Oliver Kieselbach 8a3b4136a6 feat(web): internal annotation lane follows the Global-Admin view ...

The "Internal (Autopilot Monitor)" lane is labelled "never visible to the
tenant" and sits on the session page shown in every live demo, but it was
gated on the platform identity alone and stayed on screen when the
Global-Admin view was switched off.

visibleLanes() now takes the view flag as an explicit second argument and
combines it with the identity, so the rule also covers the read-only Global
Reader. The /annotations overview additionally filters the rendered ROWS to
the visible lanes: that list is not lane-scoped by the request, so an
internal row would otherwise surface there even with the lane dropped from
the filter dropdown.

Not a permission change -- the backend filters the lane for tenant callers
regardless (GetSessionAnnotationsFunction.FilterLanesForCaller) and owns the
write matrix.

Also fixes the retention-override banner: the bare warning glyph inherited
the base 16px size against 12px text and sat below the first line, with an
mt-0.5 hand-nudge that could not hold it. Replaced by a w-4 h-4 SVG whose
box matches the text-xs line box exactly, so items-start aligns it with no
margin -- and it now matches the icon style of every other alert box.

The IME log pattern controls needed no change: canEdit already reads
isGlobalAdmin && globalAdminMode, so demo mode reaches them through the
effective flag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-01 20:43:58 +02:00

..

demo-presentation-mode.md

feat(web): internal annotation lane follows the Global-Admin view

2026-09-01 20:43:58 +02:00

portal-navigation-prefetch.md

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00