OpenConstructionERP Files

Round 4 — 20-module deep improvements sweep. A single release bundling 20 parallel module-deep audit + fix passes on previously under-tested modules. Every module touched here got a baseline pytest file; combined ~140 new tests, no regressions.

Security (P0 / P1)

• teams: critical RBAC bypass closed. create_team, add_member, remove_member had no verify_project_access gate — any authenticated user could create teams in any project and self-elevate to owner / project_manager, inheriting elevated permissions. Service-layer project-access check + self-elevation block on elevated roles.
• architecture_map: critical information disclosure closed. Was Depends(get_current_user_id) only → every viewer / estimator could enumerate the full ERP architecture (table names, model columns, module deps). Now requires architecture.read admin permission.
• rfq_bidding: award role gate. award_bid only required rfq.update (EDITOR) but the FSM declares admin / manager. Added service-layer 403 check on {admin, manager, owner}. Also: bid-submission state-escape blocked, past-deadline submissions 409.
• smart_views: federation read leak closed. _can_read returned True blindly for federation scope. Closes backlog [#103] (federation visibility staleness on owner change) via new event subscriber on projects.project.updated.
• opencde_api: $orderby allowlist + LIKE-wildcard injection on labels filter.
• pipelines: create_pipeline IDOR (accepted project_id from body without verify_project_access).
• coordination_hub: silent write on coordination.read GET (viewers were committing seed rows).
• compliance_docs + correspondence: magic-byte upload endpoints. Mirror v4.2.1 punchlist + v4.2.3 AI fixes.
• correspondence: CRLF subject sanitisation (email-header injection block).
• contacts: PII redaction in logs + import-error responses + duplicate-email race (IntegrityError → 409).
• erp_chat: history role / length sanitisation. Smuggled system role in conversation_history now dropped — kills prompt-injection via fake system turn.
• ai_agents: tool-context spoofing fix + Idempotency-Key header dedupes retries.
• clash_ai_triage: rate limit added to triage / batch / replay endpoints + 180 s wall-timeout + structured per-call cost log.
• enterprise_workflows: action_type whitelist + MAX_STEPS=32 cap + role validation.

Correctness

• clash_cost_impact: Decimal-exact rollup (kills 0.005 × N drift on large projects) + ROUND_HALF_UP instead of banker's even.
• coordination_hub: warn / error threshold invariant (inverted pairs could persist and silently break the elif-cascade).
• rfq_bidding: money / currency Decimal validation + 3-letter ISO normalisation + latent MissingGreenlet fixed (ORM access after expire_all() — hidden in prod because prior try: except: pass audit-log catch swallowed it).
• markups + dwg_takeoff: Float → Numeric on measurement_value, pixels_per_unit, real_distance, scale_override, thickness, scale_denominator. Float precision drift no longer leaks into BOQ via takeoff / markups.
• dwg_takeoff: magic-byte validation moved pre-write.
• compliance_ai: was stub-only. Built POST /from-nl with auth + rate-limit + 2000-char input cap + 1024-token AI cap + structured verdict log + _log_failures-wrapped event publish. Fixed latent double-prefix bug.
• smart_views: federation views now appear in list_visible_to_user (were excluded entirely).

Performance

• opencde_api: N+1 in create_topic — len(list(...)) over every project row → SELECT COUNT(*).
• project_intelligence: LLM LRU cache (sha256-keyed, 60 s TTL) + bounded state cache (was unbounded → memory leak on long-lived process).
• pipelines: max-nodes cap (256), per-node asyncio.wait_for timeout (300 s), row-ids cap (5000) on source.boq / transform.filter envelopes.

Observability

• New structured cost / outcome logs across: erp_chat, ai_agents, clash_ai_triage, project_intelligence, compliance_ai, pipelines, coordination_hub, teams, enterprise_workflows. Each emits a single module.operation INFO record with relevant fields.
• architecture_map writes per-endpoint audit log of who's enumerating system architecture.
• teams publishes teams.team.{created,updated,deleted} + teams.membership.{added,removed} for permission-cache invalidation.
• compliance_docs publishes compliance_docs.expiry.alert on status transitions.

DB migrations

• v3097_markups_measurement_numeric (merges two heads)
• v3097_dwg_takeoff_decimal_quantities
• v3098_correspondence_attachments_column

Single head at v3098.

Tests

About 140 new tests across 20 module test files. No regressions in adjacent suites.

Notes

cost_match was found to be a stub-only module (matching logic lives in match_elements; cost_match is reserved for T12 assembly material-layer matching). Baseline tests pin current shape with a guard that fails when models.py lands.