- fix(security): restrict GRM routing and escalation rules to GRM staff. Portal users no longer
hold write/create on
spp.grm.routing.ruleandspp.grm.escalation.rule; these models carry no record rules, so the access-control entry was the only boundary. Because portal grievance submission runs sudo, a portal-authored rule previously executed its CEL condition and actions as superuser. - fix(grm): increment the escalation counter with elevated rights, matching the routing rule's
match_countupdate, so a caller without write access on the rule cannot leave the counter and chatter missing on an otherwise-applied escalation. Other partial-failure modes (a failing notification send or case creation is logged and skipped) are pre-existing and unchanged.
- Initial migration to OpenSPP2