Platform management transfer, and two certification framework corrections

[coodos]

Description of change

Two independent pieces of work that were sitting on the same branch.

Platform management transfer (registry). A platform profile can now be handed to a named manager, and a managed profile is protected from being overwritten by anyone else. Adds PlatformManagementService, extends the registry's JWT handling, and carries a migration.

Two corrections to the certification framework (PPA).

The deployment assurance dimension is removed. A release under review has not been deployed yet, so the row was always L0 and dragged every assessment down for a fact about the future rather than anything about the release. Framework version goes to 3 — the scoring set changed from sixteen dimensions to fifteen, so an assessment judged under version 2 is not comparable to one judged now, and that version is inside every signed certificate.

The assessment header still described the minimum rule that the geometric mean replaced ("the level is the weakest of these dimensions… raising that one row is what raises the level"). Reworded to match what the code does, and the blocking case is now stated separately from the merely-weakest one. The framework file is also reloaded when it changes rather than cached for the life of the process, so editing policy no longer appears to do nothing.

Removes listDeployments and its record type, which had no callers left.

Issue Number

n/a

Type of change

New, and Bug fix

How the change has been tested

• pnpm --filter registry test — 28 passed across 5 suites, including the new PlatformManagementService.spec.ts.
• pnpm --filter ppa test — 22 passed. The scoring tests still hold with fifteen dimensions; the fixture that used deployment-assurance as a weak row now uses code-review.
• pnpm --filter ppa check and build — 0 errors, 0 warnings.
• Verified against the running app: the assessment drawer shows Framework v3 with fifteen dimensions and no deployment row.

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 173a7313-6fee-4da6-8c07-d9e63458dad0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}