests/Feature/Filament/AdminHomeRedirectsToChooseTenantWhenWorkspaceSelectedTest.php

@@ -13,7 +13,7 @@
 
 uses(RefreshDatabase::class);
 
-it('redirects /admin to the workspace managed-tenants landing when a workspace is selected and has no tenants', function (): void {
+it('redirects /admin to onboarding when a workspace is selected and has no tenants', function (): void {
     $user = User::factory()->create();
 
     $workspace = Workspace::factory()->create();
@@ -28,7 +28,7 @@
         ->actingAs($user)
         ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
         ->get('/admin')
-        ->assertRedirect(route('admin.workspace.managed-tenants.onboarding', ['workspace' => $workspace->slug ?? $workspace->getKey()]));
+        ->assertRedirect('/admin/onboarding');
 });
 
 it('redirects /admin to choose-tenant when a workspace is selected and has multiple tenants', function (): void {

tests/Feature/Filament/TenantMembersDbOnlyRenderTest.php

@@ -29,7 +29,7 @@
             'ownerRecord' => $tenant,
             'pageClass' => ViewTenant::class,
         ])
-        ->assertSee($member->name);
+        ->assertSee($member->email);
 
     Bus::assertNothingDispatched();
 });

tests/Feature/Notifications/OperationRunNotificationTest.php

@@ -63,6 +63,33 @@
     expect($user->notifications()->count())->toBe(0);
 });
 
+it('uses a tenantless view link for managed tenant onboarding wizard runs', function () {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+    $this->actingAs($user);
+
+    $run = OperationRun::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'user_id' => $user->getKey(),
+        'initiator_name' => $user->name,
+        'type' => 'provider.connection.check',
+        'status' => 'queued',
+        'outcome' => 'pending',
+        'context' => [
+            'wizard' => [
+                'flow' => 'managed_tenant_onboarding',
+                'step' => 'verification',
+            ],
+        ],
+    ]);
+
+    $user->notify(new OperationRunQueued($run));
+
+    $notification = $user->notifications()->latest('id')->first();
+    expect($notification)->not->toBeNull();
+    expect($notification->data['actions'][0]['url'] ?? null)
+        ->toBe(OperationRunLinks::tenantlessView($run));
+});
+
 it('emits a terminal notification when an operation run transitions to completed', function () {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
     $this->actingAs($user);

tests/Feature/Onboarding/OnboardingActivationTest.php

@@ -0,0 +1,134 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\AuditLog;
+use App\Models\OperationRun;
+use App\Models\Tenant;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\OperationRunOutcome;
+use App\Support\OperationRunStatus;
+use App\Support\Workspaces\WorkspaceContext;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+it('denies activation to non-owners even when verification succeeded', function (): void {
+    Queue::fake();
+
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'manager',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $entraTenantId = '88888888-8888-8888-8888-888888888888';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+    ]);
+
+    $component->call('createProviderConnection', [
+        'display_name' => 'Acme connection',
+        'client_id' => '00000000-0000-0000-0000-000000000000',
+        'client_secret' => 'super-secret',
+        'is_default' => true,
+    ]);
+
+    $component->call('startVerification');
+
+    $tenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    $run = OperationRun::query()
+        ->where('tenant_id', (int) $tenant->getKey())
+        ->where('type', 'provider.connection.check')
+        ->firstOrFail();
+
+    $run->update([
+        'status' => OperationRunStatus::Completed->value,
+        'outcome' => OperationRunOutcome::Succeeded->value,
+    ]);
+
+    $component
+        ->call('completeOnboarding')
+        ->assertStatus(403);
+
+    $tenant->refresh();
+    expect($tenant->status)->not->toBe(Tenant::STATUS_ACTIVE);
+});
+
+it('requires an override reason when verification is blocked and records an audit event when overridden', function (): void {
+    Queue::fake();
+
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $entraTenantId = '99999999-9999-9999-9999-999999999999';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+    ]);
+
+    $component->call('createProviderConnection', [
+        'display_name' => 'Acme connection',
+        'client_id' => '00000000-0000-0000-0000-000000000000',
+        'client_secret' => 'super-secret',
+        'is_default' => true,
+    ]);
+
+    $component->call('startVerification');
+
+    $tenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    $run = OperationRun::query()
+        ->where('tenant_id', (int) $tenant->getKey())
+        ->where('type', 'provider.connection.check')
+        ->firstOrFail();
+
+    $run->update([
+        'status' => OperationRunStatus::Completed->value,
+        'outcome' => OperationRunOutcome::Failed->value,
+    ]);
+
+    $component
+        ->set('data.override_blocked', true)
+        ->set('data.override_reason', '')
+        ->call('completeOnboarding')
+        ->assertHasErrors(['data.override_reason']);
+
+    $component
+        ->set('data.override_blocked', true)
+        ->set('data.override_reason', 'Temporary exception approved by owner')
+        ->call('completeOnboarding');
+
+    $tenant->refresh();
+    expect($tenant->status)->toBe(Tenant::STATUS_ACTIVE);
+
+    expect(AuditLog::query()
+        ->where('workspace_id', (int) $workspace->getKey())
+        ->where('action', 'managed_tenant_onboarding.activation')
+        ->exists())->toBeTrue();
+});

tests/Feature/Onboarding/OnboardingEntryPointTest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+
+it('redirects to choose-workspace when visiting /admin/onboarding without a selected workspace', function (): void {
+    $user = User::factory()->create();
+    $workspace = Workspace::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->forget(WorkspaceContext::SESSION_KEY);
+
+    $this->actingAs($user)
+        ->get('/admin/onboarding')
+        ->assertRedirect('/admin/choose-workspace');
+});
+
+it('renders the onboarding wizard at /admin/onboarding when a workspace is selected', function (): void {
+    $user = User::factory()->create();
+    $workspace = Workspace::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user)
+        ->get('/admin/onboarding')
+        ->assertSuccessful();
+});

tests/Feature/Onboarding/OnboardingFoundationsTest.php

@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Tenant;
+use App\Services\Auth\WorkspaceRoleCapabilityMap;
+use App\Support\Auth\Capabilities;
+
+it('registers managed tenant onboarding wizard capabilities in the canonical registry', function (): void {
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_VIEW))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_CONNECTION_MANAGE))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_VERIFICATION_START))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_INVENTORY_SYNC))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_POLICY_SYNC))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_BOOTSTRAP_BACKUP_BOOTSTRAP))->toBeTrue();
+    expect(Capabilities::isKnown(Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE))->toBeTrue();
+});
+
+it('maps onboarding wizard capabilities to workspace roles (least privilege)', function (): void {
+    expect(WorkspaceRoleCapabilityMap::hasCapability('owner', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY))->toBeTrue();
+    expect(WorkspaceRoleCapabilityMap::hasCapability('manager', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY))->toBeTrue();
+    expect(WorkspaceRoleCapabilityMap::hasCapability('operator', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY))->toBeFalse();
+    expect(WorkspaceRoleCapabilityMap::hasCapability('readonly', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_IDENTIFY))->toBeFalse();
+
+    expect(WorkspaceRoleCapabilityMap::hasCapability('owner', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE))->toBeTrue();
+    expect(WorkspaceRoleCapabilityMap::hasCapability('manager', Capabilities::WORKSPACE_MANAGED_TENANT_ONBOARD_ACTIVATE))->toBeFalse();
+});
+
+it('supports the v1 managed tenant lifecycle statuses', function (): void {
+    $draft = Tenant::factory()->create(['status' => Tenant::STATUS_DRAFT]);
+    $onboarding = Tenant::factory()->create(['status' => Tenant::STATUS_ONBOARDING]);
+    $active = Tenant::factory()->create(['status' => Tenant::STATUS_ACTIVE]);
+
+    expect(Tenant::activeQuery()->pluck('id')->all())->toContain((int) $active->getKey());
+    expect(Tenant::activeQuery()->pluck('id')->all())->not->toContain((int) $draft->getKey());
+    expect(Tenant::activeQuery()->pluck('id')->all())->not->toContain((int) $onboarding->getKey());
+
+    $onboarding->delete();
+    $onboarding->refresh();
+
+    expect($onboarding->status)->toBe(Tenant::STATUS_ARCHIVED);
+
+    $onboarding->restore();
+    $onboarding->refresh();
+
+    expect($onboarding->status)->toBe(Tenant::STATUS_ACTIVE);
+});

tests/Feature/Onboarding/OnboardingIdentifyTenantTest.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\Tenant;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Livewire\Livewire;
+
+it('is idempotent when identifying the same Entra tenant ID twice in the same workspace', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user);
+
+    $entraTenantId = '11111111-1111-1111-1111-111111111111';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+        'primary_domain' => 'acme.example',
+        'notes' => 'Initial onboarding',
+    ]);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+        'primary_domain' => 'acme.example',
+        'notes' => 'Initial onboarding',
+    ]);
+
+    expect(Tenant::query()->where('tenant_id', $entraTenantId)->count())->toBe(1);
+
+    $tenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    expect((int) $tenant->workspace_id)->toBe((int) $workspace->getKey());
+
+    expect(TenantOnboardingSession::query()
+        ->where('workspace_id', (int) $workspace->getKey())
+        ->where('entra_tenant_id', $entraTenantId)
+        ->whereNull('completed_at')
+        ->count())->toBe(1);
+});
+
+it('responds with deny-as-not-found when attempting to identify an Entra tenant ID that belongs to another workspace', function (): void {
+    $entraTenantId = '22222222-2222-2222-2222-222222222222';
+
+    $workspaceA = Workspace::factory()->create();
+    $workspaceB = Workspace::factory()->create();
+
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspaceA->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspaceB->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    Tenant::factory()->create([
+        'workspace_id' => (int) $workspaceA->getKey(),
+        'tenant_id' => $entraTenantId,
+        'status' => Tenant::STATUS_ACTIVE,
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspaceB->getKey());
+
+    $this->actingAs($user);
+
+    Livewire::actingAs($user)
+        ->test(ManagedTenantOnboardingWizard::class)
+        ->call('identifyManagedTenant', [
+            'entra_tenant_id' => $entraTenantId,
+            'environment' => 'prod',
+            'name' => 'Other Workspace',
+        ])
+        ->assertStatus(404);
+});

tests/Feature/Onboarding/OnboardingLegacyRoutesTest.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+
+it('returns 404 for legacy onboarding entry points (no redirects)', function (): void {
+    $user = User::factory()->create();
+
+    $this->actingAs($user);
+
+    $this->get('/admin/register-tenant')->assertNotFound();
+    $this->get('/admin/managed-tenants/onboarding')->assertNotFound();
+    $this->get('/admin/new')->assertNotFound();
+});
+
+it('returns 404 for the legacy workspace-scoped onboarding route', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user)
+        ->get("/admin/w/{$workspace->getKey()}/managed-tenants/onboarding")
+        ->assertNotFound();
+});

tests/Feature/Onboarding/OnboardingProviderConnectionTest.php

@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\ProviderConnection;
+use App\Models\Tenant;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Livewire\Livewire;
+
+it('stores the selected provider_connection_id in the onboarding session', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user);
+
+    $entraTenantId = '33333333-3333-3333-3333-333333333333';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+    ]);
+
+    $tenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    $connection = ProviderConnection::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'provider' => 'microsoft',
+        'entra_tenant_id' => $entraTenantId,
+        'display_name' => 'Acme (onboarding)',
+        'is_default' => true,
+    ]);
+
+    $component->call('selectProviderConnection', (int) $connection->getKey());
+
+    $session = TenantOnboardingSession::query()
+        ->where('workspace_id', (int) $workspace->getKey())
+        ->where('entra_tenant_id', $entraTenantId)
+        ->whereNull('completed_at')
+        ->firstOrFail();
+
+    expect($session->state['provider_connection_id'] ?? null)->toBe((int) $connection->getKey());
+});
+
+it('prevents selecting a provider connection bound to a different managed tenant', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user);
+
+    $entraTenantId = '44444444-4444-4444-4444-444444444444';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Primary Tenant',
+    ]);
+
+    $primaryTenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    $otherTenant = Tenant::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => '55555555-5555-5555-5555-555555555555',
+        'status' => Tenant::STATUS_ONBOARDING,
+    ]);
+
+    $otherConnection = ProviderConnection::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $otherTenant->getKey(),
+        'provider' => 'microsoft',
+        'entra_tenant_id' => (string) $otherTenant->tenant_id,
+        'display_name' => 'Other tenant connection',
+        'is_default' => true,
+    ]);
+
+    expect((int) $otherConnection->tenant_id)->not->toBe((int) $primaryTenant->getKey());
+
+    $component
+        ->call('selectProviderConnection', (int) $otherConnection->getKey())
+        ->assertStatus(404);
+});

tests/Feature/Onboarding/OnboardingRbacSemanticsTest.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Livewire\Livewire;
+
+it('returns 404 for non-members when visiting /admin/onboarding with a selected workspace', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user)
+        ->get('/admin/onboarding')
+        ->assertNotFound();
+});
+
+it('allows workspace members without onboarding capability to view the page but denies action attempts with 403', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'readonly',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user)
+        ->get('/admin/onboarding')
+        ->assertSuccessful();
+
+    Livewire::actingAs($user)
+        ->test(ManagedTenantOnboardingWizard::class)
+        ->call('identifyManagedTenant', [
+            'entra_tenant_id' => '11111111-1111-1111-1111-111111111111',
+            'environment' => 'prod',
+            'name' => 'Acme',
+        ])
+        ->assertStatus(403);
+});

tests/Feature/Onboarding/OnboardingSecretSafetyTest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Livewire\Livewire;
+
+it('never persists client secrets in onboarding session state and never pre-fills them on resume', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $this->actingAs($user);
+
+    $entraTenantId = '66666666-6666-6666-6666-666666666666';
+    $secret = 'super-secret-client-secret';
+
+    Livewire::actingAs($user)
+        ->test(ManagedTenantOnboardingWizard::class)
+        ->call('identifyManagedTenant', [
+            'entra_tenant_id' => $entraTenantId,
+            'environment' => 'prod',
+            'name' => 'Acme',
+        ])
+        ->call('createProviderConnection', [
+            'display_name' => 'Acme connection',
+            'client_id' => '00000000-0000-0000-0000-000000000000',
+            'client_secret' => $secret,
+            'is_default' => true,
+        ]);
+
+    $session = TenantOnboardingSession::query()
+        ->where('workspace_id', (int) $workspace->getKey())
+        ->where('entra_tenant_id', $entraTenantId)
+        ->whereNull('completed_at')
+        ->firstOrFail();
+
+    $encodedState = json_encode($session->state, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+    expect($encodedState)->not->toContain($secret);
+    expect($session->state)->not->toHaveKey('client_secret');
+    expect($session->state)->not->toHaveKey('new_connection');
+
+    $resumed = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $data = $resumed->get('data');
+
+    expect($data['new_connection']['client_secret'] ?? null)->toBeNull();
+});

tests/Feature/Onboarding/OnboardingVerificationTest.php

@@ -0,0 +1,133 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Jobs\ProviderConnectionHealthCheckJob;
+use App\Models\OperationRun;
+use App\Models\Tenant;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+it('dedupes active verification runs and stores the run id in the onboarding session', function (): void {
+    Queue::fake();
+
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $entraTenantId = '77777777-7777-7777-7777-777777777777';
+
+    $component = Livewire::actingAs($user)->test(ManagedTenantOnboardingWizard::class);
+
+    $component->call('identifyManagedTenant', [
+        'entra_tenant_id' => $entraTenantId,
+        'environment' => 'prod',
+        'name' => 'Acme',
+    ]);
+
+    $component->call('createProviderConnection', [
+        'display_name' => 'Acme connection',
+        'client_id' => '00000000-0000-0000-0000-000000000000',
+        'client_secret' => 'super-secret',
+        'is_default' => true,
+    ]);
+
+    $component->call('startVerification');
+    $component->call('startVerification');
+
+    Queue::assertPushed(ProviderConnectionHealthCheckJob::class, 1);
+
+    $tenant = Tenant::query()->where('tenant_id', $entraTenantId)->firstOrFail();
+
+    expect(OperationRun::query()
+        ->where('tenant_id', (int) $tenant->getKey())
+        ->where('type', 'provider.connection.check')
+        ->count())->toBe(1);
+
+    $runId = (int) OperationRun::query()
+        ->where('tenant_id', (int) $tenant->getKey())
+        ->where('type', 'provider.connection.check')
+        ->value('id');
+
+    $session = TenantOnboardingSession::query()
+        ->where('workspace_id', (int) $workspace->getKey())
+        ->where('entra_tenant_id', $entraTenantId)
+        ->whereNull('completed_at')
+        ->firstOrFail();
+
+    expect($session->state['verification_operation_run_id'] ?? null)->toBe($runId);
+});
+
+it('renders stored verification findings in the wizard report section', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+    $entraTenantId = '99999999-9999-9999-9999-999999999999';
+
+    $tenant = Tenant::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => $entraTenantId,
+        'status' => 'onboarding',
+    ]);
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'failed',
+        'context' => [
+            'target_scope' => [
+                'entra_tenant_id' => $entraTenantId,
+                'entra_tenant_name' => 'Contoso',
+            ],
+        ],
+        'failure_summary' => [
+            [
+                'code' => 'provider.connection.check.failed',
+                'reason_code' => 'permission_denied',
+                'message' => 'Missing required Graph permissions.',
+            ],
+        ],
+    ]);
+
+    TenantOnboardingSession::query()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'entra_tenant_id' => $entraTenantId,
+        'current_step' => 'verify',
+        'state' => [
+            'verification_operation_run_id' => (int) $run->getKey(),
+        ],
+        'started_by_user_id' => (int) $user->getKey(),
+        'updated_by_user_id' => (int) $user->getKey(),
+    ]);
+
+    $this->actingAs($user)
+        ->get('/admin/onboarding')
+        ->assertSuccessful()
+        ->assertSee('permission_denied')
+        ->assertSee('Missing required Graph permissions.')
+        ->assertSee($entraTenantId);
+});

tests/Feature/Operations/TenantlessOperationRunViewerTest.php

@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\OperationRun;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\OperationRunOutcome;
+use App\Support\OperationRunStatus;
+use App\Support\Workspaces\WorkspaceContext;
+
+it('allows viewing an operation run without a selected workspace when the user is a member of the run workspace', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->forget(WorkspaceContext::SESSION_KEY);
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => null,
+        'type' => 'provider.connection.check',
+        'status' => OperationRunStatus::Queued->value,
+        'outcome' => OperationRunOutcome::Pending->value,
+    ]);
+
+    $this->actingAs($user)
+        ->get("/admin/operations/{$run->getKey()}")
+        ->assertSuccessful();
+
+    expect(session()->get(WorkspaceContext::SESSION_KEY))->toBeNull();
+});
+
+it('returns 404 for non-members when viewing an operation run without a selected workspace', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    session()->forget(WorkspaceContext::SESSION_KEY);
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => null,
+        'type' => 'provider.connection.check',
+        'status' => OperationRunStatus::Queued->value,
+        'outcome' => OperationRunOutcome::Pending->value,
+    ]);
+
+    $this->actingAs($user)
+        ->get("/admin/operations/{$run->getKey()}")
+        ->assertNotFound();
+});
+
+it('renders stored target scope and failure details for a completed run', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    session()->forget(WorkspaceContext::SESSION_KEY);
+
+    $entraTenantId = '11111111-1111-1111-1111-111111111111';
+    $failureMessage = 'Missing required Graph permissions.';
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => null,
+        'type' => 'provider.connection.check',
+        'status' => OperationRunStatus::Completed->value,
+        'outcome' => OperationRunOutcome::Failed->value,
+        'context' => [
+            'target_scope' => [
+                'entra_tenant_id' => $entraTenantId,
+                'entra_tenant_name' => 'Contoso',
+            ],
+        ],
+        'failure_summary' => [
+            [
+                'code' => 'provider.connection.check.failed',
+                'reason_code' => 'permission_denied',
+                'message' => $failureMessage,
+            ],
+        ],
+    ]);
+
+    $this->actingAs($user)
+        ->get("/admin/operations/{$run->getKey()}")
+        ->assertSuccessful()
+        ->assertSee($entraTenantId)
+        ->assertSee('permission_denied')
+        ->assertSee($failureMessage);
+});

tests/Feature/Rbac/OnboardingWizardUiEnforcementTest.php

@@ -0,0 +1,106 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Jobs\ProviderConnectionHealthCheckJob;
+use App\Models\ProviderConnection;
+use App\Models\Tenant;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Workspaces\WorkspaceContext;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+describe('Onboarding wizard UI enforcement', function () {
+    it('denies identifyManagedTenant for readonly workspace members', function (): void {
+        $workspace = Workspace::factory()->create();
+        $user = User::factory()->create();
+
+        WorkspaceMembership::factory()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'user_id' => (int) $user->getKey(),
+            'role' => 'readonly',
+        ]);
+
+        session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+        Livewire::actingAs($user)
+            ->test(ManagedTenantOnboardingWizard::class)
+            ->call('identifyManagedTenant', [
+                'entra_tenant_id' => '11111111-1111-1111-1111-111111111111',
+                'environment' => 'prod',
+                'name' => 'Acme',
+            ])
+            ->assertStatus(403);
+    });
+
+    it('denies provider connection creation for operator members', function (): void {
+        $workspace = Workspace::factory()->create();
+        $user = User::factory()->create();
+
+        WorkspaceMembership::factory()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'user_id' => (int) $user->getKey(),
+            'role' => 'operator',
+        ]);
+
+        session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+        Livewire::actingAs($user)
+            ->test(ManagedTenantOnboardingWizard::class)
+            ->call('createProviderConnection', [
+                'display_name' => 'Acme connection',
+                'client_id' => '00000000-0000-0000-0000-000000000000',
+                'client_secret' => 'super-secret',
+                'is_default' => true,
+            ])
+            ->assertStatus(403);
+    });
+
+    it('allows operator members to start verification for an existing onboarding session', function (): void {
+        Queue::fake();
+
+        $workspace = Workspace::factory()->create();
+        $user = User::factory()->create();
+
+        WorkspaceMembership::factory()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'user_id' => (int) $user->getKey(),
+            'role' => 'operator',
+        ]);
+
+        session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
+
+        $tenant = Tenant::factory()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'status' => Tenant::STATUS_ONBOARDING,
+        ]);
+
+        $connection = ProviderConnection::factory()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'tenant_id' => (int) $tenant->getKey(),
+            'entra_tenant_id' => (string) $tenant->tenant_id,
+        ]);
+
+        TenantOnboardingSession::query()->create([
+            'workspace_id' => (int) $workspace->getKey(),
+            'tenant_id' => (int) $tenant->getKey(),
+            'entra_tenant_id' => (string) $tenant->tenant_id,
+            'current_step' => 'connection',
+            'state' => [
+                'provider_connection_id' => (int) $connection->getKey(),
+            ],
+            'started_by_user_id' => (int) $user->getKey(),
+            'updated_by_user_id' => (int) $user->getKey(),
+        ]);
+
+        Livewire::actingAs($user)
+            ->test(ManagedTenantOnboardingWizard::class)
+            ->call('startVerification');
+
+        Queue::assertPushed(ProviderConnectionHealthCheckJob::class, 1);
+    });
+});

tests/Feature/Verification/ProviderConnectionHealthCheckWritesReportTest.php

@@ -1,165 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Jobs\ProviderConnectionHealthCheckJob;
-use App\Models\AuditLog;
-use App\Models\OperationRun;
-use App\Models\ProviderConnection;
-use App\Models\ProviderCredential;
-use App\Services\Graph\GraphClientInterface;
-use App\Services\Graph\GraphResponse;
-use App\Services\OperationRunService;
-use App\Services\Providers\MicrosoftProviderHealthCheck;
-use App\Support\Audit\AuditActionId;
-use App\Support\Verification\VerificationReportSchema;
-
-it('writes a sanitized verification report for failed provider connection checks', function (): void {
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'provider' => 'microsoft',
-        'entra_tenant_id' => fake()->uuid(),
-    ]);
-
-    ProviderCredential::factory()->create([
-        'provider_connection_id' => (int) $connection->getKey(),
-        'payload' => [
-            'tenant_id' => (string) $connection->entra_tenant_id,
-            'client_id' => fake()->uuid(),
-            'client_secret' => fake()->sha1(),
-        ],
-    ]);
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'running',
-        'outcome' => 'pending',
-        'context' => [
-            'provider_connection_id' => (int) $connection->getKey(),
-        ],
-    ]);
-
-    $this->mock(GraphClientInterface::class, function ($mock): void {
-        $mock->shouldReceive('getOrganization')
-            ->once()
-            ->andReturn(new GraphResponse(false, [], 401, ['Bearer super-secret-token']));
-    });
-
-    $job = new ProviderConnectionHealthCheckJob(
-        tenantId: (int) $tenant->getKey(),
-        userId: (int) $user->getKey(),
-        providerConnectionId: (int) $connection->getKey(),
-        operationRun: $run,
-    );
-
-    $job->handle(
-        healthCheck: app(MicrosoftProviderHealthCheck::class),
-        runs: app(OperationRunService::class),
-    );
-
-    $run = $run->fresh();
-
-    expect($run)->not->toBeNull();
-    expect($run->status)->toBe('completed');
-    expect($run->outcome)->toBe('failed');
-
-    $context = is_array($run->context) ? $run->context : [];
-    $report = $context['verification_report'] ?? null;
-
-    expect($report)->toBeArray();
-    expect(VerificationReportSchema::isValidReport($report))->toBeTrue();
-    expect(json_encode($report))->not->toContain('Bearer ');
-    expect($report['checks'][0]['reason_code'] ?? null)->toBe('authentication_failed');
-
-    foreach (($report['checks'] ?? []) as $check) {
-        expect($check)->toBeArray();
-
-        foreach (($check['evidence'] ?? []) as $pointer) {
-            expect($pointer)->toBeArray();
-            expect(array_keys($pointer))->toEqualCanonicalizing(['kind', 'value']);
-        }
-    }
-
-    $audit = AuditLog::query()
-        ->where('workspace_id', (int) $tenant->workspace_id)
-        ->where('action', AuditActionId::VerificationCompleted->value)
-        ->latest('id')
-        ->first();
-
-    expect($audit)->not->toBeNull();
-    expect($audit?->metadata)->toMatchArray([
-        'operation_run_id' => (int) $run->getKey(),
-    ]);
-});
-
-it('writes a verification report for successful provider connection checks', function (): void {
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'provider' => 'microsoft',
-        'entra_tenant_id' => fake()->uuid(),
-    ]);
-
-    ProviderCredential::factory()->create([
-        'provider_connection_id' => (int) $connection->getKey(),
-        'payload' => [
-            'tenant_id' => (string) $connection->entra_tenant_id,
-            'client_id' => fake()->uuid(),
-            'client_secret' => fake()->sha1(),
-        ],
-    ]);
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'running',
-        'outcome' => 'pending',
-        'context' => [
-            'provider_connection_id' => (int) $connection->getKey(),
-        ],
-    ]);
-
-    $this->mock(GraphClientInterface::class, function ($mock): void {
-        $mock->shouldReceive('getOrganization')
-            ->once()
-            ->andReturn(new GraphResponse(true, [
-                'id' => 'org_123',
-                'displayName' => 'Org 123',
-            ], 200));
-    });
-
-    $job = new ProviderConnectionHealthCheckJob(
-        tenantId: (int) $tenant->getKey(),
-        userId: (int) $user->getKey(),
-        providerConnectionId: (int) $connection->getKey(),
-        operationRun: $run,
-    );
-
-    $job->handle(
-        healthCheck: app(MicrosoftProviderHealthCheck::class),
-        runs: app(OperationRunService::class),
-    );
-
-    $run = $run->fresh();
-
-    expect($run)->not->toBeNull();
-    expect($run->status)->toBe('completed');
-    expect($run->outcome)->toBe('succeeded');
-
-    $context = is_array($run->context) ? $run->context : [];
-    $report = $context['verification_report'] ?? null;
-
-    expect($report)->toBeArray();
-    expect(VerificationReportSchema::isValidReport($report))->toBeTrue();
-    expect($report['summary']['counts'] ?? [])->toMatchArray([
-        'total' => 1,
-        'pass' => 1,
-        'fail' => 0,
-    ]);
-});

tests/Feature/Verification/VerificationAuthorizationTest.php

@@ -1,112 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\OperationRunResource;
-use App\Models\OperationRun;
-use App\Models\ProviderConnection;
-use App\Models\Tenant;
-use App\Services\Verification\StartVerification;
-use Illuminate\Auth\Access\AuthorizationException;
-use Illuminate\Support\Facades\Queue;
-use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
-
-it('returns 404 for non-members on verification view and start', function (): void {
-    Queue::fake();
-
-    $tenant = Tenant::factory()->create();
-    $otherTenant = Tenant::factory()->create();
-
-    [$user] = createUserWithTenant($otherTenant, role: 'readonly');
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [
-            'verification_report' => json_decode(
-                (string) file_get_contents(base_path('specs/074-verification-checklist/contracts/examples/fail.json')),
-                true,
-                512,
-                JSON_THROW_ON_ERROR,
-            ),
-        ],
-    ]);
-
-    $this->actingAs($user)
-        ->get(OperationRunResource::getUrl('view', ['record' => $run], tenant: $tenant))
-        ->assertStatus(404);
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-    ]);
-
-    expect(fn () => app(StartVerification::class)->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-    ))->toThrow(NotFoundHttpException::class);
-});
-
-it('allows readonly members to view verification reports but forbids starting verification', function (): void {
-    Queue::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'readonly');
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [
-            'verification_report' => json_decode(
-                (string) file_get_contents(base_path('specs/074-verification-checklist/contracts/examples/fail.json')),
-                true,
-                512,
-                JSON_THROW_ON_ERROR,
-            ),
-        ],
-    ]);
-
-    $this->actingAs($user)
-        ->get(OperationRunResource::getUrl('view', ['record' => $run], tenant: $tenant))
-        ->assertOk()
-        ->assertSee('Verification report');
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-    ]);
-
-    expect(fn () => app(StartVerification::class)->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-    ))->toThrow(AuthorizationException::class);
-});
-
-it('allows members with start capability to start verification', function (): void {
-    Queue::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'provider' => 'microsoft',
-        'entra_tenant_id' => fake()->uuid(),
-    ]);
-
-    $result = app(StartVerification::class)->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-    );
-
-    expect($result->status)->toBe('started');
-    expect($result->run->type)->toBe('provider.connection.check');
-    expect($result->run->tenant_id)->toBe((int) $tenant->getKey());
-    expect($result->run->context)->toMatchArray([
-        'provider_connection_id' => (int) $connection->getKey(),
-    ]);
-});

tests/Feature/Verification/VerificationReportMissingOrMalformedTest.php

@@ -1,59 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\OperationRunResource\Pages\ViewOperationRun;
-use App\Models\OperationRun;
-use Filament\Facades\Filament;
-use Livewire\Livewire;
-
-it('shows a safe empty state when a verification report is missing', function (): void {
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [],
-    ]);
-
-    assertNoOutboundHttp(function () use ($run): void {
-        Livewire::test(ViewOperationRun::class, ['record' => $run->getRouteKey()])
-            ->assertSee('Verification report')
-            ->assertSee('Verification report unavailable');
-    });
-});
-
-it('shows a safe empty state when a verification report is malformed', function (): void {
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [
-            'verification_report' => [
-                'schema_version' => '1.0.0',
-                'flow' => 'provider.connection.check',
-            ],
-        ],
-    ]);
-
-    assertNoOutboundHttp(function () use ($run): void {
-        Livewire::test(ViewOperationRun::class, ['record' => $run->getRouteKey()])
-            ->assertSee('Verification report')
-            ->assertSee('Verification report unavailable');
-    });
-});

tests/Feature/Verification/VerificationReportRedactionTest.php

@@ -1,47 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\OperationRunResource\Pages\ViewOperationRun;
-use App\Models\OperationRun;
-use Filament\Facades\Filament;
-use Livewire\Livewire;
-
-it('redacts forbidden evidence fields in rendered verification reports', function (): void {
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $report = json_decode(
-        (string) file_get_contents(base_path('specs/074-verification-checklist/contracts/examples/fail.json')),
-        true,
-        512,
-        JSON_THROW_ON_ERROR,
-    );
-
-    $report['checks'][0]['evidence'][] = ['kind' => 'authorization', 'value' => 'Bearer abc.def.ghi'];
-    $report['checks'][0]['evidence'][] = ['kind' => 'access_token', 'value' => 'super-secret'];
-    $report['checks'][0]['message'] = 'Authorization: Bearer abc.def.ghi access_token=super-secret';
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [
-            'verification_report' => $report,
-        ],
-    ]);
-
-    assertNoOutboundHttp(function () use ($run): void {
-        Livewire::test(ViewOperationRun::class, ['record' => $run->getRouteKey()])
-            ->assertSee('Verification report')
-            ->assertSee('Token acquisition works')
-            ->assertDontSee('access_token')
-            ->assertDontSee('Bearer abc.def.ghi')
-            ->assertDontSee('super-secret');
-    });
-});

tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php

@@ -1,50 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\OperationRunResource\Pages\ViewOperationRun;
-use App\Models\OperationRun;
-use Filament\Facades\Filament;
-use Illuminate\Support\Facades\Bus;
-use Livewire\Livewire;
-
-it('renders the verification report viewer DB-only (no outbound HTTP, no job dispatch)', function (): void {
-    Bus::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $report = json_decode(
-        (string) file_get_contents(base_path('specs/074-verification-checklist/contracts/examples/fail.json')),
-        true,
-        512,
-        JSON_THROW_ON_ERROR,
-    );
-
-    $run = OperationRun::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'user_id' => (int) $user->getKey(),
-        'type' => 'provider.connection.check',
-        'status' => 'completed',
-        'outcome' => 'failed',
-        'context' => [
-            'verification_report' => $report,
-        ],
-    ]);
-
-    assertNoOutboundHttp(function () use ($run): void {
-        $component = Livewire::test(ViewOperationRun::class, ['record' => $run->getRouteKey()])
-            ->assertSee('Verification report')
-            ->assertSee('Blocked')
-            ->assertSee('Token acquisition works');
-
-        $component
-            ->call('$refresh')
-            ->assertSee('Token acquisition works');
-    });
-
-    Bus::assertNothingDispatched();
-});

tests/Feature/Verification/VerificationStartAfterCompletionTest.php

@@ -1,62 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Jobs\ProviderConnectionHealthCheckJob;
-use App\Models\OperationRun;
-use App\Models\ProviderConnection;
-use App\Services\OperationRunService;
-use App\Services\Verification\StartVerification;
-use App\Support\OperationRunOutcome;
-use App\Support\OperationRunStatus;
-use Filament\Facades\Filament;
-use Illuminate\Support\Facades\Queue;
-
-it('creates a new verification run after the previous run is completed', function (): void {
-    Queue::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => $tenant->getKey(),
-        'provider' => 'microsoft',
-        'entra_tenant_id' => fake()->uuid(),
-    ]);
-
-    $starter = app(StartVerification::class);
-
-    $first = $starter->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-    );
-
-    /** @var OperationRun $firstRun */
-    $firstRun = $first->run->refresh();
-
-    app(OperationRunService::class)->updateRun(
-        $firstRun,
-        status: OperationRunStatus::Completed->value,
-        outcome: OperationRunOutcome::Succeeded->value,
-    );
-
-    $second = $starter->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-    );
-
-    expect($second->status)->toBe('started');
-    expect($second->run->getKey())->not->toBe($firstRun->getKey());
-
-    expect(OperationRun::query()
-        ->where('tenant_id', $tenant->getKey())
-        ->where('type', 'provider.connection.check')
-        ->count())->toBe(2);
-
-    Queue::assertPushed(ProviderConnectionHealthCheckJob::class, 2);
-});

tests/Feature/Verification/VerificationStartDedupeTest.php

@@ -1,53 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Jobs\ProviderConnectionHealthCheckJob;
-use App\Models\OperationRun;
-use App\Models\ProviderConnection;
-use App\Services\Verification\StartVerification;
-use Filament\Facades\Filament;
-use Illuminate\Support\Facades\Queue;
-
-it('dedupes verification starts while a run is active', function (): void {
-    Queue::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'operator');
-    $this->actingAs($user);
-
-    $tenant->makeCurrent();
-    Filament::setTenant($tenant, true);
-
-    $connection = ProviderConnection::factory()->create([
-        'tenant_id' => $tenant->getKey(),
-        'provider' => 'microsoft',
-        'entra_tenant_id' => fake()->uuid(),
-    ]);
-
-    $starter = app(StartVerification::class);
-
-    $first = $starter->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-        extraContext: ['wizard' => ['flow' => 'managed_tenant_onboarding']],
-    );
-
-    $second = $starter->providerConnectionCheck(
-        tenant: $tenant,
-        connection: $connection,
-        initiator: $user,
-        extraContext: ['wizard' => ['flow' => 'managed_tenant_onboarding']],
-    );
-
-    expect($first->run->getKey())->toBe($second->run->getKey());
-    expect($first->status)->toBe('started');
-    expect($second->status)->toBe('deduped');
-
-    expect(OperationRun::query()
-        ->where('tenant_id', $tenant->getKey())
-        ->where('type', 'provider.connection.check')
-        ->count())->toBe(1);
-
-    Queue::assertPushed(ProviderConnectionHealthCheckJob::class, 1);
-});

tests/Feature/Workspaces/SwitchWorkspaceRedirectsToTenantRegistrationWhenNoTenantsTest.php

@@ -10,7 +10,7 @@
 
 uses(RefreshDatabase::class);
 
-it('redirects to tenant registration after switching to a workspace with no tenants', function (): void {
+it('redirects to onboarding after switching to a workspace with no tenants', function (): void {
     $user = User::factory()->create();
 
     $workspace = Workspace::factory()->create();
@@ -24,7 +24,7 @@
     $this
         ->actingAs($user)
         ->post(route('admin.switch-workspace'), ['workspace_id' => (int) $workspace->getKey()])
-        ->assertRedirect(route('admin.workspace.managed-tenants.onboarding', ['workspace' => $workspace->slug ?? $workspace->getKey()]));
+        ->assertRedirect(route('admin.onboarding'));
 
     expect(session(WorkspaceContext::SESSION_KEY))->toBe((int) $workspace->getKey());
 });

tests/Unit/Badges/VerificationBadgesTest.php

@@ -1,68 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Support\Badges\BadgeCatalog;
-use App\Support\Badges\BadgeDomain;
-
-it('maps verification check status values to canonical badge semantics', function (): void {
-    $pass = BadgeCatalog::spec(BadgeDomain::VerificationCheckStatus, 'pass');
-    expect($pass->label)->toBe('Pass');
-    expect($pass->color)->toBe('success');
-
-    $fail = BadgeCatalog::spec(BadgeDomain::VerificationCheckStatus, 'fail');
-    expect($fail->label)->toBe('Fail');
-    expect($fail->color)->toBe('danger');
-
-    $warn = BadgeCatalog::spec(BadgeDomain::VerificationCheckStatus, 'warn');
-    expect($warn->label)->toBe('Warn');
-    expect($warn->color)->toBe('warning');
-
-    $skip = BadgeCatalog::spec(BadgeDomain::VerificationCheckStatus, 'skip');
-    expect($skip->label)->toBe('Skipped');
-    expect($skip->color)->toBe('gray');
-
-    $running = BadgeCatalog::spec(BadgeDomain::VerificationCheckStatus, 'running');
-    expect($running->label)->toBe('Running');
-    expect($running->color)->toBe('info');
-});
-
-it('maps verification check severity values to canonical badge semantics', function (): void {
-    $info = BadgeCatalog::spec(BadgeDomain::VerificationCheckSeverity, 'info');
-    expect($info->label)->toBe('Info');
-    expect($info->color)->toBe('gray');
-
-    $low = BadgeCatalog::spec(BadgeDomain::VerificationCheckSeverity, 'low');
-    expect($low->label)->toBe('Low');
-    expect($low->color)->toBe('info');
-
-    $medium = BadgeCatalog::spec(BadgeDomain::VerificationCheckSeverity, 'medium');
-    expect($medium->label)->toBe('Medium');
-    expect($medium->color)->toBe('warning');
-
-    $high = BadgeCatalog::spec(BadgeDomain::VerificationCheckSeverity, 'high');
-    expect($high->label)->toBe('High');
-    expect($high->color)->toBe('danger');
-
-    $critical = BadgeCatalog::spec(BadgeDomain::VerificationCheckSeverity, 'critical');
-    expect($critical->label)->toBe('Critical');
-    expect($critical->color)->toBe('danger');
-});
-
-it('maps verification report overall values to canonical badge semantics', function (): void {
-    $ready = BadgeCatalog::spec(BadgeDomain::VerificationReportOverall, 'ready');
-    expect($ready->label)->toBe('Ready');
-    expect($ready->color)->toBe('success');
-
-    $needsAttention = BadgeCatalog::spec(BadgeDomain::VerificationReportOverall, 'needs_attention');
-    expect($needsAttention->label)->toBe('Needs attention');
-    expect($needsAttention->color)->toBe('warning');
-
-    $blocked = BadgeCatalog::spec(BadgeDomain::VerificationReportOverall, 'blocked');
-    expect($blocked->label)->toBe('Blocked');
-    expect($blocked->color)->toBe('danger');
-
-    $running = BadgeCatalog::spec(BadgeDomain::VerificationReportOverall, 'running');
-    expect($running->label)->toBe('Running');
-    expect($running->color)->toBe('info');
-});

tests/Unit/GraphContractRegistryOnboardingProbesTest.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Services\Graph\GraphContractRegistry;
+
+it('provides contract registry paths for onboarding verification probes', function (): void {
+    $registry = app(GraphContractRegistry::class);
+
+    $organizationPath = $registry->probePath('organization');
+
+    expect($organizationPath)->not->toBeNull();
+    expect(ltrim((string) $organizationPath, '/'))->toBe('organization');
+
+    $appId = '00000000-0000-0000-0000-000000000000';
+    $servicePrincipalByAppIdPath = $registry->probePath('service_principal_by_app_id', ['{appId}' => $appId]);
+
+    expect($servicePrincipalByAppIdPath)->not->toBeNull();
+    expect((string) $servicePrincipalByAppIdPath)->toContain('servicePrincipals');
+    expect((string) $servicePrincipalByAppIdPath)->toContain($appId);
+
+    $servicePrincipalId = '11111111-1111-1111-1111-111111111111';
+    $assignmentsPath = $registry->probePath('service_principal_app_role_assignments', ['{servicePrincipalId}' => $servicePrincipalId]);
+
+    expect($assignmentsPath)->not->toBeNull();
+    expect((string) $assignmentsPath)->toContain("servicePrincipals/{$servicePrincipalId}/appRoleAssignments");
+});