feat: triage workspace + PAT auth + upgrade infrastructure + seed dataset + OpenAPI hardening

.beads/.gitignore

@@ -0,0 +1,70 @@
+# Dolt database (managed by Dolt, not git)
+dolt/
+embeddeddolt/
+
+# Runtime files
+bd.sock
+bd.sock.startlock
+sync-state.json
+last-touched
+.exclusive-lock
+
+# Daemon runtime (lock, log, pid)
+daemon.*
+
+# Push state (runtime, per-machine)
+push-state.json
+
+# Lock files (various runtime locks)
+*.lock
+
+# Credential key (encryption key for federation peer auth — never commit)
+.beads-credential-key
+
+# Local version tracking (prevents upgrade notification spam after git ops)
+.local_version
+
+# Worktree redirect file (contains relative path to main repo's .beads/)
+# Must not be committed as paths would be wrong in other clones
+redirect
+
+# Sync state (local-only, per-machine)
+# These files are machine-specific and should not be shared across clones
+.sync.lock
+export-state/
+export-state.json
+
+# Ephemeral store (SQLite - wisps/molecules, intentionally not versioned)
+ephemeral.sqlite3
+ephemeral.sqlite3-journal
+ephemeral.sqlite3-wal
+ephemeral.sqlite3-shm
+
+# Dolt server management (auto-started by bd)
+dolt-server.pid
+dolt-server.log
+dolt-server.lock
+dolt-server.port
+dolt-server.activity
+
+# Corrupt backup directories (created by bd doctor --fix recovery)
+*.corrupt.backup/
+
+# Backup data (auto-exported JSONL, local-only)
+backup/
+
+# Per-project environment file (Dolt connection config, GH#2520)
+.env
+
+# Legacy files (from pre-Dolt versions)
+*.db
+*.db?*
+*.db-journal
+*.db-wal
+*.db-shm
+db.sqlite
+bd.db
+# NOTE: Do NOT add negation patterns here.
+# They would override fork protection in .git/info/exclude.
+# Config files (metadata.json, config.yaml) are tracked by git by default
+# since no pattern above ignores them.

.beads/README.md

@@ -0,0 +1,81 @@
+# Beads - AI-Native Issue Tracking
+
+Welcome to Beads! This repository uses **Beads** for issue tracking - a modern, AI-native tool designed to live directly in your codebase alongside your code.
+
+## What is Beads?
+
+Beads is issue tracking that lives in your repo, making it perfect for AI coding agents and developers who want their issues close to their code. No web UI required - everything works through the CLI and integrates seamlessly with git.
+
+**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)
+
+## Quick Start
+
+### Essential Commands
+
+```bash
+# Create new issues
+bd create "Add user authentication"
+
+# View all issues
+bd list
+
+# View issue details
+bd show <issue-id>
+
+# Update issue status
+bd update <issue-id> --claim
+bd update <issue-id> --status done
+
+# Sync with Dolt remote
+bd dolt push
+```
+
+### Working with Issues
+
+Issues in Beads are:
+- **Git-native**: Stored in Dolt database with version control and branching
+- **AI-friendly**: CLI-first design works perfectly with AI coding agents
+- **Branch-aware**: Issues can follow your branch workflow
+- **Always in sync**: Auto-syncs with your commits
+
+## Why Beads?
+
+✨ **AI-Native Design**
+- Built specifically for AI-assisted development workflows
+- CLI-first interface works seamlessly with AI coding agents
+- No context switching to web UIs
+
+🚀 **Developer Focused**
+- Issues live in your repo, right next to your code
+- Works offline, syncs when you push
+- Fast, lightweight, and stays out of your way
+
+🔧 **Git Integration**
+- Automatic sync with git commits
+- Branch-aware issue tracking
+- Dolt-native three-way merge resolution
+
+## Get Started with Beads
+
+Try Beads in your own projects:
+
+```bash
+# Install Beads
+curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
+
+# Initialize in your repo
+bd init
+
+# Create your first issue
+bd create "Try out Beads"
+```
+
+## Learn More
+
+- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)
+- **Quick Start Guide**: Run `bd quickstart`
+- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)
+
+---
+
+*Beads: Issue tracking that moves at the speed of thought* ⚡

.beads/config.yaml

@@ -0,0 +1,57 @@
+# Beads Configuration File
+# This file configures default behavior for all bd commands in this repository
+# All settings can also be set via environment variables (BD_* prefix)
+# or overridden with command-line flags
+
+# Issue prefix for this repository (used by bd init)
+# If not set, bd init will auto-detect from directory name
+# Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.
+# issue-prefix: ""
+
+# Use no-db mode: JSONL-only, no Dolt database
+# When true, bd will use .beads/issues.jsonl as the source of truth
+# no-db: false
+
+# Enable JSON output by default
+# json: false
+
+# Feedback title formatting for mutating commands (create/update/close/dep/edit)
+# 0 = hide titles, N > 0 = truncate to N characters
+# output:
+#   title-length: 255
+
+# Default actor for audit trails (overridden by BEADS_ACTOR or --actor)
+# actor: ""
+
+# Export events (audit trail) to .beads/events.jsonl on each flush/sync
+# When enabled, new events are appended incrementally using a high-water mark.
+# Use 'bd export --events' to trigger manually regardless of this setting.
+# events-export: false
+
+# Multi-repo configuration (experimental - bd-307)
+# Allows hydrating from multiple repositories and routing writes to the correct database
+# repos:
+#   primary: "."  # Primary repo (where this database lives)
+#   additional:   # Additional repos to hydrate from (read-only)
+#     - ~/beads-planning  # Personal planning repo
+#     - ~/work-planning   # Work planning repo
+
+# JSONL backup (periodic export for off-machine recovery)
+# Auto-enabled when a git remote exists. Override explicitly:
+# backup:
+#   enabled: false     # Disable auto-backup entirely
+#   interval: 15m      # Minimum time between auto-exports
+#   git-push: false    # Disable git push (export locally only)
+#   git-repo: ""       # Separate git repo for backups (default: project repo)
+
+# Integration settings (access with 'bd config get/set')
+# Non-secret keys (stored in the database):
+# - jira.url, jira.project
+# - linear.team_id
+# - github.org, github.repo
+#
+# Secret keys (stored in this file but prefer env vars to avoid git exposure):
+# - linear.api_key  → use LINEAR_API_KEY env var instead
+# - github.token    → use GITHUB_TOKEN env var instead
+
+sync.remote: "git+https://github.com/mitre/vulcan.git"

.beads/metadata.json

@@ -0,0 +1,7 @@
+{
+  "database": "dolt",
+  "backend": "dolt",
+  "dolt_mode": "server",
+  "dolt_database": "vulcan_v2",
+  "project_id": "cb49a1de-7945-4a6b-9c30-2cca1bdbe6dc"
+}

.env.example

@@ -12,15 +12,12 @@
 #
 # DATABASE_PORT=5432
 # DATABASE_HOST=127.0.0.1
+# DATABASE_NAME=vulcan_development   # dev + production only; test is hardcoded (vulcan_test)
 # POSTGRES_PORT=5432
 #
 # macOS with Kerberos/GSSAPI connection errors (corporate networks):
 # DATABASE_GSSENCMODE=disable
 #
-# Worktree isolation: suffix appended to database names in database.yml
-# Each worktree gets its own database (e.g., vulcan_vue_development_v2)
-# DB_SUFFIX=_v2
-#
 # App server port (Puma):
 # PORT=3000
 
@@ -63,6 +60,36 @@ VULCAN_OIDC_REDIRECT_URI=http://localhost:3000/users/auth/oidc/callback
 # from the issuer's /.well-known/openid-configuration endpoint
 # VULCAN_OIDC_DISCOVERY=true
 
+# =============================================================================
+# MULTI-PROVIDER OIDC (Optional — N simultaneous providers)
+# =============================================================================
+# Set VULCAN_OIDC_PROVIDERS to enable multiple OIDC providers simultaneously.
+# Each key becomes a tab on the login page and a callback route.
+# When unset, the legacy single-provider vars above are used (backward compat).
+#
+# VULCAN_OIDC_PROVIDERS=okta,login_gov
+#
+# Per-provider vars follow the pattern VULCAN_OIDC_<KEY>_<FIELD>:
+#
+# --- Okta ---
+# VULCAN_OIDC_OKTA_ISSUER_URL=https://your-domain.okta.com/oauth2/default
+# VULCAN_OIDC_OKTA_CLIENT_ID=your_okta_client_id
+# VULCAN_OIDC_OKTA_CLIENT_SECRET=your_okta_client_secret
+# VULCAN_OIDC_OKTA_REDIRECT_URI=http://localhost:3000/users/auth/okta/callback
+# VULCAN_OIDC_OKTA_TITLE=Okta
+#
+# --- Login.gov (uses private_key_jwt, no client secret) ---
+# VULCAN_OIDC_LOGIN_GOV_ISSUER_URL=https://idp.int.identitysandbox.gov
+# VULCAN_OIDC_LOGIN_GOV_CLIENT_ID=urn:gov:gsa:openidconnect.profiles:sp:sso:your-org:vulcan
+# VULCAN_OIDC_LOGIN_GOV_CLIENT_AUTH_METHOD=jwt_bearer
+# VULCAN_OIDC_LOGIN_GOV_PRIVATE_KEY_PATH=/path/to/login_gov_private.pem
+# VULCAN_OIDC_LOGIN_GOV_ACR_VALUES=urn:acr.login.gov:auth-only
+# VULCAN_OIDC_LOGIN_GOV_TITLE=Login.gov
+#
+# Provider keys must be lowercase snake_case (a-z, 0-9, underscores).
+# Each provider can have its own logo at app/assets/images/<key>-logo.{svg,png}.
+# See docs/deployment/auth/ for provider-specific setup guides.
+
 # =============================================================================
 # AUTHENTICATION OPTIONS
 # =============================================================================
@@ -159,6 +186,19 @@ VULCAN_CONSENT_TTL=0
 # VULCAN_PASSWORD_MIN_NUMBER=2
 # VULCAN_PASSWORD_MIN_SPECIAL=2
 
+# =============================================================================
+# API TOKENS — Personal Access Tokens for programmatic API access
+# =============================================================================
+# Enable/disable the PAT feature entirely. When false, token management
+# endpoints return 404 and Authorization: Token headers are ignored.
+VULCAN_API_TOKENS_ENABLED=true
+# Maximum number of active (non-revoked) tokens per user
+# VULCAN_API_TOKENS_MAX_PER_USER=20
+# Maximum token lifetime in days (enforced on creation)
+# VULCAN_API_TOKENS_MAX_LIFETIME_DAYS=365
+# Auto-revoke tokens unused for this many days (rake api_tokens:revoke_idle)
+# VULCAN_API_TOKENS_AUTO_REVOKE_IDLE_DAYS=90
+
 # =============================================================================
 # SLACK INTEGRATION (Optional)
 # =============================================================================

.eslintrc.js

@@ -1,9 +1,14 @@
+const rulesDirPlugin = require("eslint-plugin-rulesdir");
+
+rulesDirPlugin.RULES_DIR = "eslint-rules";
+
 module.exports = {
   env: {
     browser: true,
     es6: true,
     node: true,
   },
+  plugins: ["rulesdir"],
   extends: ["plugin:vue/recommended", "prettier", "plugin:prettier/recommended"],
   ignorePatterns: [
     "docs/.vitepress/cache/**",
@@ -16,6 +21,7 @@ module.exports = {
     "no-console": "warn",
     "no-return-await": "warn",
     "no-throw-literal": "warn",
+    "rulesdir/comment-tracker": "error",
     "vue/require-default-prop": "off",
     "vue/prop-name-casing": "off",
     "vue/multi-word-component-names": "off",

.gitattributes

@@ -0,0 +1,5 @@
+# Verbatim upstream XCCDF documents (DISA-published SRGs/STIGs seeded as-is).
+# They contain trailing whitespace as published; whitespace checks must not
+# flag or alter them — byte fidelity is the requirement.
+db/seeds/srgs/*.xml -whitespace
+db/seeds/stigs/*.xml -whitespace