# Apollo administrator access and Git resolution

Owner request, 2026-09-07: every organization administrator may use Apollo for their licence;
development projects and AI project maintenance remain Superuser-only. The Sibyla new-session
page also failed in IIS because `git` could not be found.

## Implementation

- AI routes and navigation accept organization administrators. Database RLS grants them only
  the licence-scoped `apollo`/`HERMES` project and their owner's conversations, messages and
  executions. Project definitions and profile assignments remain read-only for administrators.
- `app.organization_admin` is derived from the resolved server-side role and reset locally on
  every transaction; administrators are never promoted to `app.superuser`.
- Execution, resume, archive, cancellation, subscriptions and live-execution lookup retain
  database authorization. Apollo listings use the selected licence, including for Superusers.
- Existing per-licence Hermes profile provisioning remains required. An unconfigured licence
  fails closed; it never falls back to another licence's profile.
- `AiHarness:GitExecutablePath` supplies an explicit native executable for repository inspection
  and worktree creation/removal. The shared resolver now handles the empty directory name .NET
  returns for bare commands, allowing PATH lookup to work. The configured installation is
  `C:\Users\Administrator\AppData\Local\hermes\git\cmd\git.exe`; its ACL already grants
  `IIS AppPool\Sibyla.Web` read/execute access.

## Verification and rollout

215 relevant tests passed: Browser 137, TenantIsolation 58, and workspace/process/Hermes 20.
After narrowing licence-scoped listings, the 17 affected lifecycle/render tests passed again.
Tests include a simulated Hermes turn and native resume as a non-Superuser administrator,
denial of development and other-owner sessions, and real Git inspect/create/remove with no Git
on the child PATH. These do not claim an authenticated production-browser acceptance.

Migration `20260907130722_ApolloAdministratorAccess` is applied to Main and Preview. Its final
`aicnvp` policy was also readjusted on both databases during verification to qualify the outer
project column. The application changes require the next web release. No IIS release activation,
service restart or Hermes profile provisioning was performed by this task.