docs: record migration head 0021 (SSO) in production, TLS via NPM, Caddy removed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/AI_PROJECT_STATE.md

@@ -440,7 +440,7 @@ allowlist and the fiscal rule engines still decide what may actually be written
 Hub `classification_cache` fixed: fingerprint (tenant + input + ENGINE_VERSION + dataset_versions()) is computed first and a HIT returns without running the Classifier (test: `central/tests/test_classification_cache.py`). Live benchmark (100 products): MISS 337 ms/product, HIT 15 ms/product, 100/100 hits, identical results. Fingerprint inputs unchanged, so existing cache entries stay valid and version bumps still invalidate naturally.
 
 ## Release Candidate 1.0.0-rc1 (2026-09-19) — COMPLETE_LOCAL_RC
-Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations; head `0020_not_null_timestamps` since 2026-09-23). See `docs/RELEASE_CANDIDATE_V1.md`.
+Frozen: `release/VERSION`, `central/app/version.py` (`GET /version`), `release/RELEASE_MANIFEST.json` (versions + ACTIVE dataset hashes + migrations; head `0021_sso_federated_identity` since 2026-09-23). See `docs/RELEASE_CANDIDATE_V1.md`.
 Architecture: Hub central (Docker Hub+PostgreSQL, `deploy/hub`) <-HTTPS- Agent Windows (`deploy/agent-windows`, service GTIFiscalAgent) -local read-only-> SGV Firebird. The Hub never accesses Firebird.
 Agent: `FISCAL_MODE` DRY_RUN|AUTO_APPLY (DRY_RUN = technically no writes), `COMPANY_CODE/COMPANY_CNPJ/COMPANY_CRT_SOURCE(AUTO|EMISSOR|C000004)`, `COMPANY_UF` explicit override only; single preflight `agent/scripts/preflight.py` (also enforced at service start); REPROCESS_ALL job result includes the coverage report + company context (`gti_fiscal_agent/coverage.py`, shared with multi-db tooling); `scripts/prove_zero_write.py` (DML counters + table digests). Packaging: `scripts/build_agent_package.py` (secret-scanned zip). Hub prod: `deploy/hub/docker-compose.prod.yml` (Postgres internal only), backup/restore, dataset seed export/import; `APP_ENV=production` refuses AGENT_DEV_TOKEN.
 Pilot profile: CONSTRUCAO (`pilot-construcao.env.example`); planned, not installed: MMMODAS/RINCAO/UNIAO with `COMPANY_CRT_SOURCE=EMISSOR`. No real host was accessed: a local simulation ran the Agent (registered agent, DRY_RUN) end-to-end on the CONSTRUCAO copy. Follow-up: memoize `dataset_versions()`.
@@ -481,8 +481,13 @@ See `docs/PRE_AI_LOCAL_COMPLETION_V3_REPORT.md` for measured values.
 
 - Hub + PostgreSQL run on VM 10.0.10.117 (`deploy/hub`, compose project
   `gti-fiscal-hub`), next to the GTI Gerenciador but isolated (own DB, process,
-  login). TLS via Caddy on 443 only; HTTPS still waits on public DNS.
-- Migration head: `0020_not_null_timestamps`. An empty database is initialized
+  login). Public HTTPS `gtifiscal.gtigrupo.com.br` via the GTI Nginx Proxy Manager
+  (10.0.10.100) -> `http://10.0.10.117:8000` (DOCKER-USER allows only the NPM).
+- Human access: SSO from GTI Gerenciador (Ed25519 assertion, nonce, single-use jti;
+  collaborators in `admin_users` with `auth_source=GTI_GERENCIADOR`, no password);
+  local admin only as break-glass at `/login/local`. Same visual identity as the
+  panel (`static/gti-theme.css` is a copy of its design system).
+- Migration head: `0021_sso_federated_identity`. An empty database is initialized
   by `alembic upgrade head` alone — never `stamp`/`create_all`.
 - `0001` is a frozen explicit baseline (it used to call `create_all()`, which
   broke every fresh install). `0019` fixes the frozen `created_at` defaults

docs/PILOT_DEPLOYMENT.md

@@ -132,7 +132,8 @@ Agents with `central/scripts/register_agent.py` (see below).
   keep that frozen value — their real creation time is not recoverable).
 - `0020` enforces NOT NULL on 20 timestamp columns that always had
   `DEFAULT now()`. It aborts, changing nothing, if any NULL exists — clean
-  those rows explicitly first. Current head: `0020_not_null_timestamps`
+  those rows explicitly first. `0021` adds the SSO federated identity (see "Human access"). Current head:
+  `0021_sso_federated_identity`
   (also recorded in `release/RELEASE_MANIFEST.json`).
 
 ### HTTPS / reverse proxy

docs/RELEASE_CANDIDATE_V1.md

@@ -19,7 +19,7 @@ The Hub never accesses Firebird and never stores Firebird credentials or paths.
 | GTI_FISCAL_VERSION (Hub, Agent, packages) | 1.0.0-rc1 (`release/VERSION`, `central/app/version.py`, `GET /version`) |
 | fiscal engine (`ENGINE_VERSION`) / decision (`DECISION_VERSION`) | 0.3.0 / mission-04c-ipi-ex-split (unchanged: no fiscal semantics touched) |
 | decision engines | fiscal-decision-v1, product-defaults-v1, icms-context-v1 |
-| migrations | 0001..0020 (head `0020_not_null_timestamps`, applied in production 2026-09-23; a fresh database is initialized by `alembic upgrade head` alone) |
+| migrations | 0001..0021 (head `0021_sso_federated_identity`, applied in production 2026-09-23; a fresh database is initialized by `alembic upgrade head` alone) |
 | datasets | 13 ACTIVE kinds with sha256/record_count in the manifest |
 
 ## What RC1 adds (no fiscal rule changes)

release/RELEASE_MANIFEST.json

@@ -17,10 +17,10 @@
   "ICMS_CONTEXT_ENGINE_VERSION": "icms-context-v1"
  },
  "migrations": {
-  "alembic_head_in_repo": "0020_not_null_timestamps",
-  "applied_revision": "0020_not_null_timestamps",
+  "alembic_head_in_repo": "0021_sso_federated_identity",
+  "applied_revision": "0021_sso_federated_identity",
   "applied_revision_source": "production Hub 10.0.10.117 (gti-fiscal-hub-fiscal-hub-1), verified 2026-09-23",
-  "count": 20
+  "count": 21
  },
  "datasets_active": [
   {