feat(enterprise): remaining capture, identity, and admin controls

[ComputelessComputer]

Ships remaining Anarlog Enterprise workstreams after the MIT/commercial capture contracts landed.

Capture (ANLG-223 children)

• ANLG-226: Version-pinned Vexa v0.12.18 behavior matrix and replayable fixtures under enterprise/google-meet-worker/fixtures/.
• ANLG-230: Reliability gate covering admission, kick, host-end, lobby/nobody-joined timeouts, crash/network/STT, speaker edge cases, two-hour duration, and terminal reasons. Live Meet against a real URL (https://meet.google.com/sku-zryu-aer) produced AdmissionDenied (can't join this video call) and cleaned up (live_google_meet_emits_actionable_terminal_reason_and_cleans_up, 4.57s). Admitted join + recording chunks still need a host who starts/admits the bot. Control-plane migrations are asserted additive.
• ANLG-231: Calendar upsert schedules exactly one capture job per eligible event, with list/cancel APIs and a Team settings “upcoming bot attendance” panel.
• ANLG-233: Eval compose, production compose, Helm chart, optional STT, object-storage PVC, ServiceMonitor, offline license validation, NOTICE, and ops docs.
• ANLG-234: Native Zoom RTMS worker (no browser bot).
• ANLG-232: Teams Graph media-bot path behind the MIT capture contract, plus an explicit Windows Server/Azure deployment limit.

Identity and admin

• ANLG-216: Workspace policy table, share-RPC fail-closed (including link issuance), share panel honors allowed scopes, retention job.
• ANLG-217: Metadata-only usage overview (members, seats, devices, shares).
• ANLG-218: Domain claim, Require SSO, web+desktop signInWithSSO by email domain, SCIM /scim/v2 deprovision that deletes membership and sync devices (E2EE rotation via existing trigger). IdP SAML metadata is still configured in Supabase, not an in-app Okta wizard.
• ANLG-133 / 131 / 132 / 134 / 136 / 137 / 138: Planning specs under enterprise/docs/planning/.

Consent (ANLG-135)

• Local-only session_disclosure_attempts / session_participant_consent tables (not CloudSync, not E2EE).
• A sent Slack disclosure is transport evidence only; sessionHasLegalConsent() is always false.
• Schema CHECK rejects a disclosure_sent consent source.
• Explicit chat decline stops listening; late joiners stay unknown.
• Slack huddle AX send remains macOS-only; live huddle testing was not run here.

Intentionally not Done

• ANLG-230 still needs live admitted Meet capture (host present).
• ANLG-135 still needs controlled live Slack huddle testing on macOS.
• ANLG-223 parent stays open until the Meet reliability gate has admitted-join live evidence.

Verification

• cargo test --locked -p db-app --lib (195 passed)
• cargo test --manifest-path enterprise/Cargo.toml -p anarlog-enterprise-control-plane --test upgrade
• cargo test --manifest-path enterprise/Cargo.toml -p anarlog-enterprise-google-meet-worker --test reliability_gate
• Live Meet ignored test live_google_meet_emits_actionable_terminal_reason_and_cleans_up passed against a real Meet URL
• pnpm -F desktop typecheck
• targeted desktop tests: meeting-consent, meeting-chat-capture, useStartListening, meeting-settings
• pnpm exec oxlint --quiet --format=github on changed desktop STT files (0 errors)
• merged main (#6983) and recompiled i18n catalogs from merged .po files
• CI: fmt now excludes Helm templates; set_workspace_policy / scim_apply_user use #variable_conflict use_column; pgTAP plan for 041 is 14
• supabase test db not run here (no local Docker); that check is on CI

  

[netlify]

✅ Deploy Preview for anarlog canceled.

Name	Link
🔨 Latest commit	3ef911b
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a87cca62c53c500082c7913