@astram/guide 0.2.20 → 0.2.21

package/CAPABILITIES.md

@@ -169,7 +169,10 @@ imports: [
   `GET /identity/auth-facts` feeds the frontend's permission-gated navigation.
 - **Scoped-hierarchy tenancy** (ADR-0027): a tenant is a company node; an admin's authority covers
   its subtree. Reads, updates, deletes AND creates of subtree-scoped types are walled in the query
-  (ADR-0030, ADR-0034). Non-root admins cannot create top-level tenants.
+  (ADR-0030, ADR-0034). Non-root admins cannot create top-level tenants. With
+  `IdentityFeatureModule` wired, a session's subtree (its company and every company below) is
+  resolved at sign-in automatically (identity 0.24); pass `ShieldModule.forRoot({ scopeSubtreeResolver })`
+  only to replace identity's resolver. Without identity, reach is the active company only.
 - **No escalation**: you can grant, revoke or assign (via postings) only roles and keys you hold
   (ADR-0029); a role used outside your subtree is root-only; changing another user's email or
   status needs dominance over that user. Grant changes are audited in the same transaction.
@@ -506,8 +509,8 @@ imports: [
   (directly or through `identity:<type>:*` / `identity:*`). `GET /identity/permission-announcements
   ?status=open|dismissed&page=&limit=&companyUuid=` lists the tasks the caller can act on: holders
   of `identity:role:update` whose grant ceiling covers the key, for the companies below them (their
-  own company already holds what they can grant; this needs `scopeSubtreeResolver` wired in
-  `ShieldModule.forRoot`, which the scaffold does not do yet); root sees every company. On a fresh
+  own company already holds what they can grant; the subtree comes with `IdentityFeatureModule`,
+  identity 0.24); root sees every company. On a fresh
   install the keys from the very first catalogue pass raise no task (identity 0.23). Granting the key to any of the company's roles closes the
   task on the next read; `POST /identity/permission-announcements/:companyUuid/:key/dismiss`
   ("Reviewed, not needed", audited) closes it on purpose and `…/reopen` undoes that. A key removed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",