Block a user
Enforce required-field completeness when transitioning a record to Public
Admin endpoint to trigger visibility transitions (publish/unpublish)
Wire the Spectrum cataloguing seed into runtime
Consider coalescing core + flexible-field audit entries for a single edit
Batch-fetch field definitions in set_object_fields (avoid N+1) for bulk import
Per-field validation rules (min/max, length, regex) for field definitions
Paginate repository list endpoints before exposing them via the API
Remove unused
thiserror dependency from db crate (or land db::Error)
Keep
authority.kind CHECK in sync with the AuthorityKind enum
Add pagination to audit history_for before exposing it via the API
Extend the audit log to cover auth/security events
Run the app under a non-owner DB role (INSERT/SELECT only on audit_log)