EPIC: brain2daax — reference-platform platform-maturity rollout

EPIC — brain2daax: reference-platform platform-maturity rollout

Tracking issue for porting reference-platform's proven platform-maturity patterns into daax-web. Full spec: docs/brain2daax.md. Decision trail: .logs/decisions/brain2daax.jsonl (3 rounds of cross-provider Opus+Codex adversarial review).

All sub-issues are DRAFT (awaiting JP approval before work begins). Each carries explicit acceptance criteria and required unit/integration/E2E testing per .claude/workflow.md Definition of Done. Grouped by the spec's dependency-ordered phases (not review round).

Architecture decision (D1, 2026-06-13): consolidate all data stores on Postgres.

Phase 0 — Foundational: Postgres (milestone)

• #92 — Stand up Postgres + Node migration tooling
• #93 — Migrate catalog.db + releases.db → Postgres (parity-tested)

Phase 1 — Security & supply chain (highest leverage, ship first; independent of Phase 0)

• #94 — F1a: HTTP proxy-secret trust boundary (closes task-007 for proxy-less ingress)
• #95 — F1b: Terminal WebSocket authentication (CRITICAL)
• #96 — F4: CI quality gates + vuln scan + auth-drift gate
• #97 — F2: SBOM generation (CycloneDX + SPDX)

Phase 2 — Operational hygiene

• #98 — F7: Deep health endpoint + probes
• #99 — F8: Build / deploy-provenance admin page
• #100 — F3: Frontend/backend container split — blocked by #95

Phase 3 — Identity & RBAC (depends on Phase 0)

• #101 — F5: User identity + DB RBAC on Postgres (JIT + enforcement)
• #102 — F6: Admin DB inspection console (read-first, SQLi-safe)
• #103 — Operational resilience: backups, secret rotation, rollback (gates F1/F5/F6 GA)

Phase 4 — Deployment & cloud

• #104 — F9: Clean cloud-agnostic deployment model

Key dependency edges

• #95 (F1b) must precede #100 (F3) — containment.
• #92 → #93 → {#97 sbom column, #101 RBAC, #102 console}.
• #103 gates GA of #94/#95/#101/#102.

Net effect (spec §9)

Closes task-007 + the WS gap; per-image SBOM with real-vs-placeholder guard; persistent identity + enforced RBAC + audit; read-first DB console; single Postgres with version-controlled migrations; env-based phased fail-closed deploy. Local-first preserved (§8); cloud kept provider-agnostic (managed Postgres via connection-string swap).

Start with docs/brain2daax.md, then read .logs/decisions/brain2daax.jsonl and the Definition of Done in .claude/workflow.md. Review the dependency-ordered sub-issues from #92 through #104; done means the approved phases, acceptance criteria, and required unit, integration, and E2E tests are completed.