Document observability and runtime permissions

Author: Vanderhell

CHANGELOG.md

@@ -12,6 +12,8 @@ This project follows [Semantic Versioning](https://semver.org/): incompatible pu
 - Typed jobs, durable retry and idempotent enqueue.
 - Durable schedules, static workflow DAGs, management, recovery, leases, and fencing.
 - Simplified managed API, SQL migration modes, and .NET Framework 4.7.2/WPF consumer support.
+- Dashboard and storage-neutral observability management API, including queue health, execution filters, stable management keys, worker heartbeat diagnostics, and SQL parity smoke tests.
+- Restricted Windows runtime-identity smoke test for `ValidateOnly` SQL deployments.
 
 ### Changed
 

docs/management-monitoring.md

@@ -48,3 +48,5 @@ dotnet run --project BasaltDashboard -- --sql "<connection string>"
 The dashboard shows overview queue cards, executions, failed/dead/retrying work, schedules, workflows, observed workers, and cumulative statistics. The executions view has a state filter and selected-execution lifecycle/ledger detail. Its selected execution and schedule controls call the same public `Cancel`, `Requeue`, `PauseSchedule`, `ResumeSchedule`, and `RemoveSchedule` methods available to an application. It does not start workers or modify provider configuration.
 
 `sql-observability-smoke` is a manual SQL parity check. It creates an isolated database named `BasaltObservabilitySmoke_*` and removes it in `finally`, including after a failed assertion.
+
+`tests/BasaltPermissionSmoke` separately verifies the restricted SQL runtime model under a real Windows identity. It creates its Basalt schema with a migration identity, opens it as `ValidateOnly` from the runtime process, and confirms that the runtime can manage Basalt work but cannot modify a foreign `dbo` table.

docs/sql-server.md

@@ -38,6 +38,12 @@ GRANT UPDATE
 
 Use `ValidateOnly` for this runtime identity. Do not grant it schema ownership, `ALTER`, `CONTROL`, or rights on unrelated application schemas unless the application independently requires them.
 
+### Restricted runtime verification
+
+`tests/BasaltPermissionSmoke` is a manual Windows-authentication verification for this model. Its `--migrate` mode must run under the migration identity; it creates a dedicated Basalt schema and grants only the permissions above to the runtime identity. Run the normal mode in a process started as that runtime Windows account. It verifies typed idempotent enqueue, retry, claim/completion, management reads, `ValidateOnly`, health, and denial of an attempted update to a foreign `dbo` sentinel table. Run `--cleanup` under the migration identity afterwards; it removes the dedicated schema and sentinel.
+
+The smoke does not require SQL authentication and never grants DDL rights to the runtime identity.
+
 ## Connections and workers
 
 Basalt creates, opens, and disposes its own SQL connections. Supply either a connection string or a factory returning a fresh `Microsoft.Data.SqlClient.SqlConnection`: