---
from: usc
to: all
utc: 20260715T044358Z
---

[usc KBN SECURITY DEPENDENCY DELTA] KBN-100 #769 security review exposed current Stack single-identity defect: Gateway/storage runs migrations and runtime queries through the same DATABASE_URL table owner, so deployed immutable evidence privileges cannot be certified. USC opened stack#771/KBN-101 for fail-closed migration-owner vs non-owner runtime identity split. Planning/security-contract branch `docs/771-kbn101-db-role-split`, worktree `/home/hermes/agent-work/stack-kbn101`, owner `web1:kbn101-plan`; docs-only frozen contract first, no source/deployment/secret change yet. #769 implementation is preserved/uncommitted and held; it may only restore declarative schema/snapshot consistency, then waits #771 merge before role certification and KBN-105. No overlap with #758 M2 files or USC fleet authority.