OPC # 0006: OPC Git Trunk-Based management

Co-authored-by: Copilot <copilot@github.com>

ControlPlane.Api/Program.cs

@@ -166,6 +166,7 @@ await using (var cmd = ds.CreateCommand("""
 // Idempotent column additions for schema migrations
 await using (var migCmd = ds.CreateCommand("""
     ALTER TABLE release_record ADD COLUMN IF NOT EXISTS opc_numbers TEXT[] NOT NULL DEFAULT '{}';
+    ALTER TABLE release_record ADD COLUMN IF NOT EXISTS commit_sha  VARCHAR(40);
     """))
     await migCmd.ExecuteNonQueryAsync();
 

ControlPlane.Api/Services/PromotionService.cs

@@ -52,6 +52,38 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
     private static Signature MakeSig() =>
         new("OPC Control Plane", "opc@clarity.internal", DateTimeOffset.UtcNow);
 
+    // ── Remote URL (config-driven, never reads .git/config URL) ──────────────
+
+    /// <summary>
+    /// Builds the HTTPS remote URL for a named repo entirely from Gitea config.
+    /// The local clone's .git/config remote URL is irrelevant — this is the authority.
+    /// </summary>
+    private string GetRemoteUrl(string repoName)
+    {
+        var baseUrl  = (config["Gitea:BaseUrl"]
+            ?? throw new InvalidOperationException("Gitea:BaseUrl is not configured.")).TrimEnd('/');
+        var owner    = config[$"Gitea:Repos:{repoName}:Owner"] ?? config["Gitea:Owner"]
+            ?? throw new InvalidOperationException($"Gitea owner not configured for '{repoName}'.");
+        var repoSlug = config[$"Gitea:Repos:{repoName}:Repo"] ?? repoName;
+        return $"{baseUrl}/{owner}/{repoSlug}.git";
+    }
+
+    /// <summary>
+    /// Returns the 'origin' remote after normalising its URL to the config-driven HTTPS URL.
+    /// If the clone was checked out with SSH (e.g. on a dev machine), this corrects it silently
+    /// so that LibGit2Sharp — which has no SSH support — always uses HTTPS.
+    /// </summary>
+    private Remote EnsureRemote(Repository repo, string repoName)
+    {
+        var url    = GetRemoteUrl(repoName);
+        var remote = repo.Network.Remotes["origin"];
+        if (remote is null)
+            return repo.Network.Remotes.Add("origin", url);
+        if (remote.Url != url)
+            repo.Network.Remotes.Update("origin", r => r.Url = url);
+        return repo.Network.Remotes["origin"]!;
+    }
+
     // ── Branch status ────────────────────────────────────────────────────────
 
     /// <summary>
@@ -72,13 +104,10 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
         // Fetch to get up-to-date remote refs; swallow network errors so status still works offline.
         try
         {
-            var remote = repo.Network.Remotes["origin"];
-            if (remote is not null)
-            {
+            var remote   = EnsureRemote(repo, repoName);
             var refSpecs = remote.FetchRefSpecs.Select(r => r.Specification).ToList();
             repo.Network.Fetch(remote.Name, refSpecs, MakeFetchOptions());
         }
-        }
         catch (Exception ex)
         {
             logger.LogWarning(ex, "Fetch during ladder status failed — continuing with cached refs");
@@ -91,7 +120,9 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
             ct.ThrowIfCancellationRequested();
 
             var branchName  = Ladder[i];
-            var branch     = repo.Branches[branchName];
+            // Always read from the remote tracking ref so the status reflects what is on origin,
+            // not the server's potentially-stale local branch pointer.
+            var branch      = repo.Branches[$"origin/{branchName}"];
 
             if (branch?.Tip is null)
             {
@@ -110,7 +141,7 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
             if (i + 1 < Ladder.Length)
             {
-                var nextBranch = repo.Branches[Ladder[i + 1]];
+                var nextBranch = repo.Branches[$"origin/{Ladder[i + 1]}"];
                 if (nextBranch?.Tip is not null)
                 {
                     var div = repo.ObjectDatabase.CalculateHistoryDivergence(tip, nextBranch.Tip);
@@ -215,14 +246,16 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
         // 1. Fetch latest remote state for all branches
         Log("  Fetching origin...");
-        var remote = repo.Network.Remotes["origin"]
-            ?? throw new InvalidOperationException("No 'origin' remote configured.");
+        var remote   = EnsureRemote(repo, repoName);
         var refSpecs = remote.FetchRefSpecs.Select(r => r.Specification).ToList();
         repo.Network.Fetch(remote.Name, refSpecs, MakeFetchOptions());
 
-        // 2. Resolve local branches
-        var fromBranch = repo.Branches[from]
-            ?? throw new InvalidOperationException($"Branch '{from}' not found.");
+        // 2. Resolve branches — always read from origin/ so we reflect what is actually on the remote,
+        //    never the server's potentially-stale local branch pointers.
+        var fromBranch = repo.Branches[$"origin/{from}"]
+            ?? throw new InvalidOperationException($"Remote branch 'origin/{from}' not found.");
+        // `to` is read locally because we need to mutate its ref and push — it is immediately
+        // fast-forwarded to origin/{to} in the next step so it is never stale when used.
         var toBranch = repo.Branches[to]
             ?? throw new InvalidOperationException($"Branch '{to}' not found.");
 
@@ -327,8 +360,7 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
             try
             {
-                var remote = repo.Network.Remotes["origin"]
-                    ?? throw new InvalidOperationException("No 'origin' remote.");
+                var remote = EnsureRemote(repo, repoName);
                 // Force push — "+" prefix overrides remote reflog
                 repo.Network.Push(remote, $"+refs/heads/{branchName}:refs/heads/{branchName}", MakePushOptions());
             }
@@ -419,8 +451,7 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
         // 1. Fetch
         Log("  Fetching origin...");
-        var remote = repo.Network.Remotes["origin"]
-            ?? throw new InvalidOperationException("No 'origin' remote configured.");
+        var remote   = EnsureRemote(repo, repoName);
         var refSpecs = remote.FetchRefSpecs.Select(r => r.Specification).ToList();
         repo.Network.Fetch(remote.Name, refSpecs, MakeFetchOptions());
 
@@ -548,13 +579,10 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
         // Fetch latest remote refs — swallow network errors so status still works offline.
         try
         {
-            var remote = repo.Network.Remotes["origin"];
-            if (remote is not null)
-            {
+            var remote   = EnsureRemote(repo, repoName);
             var refSpecs = remote.FetchRefSpecs.Select(r => r.Specification).ToList();
             repo.Network.Fetch(remote.Name, refSpecs, MakeFetchOptions());
         }
-        }
         catch (Exception ex)
         {
             logger.LogWarning(ex, "Fetch during conformance check failed — continuing with cached refs");
@@ -566,12 +594,13 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
             var branchName = Ladder[i];
             var srcName    = i > 0 ? Ladder[i - 1] : null; // predecessor branch (e.g. develop for staging)
-            var branch     = repo.Branches[branchName];
+            // Always read from origin/ tracking refs — never local branch pointers.
+            var branch     = repo.Branches[$"origin/{branchName}"];
 
             // ── Branch missing ──────────────────────────────────────────────
             if (branch?.Tip is null)
             {
-                var srcTip = srcName is not null ? repo.Branches[srcName]?.Tip?.Sha : null;
+                var srcTip = srcName is not null ? repo.Branches[$"origin/{srcName}"]?.Tip?.Sha : null;
                 checks.Add(new BranchConformanceCheck(
                     branchName, srcName,
                     ConformanceViolation.Missing,
@@ -592,7 +621,7 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
                 continue;
             }
 
-            var srcBranch = repo.Branches[srcName];
+            var srcBranch = repo.Branches[$"origin/{srcName}"];
             if (srcBranch?.Tip is null)
             {
                 // Source branch is itself missing — skip, it will be reported separately.
@@ -666,8 +695,7 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
 
             repo.Refs.Add($"refs/heads/{branchName}", commit.Sha);
 
-            var remote = repo.Network.Remotes["origin"]
-                ?? throw new InvalidOperationException("No 'origin' remote configured.");
+            var remote = EnsureRemote(repo, repoName);
 
             repo.Network.Push(remote, $"refs/heads/{branchName}:refs/heads/{branchName}", MakePushOptions());
 
@@ -759,6 +787,64 @@ public class PromotionService(IConfiguration config, ILogger<PromotionService> l
             return [];
         }
     }
+
+    /// <summary>
+    /// Returns distinct, sorted OPC numbers for commits reachable from <paramref name="toSha"/>
+    /// that are NOT reachable from <paramref name="fromSha"/> — i.e. the exact delta for this release.
+    /// Falls back to <see cref="ExtractOpcNumbersAsync"/> (last 50 commits) when <paramref name="fromSha"/>
+    /// is null (first-ever release for this environment).
+    /// </summary>
+    public Task<List<string>> ExtractOpcNumbersDeltaAsync(
+        string  repoName,
+        string  toSha,
+        string? fromSha,
+        CancellationToken ct = default) =>
+        fromSha is null
+            ? ExtractOpcNumbersAsync(repoName, ct: ct)
+            : Task.Run(() => ExtractOpcNumbersDeltaCore(repoName, toSha, fromSha), ct);
+
+    private List<string> ExtractOpcNumbersDeltaCore(string repoName, string toSha, string fromSha)
+    {
+        var repoPath = GetRepoPath(repoName);
+        if (string.IsNullOrWhiteSpace(repoPath) || !Directory.Exists(repoPath))
+            return [];
+        try
+        {
+            using var repo = new Repository(repoPath);
+            var toCommit   = repo.Lookup<Commit>(toSha);
+            var fromCommit = repo.Lookup<Commit>(fromSha);
+            if (toCommit is null) return [];
+
+            var filter = fromCommit is null
+                ? new CommitFilter { IncludeReachableFrom = toCommit }
+                : new CommitFilter { IncludeReachableFrom = toCommit, ExcludeReachableFrom = fromCommit };
+
+            var set = new HashSet<string>(StringComparer.Ordinal);
+            foreach (var commit in repo.Commits.QueryBy(filter))
+                foreach (System.Text.RegularExpressions.Match m in OpcTagPattern.Matches(commit.Message))
+                    set.Add($"OPC # {m.Groups[1].Value.PadLeft(4, '0')}");
+
+            return [.. set.OrderBy(x => x)];
+        }
+        catch (Exception ex)
+        {
+            logger.LogWarning(ex, "ExtractOpcNumbersDelta failed for {Repo} {From}..{To}", repoName, fromSha[..7], toSha[..7]);
+            return [];
+        }
+    }
+
+    /// <summary>Returns the full HEAD SHA of <paramref name="branch"/> in <paramref name="repoName"/>, or null.</summary>
+    public string? GetBranchTipSha(string repoName, string branch)
+    {
+        var repoPath = GetRepoPath(repoName);
+        if (string.IsNullOrWhiteSpace(repoPath) || !Directory.Exists(repoPath)) return null;
+        try
+        {
+            using var repo = new Repository(repoPath);
+            return (repo.Branches[$"origin/{branch}"] ?? repo.Branches[branch])?.Tip?.Sha;
+        }
+        catch { return null; }
+    }
 }
 
 /// <summary>A single unreleased commit — carries full SHA for cherry-pick operations.</summary>

ControlPlane.Api/Services/ReleaseService.cs

@@ -51,7 +51,12 @@ public class ReleaseService(
             return blocked;
         }
 
-        var record = await history.CreateReleaseAsync(targetEnv, ImageName);
+        // Resolve the Clarity branch for this environment and stamp the HEAD SHA
+        // before creating the record so we capture "what was deployed" accurately.
+        var branch    = targetEnv switch { "fdev" => "develop", "staging" => "staging", "uat" => "uat", _ => "main" };
+        var currentSha = promotions.GetBranchTipSha("Clarity", branch);
+
+        var record = await history.CreateReleaseAsync(targetEnv, ImageName, currentSha);
 
         try
         {
@@ -183,9 +188,16 @@ public class ReleaseService(
         }
         finally
         {
-            // Stamp OPC ticket numbers from recent commits on the target branch.
-            var branch = targetEnv switch { "fdev" => "develop", "staging" => "staging", "uat" => "uat", _ => "main" };
-            try   { record.OpcNumbers = await promotions.ExtractOpcNumbersAsync("Clarity", branch, 50, ct); }
+            // Stamp the exact OPC ticket numbers introduced by this release:
+            // diff from previous release's SHA to this release's SHA on the Clarity branch.
+            try
+            {
+                var prev = await history.GetLastSuccessfulReleaseForEnvAsync(targetEnv);
+                // Exclude the current (in-flight) record — it's not succeeded yet
+                var prevSha = prev?.Id == record.Id ? null : prev?.CommitSha;
+                if (currentSha is not null)
+                    record.OpcNumbers = await promotions.ExtractOpcNumbersDeltaAsync("Clarity", currentSha, prevSha, ct);
+            }
             catch { /* git not configured — continue without OPC stamp */ }
 
             await history.UpdateReleaseAsync(record);

ControlPlane.Core/Interfaces/SagaContext.cs

@@ -24,6 +24,11 @@ public class SagaContext
     // Written by LaunchStep — primary app container name
     public string? ContainerName { get; set; }
 
+    // Written by VaultStep — scoped periodic token for the tenant (not the root token)
+    // and its accessor used for compensation/revocation
+    public string? VaultToken { get; set; }
+    public string? VaultTokenAccessor { get; set; }
+
     // Written by PulumiStep (DedicatedVM/Enterprise tier) — target host details for subsequent steps
     public string? VmIpAddress { get; set; }
     public string? VmSshKeyPath { get; set; }

ControlPlane.Core/Models/ReleaseRecord.cs

@@ -17,6 +17,7 @@ public class ReleaseRecord
     public DateTimeOffset? FinishedAt  { get; set; }
     public List<TenantReleaseResult> Tenants    { get; set; } = [];
     public List<string>              OpcNumbers { get; set; } = [];
+    public string?                   CommitSha  { get; set; }  // Clarity branch HEAD SHA at release time
 }
 
 public class TenantReleaseResult

ControlPlane.Core/Services/BuildHistoryService.cs

@@ -142,13 +142,13 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
 
     // ── Releases ────────────────────────────────────────────────────────────
 
-    public async Task<ReleaseRecord> CreateReleaseAsync(string environment, string imageName)
+    public async Task<ReleaseRecord> CreateReleaseAsync(string environment, string imageName, string? commitSha = null)
     {
-        var record = new ReleaseRecord { Environment = environment, ImageName = imageName };
+        var record = new ReleaseRecord { Environment = environment, ImageName = imageName, CommitSha = commitSha };
 
         await using var cmd = db.CreateCommand("""
-            INSERT INTO release_record (id, environment, image_name, status, started_at, opc_numbers)
-            VALUES ($1, $2, $3, $4, $5, $6)
+            INSERT INTO release_record (id, environment, image_name, status, started_at, opc_numbers, commit_sha)
+            VALUES ($1, $2, $3, $4, $5, $6, $7)
             """);
         cmd.Parameters.AddWithValue(record.Id);
         cmd.Parameters.AddWithValue(record.Environment);
@@ -156,6 +156,7 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
         cmd.Parameters.AddWithValue(record.Status.ToString());
         cmd.Parameters.AddWithValue(record.StartedAt);
         cmd.Parameters.Add(new NpgsqlParameter<string[]> { TypedValue = [.. record.OpcNumbers] });
+        cmd.Parameters.AddWithValue((object?)record.CommitSha ?? DBNull.Value);
         await cmd.ExecuteNonQueryAsync();
 
         return record;
@@ -169,12 +170,13 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
         await using var tx   = await conn.BeginTransactionAsync();
 
         await using var upd = new NpgsqlCommand("""
-            UPDATE release_record SET status = $2, finished_at = $3, opc_numbers = $4 WHERE id = $1
+            UPDATE release_record SET status = $2, finished_at = $3, opc_numbers = $4, commit_sha = $5 WHERE id = $1
             """, conn, tx);
         upd.Parameters.AddWithValue(record.Id);
         upd.Parameters.AddWithValue(record.Status.ToString());
         upd.Parameters.AddWithValue(record.FinishedAt!.Value);
         upd.Parameters.Add(new NpgsqlParameter<string[]> { TypedValue = [.. record.OpcNumbers] });
+        upd.Parameters.AddWithValue((object?)record.CommitSha ?? DBNull.Value);
         await upd.ExecuteNonQueryAsync();
 
         // Replace tenant results wholesale on each update
@@ -206,7 +208,7 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
         var lookup  = new Dictionary<string, ReleaseRecord>();
 
         await using var cmd = db.CreateCommand("""
-            SELECT id, environment, image_name, status, started_at, finished_at, opc_numbers
+            SELECT id, environment, image_name, status, started_at, finished_at, opc_numbers, commit_sha
             FROM release_record
             ORDER BY started_at DESC
             LIMIT 50
@@ -224,6 +226,7 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
                     StartedAt   = reader.GetFieldValue<DateTimeOffset>(4),
                     FinishedAt  = reader.IsDBNull(5) ? null : reader.GetFieldValue<DateTimeOffset>(5),
                     OpcNumbers  = reader.IsDBNull(6) ? [] : [.. reader.GetFieldValue<string[]>(6)],
+                    CommitSha   = reader.IsDBNull(7) ? null : reader.GetString(7),
                 };
                 ordered.Add(r);
                 lookup[r.Id] = r;
@@ -254,5 +257,34 @@ public class BuildHistoryService(NpgsqlDataSource db, ILogger<BuildHistoryServic
 
         return ordered;
     }
+
+    /// <summary>
+    /// Returns the most recent succeeded release for <paramref name="environment"/>, or null if none exists.
+    /// Used to calculate the OPC ticket delta between releases (previousSha..currentSha).
+    /// </summary>
+    public async Task<ReleaseRecord?> GetLastSuccessfulReleaseForEnvAsync(string environment)
+    {
+        await using var cmd = db.CreateCommand("""
+            SELECT id, environment, image_name, status, started_at, finished_at, opc_numbers, commit_sha
+            FROM release_record
+            WHERE environment = $1 AND status = 'Succeeded'
+            ORDER BY started_at DESC
+            LIMIT 1
+            """);
+        cmd.Parameters.AddWithValue(environment);
+        await using var reader = await cmd.ExecuteReaderAsync();
+        if (!await reader.ReadAsync()) return null;
+        return new ReleaseRecord
+        {
+            Id          = reader.GetString(0),
+            Environment = reader.GetString(1),
+            ImageName   = reader.GetString(2),
+            Status      = Enum.Parse<ReleaseStatus>(reader.GetString(3)),
+            StartedAt   = reader.GetFieldValue<DateTimeOffset>(4),
+            FinishedAt  = reader.IsDBNull(5) ? null : reader.GetFieldValue<DateTimeOffset>(5),
+            OpcNumbers  = reader.IsDBNull(6) ? [] : [.. reader.GetFieldValue<string[]>(6)],
+            CommitSha   = reader.IsDBNull(7) ? null : reader.GetString(7),
+        };
+    }
 }
 

ControlPlane.Worker/Services/ClarityContainerService.cs

@@ -105,6 +105,9 @@ public class ClarityContainerService(
                 ["clarity.subdomain"]              = subdomain,
                 ["clarity.siteCode"]               = siteCode,
                 ["clarity.env"]                    = environment,
+                // Groups containers in Docker Desktop by environment tier (fdev / uat / prod).
+                ["com.docker.compose.project"]     = $"clarity-{environment.ToLowerInvariant()}",
+                ["com.docker.compose.service"]     = name,
             },
         }, cancellationToken);
 

ControlPlane.Worker/Steps/KeycloakStep.cs

@@ -41,6 +41,17 @@ public class KeycloakStep(
         }, cancellationToken);
 
         // clarity-web-app: public OIDC client used by the React frontend.
+        // fdev is a developer dogfood environment — allow localhost redirect URIs so that a
+        // local Aspire dev loop (any port) can complete the OIDC flow against the shared
+        // OPC infra Keycloak without any post-provisioning patching.
+        var isFdev = string.Equals(context.Job.Environment, "fdev", StringComparison.OrdinalIgnoreCase);
+        var redirectUris = isFdev
+            ? new[] { $"{tenantOrigin}/*", "http://localhost:*/*", "http://*.dev.localhost:*/*" }
+            : new[] { $"{tenantOrigin}/*" };
+        var webOrigins = isFdev
+            ? "+"          // match all valid redirect URI origins
+            : tenantOrigin;
+
         await adminClient.CreateClientAsync(realmId, new
         {
             clientId                  = "clarity-web-app",
@@ -51,8 +62,8 @@ public class KeycloakStep(
             directAccessGrantsEnabled = false,
             rootUrl                   = tenantOrigin,
             baseUrl                   = "/",
-            redirectUris              = new[] { $"{tenantOrigin}/*" },
-            webOrigins                = new[] { tenantOrigin },
+            redirectUris,
+            webOrigins                = new[] { webOrigins },
         }, cancellationToken);
 
         // Ensure tokens issued by clarity-web-app include "clarity-rest-api" in the `aud` claim

ControlPlane.Worker/Steps/LaunchStep.cs

@@ -32,7 +32,7 @@ public class LaunchStep(
             subdomain:                job.Subdomain,
             keycloakRealm:            $"clarity-{job.Subdomain.ToLowerInvariant()}",
             postgresConnectionString: context.TenantConnectionString,
-            vaultToken:               ReadVaultToken(config),
+            vaultToken:               context.VaultToken ?? ReadVaultToken(config),
             jobId:                    job.Id,
             cancellationToken:        cancellationToken);
 

ControlPlane.Worker/Steps/VaultStep.cs

@@ -1,6 +1,9 @@
 using ControlPlane.Core.Interfaces;
 using ControlPlane.Core.Models;
+using System.Net.Http.Headers;
+using System.Text;
 using System.Text.Json;
+using System.Text.Json.Nodes;
 
 namespace ControlPlane.Worker.Steps;
 
@@ -8,38 +11,117 @@ public class VaultStep(ILogger<VaultStep> logger, IConfiguration config) : ISaga
 {
     public string StepName => "Cryptographic Pre-Flight (Vault)";
 
-    public Task ExecuteAsync(SagaContext context, CancellationToken cancellationToken)
+    // Policy grants the tenant token exactly the three Transit operations Clarity.Server needs:
+    //   GenerateTenantKEKAsync  → datakey/plaintext  (first boot only)
+    //   DecryptTenantKEKAsync   → decrypt            (every restart)
+    //   RewrapTenantKEKAsync    → rewrap             (key rotation)
+    private const string PolicyTemplate = """
+        path "clarity-transit/datakey/plaintext/master-key" {
+          capabilities = ["update"]
+        }
+        path "clarity-transit/decrypt/master-key" {
+          capabilities = ["update"]
+        }
+        path "clarity-transit/rewrap/master-key" {
+          capabilities = ["update"]
+        }
+        """;
+
+    public async Task ExecuteAsync(SagaContext context, CancellationToken cancellationToken)
     {
-        // TODO: VaultSharp
-        // 1. Assert Transit engine is active and healthy
-        // 2. Derive/validate TenantContextId (e.g. FL_COM_001)
-        // 3. Register TenantContextId in a KV entry or TenantRegistry table
-        //    so Clarity.Server can resolve the derivation path later
-        //
-        // Root token is read at runtime from the persisted init.json on the Vault volume:
-        //   var token = ReadRootToken();
-        logger.LogInformation("[{JobId}] Vault step is a stub - VaultSharp not yet wired.", context.Job.Id);
+        var rootToken = ReadRootToken();
+        var vaultAddr = (config["Vault:Address"] ?? "http://localhost:8200").TrimEnd('/');
+        var subdomain = context.Job.Subdomain.ToLowerInvariant();
+        var policyName = $"clarity-tenant-{subdomain}";
+
+        using var http = new HttpClient { BaseAddress = new Uri(vaultAddr) };
+        http.DefaultRequestHeaders.Add("X-Vault-Token", rootToken);
+
+        // ── 1. Assert Transit engine + master-key are healthy ─────────────────
+        logger.LogInformation("[{JobId}] Verifying Vault Transit engine and master-key.", context.Job.Id);
+        var healthRes = await http.GetAsync("v1/clarity-transit/keys/master-key", cancellationToken);
+        if (!healthRes.IsSuccessStatusCode)
+            throw new InvalidOperationException(
+                $"Vault Transit master-key not found at {vaultAddr}. " +
+                "Ensure OPC infra is running and the entrypoint has bootstrapped Vault.");
+
+        // ── 2. Upsert per-tenant policy (idempotent PUT) ──────────────────────
+        logger.LogInformation("[{JobId}] Writing Vault policy '{Policy}'.", context.Job.Id, policyName);
+        var policyBody = JsonSerializer.Serialize(new { policy = PolicyTemplate });
+        var policyRes = await http.PutAsync(
+            $"v1/sys/policies/acl/{policyName}",
+            new StringContent(policyBody, Encoding.UTF8, "application/json"),
+            cancellationToken);
+        policyRes.EnsureSuccessStatusCode();
+
+        // ── 3. Create scoped periodic token bound to tenant policy ────────────
+        logger.LogInformation("[{JobId}] Creating scoped Vault token for policy '{Policy}'.", context.Job.Id, policyName);
+        var tokenBody = JsonSerializer.Serialize(new
+        {
+            policies  = new[] { policyName },
+            period    = "72h",
+            renewable = true,
+            metadata  = new Dictionary<string, string>
+            {
+                ["tenant"]    = subdomain,
+                ["createdBy"] = "ControlPlane.Worker",
+            },
+        });
+        var tokenRes = await http.PostAsync(
+            "v1/auth/token/create",
+            new StringContent(tokenBody, Encoding.UTF8, "application/json"),
+            cancellationToken);
+        tokenRes.EnsureSuccessStatusCode();
+
+        var tokenJson = JsonNode.Parse(await tokenRes.Content.ReadAsStringAsync(cancellationToken))!;
+        context.VaultToken         = tokenJson["auth"]!["client_token"]!.GetValue<string>();
+        context.VaultTokenAccessor = tokenJson["auth"]!["accessor"]!.GetValue<string>();
+
+        logger.LogInformation("[{JobId}] Vault step complete. Token accessor: {Accessor}",
+            context.Job.Id, context.VaultTokenAccessor);
+
         context.Job.CompletedSteps |= CompletedSteps.VaultVerified;
-        return Task.CompletedTask;
     }
 
-    public Task CompensateAsync(SagaContext context, CancellationToken cancellationToken)
+    public async Task CompensateAsync(SagaContext context, CancellationToken cancellationToken)
     {
-        logger.LogInformation("[{JobId}] Vault step: no compensation needed.", context.Job.Id);
-        return Task.CompletedTask;
+        if (string.IsNullOrWhiteSpace(context.VaultTokenAccessor)) return;
+
+        logger.LogWarning("[{JobId}] Compensating Vault — revoking token accessor {Accessor}.",
+            context.Job.Id, context.VaultTokenAccessor);
+
+        try
+        {
+            var rootToken = ReadRootToken();
+            var vaultAddr = (config["Vault:Address"] ?? "http://localhost:8200").TrimEnd('/');
+            using var http = new HttpClient { BaseAddress = new Uri(vaultAddr) };
+            http.DefaultRequestHeaders.Add("X-Vault-Token", rootToken);
+
+            var body = JsonSerializer.Serialize(new { accessor = context.VaultTokenAccessor });
+            await http.PostAsync(
+                "v1/auth/token/revoke-accessor",
+                new StringContent(body, Encoding.UTF8, "application/json"),
+                cancellationToken);
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "[{JobId}] Failed to revoke Vault token accessor {Accessor} during compensation.",
+                context.Job.Id, context.VaultTokenAccessor);
+        }
     }
 
-    /// <summary>
-    /// Reads the root token from the init.json written by the Vault entrypoint on first boot.
-    /// Path is injected via Vault__KeysFile config.
-    /// </summary>
     internal string ReadRootToken()
     {
-        var path = config["Vault__KeysFile"]
-            ?? throw new InvalidOperationException("Vault__KeysFile is not configured.");
-
+        var path = config["Vault:KeysFile"] ?? config["Vault__KeysFile"];
+        if (!string.IsNullOrWhiteSpace(path) && File.Exists(path))
+        {
             using var doc = JsonDocument.Parse(File.ReadAllText(path));
-        return doc.RootElement.GetProperty("root_token").GetString()
-            ?? throw new InvalidOperationException("root_token not found in Vault init.json.");
+            if (doc.RootElement.TryGetProperty("root_token", out var tok))
+                return tok.GetString()!;
+        }
+
+        return config["Vault:Token"]
+            ?? throw new InvalidOperationException(
+                "Cannot resolve Vault root token: neither Vault:KeysFile nor Vault:Token is configured.");
     }
 }

ControlPlane.Worker/appsettings.Development.json

@@ -0,0 +1,5 @@
+{
+  "Vault": {
+    "KeysFile": "C:\\Users\\amadzarak\\source\\repos\\ClarityStack\\OPC\\infra\\vault\\data\\init.json"
+  }
+}

ControlPlane.Worker/appsettings.json

@@ -20,7 +20,7 @@
 
   // ── Vault ─────────────────────────────────────────────────────────────────────
   // Worker uses localhost:8200 for admin calls.
-  // Vault__KeysFile is machine-specific → still injected by Aspire AppHost.
+  // Vault:KeysFile is machine-specific → set in appsettings.Development.json.
   "Vault": {
     "Address": "http://localhost:8200",
     "ContainerAddress": "http://vault:8200"

clarity.controlplane/src/index.css

@@ -804,30 +804,116 @@ body {
 
 .opc-sdlc-pipeline {
   display: flex;
-  align-items: center;
-  flex-wrap: wrap;
-  gap: 0.2rem;
-  margin-bottom: 0.35rem;
-}
-
-.opc-sdlc-stage-item {
-  display: flex;
-  align-items: center;
-  gap: 0.2rem;
+  align-items: flex-start;
+  flex-wrap: nowrap;
+  gap: 0;
+  overflow-x: auto;
+  padding-bottom: 0.25rem;
 }
 
 .opc-sdlc-arrow {
   color: #8f99a8;
-  font-size: 0.8rem;
+  font-size: 1rem;
   font-weight: 600;
-  margin: 0 0.1rem;
+  flex-shrink: 0;
+  align-self: center;
+  margin: 0 0.4rem;
   user-select: none;
 }
 
-.opc-sdlc-furthest {
-  font-size: 0.75rem;
+/* Individual branch box */
+.opc-sdlc-box {
+  flex: 1 1 140px;
+  min-width: 130px;
+  max-width: 200px;
+  display: flex;
+  flex-direction: column;
+  border: 1px solid #dce0e6;
+  border-radius: 6px;
+  background: #fff;
+  overflow: hidden;
+  flex-shrink: 0;
+}
+
+.opc-sdlc-box--reached {
+  border-width: 2px;
+}
+
+.opc-sdlc-box-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0.3rem 0.5rem;
+  background: #f6f7f9;
+  border-bottom: 1px solid #e5e8eb;
+  flex-shrink: 0;
+}
+
+.opc-sdlc-box-count {
+  font-size: 0.68rem;
   color: #738091;
-  margin-top: 0.3rem;
+  background: #e5e8eb;
+  border-radius: 10px;
+  padding: 0 6px;
+  line-height: 1.5;
+}
+
+/* Scrollable body */
+.opc-sdlc-box-body {
+  flex: 1;
+  overflow-y: auto;
+  max-height: 140px;
+  min-height: 60px;
+  padding: 0.3rem 0.4rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.15rem;
+}
+
+.opc-sdlc-sha-row {
+  display: flex;
+  align-items: baseline;
+  gap: 0.35rem;
+  padding: 0.1rem 0.2rem;
+  border-radius: 3px;
+  opacity: 0.35;
+}
+
+.opc-sdlc-sha-row--reached {
+  opacity: 1;
+}
+
+.opc-sdlc-sha {
+  font-family: 'Consolas', 'Courier New', monospace;
+  font-size: 0.7rem;
+  color: #2d72d2;
+  flex-shrink: 0;
+}
+
+.opc-sdlc-sha-msg {
+  font-size: 0.68rem;
+  color: #4a5568;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  flex: 1;
+  min-width: 0;
+}
+
+.opc-sdlc-box-empty {
+  font-size: 0.7rem;
+  color: #a3acb6;
+  font-style: italic;
+  padding: 0.2rem 0;
+}
+
+.opc-sdlc-box-pending {
+  font-size: 0.68rem;
+  color: #a3acb6;
+  font-style: italic;
+  margin-top: auto;
+  padding-top: 0.25rem;
+  border-top: 1px dashed #e5e8eb;
 }
 
 /* Commits section labels */

clarity.controlplane/src/opc/OpcPage.tsx

@@ -1,4 +1,4 @@
-import { useState, useMemo, useEffect, useCallback } from 'react';
+import { useState, useMemo, useEffect, useCallback, Fragment } from 'react';
 import { GitCommitDrawer } from '../components/GitCommitDrawer';
 import {
   Button, Callout, Divider, Drawer, FormGroup,
@@ -79,15 +79,6 @@ const SDLC_STAGES: { branch: string; label: string; intent: Intent }[] = [
   { branch: 'main',    label: 'Production', intent: Intent.SUCCESS  },
 ];
 
-function deriveSdlcSummary(coverage: BranchCoverage[]): { label: string; intent: Intent } | null {
-  for (let i = SDLC_STAGES.length - 1; i >= 0; i--) {
-    const stage = SDLC_STAGES[i];
-    const hit = coverage.find(c => c.branch === stage.branch);
-    if (hit?.contains) return { label: stage.label, intent: stage.intent };
-  }
-  return null;
-}
-
 // Aggregate per-repo branch coverage into a single view.
 // A stage is "reached" only when every repo that recognised at least one hash
 // reports contains=true for that branch. Repos that recognised no hashes are
@@ -487,42 +478,48 @@ function CommitsTab({ opc, isActive }: { opc: Opc; isActive: boolean }) {
 
       {/* SDLC Delivery Chain */}
       {coverage.length > 0 && (() => {
-        const summary = deriveSdlcSummary(coverage);
+        const allCommits = [
+          ...autoCommits,
+          ...pinned.map(p => ({ repoKey: 'pinned', hash: p.hash, shortHash: p.shortHash, author: p.pinnedBy, date: p.pinnedAt, subject: p.subject, files: [] })),
+        ].filter((c, i, a) => a.findIndex(x => x.hash === c.hash) === i);
+
         return (
           <div className="opc-delivery-chain">
-            <div className="opc-field-label" style={{ marginBottom: '0.6rem' }}>Delivery Chain</div>
+            <div className="opc-field-label" style={{ marginBottom: '0.75rem' }}>Delivery Chain</div>
             <div className="opc-sdlc-pipeline">
               {SDLC_STAGES.map((stage, i) => {
                 const hit     = coverage.find(c => c.branch === stage.branch);
                 const reached = hit?.contains ?? false;
                 return (
-                  <div key={stage.branch} className="opc-sdlc-stage-item">
+                  <Fragment key={stage.branch}>
                     {i > 0 && <span className="opc-sdlc-arrow">→</span>}
-                    <Tooltip content={
-                      reached
-                        ? `All linked commits have reached ${stage.label}`
-                        : hit
-                          ? `Not all linked commits have reached ${stage.label} yet`
-                          : `${stage.label} branch not found locally`
-                    }>
-                      <Tag
-                        intent={reached ? stage.intent : Intent.NONE}
-                        icon={reached ? 'tick-circle' : 'circle'}
-                        minimal={!reached}
-                        round
-                      >
+                    <div className={`opc-sdlc-box${reached ? ' opc-sdlc-box--reached' : ''}`} style={{ borderColor: reached ? SDLC_STAGES[i].intent === 'primary' ? '#2d72d2' : SDLC_STAGES[i].intent === 'warning' ? '#c87619' : SDLC_STAGES[i].intent === 'danger' ? '#ac2f33' : '#1c6e42' : '#dce0e6' }}>
+                      {/* Box header */}
+                      <div className="opc-sdlc-box-header">
+                        <Tag intent={reached ? stage.intent : Intent.NONE} minimal={!reached} round style={{ fontWeight: 600, fontSize: '0.72rem' }}>
                           {stage.label}
                         </Tag>
-                    </Tooltip>
+                        {reached && <span className="opc-sdlc-box-count">{allCommits.length}</span>}
                       </div>
+                      {/* Scrollable SHA list */}
+                      <div className="opc-sdlc-box-body">
+                        {allCommits.length === 0 ? (
+                          <span className="opc-sdlc-box-empty">No linked commits</span>
+                        ) : allCommits.map(c => (
+                          <div key={c.hash} className={`opc-sdlc-sha-row${reached ? ' opc-sdlc-sha-row--reached' : ''}`} title={c.subject}>
+                            <code className="opc-sdlc-sha">{c.shortHash}</code>
+                            <span className="opc-sdlc-sha-msg">{c.subject}</span>
+                          </div>
+                        ))}
+                        {!reached && allCommits.length > 0 && (
+                          <div className="opc-sdlc-box-pending">Not yet promoted</div>
+                        )}
+                      </div>
+                    </div>
+                  </Fragment>
                 );
               })}
             </div>
-            {summary && (
-              <div className="opc-sdlc-furthest">
-                Furthest: <strong>{summary.label}</strong>
-              </div>
-            )}
           </div>
         );
       })()}