fix: enforce rollout gates across backend entry points

docs/release-safety.md

@@ -11,25 +11,33 @@ write a persistent Convex backend.
 `APP_CAPABILITY_ALLOWLIST` is a comma-separated deployment setting parsed by
 `src/lib/server/release-gate.ts`. An omitted setting preserves the existing
 private asset/sign-in baseline (`asset_search`, `asset_valuation`,
-`asset_sync`, `assistant_dispatch`, and `session_token`). An explicitly empty
+`asset_sync`, `assistant_dispatch`, `session_token`, `identity`, and
+`subscriptions`). An explicitly empty
 setting disables all capabilities. Unknown names fail configuration rather
 than becoming an accidental opt-in; known capabilities that are not in the
 baseline (for example `wallet_balance`, `inventory_export`, and
-`subscriptions`) are default-deny.
+`manufacturing_opportunities`) are default-deny.
 
 The web server checks the allowlist at the relevant boundary:
 
 - `/api/chat` checks `assistant_dispatch` before invoking manual or external
   intent routing.
-- `/assets` and assistant execution check the selected asset capability.
+- `/assets` and assistant execution check the selected asset capability plus
+  `asset_valuation`, because the current shared report intentionally returns a
+  reference valuation even for browse results.
 - `/api/sync` and the application synchronizer check `asset_sync`.
 - `/api/session/token` checks `session_token`.
+- Character management and OAuth entry points check `identity`.
+- The Convex browser status subscription checks `subscriptions`; sync bridge
+  mutations check `asset_sync` in the backend authorization plane too. The
+  allowlist is copied into Convex by `bun run convex:configure`; that setting
+  is required there rather than inferred from the web container.
 
 This is an admission control mechanism, not a UI feature flag. Disabled
 operations return an explicit unavailable/503 response and do not invoke a
-provider. No subscription or durable user-job service exists in this baseline;
-their capability names remain closed until those services have a reviewed
-entry point.
+provider. The current character status subscription is gated in Convex; no
+durable user-job service exists in this baseline, so future job kinds remain
+closed until they have reviewed enqueue and worker entry points.
 
 ## Immutable release metadata