suit 1.0.0-beta4

Fourth beta. Adds access reviews, serialises audit appends, and binds every grant and certification to the terms that were approved. Full details are in CHANGELOG.md.

Added

• Access reviews (suit_review). Campaigns freeze the active eligibilities at activation; a reviewer, never the subject, retains or revokes each one. Eligibility not retained by the deadline is refused from the moment the deadline passes. Certification is bound to a snapshot of the eligibility, the role's permissions and the SoD policies, and expires after max_certification_age_days (default 90). Removing the module fails closed.

Security

• Concurrent audit appends could fork the chain. The chain head is now read under a row lock on MySQL and PostgreSQL and advanced by compare-and-swap. Measured on MySQL 8 (InnoDB, READ COMMITTED): four processes appending 50 events each recorded 200 of 200, with no forks.
• Grants are bound to the role as approved. Each grant records a fingerprint of the role's permissions and administrator flag. A changed role stops conferring the grant, and saving or deleting the role revokes it permanently, so restoring the role does not revive it.
• Certification age cannot be extended by a later policy change.

Changed

• New audit events are written in suit.audit.v1. Existing events keep their hashes and stay verifiable.
• Audit retention is opt-in, and now actually runs when enabled; each purge appends a retention.purged declaration.
• enable_extended_telemetry is honoured.
• drush suit:verify checks each event in its own format and reports whether the chain is complete from its origin.

Upgrade

Run database updates: suit_update_10001 to 10003 and suit_pim_update_10001 to 10003. Retention stays off on existing sites.

Known limitations

• The access-review admin UI has no browser tests yet.
• Concurrency was measured on MySQL 8.0 only; PostgreSQL and SQLite are untested under concurrent writers. See tests/concurrency/README.md.