…m seed)

The $2B unlock a CLI can't be: a persistent, multi-tenant surface. Instead of a
one-shot scan, an org pushes every CI scan and queries its history/trend — the
recurring-revenue backbone. Stdlib only (sqlite3 + http.server), ships in the
same wheel, no dependency.

- appguardrail_core/controlplane.py: SQLite store (orgs + scans), API-key auth
  (sha256-hashed), tenant-scoped add/list/get, and an HTTP API. Counts and
  deploy-blocking are computed from findings on ingest.
- `appguardrail serve [--db --host --port] [--create-org NAME]`; bootstraps a
  default org + API key on an empty DB.
- Endpoints: POST/GET /api/v1/scans, GET /api/v1/scans/{id}, GET /api/v1/health;
  Authorization: Bearer <key>.
- Tests: tests/test_controlplane.py (store, counts, tenant isolation, health,
  ingest+history round-trip, 401 auth, 400 bad body) + module self-check.
- Verified: full suite 215 passed; e2e provision -> POST scan -> GET history,
  401 on missing/wrong key, cross-tenant reads blocked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EywwS2Du8pimW7xqRP3An3

…plane (#201)

Multi-tenant needs multi-user: an org shares one key today, so CI, a read-only
dashboard, and an admin all hold the same all-powerful credential. This adds
per-key roles.

- controlplane.py: `keys` table (org_id, key_hash, role, label). create_key()
  issues a role-scoped key; role_for_key() resolves (org_id, role) and treats
  the bootstrap key as owner; has_role() enforces viewer<member<owner.
  create_org now seeds an owner key.
- API enforcement: GET (read) = any role; POST /scans = member+; POST /webhook
  and POST /keys = owner. New POST /api/v1/keys mints role-scoped keys.
- Tests: role resolution + has_role ordering, and the full API role matrix
  (viewer read-only, member ingest-only, owner full) via the live server.
- Verified: full suite 236 passed; e2e role matrix (viewer/member/owner) enforced.


Claude-Session: https://claude.ai/code/session_01EywwS2Du8pimW7xqRP3An3

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

When an org's drift-alert webhook URL is a Slack Incoming Webhook
(host hooks.slack.com), render the alert as a Block Kit message:
a header with the new deploy-blocking count, a fields section for
org / new blockers / repo / scan id, and a section listing the top
5 offending rule_id/file pairs with a "+N more" overflow line.
Text is Slack-escaped and length-trimmed to Block Kit caps.

Any non-Slack URL still receives the existing generic JSON payload
unchanged (backward compatible). The format is chosen inside
_send_alert via host detection; add_scan now passes the org name and
the list of newly-introduced blocking findings through so the Slack
renderer can name them. No new dependency (stdlib urllib only).


Claude-Session: https://claude.ai/code/session_01EywwS2Du8pimW7xqRP3An3

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Adversarial review of the control plane found two real gaps, both reachable
by any holder of a valid key:

- Request bodies were unbounded: a huge Content-Length OOMs the server, and a
  negative one makes rfile.read(-1) block until EOF. Now capped at 10MiB and
  negatives rejected (400) before reading.
- limit/offset query ints were passed through unclamped: sqlite treats
  LIMIT -1 as *no limit*, so ?limit=-1 dumped the org's entire scan history,
  bypassing the pagination cap. Now clamped (list 1..1000, trend 1..365,
  offset >= 0).

Reviewed-and-cleared in the same pass: role validation on key creation (safe
fallback to member), unknown-role handling in has_role (rank -1), key lookup
by sha256 hash (no timing-sensitive comparison), tenant isolation on all
reads (existing tests).

Tests: 3 new (limit=-1 / huge limit+negative offset clamped; 50MiB body ->
400; negative Content-Length -> 400). Full suite 245 passed.


Claude-Session: https://claude.ai/code/session_01EywwS2Du8pimW7xqRP3An3

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

SHA-256 is a fast, non-memory-hard hash unsuitable for hashing secrets:
if the control-plane store leaks, an attacker can brute-force API keys at
billions of guesses per second. Switch _hash_key to hashlib.scrypt, a
memory-hard KDF from the stdlib, with a fixed application salt so the hash
stays deterministic and keys remain findable by indexed equality lookup.

Resolves CodeQL py/weak-sensitive-data-hashing (high).