feat: v8.5.1 -- licensed tier reconciled at boot + dev-mode token endpoint

Patch release synced from enterprise. No breaking changes; additive migration only.

Fixed (Community):
- Licensed tier is now written into the database at boot. After validating the
  deployment license, the agent upserts the deployment organization's tier and
  max_nodes to the licensed values via a new RLS-safe SECURITY DEFINER migration,
  so the portal UI, node-limit enforcement, and compliance-evidence paths no
  longer lag the in-memory tier (surfaced at /health) on a fresh install. The
  promotion is idempotent (writes only when tier/limit differs) and non-fatal.

Added (Community):
- Dev-mode token endpoint: POST /api/v1/dev/token. In an explicitly
  non-production deployment, mints a short-lived HS256 user_token from the
  authenticated Basic-auth credential so local and CI integrations don't have to
  hand-run a JWT signing script. Fail-closed: the route is only registered when a
  non-production ENVIRONMENT / DEPLOYMENT_MODE / DEPLOYMENT_KIND is set (else 404),
  and returns 503 if JWT_SECRET is not configured. Tenant inherited from the
  Basic-auth username; signing algorithm pinned to HS256. Never reachable in production.

Documentation:
- Architecture: "Five Runtime Modes" overview with Decision / MAP / WCP sequence
  diagrams describing how governance is enforced in each runtime mode.

Version: all version sites bumped to 8.5.1.
Signed-off-by: AxonFlow Team <bot@getaxonflow.com>

Author: axonflow-bot

.github/workflows/security.yml

@@ -144,6 +144,14 @@ jobs:
     name: Trivy Filesystem Scan
     runs-on: ubuntu-latest
     needs: [detect-changes]
+    # Trivy's Java analyzer resolves remote parent POMs by default. On
+    # ee/examples/compliance/rbi-sebi/java/pom.xml that network call cancels
+    # ("semaphore acquire: context canceled") and FATAL-aborts the WHOLE fs
+    # scan -> no SARIF -> Security Scan Summary red on every PR. Offline scan
+    # disables remote dependency resolution (the crash class); skip-dirs below
+    # also excludes example projects, which are not shipped artifacts.
+    env:
+      TRIVY_OFFLINE_SCAN: 'true'
     # Run if: push/schedule/workflow_dispatch OR (PR/merge_group with security-relevant changes)
     if: |
       always() &&
@@ -164,6 +172,7 @@ jobs:
           format: 'sarif'
           output: 'trivy-fs-results.sarif'
           severity: 'CRITICAL,HIGH,MEDIUM'
+          skip-dirs: 'ee/examples'
 
       - name: Upload Trivy results to Security tab
         uses: github/codeql-action/upload-sarif@v4
@@ -180,6 +189,7 @@ jobs:
           format: 'table'
           severity: 'CRITICAL,HIGH'
           exit-code: '1'
+          skip-dirs: 'ee/examples'
 
   # Trivy Configuration Scan
   trivy-config-scan:

CHANGELOG.md

@@ -12,13 +12,30 @@ community mirror, **Enterprise** changes are EE-only.
 
 ## [Unreleased]
 
+## [8.5.1] - 2026-06-08 — Licensed tier reported correctly in the portal/database + dev-mode token endpoint
+
+Patch release. Fixes a tier-reporting divergence where the licensed tier was held only in agent memory and never written to the `organizations` table, so the portal and other database consumers could lag behind `/health`. Also adds a non-production developer convenience for minting user tokens. Additive migration only; no breaking changes.
+
+### Added (Community)
+
+- **Dev-mode token endpoint (`POST /api/v1/dev/token`).** In an explicitly non-production deployment, mints a short-lived HS256 `user_token` from the authenticated Basic-auth credential, so local and CI integrations don't have to hand-run a JWT signing script. Fail-closed: the endpoint is **only registered** when an explicitly non-production `ENVIRONMENT` / `DEPLOYMENT_MODE` / `DEPLOYMENT_KIND` is set — otherwise the route returns `404`; and when registered but `JWT_SECRET` is not configured it returns `503` rather than minting. The token's tenant is inherited from the Basic-auth username, and the signing algorithm is pinned to HS256. Never reachable in production.
+
+### Fixed (Community)
+
+- **The agent now writes the licensed tier into the database at boot.** After validating the deployment license, the agent upserts the deployment organization's `tier` and `max_nodes` to the licensed values, using a new RLS-safe `SECURITY DEFINER` migration so the write clears `FORCE ROW LEVEL SECURITY` without giving the request path elevated privileges. Previously the licensed tier lived only in agent memory (surfaced at `/health`) while `organizations.tier` stayed at the seeded `Community` default — so the portal UI, node-limit enforcement, and compliance-evidence paths could report `Community` on a valid Enterprise license. The promotion runs at boot and is idempotent: it writes only when the tier or node limit actually differs.
+- **Tests:** added a runtime end-to-end test that boots a freshly-installed Enterprise deployment and asserts the database reports `Enterprise` with no prior request traffic, plus a migration-level unit test for the promotion helper.
+
+### Documentation
+
+- Expanded architecture documentation: a "Five Runtime Modes" overview with Decision / MAP / WCP sequence diagrams describing how governance is enforced in each runtime mode.
+
 ## [8.5.0] - 2026-05-30 — Decision Mode context propagation + Pasal 56(b) attestation + multi-arch images
 
 Minor release. Decision Mode gains request-context propagation and durable audit persistence, OJK compliance gains an explicit UU PDP Pasal 56(b) transfer-basis tag plus a wired cross-border-transfers export, and all six platform images now ship for both `linux/amd64` and `linux/arm64`. Indonesia compliance migrations (OJK + UU PDP + BI) relocated from `industry/banking/` to `enterprise/` so they load in every in-vpc-enterprise deployment by default. No breaking changes. SDKs are also updated in this release train — Go / Python / TypeScript / Java to **v8.4.0** and Rust to **v0.6.0** — adding the typed `context` field on `DecisionSummary` / `DecisionExplanation` and the `pasal_56b_dpa` transfer-basis value; see each SDK's own release notes for details.
 
 ### Added (Community)
 
-- **Decision Mode request-context propagation (`request.context`).** `POST /api/v1/decide` accepts an optional top-level `context` object — arbitrary caller-supplied key/value metadata (e.g. `tenant_tier`, `region`, `feature_flag`) that rides alongside the decision for audit and correlation. Keys are filtered against an allowlist, canonicalized, capped at 256 bytes per value and 10 keys per request, and a `request.context.truncated` flag is set when either cap trims the payload. Allowed keys land as OTel span attributes under `request.context.<key>` for trace-side filtering. The allowlist is configurable via `AXONFLOW_DECISION_CONTEXT_ALLOWLIST` (comma-separated); the default ships the BukuWarung-aligned key set. Closes #2509.
+- **Decision Mode request-context propagation (`request.context`).** `POST /api/v1/decide` accepts an optional top-level `context` object — arbitrary caller-supplied key/value metadata (e.g. `tenant_tier`, `region`, `feature_flag`) that rides alongside the decision for audit and correlation. Keys are filtered against an allowlist, canonicalized, capped at 256 bytes per value and 10 keys per request, and a `request.context.truncated` flag is set when either cap trims the payload. Allowed keys land as OTel span attributes under `request.context.<key>` for trace-side filtering. The allowlist is configurable via `AXONFLOW_DECISION_CONTEXT_ALLOWLIST` (comma-separated); the default ships a curated set of agent/session/leader identity headers plus a tenant-scoped header family. Closes #2509.
 
 - **Decision Mode decisions now persist to `audit_logs`.** Previously `POST /api/v1/decide` emitted only an OTel span, so `GET /api/v1/decisions` returned empty for Decision Mode callers who had not wired an OTel backend. Each decision now also writes a best-effort row to `audit_logs` (mirroring `writeExplainableAuditLog`), with the propagated context stored under `policy_details->'context'`. `GET /api/v1/decisions` surfaces a 5-key truncated view of the context; the explain endpoint returns the full context plus a `context_truncated` flag. OpenAI-compatible callers continue to use `llm_call_audits` unchanged. (BUKU-A scope expansion on #2509.)
 

CONTRIBUTING.md

@@ -32,6 +32,10 @@ git rebase --signoff origin/main
 
 A DCO check runs automatically on every PR opened in the `getaxonflow` org. **PRs with any unsigned commit will be blocked from merging until the missing sign-offs are added.** No exceptions, including for maintainers.
 
+## No partner/customer names in community source
+
+Partner-driven features are named for the **capability** (e.g. `Indonesia`, `KTP`, `OJK`), never for the partner. Partner-specific artifacts (policy bundles, eval configs, partner runbooks) live **gated or internal** (`ee/`, `technical-docs/`, `docs/protected/`) — never in community source. A CI denylist (`.github/partner-name-denylist.txt`, enforced by the Partner Name Denylist workflow and as a fail-closed gate in the community sync) blocks any denylisted name from appearing in synced paths (`platform/`, `migrations/`, `config/seed-data/`, `docs/`, `examples/`, `infra/`) or public docs.
+
 ## Table of Contents
 
 - [Quick Start](#quick-start)

VERSION

@@ -1 +1 @@
-8.5.0
+8.5.1

docker-compose.yml

@@ -87,7 +87,7 @@ services:
       DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-community}
       AXONFLOW_INTEGRATIONS: ${AXONFLOW_INTEGRATIONS:-}
       AXONFLOW_LICENSE_KEY: ${AXONFLOW_LICENSE_KEY:-}
-      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-8.5.0}"
+      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-8.5.1}"
 
       # Anonymous platform startup telemetry — inherit the operator's
       # opt-out lever. CI / dev shells should export AXONFLOW_TELEMETRY=off
@@ -261,7 +261,7 @@ services:
       PORT: 8081
       DEPLOYMENT_MODE: ${DEPLOYMENT_MODE:-community}
       AXONFLOW_LICENSE_KEY: ${AXONFLOW_LICENSE_KEY:-}
-      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-8.5.0}"
+      AXONFLOW_VERSION: "${AXONFLOW_VERSION:-8.5.1}"
 
       # Anonymous platform startup telemetry — inherit the operator's
       # opt-out lever. See agent service above for the full rationale.

docs/ARCHITECTURE.md

@@ -157,6 +157,97 @@ response = await axonflow.execute_query(
 
 ---
 
+## The Five Runtime Modes
+
+AxonFlow is a **policy plane** for AI execution: at the point where an agent, model, or workflow is about to do something consequential, it **decides, enforces, redacts, and records** that action against your policies. There are five ways to wire that in. They differ only in *who calls AxonFlow* and *where AxonFlow sits relative to the traffic* — the governed-call lifecycle (decide → allow/deny/redact → audit, fail-closed) is identical across all five.
+
+The split that makes this work is **PEP / PDP**: AxonFlow is the **Policy Decision Point** (it returns a verdict), and the integration is the **Policy Enforcement Point** (it acts on the verdict).
+
+| Mode | Who calls AxonFlow | Traffic path | Endpoint(s) | When to use |
+|---|---|---|---|---|
+| **Decision Mode** | Your infra **gateway** | Client → gateway → target (verdict checked inline) | `POST /api/v1/decide` | Gateway-level enforcement with **no app-code changes** |
+| **Gateway** | Your **app code** (SDK) | App → LLM (direct) | `POST /api/policy/pre-check`, `POST /api/audit/llm-call` | Adding governance to an existing app/framework, least invasive |
+| **Proxy** | Your **app code** (one call) | App → AxonFlow → LLM | `POST /api/request` | New apps wanting AxonFlow to own routing + the LLM call |
+| **MAP** (Multi-Agent Planning) | Your **app code** | App → AxonFlow plans + executes | Orchestrator planning API | Decomposing a request into a governed multi-step plan |
+| **WCP** (Workflow Control Plane) | Your **external orchestrator** | Orchestrator → AxonFlow gates each step | `workflow_control/` step gate + complete | Step-level gates beside LangGraph / n8n / Temporal |
+
+> The public, user-facing version of this model — with a per-integration coverage matrix — lives at [docs.getaxonflow.com/docs/architecture/governance-coverage](https://docs.getaxonflow.com/docs/architecture/governance-coverage). This section is the engineering source that page derives from.
+
+### Decision Mode — gateway-level governance, no app changes
+
+Your infrastructure gateway (LLM gateway, MCP gateway, agent router) asks AxonFlow for a verdict on each request and enforces it locally. AxonFlow is **never on the traffic path** — it is consulted for decisions only. This is the lowest-touch way to govern many apps at once: application code is unchanged; the gateway does the enforcing.
+
+```mermaid
+sequenceDiagram
+    participant C as Client
+    participant GW as Infra gateway (PEP)
+    participant AX as AxonFlow (PDP)
+    participant T as Target (LLM / tool / agent)
+    C->>GW: request
+    GW->>AX: POST /api/v1/decide
+    alt deny / needs_approval
+        AX-->>GW: deny
+        GW-->>C: blocked (reason)
+    else allow
+        AX-->>GW: allow (+ obligations)
+        GW->>T: forward
+        T-->>GW: response
+        GW-->>C: response (obligations applied)
+    end
+    GW->>AX: audit (decision_id · trace_id)
+```
+
+**Endpoint:** `POST /api/v1/decide` (`stage` = llm / tool / agent). Reference PEP adapters ship for **LLM**, **MCP** (`tools/call`), and **agent** gateways. **Code:** `platform/agent/decision_handler.go`. **See:** [ADR-056 — Decision Mode](../technical-docs/architecture-decisions/ADR-056-decision-mode.md).
+
+### MAP — Multi-Agent Planning
+
+AxonFlow decomposes a natural-language request into a multi-step plan, then executes the steps with a policy decision **at each step**, with replay/resume and optional approval gates.
+
+```mermaid
+sequenceDiagram
+    participant App
+    participant AX as AxonFlow (planner)
+    participant S as Step executor
+    App->>AX: request (multi-agent-plan)
+    AX-->>App: plan (steps)
+    loop each step
+        AX->>AX: policy decision for step
+        AX->>S: execute (governed)
+        S-->>AX: result
+    end
+    AX-->>App: workflow result + per-step audit
+```
+
+**Code:** `platform/orchestrator/planning_engine.go` (plan generation), with per-step decisions recorded to the decision chain (`platform/agent/decision_chain.go`).
+
+### WCP — Workflow Control Plane
+
+Your external orchestrator (LangGraph, n8n, Temporal, Airflow) keeps running the workflow; AxonFlow adds a **gate before each step** and a **completion record after**, plus checkpoints and approvals — without replacing the orchestration engine.
+
+```mermaid
+sequenceDiagram
+    participant O as External orchestrator (PEP)
+    participant AX as AxonFlow
+    participant N as Step / node
+    O->>AX: gate(step)
+    alt block / needs_approval
+        AX-->>O: block
+    else allow
+        AX-->>O: allow
+        O->>N: run step
+        N-->>O: result
+        O->>AX: complete(step) — state + audit
+    end
+```
+
+**Code:** `platform/orchestrator/workflow_control/` (step gates + completion + checkpoints). **See:** [ADR-028 — Workflow Control Plane](../technical-docs/architecture-decisions/ADR-028-workflow-control-plane.md).
+
+### Gateway & Proxy
+
+**Gateway Mode** and **Proxy Mode** are covered in detail above ([Gateway Mode](#gateway-mode-recommended-for-existing-stacks), [Proxy Mode](#proxy-mode-full-control)); their combined request/audit sequence is in [Execution Model → Policies Before and After Steps](#policies-before-and-after-steps). The LLM-architecture rationale for the Gateway-default / optional-full-Proxy split is in [ADR-004 — LLM Architecture](../technical-docs/architecture-decisions/ADR-004-llm-architecture-governance.md).
+
+---
+
 ## Control Plane vs Orchestration
 
 | Aspect | Orchestration (LangChain) | Control Plane (AxonFlow) |

docs/api/agent-api.yaml

@@ -4106,12 +4106,13 @@ components:
             decision span, so a SIEM can correlate the decision with upstream
             logs (e.g. by session_id). Intended for infrastructure-gateway
             audit headers such as `X-AI-Agent`, `X-Session-ID`,
-            `X-Leader-Identity`, and the `x-bukuwarung-*` family.
+            `X-Leader-Identity`, and a tenant-scoped header family.
 
             Only keys matching the server's allowlist
-            (`AXONFLOW_DECISION_CONTEXT_ALLOWLIST`; default
-            `x-ai-agent,x-session-id,x-leader-identity,x-bukuwarung-*`, where a
-            trailing `*` is a prefix match) are persisted; all other keys are
+            (`AXONFLOW_DECISION_CONTEXT_ALLOWLIST`; the default covers common
+            agent / session / leader identity headers plus a tenant-scoped
+            header family, where a trailing `*` is a prefix match) are
+            persisted; all other keys are
             silently dropped. Surviving keys are canonicalized to
             lower_snake_case (`X-AI-Agent` → `x_ai_agent`) so joins are
             deterministic regardless of header casing. Non-string values are

examples/mcp-decision-mode/.env.example

@@ -7,7 +7,7 @@ AXONFLOW_AGENT_URL=http://localhost:8080
 
 # Basic-auth credentials for the agent. In enterprise mode CLIENT_SECRET is
 # the license key, and CLIENT_ID / TENANT_ID are your AxonFlow org identifier.
-# Replace these with the values your AxonFlow deployment issued for BukuWarung.
+# Replace these with the values your AxonFlow deployment issued for your organization.
 AXONFLOW_CLIENT_ID=mcp-decision-mode-demo
 AXONFLOW_CLIENT_SECRET=replace-with-license-key
 AXONFLOW_TENANT_ID=mcp-decision-mode-demo

examples/mcp-decision-mode/README.md

@@ -45,14 +45,14 @@ through the PEP, which asks the PDP first.
 
 ## Audit-layer mapping
 
-BukuWarung's Risk Committee defines a four-layer audit framework. This example
+A design partner's Risk Committee defines a four-layer audit framework. This example
 produces the first two layers and is the join point for the other two:
 
 | Layer | What it is | Produced by |
 |-------|-----------|-------------|
 | **Layer 1** | MCP server logging (`timestamp, session_id, leader_email, tool_name, parameters_hash, response_record_count, duration_ms`) | `audit_log.py` → `audit_log.jsonl` |
 | **Layer 2** | `X-AI-Agent` / `X-Session-ID` / `X-Leader-Identity` propagation | `mcp_server.py` forwards them in the `decide()` `context` map; values land in the Layer 1 row (`ai_agent`, `session_id`, `leader_email`) |
-| **Layer 3** | Decision record → SIEM, correlated to BigQuery Cloud Audit Logs by `session_id` | AxonFlow decision record (`decision_id` + `trace_id`) exported via OpenTelemetry; correlate on `session_id` (BukuWarung GCP-side config) |
+| **Layer 3** | Decision record → SIEM, correlated to BigQuery Cloud Audit Logs by `session_id` | AxonFlow decision record (`decision_id` + `trace_id`) exported via OpenTelemetry; correlate on `session_id` (the design partner's GCP-side config) |
 | **Layer 4** | Anomaly alerts (volume, off-hours, bulk retrieval) | SIEM's job once Layer 1 + Layer 3 feeds are joined |
 
 ## Quickstart

examples/mcp-decision-mode/audit_log.py

@@ -2,7 +2,7 @@
 
 Each governed MCP tool invocation writes exactly one JSON line to an append
 -only ``audit_log.jsonl``. This is the PEP-side audit record that satisfies
-**Layer 1** of BukuWarung's four-layer audit framework (MCP server logging).
+**Layer 1** of a design partner's four-layer audit framework (MCP server logging).
 It is produced locally by the MCP server, independent of whether AxonFlow
 persists the forwarded context, so the example works end-to-end today.
 
@@ -15,8 +15,8 @@
                                           (session_id, leader_email, ai_agent)
   Layer 3  BigQuery Cloud Audit Logs → SIEM   AxonFlow decision record
                                           (decision_id) lands in the SIEM and
-                                          correlates by session_id (BukuWarung
-                                          GCP-side config)
+                                          correlates by session_id (the design
+                                          partner's GCP-side config)
   Layer 4  Anomaly alerts ............... SIEM's job once both feeds are in
 
 Layer 1 schema (the Risk Committee's named field set) — every row carries,