Changelog

What's Changed

• fix(prompts): authorize prompt folders and inherit prompt access from them
• test(iam): run the IAM Playwright specs on an enterprise build
• ci(ent-gate): start OpenFGA so the IAM specs can run
• ci(ent-gate): fail fast when RBAC is not live, and capture the logs that say why
• test(iam): turn the IAM shard off until the specs are parallel-safe
• ci(iam): register the Wave 2 Edit Role specs in the IAM shard
• fix(ai): route o2-ai requests through NATS in HA mode
• feat(anomaly): decide anomalies by a per-slot value band and publish its bounds
• feat(rum): rum_analytics permission type and super-cluster replication
• fix(ai): send the internal secret on sre-rca calls to o2-ai
• feat(openfga): route permissions for metrics query history
• feat(logs): default-on AI/audit/service streams, unbuilt redaction pattern tracking, internal-stream filtering in correlate
• docs(audit): note credential redaction in O2_AUDIT_ENABLED help; keep defaults on
• fix(anomaly): record why no destination accepted an alert, and retry only transient failures
• fix(service_graph): count service nodes by their own requests for the traces triage loop
• fix: tighten input validation, auth and outbound request checks
• fix: read the ext auth salt through config::get_ext_auth_salt (port to v1.1.0)