feat(network): implement peer discovery features and UI integration

Added functionality for peer discovery, including new API endpoints for listing, approving, and rejecting discovered peers. Updated the network queries and settings to support peer discovery configurations. Enhanced the UI to display discovered peers and integrated related settings in the tenant settings component. Updated OpenAPI documentation to reflect the new endpoints and parameters. This improves the network management capabilities by allowing dynamic peer discovery and management.

.agents/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.agents/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.agents/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.claude/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.claude/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.claude/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.codegraph/daemon.pid

@@ -1,6 +0,0 @@
-{
-  "pid": 51184,
-  "version": "0.9.9",
-  "socketPath": "\\\\.\\pipe\\codegraph-97b92efdcc5351da",
-  "startedAt": 1784215907952
-}

.cursor/mcp.json.example

@@ -11,9 +11,9 @@
       ]
     },
     "reui": {
-      "url": "https://mcp.reui.io/api/mcp?style=base-nova",
+      "url": "https://mcp.reui.io",
       "headers": {
-        "X-Reui-Style": "base-nova"
+        "Authorization": "Bearer <REUI_LICENSE_KEY>"
       }
     }
   }

.cursor/rules/kpi-hybrid.mdc

@@ -0,0 +1,29 @@
+---
+description: Только hybrid KPI — KpiStatGrid / row tile DNA (stats-12). Запрет SectionCards и hand-roll.
+alwaysApply: true
+---
+
+# KPI hybrid — только kit (stats-12 DNA)
+
+Preview: [stats-12](https://reui.io/preview/base/stats-12). SoT DNA = EvoBGP. Markup в проекте: `apps/web/src/components/reui-kit/kpi-stat-grid.tsx`.
+
+Связанные: [`reui-mcp.mdc`](reui-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc).
+
+## MUST
+
+| Зона | Компонент / DNA |
+|------|-----------------|
+| KPI-полосы / dashboard metrics | только `reui-kit/KpiStatGrid` (через `OpsDashboard` / `DetailPanel.Metrics` при наличии) |
+| Markup | horizontal compact hybrid: icon left `Item` `size-10.5` `bg-muted` + `border-background` + shadow + `ItemMedia` + label/Badge + value ± `variant` |
+| Row icon tiles (data-grid) | та же DNA — semantic `text-*` на `bg-muted` |
+| Quick Actions | только `reui-kit/QuickActionGrid` (sibling hybrid DNA) |
+
+Импорты UI: `@evobgp/ui/components/*`.
+
+## NEVER
+
+- SectionCards / vertical-only KPI / hand-roll Frame/Card KPI
+- Другой size / radius / solid brand fill вместо `bg-muted`
+- `card-35` как замена stats-12 hybrid KPI
+- Копипаст ReUI block в route — adapt через `reui-kit/`
+- Голый lucide `size-4` в name-cell без hybrid tile

.cursor/rules/reui-mcp.mdc

@@ -0,0 +1,111 @@
+---
+description: ReUI PRO (@reui) — MCP user-reui, Frame surface, kit, license, матрица выбора
+alwaysApply: true
+---
+
+# ReUI MCP — обязательно (PRO + free)
+
+Проект: **Base UI** (`style: base-nova`), surface lock **`frame`**.
+
+Связанные: [`shadcn-mcp.mdc`](shadcn-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`docs/ui-design-contract.md`](docs/ui-design-contract.md).
+
+| Документ | URL |
+|----------|-----|
+| **llms.txt** | https://reui.io/llms.txt |
+| **Get Started** | https://reui.io/docs/get-started |
+| **Styling** | https://reui.io/docs/styling |
+| **MCP** | https://reui.io/docs/mcp |
+| **Blocks** | https://reui.io/blocks |
+| **Settings blocks** | https://reui.io/blocks/application/settings |
+| **License** | https://reui.io/docs/license-setup |
+| **Base UI components** | https://reui.io/docs/components/base/<name> |
+
+## Primary MCP
+
+1. **`user-reui`** — `search` / `compose_page` / `get_block` / `get_component` / `get_install_command` / `validate_usage` / `get_audit_checklist`
+2. **`plugin-shadcn-shadcn`** — primitives `@shadcn`; для `@reui` — вторично
+
+**Обязательно** цитировать `previewUrl` + `docsUrl` для каждой UI-зоны.
+
+## Когда ReUI vs shadcn
+
+| Задача | Registry | Импорт |
+|--------|----------|--------|
+| Button, Sheet, Field, Sidebar, Tabs | `@shadcn` | `@evobgp/ui/components/*` |
+| PRO pages/sections (settings, stats, auth, dashboard) | `@reui` blocks | adapt → `apps/web/src/components/` / `reui-kit/` |
+| Data Grid | `@reui` | `@/components/reui/data-grid/*` → `ResourcePage` |
+| Filters | `@reui` | `@/components/reui/filters` |
+| Frame surface | `@reui` | `@/components/reui/frame` |
+| KPI | block [stats-12](https://reui.io/preview/base/stats-12) | `reui-kit/KpiStatGrid` — см. [`kpi-hybrid.mdc`](kpi-hybrid.mdc) |
+| Quick Actions | Frame tiles sibling KPI | `reui-kit/QuickActionGrid` |
+| Semantic badge / alert | `@reui` | `@/components/reui/badge`, `@/components/reui/alert` |
+| Number / date / autocomplete / color / kanban | `@reui` | `@/components/reui/*` |
+
+**Сложные списки** — `ResourcePage` (Frame + data-grid + filters), не raw `<table>`, не DataGridCard.  
+**Quick Actions** — только `QuickActionGrid` (не Card / Button grid).
+
+## MCP workflow
+
+0. Codegraph / поиск существующих `reui-kit/*`, `@/components/reui/*`
+1. `user-reui` `search` (`surface: "frame"`, `category` при известном)
+2. Страница целиком → `compose_page`; секция → `get_block`
+3. `get_component` для API primitives из `componentsUsed`
+4. CLI из `apps/web`: `pnpm dlx shadcn@latest add @reui/<name> --yes`
+5. Post-add: shadcn imports → `@evobgp/ui/components/*`
+6. Adapt by reuse → kit / route
+7. `validate_usage` + `get_audit_checklist`
+
+## Размещение
+
+| Слой | Путь | Импорт |
+|------|------|--------|
+| shadcn | `packages/ui/src/components/` | `@evobgp/ui/components/*` |
+| ReUI CLI | `apps/web/src/components/reui/` | `@/components/reui/*` |
+| PRO blocks (reference) | `apps/web/src/components/blocks/` | adapt into kit, не копипаст в routes |
+| Kit | `apps/web/src/components/reui-kit/` | `@/components/reui-kit/*` |
+
+## Установленные ReUI (apps/web)
+
+**Components:** `frame`, `data-grid/*`, `filters`, `kanban`, `badge`, `alert`, `autocomplete`, `number-field`, `date-selector`, `color-picker`, `timeline`, `rating`, `phone-input`, `icon-stack`
+
+**Kit:** `ResourcePage`, `KpiStatGrid`, `QuickActionGrid`, `OpsDashboard`, `KanbanBoard`, `DetailPanel`, `SettingsShell`
+
+**Blocks (reference):** `stats-12`, `card-35`, `auth-13`, `app-shell-12`, `settings-16`, `settings-8`, `empty-state-12`, `form-7`, `data-grid-filtering-2`, `dashboard-1`, …
+
+## License
+
+```env
+# .env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
+
+## Эталоны preview
+
+| Зона | Preview |
+|------|---------|
+| KPI / Quick Actions | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
+| List | https://reui.io/preview/base/data-grid-filtering-2 |
+| Settings | https://reui.io/preview/base/settings-16 |
+| Auth | https://reui.io/preview/base/auth-13 |
+| Shell | https://reui.io/preview/base/app-shell-12 |
+| Empty | https://reui.io/preview/base/empty-state-12 |
+
+## Запрещено
+
+- Копипаст с reui.io без CLI
+- ReUI в `packages/ui` / импорт как `@evobgp/ui`
+- Radix-варианты docs — только Base UI
+- Raw `bg-emerald-*` вместо ReUI `variant`
+- Hand-roll data-grid/filters/KPI/Quick Actions/settings rows при наличии `@reui` / kit
+- Смешивать Card и Frame на ops-экране
+- Ставить shadcn/ui blocks выше ReUI PRO
+
+## Чеклист
+
+- [ ] `user-reui` search/get_block + previewUrl
+- [ ] `surface: frame`
+- [ ] CLI add из `apps/web` при новом item
+- [ ] Kit / `@/components/reui` / `@evobgp/ui` — правильный слой
+- [ ] `pnpm --filter @evobgp/web run build`

.cursor/rules/reui.mdc

@@ -11,7 +11,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/rules/web-shadcn.mdc

@@ -9,12 +9,12 @@ alwaysApply: false
 # Web UI — React + shadcn/ui + ReUI
 
 **Источники правды:**
+- **ReUI PRO first:** MCP `user-reui` ([`reui-mcp.mdc`](reui-mcp.mdc)) — pages / KPI / lists / settings / shell
+- shadcn primitives: MCP `plugin-shadcn-shadcn` (secondary)
+- ReUI Base UI: https://reui.io/docs/components/base/<name> · [llms.txt](https://reui.io/llms.txt)
 - shadcn/ui React: https://ui.shadcn.com/docs/components
-- ReUI Base UI: https://reui.io/docs/components/base/<name>
-- ReUI llms.txt: https://reui.io/llms.txt
-- MCP `plugin-shadcn-shadcn` (registries: `@shadcn`, `@reui`) — перед любой UI-задачей
 
-Общие правила Go/API: `.cursor/rules/engineering.mdc`. Стек ID: `.cursor/rules/context7-stack.mdc`.
+Иерархия: **ReUI PRO > shadcn**. Общие: `.cursor/rules/engineering.mdc`, `context7-stack.mdc`.
 
 ## Слои UI
 
@@ -23,18 +23,18 @@ alwaysApply: false
 | shadcn-примитивы | `packages/ui/src/components/` | output `shadcn add` (не трогать под кейс) |
 | ReUI enterprise | `apps/web/src/components/reui/` | output `shadcn add @reui/*` |
 | Shared обёртки | `apps/web/src/components/` | PageHeader, QueryState, ConfirmDialog, StatusBadge, LoadingButton |
-| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, OpsDashboard, SettingsShell |
+| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, QuickActionGrid, OpsDashboard, SettingsShell |
 | Роуты | `apps/web/src/routes/` | TanStack Router (file-based) |
 
-**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2).
+**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI hybrid SoT: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2). Quick Actions: `QuickActionGrid`.
 
 Тема: `packages/ui/src/styles/globals.css`. CLI из `apps/web`: `pnpm dlx shadcn@latest add <component>`.
 
 ## Правила
 
-**WEB-01** | MUST | Перед новым UI — MCP `plugin-shadcn-shadcn`: `search_items_in_registries` → `get_item_examples_from_registries` → `get_add_command_for_items`. Только после — JSX.
-*Rationale:* единый источник правды и API.
-*Проверка:* review; нет самописных примитивов, если есть registry item.
+**WEB-01** | MUST | Перед новым UI — сначала MCP **`user-reui`** (`search` → `get_block` / `compose_page`, `surface: "frame"`) + cite `previewUrl`/`docsUrl`. Primitives — MCP `plugin-shadcn-shadcn`. Только после — JSX.
+*Rationale:* ReUI PRO выше shadcn; единый Frame surface.
+*Проверка:* review; [`reui-mcp.mdc`](reui-mcp.mdc).
 
 **WEB-02** | MUST | Отсутствующий shadcn-примитив — `pnpm dlx shadcn@latest add <component>` (из `apps/web`). ReUI — `pnpm dlx shadcn@latest add @reui/<name>`.
 *Проверка:* файлы в `packages/ui/src/components/` (для shadcn) или `apps/web/src/components/reui/` (для ReUI).
@@ -73,7 +73,7 @@ alwaysApply: false
 
 **WEB-14** | SHOULD | Нетривиальный UI — прочитать страницу компонента shadcn/ReUI (props, a11y).
 
-**WEB-15** | MUST | Сомнения — MCP `plugin-shadcn-shadcn` + shadcn CLI docs + `pnpm --filter @evobgp/web run typecheck`.
+**WEB-15** | MUST | Сомнения — MCP `user-reui` + `plugin-shadcn-shadcn` + docs + `pnpm --filter @evobgp/web run typecheck`.
 
 **WEB-16** | MUST | Подтверждение удаления — `ConfirmDialog` из `@/components/confirm-dialog`, не `window.confirm`.
 

.cursor/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.cursor/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.gitignore

@@ -28,3 +28,7 @@ Thumbs.db
 
 # Compose runtime log sidecar output (deploy/compose/runtime-logs)
 deploy/compose/runtime-logs/
+# Local MCP configs (may contain REUI license Bearer)
+.cursor/mcp.json
+.mcp.json
+.codegraph/daemon.pid

.mcp.json

@@ -1,16 +0,0 @@
-{
-  "mcpServers": {
-    "codegraph": {
-      "type": "stdio",
-      "command": "codegraph",
-      "args": [
-        "serve",
-        "--mcp"
-      ]
-    },
-    "reui": {
-      "type": "http",
-      "url": "https://mcp.reui.io/api/mcp"
-    }
-  }
-}

.opencode/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.opencode/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.opencode/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

apps/web/src/components/layout/app-shell.tsx

@@ -46,7 +46,6 @@ import { AppsMenu } from '@/components/layout/apps-menu'
 import { CommandPalette, type CommandPaletteItem } from '@/components/layout/command-palette'
 import { NavUser } from '@/components/layout/nav-user'
 import { SystemMonitorPopover } from '@/components/layout/system-monitor-popover'
-import { ModeToggle } from '@/components/mode-toggle'
 import { can, isAuthEnabled, permissionForPath } from '@/lib/auth'
 
 interface NavItem {
@@ -219,7 +218,6 @@ export function AppShell({ children }: { children: ReactNode }) {
             <div className="ml-auto flex items-center gap-2">
               <AppsMenu />
               <SystemMonitorPopover />
-              <ModeToggle />
             </div>
           </header>
           <main className="flex flex-1 flex-col gap-4 px-4 py-4 md:gap-6 md:px-6 md:py-5">

apps/web/src/components/layout/nav-user.tsx

@@ -1,12 +1,20 @@
 import { Link } from '@tanstack/react-router'
+import { useEffect, useState } from 'react'
+import { useTheme } from 'next-themes'
 import {
   ChevronsUpDownIcon,
   ExternalLinkIcon,
   LogOutIcon,
+  MonitorIcon,
+  MoonIcon,
+  PaletteIcon,
   SettingsIcon,
+  SunIcon,
 } from 'lucide-react'
 
+import { cn } from '@evobgp/ui/lib/utils'
 import { Avatar, AvatarFallback } from '@evobgp/ui/components/avatar'
+import { Button } from '@evobgp/ui/components/button'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -33,12 +41,71 @@ import {
   resetPortalHandoff,
 } from '@/lib/auth'
 
-/**
- * Sidebar footer account menu.
- * Portal mode → shows JWT email + logout via auth-portal.
- * Local mode  → shows the API-key hint + clears the local token.
- * @see https://reui.io/preview/base/app-shell-12
- */
+/** Sidebar footer account menu — ReUI app-shell-1 NavUser. @see https://reui.io/preview/base/app-shell-1 */
+
+const THEMES = [
+  {
+    value: 'light',
+    label: 'Светлая',
+    icon: <SunIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'dark',
+    label: 'Тёмная',
+    icon: <MoonIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'system',
+    label: 'Системная',
+    icon: <MonitorIcon className="size-3.5" aria-hidden />,
+  },
+] as const
+
+function ThemeSegmentedToggle() {
+  const { theme, setTheme } = useTheme()
+  const [mounted, setMounted] = useState(false)
+
+  useEffect(() => {
+    setMounted(true)
+  }, [])
+
+  const currentTheme = mounted ? (theme ?? 'system') : 'system'
+
+  return (
+    <div
+      role="radiogroup"
+      aria-label="Тема"
+      className="bg-muted/60 inline-flex items-center gap-0.5 rounded-full p-0.5"
+      onClick={(e) => e.stopPropagation()}
+      onPointerDown={(e) => e.stopPropagation()}
+    >
+      {THEMES.map(({ value, label, icon }) => {
+        const isActive = currentTheme === value
+        return (
+          <Button
+            key={value}
+            type="button"
+            role="radio"
+            aria-checked={isActive}
+            aria-label={label}
+            variant="ghost"
+            size="icon-xs"
+            onClick={() => setTheme(value)}
+            className={cn(
+              'rounded-full',
+              isActive
+                ? 'bg-background text-foreground shadow-sm'
+                : 'text-muted-foreground hover:text-foreground',
+            )}
+          >
+            {icon}
+          </Button>
+        )
+      })}
+    </div>
+  )
+}
+
 function initials(source: string): string {
   const base = source.trim()
   if (!base) return '?'
@@ -56,8 +123,7 @@ export function NavUser() {
 
   const name = claims?.name?.trim() || (authOn ? 'Пользователь' : 'Гость')
   const email =
-    claims?.email?.trim() ||
-    (authOn ? '' : 'локальный API-токен')
+    claims?.email?.trim() || (authOn ? '' : 'локальный API-токен')
   const fallback = initials(name || email)
 
   function handleSignOut() {
@@ -87,9 +153,7 @@ export function NavUser() {
             }
           >
             <Avatar className="size-8 rounded-lg">
-              <AvatarFallback className="rounded-lg text-xs">
-                {fallback}
-              </AvatarFallback>
+              <AvatarFallback className="rounded-lg text-xs">{fallback}</AvatarFallback>
             </Avatar>
             <div className="grid flex-1 text-left text-sm leading-tight">
               <span className="truncate font-semibold">{name}</span>
@@ -140,6 +204,13 @@ export function NavUser() {
                   Открыть Auth Portal
                 </DropdownMenuItem>
               ) : null}
+              <DropdownMenuItem className="cursor-default focus:bg-transparent">
+                <PaletteIcon aria-hidden />
+                Тема
+                <div className="ml-auto">
+                  <ThemeSegmentedToggle />
+                </div>
+              </DropdownMenuItem>
             </DropdownMenuGroup>
 
             <DropdownMenuSeparator />

apps/web/src/components/mode-toggle.tsx

@@ -1,29 +0,0 @@
-import { Moon, Sun } from 'lucide-react'
-import { useTheme } from 'next-themes'
-
-import { Button } from '@evobgp/ui/components/button'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@evobgp/ui/components/dropdown-menu'
-
-export function ModeToggle() {
-  const { setTheme } = useTheme()
-
-  return (
-    <DropdownMenu>
-      <DropdownMenuTrigger render={<Button variant="ghost" size="icon" />}>
-        <Sun className="size-5 scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" />
-        <Moon className="absolute size-5 scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" />
-        <span className="sr-only">Сменить тему</span>
-      </DropdownMenuTrigger>
-      <DropdownMenuContent align="end">
-        <DropdownMenuItem onClick={() => setTheme('light')}>Светлая</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('dark')}>Тёмная</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('system')}>Системная</DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}

apps/web/src/components/network/network-discovered-peers-card.tsx

@@ -0,0 +1,274 @@
+import { useMemo, useState } from 'react'
+import type { ColumnDef } from '@tanstack/react-table'
+import { CheckIcon, SearchIcon, XIcon } from 'lucide-react'
+
+import { Button } from '@evobgp/ui/components/button'
+import { Input } from '@evobgp/ui/components/input'
+import { Label } from '@evobgp/ui/components/label'
+
+import { ConfirmDialog } from '@/components/confirm-dialog'
+import { DataGridPrimaryCell } from '@/components/data-grid-cell'
+import { FormDrawer } from '@/components/form-drawer'
+import { LoadingButton } from '@/components/loading-button'
+import { SelectField } from '@/components/select-field'
+import { StatusBadge } from '@/components/status-badge'
+import { DataGridColumnHeader } from '@/components/reui/data-grid/data-grid-column-header'
+import {
+  createFilter,
+  type Filter,
+  type FilterFieldConfig,
+} from '@/components/reui/filters'
+import { ResourcePage } from '@/components/reui-kit'
+import { bgpSessionStateRu } from '@/lib/ui-labels'
+import {
+  useApproveDiscoveredPeerMutation,
+  useRejectDiscoveredPeerMutation,
+} from '@/queries/network'
+import type { PeerDiscoveryRow, SpeakerRow } from '@/types/api'
+
+/**
+ * Pending BGP peer discoveries — approve / reject.
+ * @see https://reui.io/preview/base/data-grid-filtering-2
+ * @see https://reui.io/preview/base/components/c-empty-1
+ */
+
+function speakerLabel(s: SpeakerRow): string {
+  if (s.role === 'master') {
+    const host = s.agent_domain ?? s.endpoint
+    return host ? `CP · ${host}` : 'CP (master)'
+  }
+  return s.agent_domain ?? s.endpoint ?? `${s.id.slice(0, 8)}…`
+}
+
+function createDefaultFilters(): Filter[] {
+  return [createFilter('neighbor', 'contains', [''])]
+}
+
+const filterFields: FilterFieldConfig[] = [
+  {
+    key: 'neighbor',
+    label: 'Сосед',
+    icon: <SearchIcon className="size-3.5" aria-hidden />,
+    type: 'text',
+    className: 'w-48',
+    placeholder: 'IP или Neighbor ID…',
+  },
+]
+
+interface NetworkDiscoveredPeersCardProps {
+  items: PeerDiscoveryRow[]
+  speakers: SpeakerRow[]
+  isLoading: boolean
+  isError: boolean
+  error: unknown
+  onRetry: () => void
+}
+
+export function NetworkDiscoveredPeersCard({
+  items,
+  speakers,
+  isLoading,
+  isError,
+  error,
+  onRetry,
+}: NetworkDiscoveredPeersCardProps) {
+  const approveMutation = useApproveDiscoveredPeerMutation()
+  const rejectMutation = useRejectDiscoveredPeerMutation()
+  const [filters, setFilters] = useState<Filter[]>(createDefaultFilters)
+  const [approveTarget, setApproveTarget] = useState<PeerDiscoveryRow | null>(null)
+  const [rejectTarget, setRejectTarget] = useState<PeerDiscoveryRow | null>(null)
+  const [name, setName] = useState('')
+  const [speakerId, setSpeakerId] = useState<string | null>(null)
+
+  const speakerItems = useMemo(
+    () => [
+      { value: '', label: 'Авто (с ноды обнаружения)' },
+      ...speakers.map((s) => ({ value: s.id, label: speakerLabel(s) })),
+    ],
+    [speakers],
+  )
+
+  const columns = useMemo<ColumnDef<PeerDiscoveryRow, unknown>[]>(
+    () => [
+      {
+        id: 'neighbor_id',
+        accessorFn: (row) => row.neighbor_id || row.neighbor,
+        header: ({ column }) => (
+          <DataGridColumnHeader column={column} title="Neighbor ID" />
+        ),
+        cell: ({ row }) => (
+          <DataGridPrimaryCell
+            title={row.original.neighbor_id || '—'}
+            subtitle={row.original.neighbor}
+            accent="mono"
+          />
+        ),
+        meta: { headerTitle: 'Neighbor ID' },
+      },
+      {
+        accessorKey: 'remote_asn',
+        header: ({ column }) => <DataGridColumnHeader column={column} title="ASN" />,
+        cell: ({ row }) => (
+          <span className="font-mono text-xs">{row.original.remote_asn || '—'}</span>
+        ),
+        meta: { headerTitle: 'ASN' },
+      },
+      {
+        accessorKey: 'session_state',
+        header: ({ column }) => (
+          <DataGridColumnHeader column={column} title="Состояние" />
+        ),
+        cell: ({ row }) => (
+          <StatusBadge
+            status={row.original.session_state ?? '—'}
+            label={bgpSessionStateRu(row.original.session_state)}
+          />
+        ),
+        meta: { headerTitle: 'Состояние' },
+      },
+      {
+        id: 'actions',
+        enableSorting: false,
+        header: () => <span className="sr-only">Действия</span>,
+        cell: ({ row }) => (
+          <div className="flex items-center justify-end gap-1">
+            <Button
+              size="sm"
+              type="button"
+              variant="outline"
+              onClick={() => {
+                setApproveTarget(row.original)
+                setName('')
+                setSpeakerId(row.original.speaker_id ?? null)
+              }}
+            >
+              <CheckIcon />
+              Одобрить
+            </Button>
+            <Button
+              size="sm"
+              type="button"
+              variant="ghost"
+              onClick={() => setRejectTarget(row.original)}
+            >
+              <XIcon />
+              Отклонить
+            </Button>
+          </div>
+        ),
+      },
+    ],
+    [],
+  )
+
+  function getFilterFieldValue(item: PeerDiscoveryRow, field: string): unknown {
+    if (field === 'neighbor') {
+      return `${item.neighbor_id ?? ''} ${item.neighbor}`
+    }
+    return undefined
+  }
+
+  async function confirmApprove() {
+    if (!approveTarget) return
+    await approveMutation.mutateAsync({
+      id: approveTarget.id,
+      body: {
+        name: name.trim() || undefined,
+        bgp_speaker_id: speakerId || null,
+      },
+    })
+    setApproveTarget(null)
+  }
+
+  return (
+    <>
+      <ResourcePage
+        title="На одобрение"
+        description="Новые BGP-клиенты, подключившиеся к dynamic listener (карантин без export)"
+        filterFields={filterFields}
+        filters={filters}
+        onFiltersChange={setFilters}
+        onClearFilters={() => setFilters(createDefaultFilters())}
+        getFilterFieldValue={getFilterFieldValue}
+        columns={columns}
+        data={items}
+        getRowId={(row) => row.id}
+        isLoading={isLoading}
+        isError={isError}
+        error={error instanceof Error ? error : null}
+        onRetry={onRetry}
+        emptyState={{
+          title: 'Нет ожидающих пиров',
+          description:
+            'Включите peer discovery в параметрах BIRD и задайте CIDR-диапазоны. Новые сессии появятся здесь.',
+        }}
+      />
+
+      <FormDrawer
+        open={!!approveTarget}
+        onOpenChange={(open) => {
+          if (!open) setApproveTarget(null)
+        }}
+        title="Одобрить пира"
+        description={
+          approveTarget
+            ? `Neighbor ID ${approveTarget.neighbor_id || '—'} · ${approveTarget.neighbor} AS${approveTarget.remote_asn ?? '?'}`
+            : undefined
+        }
+        className="sm:max-w-sm"
+        footer={
+          <>
+            <Button variant="outline" type="button" onClick={() => setApproveTarget(null)}>
+              Отмена
+            </Button>
+            <LoadingButton
+              type="button"
+              loading={approveMutation.isPending}
+              onClick={() => void confirmApprove()}
+            >
+              Одобрить
+            </LoadingButton>
+          </>
+        }
+      >
+        <div className="flex flex-col gap-2">
+          <Label htmlFor="disc-name">Имя (опционально)</Label>
+          <Input
+            id="disc-name"
+            value={name}
+            onChange={(e) => setName(e.target.value)}
+            placeholder="client-edge-1"
+          />
+        </div>
+        <SelectField
+          id="disc-speaker"
+          label="Спикер"
+          items={speakerItems}
+          value={speakerId ?? ''}
+          onValueChange={(v) => setSpeakerId(v || null)}
+          placeholder="Авто"
+        />
+      </FormDrawer>
+
+      <ConfirmDialog
+        open={!!rejectTarget}
+        onOpenChange={(open) => {
+          if (!open) setRejectTarget(null)
+        }}
+        title="Отклонить пира?"
+        description={
+          rejectTarget
+            ? `${rejectTarget.neighbor_id || rejectTarget.neighbor} больше не будет появляться в списке.`
+            : undefined
+        }
+        confirmLabel="Отклонить"
+        destructive
+        confirmLoading={rejectMutation.isPending}
+        onConfirm={() => {
+          if (!rejectTarget) return
+          void rejectMutation.mutateAsync(rejectTarget.id).then(() => setRejectTarget(null))
+        }}
+      />
+    </>
+  )
+}

apps/web/src/components/reui-kit/kpi-cols.ts

@@ -0,0 +1,10 @@
+/** Shared grid column classes for hybrid KPI / Quick Actions tiles. */
+export function kpiCols(count: number): string {
+  if (count <= 1) return 'grid-cols-1'
+  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
+  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
+  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
+  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
+  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
+  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
+}

apps/web/src/components/reui-kit/kpi-stat-grid.tsx

@@ -4,6 +4,7 @@ import { Link } from '@tanstack/react-router'
 import { Frame, FramePanel } from '@/components/reui/frame'
 import { Badge } from '@/components/reui/badge'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { Skeleton } from '@evobgp/ui/components/skeleton'
 
@@ -47,16 +48,6 @@ const VALUE_VARIANT_CLASS: Record<KpiStatVariant, string> = {
   destructive: 'text-destructive',
 }
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function handleCardKeyDown(onActivate: () => void, event: KeyboardEvent<HTMLDivElement>) {
   if (event.key === 'Enter' || event.key === ' ') {
     event.preventDefault()

apps/web/src/components/reui-kit/quick-action-grid.tsx

@@ -10,6 +10,7 @@ import {
 import { Badge } from '@/components/reui/badge'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 
 export interface QuickActionItem {
   id: string
@@ -30,16 +31,6 @@ interface QuickActionGridProps {
 
 const DEFAULT_ICON_CLASS = 'text-muted-foreground [&_svg]:text-current'
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function QuickActionBody({ action }: { action: QuickActionItem }) {
   return (
     <div className="relative z-10 flex h-full items-start gap-3">

apps/web/src/lib/auth.ts

@@ -259,6 +259,30 @@ export function can(required: string): boolean {
   return hasPermission(claims.permissions, required)
 }
 
+/**
+ * Whether /v1/auth/session may manage API keys (`bgp:access:admin`).
+ * Mirrors backend `requirePerm` for JWT (is_admin / permissions) and API-key operator.
+ */
+export function sessionCanManageApiKeys(session: {
+  role?: string
+  kind?: string
+  is_admin?: boolean
+  permissions?: readonly string[]
+} | null | undefined): boolean {
+  if (!session) return false
+  const jwtPath =
+    session.kind === 'jwt' ||
+    session.is_admin === true ||
+    (session.permissions?.length ?? 0) > 0
+  if (jwtPath) {
+    return (
+      session.is_admin === true ||
+      hasPermission(session.permissions ?? [], 'bgp:access:admin')
+    )
+  }
+  return session.role === 'operator'
+}
+
 /** Nav path → minimum permission to show the item. Sync with app-shell NAV. */
 export function permissionForPath(pathname: string): string | null {
   if (pathname === '/' || pathname.startsWith('/dashboard')) {

apps/web/src/queries/network.ts

@@ -8,6 +8,9 @@ import type {
   BgpSpeakerCreate,
   BgpSpeakerPatch,
   BirdStatus,
+  PeerDiscoveryApprove,
+  PeerDiscoveriesResponse,
+  PeerDiscoveryRow,
   PeerRow,
   PeersResponse,
   SpeakerRow,
@@ -19,6 +22,7 @@ export const NETWORK_AUTO_REFRESH_MS = 30_000
 export const networkKeys = {
   all: ['network'] as const,
   peers: () => [...networkKeys.all, 'peers'] as const,
+  discovered: () => [...networkKeys.all, 'discovered'] as const,
   speakers: () => [...networkKeys.all, 'speakers'] as const,
   bird: () => [...networkKeys.all, 'bird'] as const,
 }
@@ -31,6 +35,14 @@ export function networkPeersQueryOptions() {
   })
 }
 
+export function networkDiscoveredPeersQueryOptions() {
+  return queryOptions<PeerDiscoveriesResponse>({
+    queryKey: networkKeys.discovered(),
+    queryFn: () => apiJSON<PeerDiscoveriesResponse>('/v1/peers/discovered?status=pending'),
+    staleTime: 10_000,
+  })
+}
+
 export function networkSpeakersQueryOptions() {
   return queryOptions<SpeakersResponse>({
     queryKey: networkKeys.speakers(),
@@ -91,6 +103,39 @@ export function useDeletePeerMutation() {
   })
 }
 
+export function useApproveDiscoveredPeerMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: ({ id, body }: { id: string; body?: PeerDiscoveryApprove }) =>
+      apiMutate<{ peer: PeerRow; discovery: PeerDiscoveryRow }>(
+        `/v1/peers/discovered/${id}/approve`,
+        'POST',
+        body ?? {},
+        { idempotent: false },
+      ),
+    onSuccess: () => {
+      toast.success('Пир одобрен')
+      invalidateNetwork(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось одобрить пира'),
+  })
+}
+
+export function useRejectDiscoveredPeerMutation() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (id: string) =>
+      apiMutate<PeerDiscoveryRow>(`/v1/peers/discovered/${id}/reject`, 'POST', {}, {
+        idempotent: false,
+      }),
+    onSuccess: () => {
+      toast.success('Пир отклонён')
+      invalidateNetwork(qc)
+    },
+    onError: (e) => toast.error(e instanceof Error ? e.message : 'Не удалось отклонить пира'),
+  })
+}
+
 export function useCreateSpeakerMutation() {
   const qc = useQueryClient()
   return useMutation({

apps/web/src/queries/settings.ts

@@ -10,6 +10,10 @@ export const BIRD_SETTING_KEYS = [
   'bird_local_asn',
   'bird_bgp_source_ipv4',
   'bird_bgp_source_ipv6',
+  'peer_discovery_enabled',
+  'peer_discovery_ranges_v4',
+  'peer_discovery_ranges_v6',
+  'peer_discovery_require_external',
 ] as const
 
 export const REVISION_SETTING_KEYS = ['revision_retention_minutes'] as const
@@ -38,7 +42,11 @@ export const NUMERIC_SETTING_KEYS = new Set<KnownSettingKey>([
   'runtime_logs_max_file_mb',
 ])
 
-export const BOOLEAN_SETTING_KEYS = new Set<KnownSettingKey>(['runtime_logs_auto_enabled'])
+export const BOOLEAN_SETTING_KEYS = new Set<KnownSettingKey>([
+  'runtime_logs_auto_enabled',
+  'peer_discovery_enabled',
+  'peer_discovery_require_external',
+])
 
 export const settingsKeys = {
   all: ['settings'] as const,
@@ -53,6 +61,11 @@ export function settingsQueryOptions() {
 }
 
 export function parseKnownValue(key: KnownSettingKey, value: unknown): string {
+  if (BOOLEAN_SETTING_KEYS.has(key)) {
+    if (value === true || value === 1 || value === 'true' || value === '1') return 'true'
+    if (value === false || value === 0 || value === 'false' || value === '0') return 'false'
+    return ''
+  }
   if (NUMERIC_SETTING_KEYS.has(key)) {
     if (typeof value === 'number' && Number.isFinite(value)) return String(value)
     if (typeof value === 'string') return value

apps/web/src/routes/_auth/access.tsx

@@ -11,6 +11,7 @@ import { PageHeader } from '@/components/page-header'
 import { Badge } from '@/components/reui/badge'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
+import { sessionCanManageApiKeys } from '@/lib/auth'
 import { authSessionQueryOptions } from '@/queries/auth'
 import { apiKeysQueryOptions } from '@/queries/api-keys'
 
@@ -21,11 +22,11 @@ export const Route = createFileRoute('/_auth/access')({
 function AccessComponent() {
   const sessionQuery = useQuery(authSessionQueryOptions())
   const session = sessionQuery.data ?? null
-  const isOperator = session?.role === 'operator'
+  const canManageKeys = sessionCanManageApiKeys(session)
 
   const keysQuery = useQuery({
     ...apiKeysQueryOptions(),
-    enabled: isOperator,
+    enabled: canManageKeys,
   })
 
   const keys = keysQuery.data ?? []
@@ -73,16 +74,31 @@ function AccessComponent() {
 
   function refetchAll() {
     void sessionQuery.refetch()
-    if (isOperator) void keysQuery.refetch()
+    if (canManageKeys) void keysQuery.refetch()
   }
 
+  const sessionKindLabel =
+    session?.kind === 'jwt' ? 'Portal JWT' : session?.kind === 'apikey' ? 'API-ключ' : null
+
+  const sessionAccessLabel = (() => {
+    if (!session) return null
+    if (session.kind === 'jwt' || session.is_admin || (session.permissions?.length ?? 0) > 0) {
+      if (session.is_admin) return 'admin (portal)'
+      if (sessionCanManageApiKeys(session)) return 'bgp:access:admin'
+      return session.permissions?.length
+        ? session.permissions.slice(0, 3).join(', ')
+        : 'без access:admin'
+    }
+    return session.role || '—'
+  })()
+
   return (
     <div className="flex flex-col gap-6">
       <PageHeader
         title="Права доступа"
         description="API-ключи control plane и текущая сессия Bearer-токена."
         actions={
-          isOperator ? (
+          canManageKeys ? (
             <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
               <RefreshCw className={refreshing ? 'animate-spin' : ''} />
               Обновить
@@ -94,36 +110,48 @@ function AccessComponent() {
       {session ? (
         <PanelCard
           title="Текущая сессия"
-          description="Tenant и роль ключа, с которым открыта панель."
+          description="Tenant и права текущего Bearer (API-ключ или portal JWT)."
           contentClassName="grid gap-3 py-4 text-sm sm:grid-cols-2"
         >
+          <div>
+            <p className="text-muted-foreground">Tenant</p>
+            <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+          </div>
+          <div>
+            <p className="text-muted-foreground">Доступ</p>
+            <p className="font-mono text-xs">{sessionAccessLabel}</p>
+          </div>
+          {sessionKindLabel ? (
             <div>
-              <p className="text-muted-foreground">Tenant</p>
-              <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+              <p className="text-muted-foreground">Тип</p>
+              <p className="font-mono text-xs">{sessionKindLabel}</p>
             </div>
+          ) : null}
+          {session.email ? (
             <div>
-              <p className="text-muted-foreground">Роль</p>
-              <p className="font-mono">{session.role}</p>
+              <p className="text-muted-foreground">Email</p>
+              <p className="break-all text-xs">{session.email}</p>
             </div>
+          ) : null}
         </PanelCard>
       ) : (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-            Не удалось определить сессию. Укажите токен в{' '}
-            <Link
-              to="/settings"
-              search={{ tab: 'connection' }}
-              className="text-primary underline-offset-4 hover:underline"
-            >
-              настройках
-            </Link>{' '}
-            (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
-            {sessionQuery.isError && sessionQuery.error instanceof Error ? (
-              <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
-            ) : null}
+          Не удалось определить сессию. Укажите токен в{' '}
+          <Link
+            to="/settings"
+            search={{ tab: 'connection' }}
+            className="text-primary underline-offset-4 hover:underline"
+          >
+            настройках
+          </Link>{' '}
+          (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
+          {sessionQuery.isError && sessionQuery.error instanceof Error ? (
+            <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
+          ) : null}
         </PanelCard>
       )}
 
-      {isOperator ? (
+      {canManageKeys ? (
         <>
           {keysQuery.isLoading ? (
             <SectionCardsSkeleton count={3} />
@@ -140,10 +168,9 @@ function AccessComponent() {
         </>
       ) : session ? (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-          Управление API-ключами доступно только роли <strong>operator</strong>. Текущая роль:{' '}
-          <span className="font-mono">{session.role}</span>. Для выдачи ключей войдите с
-          operator-ключом или создайте ключ через API / переменную{' '}
-          <code className="text-xs">EVOBGP_API_KEYS</code>.
+          Управление API-ключами доступно роли <strong>operator</strong> (API-ключ) или portal JWT
+          с <strong>is_admin</strong> / правом <code className="text-xs">bgp:access:admin</code>.
+          Текущий доступ: <span className="font-mono">{sessionAccessLabel}</span>.
         </PanelCard>
       ) : null}
     </div>

apps/web/src/routes/_auth/network.tsx

@@ -5,29 +5,32 @@ import { TabsContent } from '@evobgp/ui/components/tabs'
 import { RefreshCw } from 'lucide-react'
 
 import { CountedLineTabs } from '@/components/counted-line-tabs'
+import { NetworkDiscoveredPeersCard } from '@/components/network/network-discovered-peers-card'
 import { NetworkKpi } from '@/components/network/network-kpi'
 import { NetworkPeersCard } from '@/components/network/network-peers-card'
 import { NetworkSpeakersCard } from '@/components/network/network-speakers-card'
 import { PageHeader } from '@/components/page-header'
 import {
   networkBirdQueryOptions,
+  networkDiscoveredPeersQueryOptions,
   networkPeersQueryOptions,
   networkSpeakersQueryOptions,
 } from '@/queries/network'
 
-type NetworkTab = 'peers' | 'speakers'
+type NetworkTab = 'peers' | 'discovered' | 'speakers'
 
 function parseNetworkTab(value: unknown): NetworkTab {
   if (value === 'speakers') return 'speakers'
+  if (value === 'discovered') return 'discovered'
   // legacy: overview | control-plane → peers
   return 'peers'
 }
 
 /**
- * Network ops page — KPI (stats-12) + peers/speakers ResourcePage lists.
+ * Network ops page — KPI (stats-12) + peers/discovered/speakers ResourcePage lists.
  * @see https://reui.io/preview/base/stats-12
  * @see https://reui.io/preview/base/data-grid-filtering-2
- * @see https://reui.io/preview/base/empty-state-12
+ * @see https://reui.io/preview/base/components/c-empty-1
  */
 export const Route = createFileRoute('/_auth/network')({
   component: NetworkComponent,
@@ -40,16 +43,26 @@ function NetworkComponent() {
   const search = useSearch({ from: '/_auth/network' })
   const navigate = Route.useNavigate()
   const peersQ = useQuery({ ...networkPeersQueryOptions(), refetchInterval: 30_000 })
+  const discoveredQ = useQuery({
+    ...networkDiscoveredPeersQueryOptions(),
+    refetchInterval: 15_000,
+  })
   const speakersQ = useQuery({ ...networkSpeakersQueryOptions(), refetchInterval: 30_000 })
   const birdQ = useQuery({ ...networkBirdQueryOptions(), refetchInterval: 30_000 })
 
-  const refreshing = peersQ.isFetching || speakersQ.isFetching || birdQ.isFetching
+  const refreshing =
+    peersQ.isFetching ||
+    discoveredQ.isFetching ||
+    speakersQ.isFetching ||
+    birdQ.isFetching
   const peers = peersQ.data?.items ?? []
+  const discovered = discoveredQ.data?.items ?? []
   const speakers = speakersQ.data?.items ?? []
   const overviewLoading = peersQ.isLoading || speakersQ.isLoading
 
   function refetchAll() {
     void peersQ.refetch()
+    void discoveredQ.refetch()
     void speakersQ.refetch()
     void birdQ.refetch()
   }
@@ -58,7 +71,7 @@ function NetworkComponent() {
     <div className="flex flex-col gap-4 md:gap-6">
       <PageHeader
         title="Сеть"
-        description="BGP-пиры, спикеры и статус BIRD"
+        description="BGP-пиры, автообнаружение и спикеры"
         actions={
           <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
             <RefreshCw className={refreshing ? 'animate-spin' : undefined} />
@@ -81,6 +94,7 @@ function NetworkComponent() {
         }
         tabs={[
           { id: 'peers', label: 'Пиры', count: peers.length },
+          { id: 'discovered', label: 'На одобрение', count: discovered.length },
           { id: 'speakers', label: 'Спикеры', count: speakers.length },
         ]}
       >
@@ -95,6 +109,17 @@ function NetworkComponent() {
           />
         </TabsContent>
 
+        <TabsContent value="discovered" className="mt-4">
+          <NetworkDiscoveredPeersCard
+            items={discovered}
+            speakers={speakers}
+            isLoading={discoveredQ.isLoading}
+            isError={discoveredQ.isError}
+            error={discoveredQ.error}
+            onRetry={() => void discoveredQ.refetch()}
+          />
+        </TabsContent>
+
         <TabsContent value="speakers" className="mt-4">
           <NetworkSpeakersCard
             items={speakers}

apps/web/src/routes/_auth/tenant-settings.tsx

@@ -54,6 +54,23 @@ const BIRD_LABELS: Record<BirdSettingKey, string> = {
   bird_local_asn: 'Локальный ASN',
   bird_bgp_source_ipv4: 'BGP source IPv4',
   bird_bgp_source_ipv6: 'BGP source IPv6',
+  peer_discovery_enabled: 'Автообнаружение пиров',
+  peer_discovery_ranges_v4: 'Discovery CIDR IPv4',
+  peer_discovery_ranges_v6: 'Discovery CIDR IPv6',
+  peer_discovery_require_external: 'Только external ASN',
+}
+
+const BIRD_BOOL_ITEMS = [
+  { value: 'true', label: 'Вкл' },
+  { value: 'false', label: 'Выкл' },
+] as const
+
+const BIRD_HINTS: Partial<Record<BirdSettingKey, string>> = {
+  peer_discovery_enabled:
+    'Dynamic neighbor range в BIRD (карантин import/export none). Требует CIDR.',
+  peer_discovery_ranges_v4: 'Через запятую или пробел, напр. 198.51.100.0/24 203.0.113.0/24',
+  peer_discovery_ranges_v6: 'Опционально, напр. 2001:db8::/32',
+  peer_discovery_require_external: 'neighbor range … external (любой чужой ASN)',
 }
 
 function TenantSettingsComponent() {
@@ -143,17 +160,32 @@ function TenantSettingsComponent() {
                       <SettingsSettingField
                         key={key}
                         title={BIRD_LABELS[key]}
-                        description={key}
+                        description={BIRD_HINTS[key] ?? key}
                         labelFor={key}
                         badge={{ label: 'BIRD', variant: 'info-light' }}
                         last={index === BIRD_SETTING_KEYS.length - 1}
                       >
-                        <Input
-                          id={key}
-                          value={birdForm[key] ?? ''}
-                          onChange={(e) => setBirdForm((s) => ({ ...s, [key]: e.target.value }))}
-                          placeholder={BIRD_LABELS[key]}
-                        />
+                        {key === 'peer_discovery_enabled' ||
+                        key === 'peer_discovery_require_external' ? (
+                          <SelectField
+                            id={key}
+                            items={[...BIRD_BOOL_ITEMS]}
+                            value={birdForm[key] || 'false'}
+                            onValueChange={(v) =>
+                              setBirdForm((s) => ({ ...s, [key]: v || 'false' }))
+                            }
+                            placeholder="Выкл"
+                          />
+                        ) : (
+                          <Input
+                            id={key}
+                            value={birdForm[key] ?? ''}
+                            onChange={(e) =>
+                              setBirdForm((s) => ({ ...s, [key]: e.target.value }))
+                            }
+                            placeholder={BIRD_LABELS[key]}
+                          />
+                        )}
                       </SettingsSettingField>
                     ))}
                     <div className="px-4 py-4">

apps/web/src/types/api.ts

@@ -221,10 +221,36 @@ export type BgpPeerCreate = {
 }
 export type BgpPeerPatch = Partial<BgpPeerCreate>
 
+export type PeerDiscoveryRow = {
+  id: string
+  speaker_id?: string | null
+  neighbor_id?: string
+  neighbor: string
+  remote_asn?: number
+  protocol_name?: string
+  session_state?: string
+  status: 'pending' | 'approved' | 'rejected' | string
+  first_seen_at?: string
+  last_seen_at?: string
+  approved_peer_id?: string | null
+}
+
+export type PeerDiscoveriesResponse = {
+  items: PeerDiscoveryRow[]
+}
+
+export type PeerDiscoveryApprove = {
+  name?: string
+  bgp_speaker_id?: string | null
+  enabled?: boolean
+}
+
 // ---- Speakers ----
 export type BgpSessionLive = {
   name: string
   neighbor?: string
+  neighbor_as?: number
+  neighbor_id?: string
   state: string
 }
 
@@ -341,13 +367,20 @@ export type JobsResponse = Page<JobRow>
 export type AppSettings = Record<string, unknown>
 
 // ---- Auth / API keys ----
+export type ApiKeyRole = 'viewer' | 'editor' | 'operator' | 'node'
+
+/** GET /v1/auth/session — API key has role; portal JWT uses kind/permissions/is_admin. */
 export type AuthSession = {
   tenant_id: string
-  role: 'viewer' | 'editor' | 'operator' | 'node'
+  /** API-key role; empty for portal JWT sessions. */
+  role: ApiKeyRole | ''
+  kind?: 'apikey' | 'jwt'
+  user_id?: string
+  email?: string
+  permissions?: string[]
+  is_admin?: boolean
 }
 
-export type ApiKeyRole = AuthSession['role']
-
 export type ApiKey = {
   id: string
   name: string

cmd/evobgp-all/main.go

@@ -42,6 +42,7 @@ func main() {
 		AuthPortalURL:           firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
 		PortalTenantID:          strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
 		AuthRequired:            boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:       firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {

cmd/evobgp-api/main.go

@@ -37,6 +37,7 @@ func main() {
 		AuthPortalURL:      firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
 		PortalTenantID:     strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
 		AuthRequired:       boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:  firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {

docs/access.md

@@ -12,6 +12,7 @@
 | `AUTH_JWT_SECRET` / `EVOBGP_AUTH_JWT_SECRET` | Тот же секрет, что `JWT_SECRET` портала (HS256) |
 | `AUTH_ISSUER` | Issuer JWT (как на портале) |
 | `AUTH_PORTAL_URL` | URL портала (также `GET /v1/auth/config`) |
+| `AUTH_AUDIT_INGEST_SECRET` / `EVOBGP_AUTH_AUDIT_INGEST_SECRET` | Shared secret для push CRUD audit в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`) |
 | `EVOBGP_PORTAL_TENANT_ID` | Fallback tenant для portal JWT, если в токене нет `bgp_tenant_id` / `tenants.bgp` |
 
 Источник tenant (по приоритету):
@@ -60,14 +61,18 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 ### Управление через API и UI
 
-При подключённой БД operator может:
+При подключённой БД управлять ключами может:
 
-- `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
-- В веб-панели: **Права доступа** (`/access`) → блок «API-ключи» (только для роли `operator`). Токен для браузера — в **Настройки** (`/settings`).
+- API-ключ с ролью **`operator`**, или
+- portal JWT с **`is_admin`** / правом **`bgp:access:admin`** (админ auth-portal).
+
+Эндпоинты: `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
+
+В веб-панели: **Права доступа** (`/access`) → блок «API-ключи». Токен для браузера (API-key gate) — в **Настройки** (`/settings`).
 
 Полный токен возвращается **один раз** в ответе `201` (создание) и `200` (ротация). В списках — только `prefix` (первые 8 символов). В БД хранится SHA-256 токена, не plaintext.
 
-`GET /v1/auth/session` — текущие `tenant_id` и `role` (для UI).
+`GET /v1/auth/session` — `tenant_id`, `kind` (`apikey`|`jwt`), для API-ключа — `role`; для JWT — `user_id`, `email`, `permissions`, `is_admin`.
 
 ### Роли
 
@@ -178,13 +183,13 @@ http://localhost:5173,http://127.0.0.1:5173,https://ui.example.com
 
 ## Краткая матрица (ориентир)
 
-| Действие | viewer | editor | operator | node |
-|----------|--------|--------|----------|------|
-| GET модули, ревизии, peers, speakers | да | да | да | нет |
-| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет |
-| apply, rollback, PATCH settings | нет | нет | да | нет |
-| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет |
-| bundle, latest revision, enroll | нет | нет | нет | да |
+| Действие | viewer | editor | operator | node | portal admin / `bgp:access:admin` |
+|----------|--------|--------|----------|------|-----------------------------------|
+| GET модули, ревизии, peers, speakers | да | да | да | нет | по permissions |
+| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет | по permissions |
+| apply, rollback, PATCH settings | нет | нет | да | нет | `bgp:operations:admin` |
+| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет | да |
+| bundle, latest revision, enroll | нет | нет | нет | да | нет |
 
 Точные проверки по каждому маршруту — в коде `internal/httpapi` и в схеме безопасности операций в OpenAPI.
 

docs/api.md

@@ -116,6 +116,16 @@
 
 `{filename}` — только basename, паттерн `^[a-z0-9][a-z0-9_.-]*\.log$`. Очистка пишет строку в таблицу `runtime_log_cleanup_audit` (миграция `000026`).
 
+## CRUD audit (`/v1/audit`)
+
+Локальный журнал изменений CRUD (modules, peers, settings, API keys, …). Миграция `000030_audit_log`. Чтение — `bgp:monitoring:read` (viewer+).
+
+| Метод | Путь | Роль | Назначение |
+|-------|------|------|------------|
+| `GET` | `/v1/audit` | viewer+ | Пагинированный audit (`cursor`, `limit`, опционально `action`, `severity`) |
+
+При `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` каждая запись дополнительно отправляется в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`).
+
 ## Соглашения из OpenAPI
 
 - Ошибки в стиле **RFC 9457** (`application/problem+json`): `type`, `title`, `status`, `detail`, и т.д.

docs/manual.md

@@ -105,6 +105,13 @@ EvoBGP управляет генерацией и применением BGP-к
 ### Настройки (`/v1/settings`)
 - KV c ключами BIRD и дополнительными feature flags.
 - Ключевые параметры BIRD: `bird_router_id`, `bird_local_ipv4`, `bird_local_ipv6`, `bird_local_asn`, `bird_bgp_source_ipv4`, `bird_bgp_source_ipv6`.
+- **Автообнаружение пиров (peer discovery):**
+  - `peer_discovery_enabled` (bool) — генерирует в `evobgp_peers.conf` dynamic BGP listener (`neighbor range` + `import none` / `export none`).
+  - `peer_discovery_ranges_v4` / `peer_discovery_ranges_v6` — CIDR через пробел/запятую (обязательны при enabled).
+  - `peer_discovery_require_external` (bool, default true) — `neighbor range … external`.
+  - Live-сессии `evobgp_dyn_*` попадают в `GET /v1/peers/discovered`; оператор **одобряет** (`POST …/approve` → обычный `bgp_peer` + `peer_reconcile`) или **отклоняет**.
+  - Идентичность pending: **Neighbor ID** (BGP Identifier), иначе `neighbor+ASN`.
+  - UI: Сеть → вкладка «На одобрение»; настройки — Параметры → BIRD.
 - **Tenant settings** — глобальный default. **Per-speaker** override: `meta_json.bird_bgp_source_ipv4` / `node_ipv4` в карточке спикера (Web UI → Сеть → Спикеры); pipeline накладывает overlay при сборке бандла для реплики. См. [remote-speakers.md](remote-speakers.md).
 
 ### Web UI: настройки tenant и интерфейса

docs/openapi.yaml

@@ -59,6 +59,8 @@ tags:
     description: Сессия текущего API-ключа (tenant и роль).
   - name: Monitoring
     description: Наблюдаемость PostgreSQL и корреляция (instance-level, viewer+). Maintenance — operator.
+  - name: Audit
+    description: Журнал CRUD-изменений tenant (локально + опциональный push в auth-portal). Чтение — bgp:monitoring:read.
   - name: Maintenance
     description: Политики обслуживания PostgreSQL (instance-scoped). CRUD и запуск — operator.
   - name: RuntimeLogs
@@ -676,13 +678,32 @@ components:
 
     AuthSession:
       type: object
-      required: [tenant_id, role]
+      required: [tenant_id, kind]
       properties:
         tenant_id:
           $ref: "#/components/schemas/ResourceId"
+        kind:
+          type: string
+          enum: [apikey, jwt]
+          description: apikey — Bearer API key; jwt — portal SSO token.
         role:
           type: string
-          enum: [viewer, editor, operator, node]
+          description: >
+            API-key role (viewer|editor|operator|node). Empty string for portal JWT sessions.
+        user_id:
+          type: string
+          description: JWT sub (portal sessions only).
+        email:
+          type: string
+          description: JWT email claim (portal sessions only).
+        permissions:
+          type: array
+          items:
+            type: string
+          description: JWT permissions (bgp:*); portal sessions only.
+        is_admin:
+          type: boolean
+          description: Portal is_admin claim; grants all bgp permissions.
 
     ApiKey:
       type: object
@@ -1009,6 +1030,12 @@ components:
           type: string
         neighbor:
           type: string
+        neighbor_as:
+          type: integer
+          description: Remote ASN from birdc (`Neighbor AS:`).
+        neighbor_id:
+          type: string
+          description: BGP Identifier / Neighbor ID from birdc (`Neighbor ID:`).
         state:
           type: string
       additionalProperties: true
@@ -1278,6 +1305,70 @@ components:
         has_more:
           type: boolean
 
+    AuditSeverity:
+      type: string
+      enum: [info, warning, critical]
+
+    AuditLogEntry:
+      type: object
+      required:
+        [id, tenant_id, event_id, source_app, action, severity, summary, created_at]
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        tenant_id:
+          $ref: "#/components/schemas/ResourceId"
+        event_id:
+          type: string
+          description: Stable id for portal ingest deduplication (prefix bgp-).
+        source_app:
+          type: string
+          enum: [bgp]
+        action:
+          type: string
+          description: Machine action key (e.g. bgp.module.create).
+        severity:
+          $ref: "#/components/schemas/AuditSeverity"
+        actor_user_id:
+          type: ["string", "null"]
+        actor_email:
+          type: ["string", "null"]
+        actor_name:
+          type: ["string", "null"]
+        actor_api_key_prefix:
+          type: ["string", "null"]
+        target_type:
+          type: ["string", "null"]
+          enum: [app_resource, null]
+        target_id:
+          type: ["string", "null"]
+        summary:
+          type: string
+        details:
+          type: ["object", "null"]
+          additionalProperties: true
+        ip:
+          type: ["string", "null"]
+        created_at:
+          type: string
+          format: date-time
+        portal_pushed_at:
+          type: ["string", "null"]
+          format: date-time
+
+    AuditLogList:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/AuditLogEntry"
+        next_cursor:
+          type: string
+        has_more:
+          type: boolean
+
     RuntimeLogAutoPolicy:
       type: object
       properties:
@@ -1630,6 +1721,51 @@ components:
           type: string
       additionalProperties: true
 
+    BgpPeerDiscovery:
+      type: object
+      required: [id, neighbor, status]
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        speaker_id:
+          type: ["string", "null"]
+        neighbor_id:
+          type: string
+          description: BGP Identifier (Neighbor ID / router ID) from birdc.
+        neighbor:
+          type: string
+          description: Neighbor IP address.
+        remote_asn:
+          type: integer
+        protocol_name:
+          type: string
+          description: BIRD protocol name (evobgp_dyn_*).
+        session_state:
+          type: string
+        status:
+          type: string
+          enum: [pending, approved, rejected]
+        first_seen_at:
+          type: string
+          format: date-time
+        last_seen_at:
+          type: string
+          format: date-time
+        approved_peer_id:
+          type: ["string", "null"]
+      additionalProperties: true
+
+    BgpPeerDiscoveryApprove:
+      type: object
+      properties:
+        name:
+          type: string
+        bgp_speaker_id:
+          type: ["string", "null"]
+        enabled:
+          type: boolean
+      additionalProperties: false
+
     BgpPeerCreate:
       type: object
       required: [neighbor, remote_asn]
@@ -2837,6 +2973,57 @@ paths:
         default:
           $ref: "#/components/responses/DefaultProblem"
 
+  /v1/communities/{id}/prefixes:
+    parameters:
+      - $ref: "#/components/parameters/TenantId"
+      - $ref: "#/components/parameters/CommunityId"
+      - $ref: "#/components/parameters/Cursor"
+      - name: limit
+        in: query
+        schema:
+          type: integer
+          default: 500
+          maximum: 5000
+    get:
+      tags: [Communities]
+      summary: Префиксы community (latest revision per module)
+      description: |
+        Уникальные materialized-префиксы с данным community_id
+        из последней ревизии каждого модуля tenant.
+        Поле `prefixes` — плоский список для клиентов вроде EvoFirewall.
+      operationId: listCommunityPrefixes
+      responses:
+        "200":
+          description: Успешно.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [items, has_more]
+                properties:
+                  items:
+                    type: array
+                    items:
+                      type: object
+                      required: [prefix]
+                      properties:
+                        prefix:
+                          type: string
+                        source:
+                          type: string
+                  prefixes:
+                    type: array
+                    items:
+                      type: string
+                  next_cursor:
+                    type: ["string", "null"]
+                  has_more:
+                    type: boolean
+        "404":
+          $ref: "#/components/responses/NotFound"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
   /v1/communities/{id}:
     parameters:
       - $ref: "#/components/parameters/TenantId"
@@ -2964,6 +3151,90 @@ paths:
         default:
           $ref: "#/components/responses/DefaultProblem"
 
+  /v1/peers/discovered:
+    get:
+      tags: [Peers]
+      summary: Список обнаруженных (неодобренных) пиров
+      description: >
+        Dynamic BGP-сессии (`evobgp_dyn_*`), которых ещё нет в `bgp_peer`.
+        По умолчанию возвращает `status=pending`. При листинге выполняет live-опрос birdc/agent и upsert pending.
+      operationId: listDiscoveredPeers
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - name: status
+          in: query
+          schema:
+            type: string
+            enum: [pending, approved, rejected, all]
+            default: pending
+      responses:
+        "200":
+          description: Успешно.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [items]
+                properties:
+                  items:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/BgpPeerDiscovery"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/peers/discovered/{id}/approve:
+    post:
+      tags: [Peers]
+      summary: Одобрить обнаруженного пира
+      description: >
+        Создаёт обычный `bgp_peer` из discovery-записи и запускает `peer_reconcile`.
+      operationId: approveDiscoveredPeer
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - $ref: "#/components/parameters/PeerId"
+        - $ref: "#/components/parameters/IdempotencyKey"
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/BgpPeerDiscoveryApprove"
+      responses:
+        "200":
+          description: Пир создан, discovery → approved.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  peer:
+                    $ref: "#/components/schemas/BgpPeer"
+                  discovery:
+                    $ref: "#/components/schemas/BgpPeerDiscovery"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
+  /v1/peers/discovered/{id}/reject:
+    post:
+      tags: [Peers]
+      summary: Отклонить обнаруженного пира
+      description: Помечает discovery как rejected; повторно не всплывает при sync.
+      operationId: rejectDiscoveredPeer
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - $ref: "#/components/parameters/PeerId"
+        - $ref: "#/components/parameters/IdempotencyKey"
+      responses:
+        "200":
+          description: Discovery → rejected.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/BgpPeerDiscovery"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
   /v1/peers/{id}:
     parameters:
       - $ref: "#/components/parameters/TenantId"
@@ -4501,6 +4772,40 @@ paths:
         default:
           $ref: "#/components/responses/DefaultProblem"
 
+  /v1/audit:
+    get:
+      tags: [Audit]
+      summary: Журнал CRUD audit tenant
+      description: |
+        Локальный журнал изменений (modules, peers, settings, API keys и т.д.).
+        При настроенных `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` события также
+        отправляются в auth-portal ingest (`source_app=bgp`).
+      operationId: listAuditLog
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+        - name: action
+          in: query
+          schema:
+            type: string
+          description: Filter by action prefix/key (exact match).
+        - name: severity
+          in: query
+          schema:
+            $ref: "#/components/schemas/AuditSeverity"
+      responses:
+        "200":
+          description: Успешно.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuditLogList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
   /v1/settings:
     get:
       tags: [Settings]

docs/ui-design-contract.md

@@ -1,100 +1,119 @@
 # UI Design Contract (ops apps)
 
-Единый контракт для vps-tracker, CFDM и EvoBGP. Surface: **ReUI Frame**. Kit API: `apps/web/src/components/reui-kit/`.
+Единый контракт для **CFDM · vps-tracker · EvoBGP · EvoFirewall · auth-portal**.  
+Surface: **ReUI Frame**. Kit: `apps/web/src/components/reui-kit/`.  
+Иерархия: **ReUI PRO > shadcn primitives**.
 
-Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks)
+Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks) · [MCP](https://reui.io/docs/mcp)
 
 ## Surface
 
+Project lock: **`surface: frame`**. Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+
 ```ts
-// apps/web/src/lib/ui-surface.ts
+// apps/web/src/lib/ui-surface.ts (где есть)
 export const UI_SURFACE = 'frame' as const
 ```
 
-Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+Settings: секции через Frame + `gap` (без hairline `Separator` под PageHeader); `SettingRow` без `FieldSeparator` по умолчанию (`separated` opt-in). Preview: [settings-3](https://reui.io/preview/base/settings-3) · [settings-16](https://reui.io/preview/base/settings-16).
 
 ## Canonical PRO references
 
 | Зона | Block | Preview |
 |------|-------|---------|
 | Shell | `app-shell-12` (+ cmdk/monitor где нужно) | https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7 |
-| KPI | horizontal compact hybrid (icon left + label/Badge + value ± variant; EvoBGP visual) | https://reui.io/preview/base/stats-12 |
+| KPI | horizontal compact hybrid (EvoBGP SoT: icon left + label/Badge + value ± variant) | https://reui.io/preview/base/stats-12 |
+| Quick Actions | Frame tiles (sibling KPI) + Badge «Перейти» | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
 | Dashboard | `dashboard-1` | https://reui.io/preview/base/dashboard-1 |
 | Lists | `data-grid-filtering-2` | https://reui.io/preview/base/data-grid-filtering-2 |
-| Settings | `settings-16` + SettingRow (`settings-7`) | https://reui.io/preview/base/settings-16 · https://reui.io/preview/base/settings-7 |
+| Settings | `settings-16` + SettingRow | https://reui.io/preview/base/settings-16 |
 | Auth | `auth-13` | https://reui.io/preview/base/auth-13 |
 | Empty | `empty-state-12` | https://reui.io/preview/base/empty-state-12 |
 | Forms | `form-7` → Sheet/Drawer | https://reui.io/preview/base/form-7 |
-| Lookup | `/lookup` — Frame form + `KpiStatGrid` + DataGrid | https://reui.io/preview/base/form-7 · https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/data-grid-filtering-2 · https://reui.io/preview/base/empty-state-2 |
 
 ## Kit API (`reui-kit/`)
 
 | Component | Role |
 |-----------|------|
 | `ResourcePage` | Frame + line tabs + Filters + DataGrid |
-| `KpiStatGrid` | horizontal compact hybrid KPI tiles (`variant`, Badge) |
-| `QuickActionGrid` | KPI-like quick action tiles under KPI (gated by `ui_show_quick_actions`) |
-| `OpsDashboard` | KPI + charts + attention queue |
+| `KpiStatGrid` | EvoBGP hybrid KPI tiles (`items`/`cards`, `variant`, Badge) |
+| `QuickActionGrid` | KPI-like quick action tiles (gated by `showQuickActions`) |
+| `OpsDashboard` | KPI + optional `afterKpi` + charts + attention queue |
 | `SettingsShell` | settings nav + Outlet |
 | `DetailPanel` | detail Frame sections |
 | `filter-utils` | apply/clear ReUI Filters |
 
+`KpiStatGrid` / `QuickActionGrid` markup — SoT **EvoBGP**; в остальных apps diff только `@scope/ui` imports.
+
 ## Dashboard layout
 
 | App | Section order |
 |-----|---------------|
-| EvoBGP / CFDM | KPI → **QuickActionGrid** → charts / rest |
+| EvoBGP / CFDM / EvoFirewall | KPI → **QuickActionGrid** → charts / rest |
 | vps-tracker | banner → KPI → charts → attention → **QuickActionGrid** → CSV |
+| auth-portal | portal-specific; Quick Actions при наличии dashboard |
 
-Gating: KV `ui_show_quick_actions` in `global_settings` via `PATCH /v1/settings` (default `true`).
+Gating: DB `show_quick_actions` / `showQuickActions` / `ui_show_quick_actions` (default `true`).
 
 ## Shared App Shell chrome
 
-Эталон: **EvoBGP** production [`apps/web/src/components/layout/app-shell.tsx`](../apps/web/src/components/layout/app-shell.tsx) + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).
-
-При переключении между vps-tracker / CFDM / EvoBGP меняются **только** sidebar nav labels/hrefs и `main` content. Разметка, ширина, фон и hover chrome идентичны.
+Эталон разметки: production apps + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).  
+При переключении между apps меняются **только** sidebar nav labels/hrefs и `main` content.
 
 | Токен / зона | Значение |
 |--------------|----------|
-| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` (в `packages/ui` sidebar + Provider style) |
-| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` из `globals.css` — **без** AppShell `color-mix` override |
+| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` |
+| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` — **без** AppShell `color-mix` override |
 | Header | `h-12`, `sticky`, `border-b`, `px-4 md:px-6` |
 | Header left | `SidebarTrigger` + `Separator` + Breadcrumb |
-| Header right | **AppsMenu** → **SystemMonitorPopover** → **ModeToggle** (без Search в chrome) |
-| Sidebar | AppSwitcher → groups (`SidebarGroupContent`) → icons `size-4` → **пустой** `SidebarFooter` |
+| Header right | **AppsMenu** → **SystemMonitorPopover** (тема — в NavUser) |
+| Sidebar | AppSwitcher → groups → icons `size-4` → **NavUser** в `SidebarFooter` |
 | `main` | `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` |
 | Search | hotkey ⌘K / Ctrl+K only (не кнопка в header) |
 
-Запрещено в chrome: `SidebarRail`, `NavUser` footer, sync-row footer, Search/Ctrl+K pill в header, issues Badge в header, muted/hover cascade на right-cluster, Provider `color-mix` для `--sidebar*`.
+Запрещено в chrome: `SidebarRail`, sync-row footer, Search pill в header, issues Badge в header, `ModeToggle` в header (тема только в NavUser), Provider `color-mix` для `--sidebar*`.
 
-App Switcher: source of truth — auth-portal `GET /api/v1/app-switcher`. Id: `bgp`. Admin: portal `/admin/apps`.
+NavUser (footer): avatar + name/email; dropdown — Настройки / Тема (segmented) / Выйти. Preview: [app-shell-1](https://reui.io/preview/base/app-shell-1).
 
-QuickActionGrid icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid `bg-primary` fills. Preview: [stats-12](https://reui.io/preview/base/stats-12).
+App Switcher: auth-portal `GET /api/v1/app-switcher`. Ids: `cfdm` · `vps` · `bgp` · `fw`. Admin: portal `/admin/apps`.
+
+QuickActionGrid / KPI icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid fills.
 
 ## System monitor
 
-`SystemMonitorPopover` in app-shell header next to `ModeToggle` (после AppsMenu). Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
+`SystemMonitorPopover` in header after AppsMenu. Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
 
 ## MCP workflow
 
-1. MCP `user-reui` — `search` / `get_block` / `get_component` with `surface: "frame"`
+1. MCP `user-reui` — `search` / `get_block` / `compose_page` / `get_component` with `surface: "frame"`
 2. Cite `previewUrl` + `docsUrl`
 3. CLI from `apps/web`: `pnpm dlx shadcn@latest add @reui/...`
-4. Adapt into kit — do not hand-roll KPI/grid/settings rows
+4. Adapt into kit — do not hand-roll KPI / Quick Actions / grid / settings rows
 5. `validate_usage` / `get_audit_checklist`
 
-Primitives: MCP `plugin-shadcn-shadcn` + `@evobgp/ui`.
+Primitives: MCP `plugin-shadcn-shadcn` + project `@scope/ui` (`@cfdm/ui` / `@evobgp/ui` / `@evofw/ui` / `@authportal/ui`).
+
+## License
+
+```env
+# apps/web/.env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
 
 ## Spacing
 
-- AppShell main: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` (shared chrome)
+- AppShell main / PageShell: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5`
 - No `space-y-*` / `space-x-*` — use `flex` + `gap-*`
 - Max 1 primary CTA per screen
-- Semantic tokens only (`variant="success"|"info"|"warning"`) — no raw `bg-emerald-*`
+- Semantic tokens only — no raw `bg-emerald-*`
 
 ## Forbidden
 
 - Card as ops list/dashboard shell
-- Hand-rolled data tables when ReUI DataGrid exists
-- Hand-rolled KPI grids when `KpiStatGrid` exists
+- Hand-rolled data tables when ReUI DataGrid / `ResourcePage` exists
+- Hand-rolled KPI when `KpiStatGrid` exists
+- Hand-rolled Quick Actions when `QuickActionGrid` exists
+- SectionCards / DataGridCard as design эталон
 - Mixing Card and Frame surfaces on one ops screen

internal/audit/portal.go

@@ -0,0 +1,118 @@
+// Package audit pushes local audit events to auth-portal ingest API.
+package audit
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/httpclient"
+	"evobgp/internal/store"
+)
+
+const ingestPath = "/api/v1/ingest/audit"
+
+// PortalPusher sends audit rows to auth-portal (best-effort, async-friendly).
+type PortalPusher struct {
+	BaseURL    string
+	Secret     string
+	HTTPClient *http.Client
+	MarkPushed func(id string) error
+}
+
+// PushEvent posts one audit entry to portal ingest.
+func (p *PortalPusher) PushEvent(ctx context.Context, entry *store.AuditEntry) error {
+	if p == nil || entry == nil {
+		return nil
+	}
+	base := strings.TrimRight(strings.TrimSpace(p.BaseURL), "/")
+	secret := strings.TrimSpace(p.Secret)
+	if base == "" || secret == "" {
+		return nil
+	}
+	hc := p.HTTPClient
+	if hc == nil {
+		hc = httpclient.New(15 * time.Second)
+	}
+	body := map[string]any{
+		"events": []map[string]any{p.eventPayload(entry)},
+	}
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("audit: marshal ingest: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+ingestPath, bytes.NewReader(raw))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+secret)
+	resp, err := hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("audit: portal ingest: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return fmt.Errorf("audit: portal ingest %s: %s", resp.Status, strings.TrimSpace(string(b)))
+	}
+	if p.MarkPushed != nil {
+		if err := p.MarkPushed(entry.ID); err != nil {
+			log.Printf("audit: mark portal pushed id=%s: %v", entry.ID, err)
+		}
+	}
+	return nil
+}
+
+func (p *PortalPusher) eventPayload(entry *store.AuditEntry) map[string]any {
+	ev := map[string]any{
+		"event_id":   entry.EventID,
+		"source_app": store.AuditSourceAppBGP,
+		"action":     entry.Action,
+		"severity":   entry.Severity,
+		"summary":    entry.Summary,
+		"created_at": entry.CreatedAt.UTC().Format(time.RFC3339Nano),
+	}
+	if entry.ActorUserID != "" {
+		ev["actor_user_id"] = entry.ActorUserID
+	} else {
+		ev["actor_user_id"] = nil
+	}
+	if entry.ActorEmail != "" {
+		ev["actor_email"] = entry.ActorEmail
+	} else {
+		ev["actor_email"] = nil
+	}
+	if entry.ActorName != "" {
+		ev["actor_name"] = entry.ActorName
+	} else {
+		ev["actor_name"] = nil
+	}
+	if entry.TargetType != "" {
+		ev["target_type"] = entry.TargetType
+	} else {
+		ev["target_type"] = nil
+	}
+	if entry.TargetID != "" {
+		ev["target_id"] = entry.TargetID
+	} else {
+		ev["target_id"] = nil
+	}
+	if entry.Details != nil {
+		ev["details"] = entry.Details
+	} else {
+		ev["details"] = nil
+	}
+	if entry.IP != "" {
+		ev["ip"] = entry.IP
+	} else {
+		ev["ip"] = nil
+	}
+	return ev
+}

internal/audit/portal_test.go

@@ -0,0 +1,63 @@
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"evobgp/internal/store"
+)
+
+func TestPortalPusherPushEvent(t *testing.T) {
+	var got struct {
+		Events []map[string]any `json:"events"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != ingestPath {
+			t.Fatalf("path=%s", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-secret" {
+			t.Fatalf("auth=%q", r.Header.Get("Authorization"))
+		}
+		_ = json.NewDecoder(r.Body).Decode(&got)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]int{"accepted": 1, "duplicates": 0})
+	}))
+	defer srv.Close()
+
+	marked := false
+	p := &PortalPusher{
+		BaseURL: srv.URL,
+		Secret:  "test-secret",
+		MarkPushed: func(id string) error {
+			marked = id == "local-id"
+			return nil
+		},
+	}
+	entry := &store.AuditEntry{
+		ID:         "local-id",
+		EventID:    "bgp-test-event",
+		Action:     "bgp.module.create",
+		Severity:   store.AuditSeverityInfo,
+		Summary:    "Created module",
+		SourceApp:  store.AuditSourceAppBGP,
+		CreatedAt:  time.Now().UTC(),
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   "mod-1",
+	}
+	if err := p.PushEvent(context.Background(), entry); err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Events) != 1 {
+		t.Fatalf("events=%d", len(got.Events))
+	}
+	if got.Events[0]["source_app"] != "bgp" {
+		t.Fatalf("source_app=%v", got.Events[0]["source_app"])
+	}
+	if !marked {
+		t.Fatal("expected mark pushed")
+	}
+}

internal/birdfmt/bgp_discovery.go

@@ -0,0 +1,121 @@
+package birdfmt
+
+import (
+	"fmt"
+	"net/netip"
+	"strings"
+)
+
+// Parent protocol names for discovery listeners (not spawned session names).
+const (
+	DiscoveryProtocolV4 = "evobgp_discover_v4"
+	DiscoveryProtocolV6 = "evobgp_discover_v6"
+)
+
+// DynamicBGPDiscoveryOptions configures quarantine dynamic BGP listeners.
+type DynamicBGPDiscoveryOptions struct {
+	RangesV4          []string // CIDR prefixes
+	RangesV6          []string
+	RequireExternal   bool // neighbor range … external (default true)
+	DynamicNameDigits int  // default 4
+}
+
+// RenderDynamicBGPDiscovery renders passive dynamic BGP quarantine listeners.
+// Spawned sessions use DynamicPeerProtocolPrefix ("evobgp_dyn_").
+// Channel policy is always import none / export none (no announcements until approve).
+func RenderDynamicBGPDiscovery(opts DynamicBGPDiscoveryOptions) (string, error) {
+	digits := opts.DynamicNameDigits
+	if digits <= 0 {
+		digits = 4
+	}
+	var parts []string
+	if len(opts.RangesV4) > 0 {
+		s, err := renderDynamicDiscoveryAF(DiscoveryProtocolV4, BGPTemplateNameV4, "ipv4", opts.RangesV4, opts.RequireExternal, digits)
+		if err != nil {
+			return "", err
+		}
+		parts = append(parts, s)
+	}
+	if len(opts.RangesV6) > 0 {
+		s, err := renderDynamicDiscoveryAF(DiscoveryProtocolV6, BGPTemplateNameV6, "ipv6", opts.RangesV6, opts.RequireExternal, digits)
+		if err != nil {
+			return "", err
+		}
+		parts = append(parts, s)
+	}
+	if len(parts) == 0 {
+		return "", nil
+	}
+	return strings.Join(parts, "\n"), nil
+}
+
+func renderDynamicDiscoveryAF(protoName, templateName, af string, ranges []string, external bool, digits int) (string, error) {
+	var cleaned []string
+	for _, r := range ranges {
+		r = strings.TrimSpace(r)
+		if r == "" {
+			continue
+		}
+		pfx, err := netip.ParsePrefix(r)
+		if err != nil {
+			return "", fmt.Errorf("birdfmt: invalid discovery range %q: %w", r, err)
+		}
+		if af == "ipv4" && !pfx.Addr().Is4() {
+			return "", fmt.Errorf("birdfmt: discovery range %q is not IPv4", r)
+		}
+		if af == "ipv6" && !pfx.Addr().Is6() {
+			return "", fmt.Errorf("birdfmt: discovery range %q is not IPv6", r)
+		}
+		cleaned = append(cleaned, pfx.Masked().String())
+	}
+	if len(cleaned) == 0 {
+		return "", nil
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "protocol bgp %s from %s {\n", protoName, templateName)
+	for _, cidr := range cleaned {
+		b.WriteString("    neighbor range ")
+		b.WriteString(cidr)
+		if external {
+			b.WriteString(" external")
+		}
+		b.WriteString(";\n")
+	}
+	fmt.Fprintf(&b, "    dynamic name \"%s\";\n", DynamicPeerProtocolPrefix)
+	fmt.Fprintf(&b, "    dynamic name digits %d;\n", digits)
+	b.WriteString("    multihop;\n")
+	b.WriteString("    passive;\n")
+	fmt.Fprintf(&b, "    %s {\n", af)
+	b.WriteString("        import none;\n")
+	b.WriteString("        export none;\n")
+	b.WriteString("    };\n")
+	b.WriteString("}\n")
+	return b.String(), nil
+}
+
+// ParseDiscoveryRanges splits a settings string (comma / newline / space separated) into CIDRs.
+func ParseDiscoveryRanges(raw string) []string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return nil
+	}
+	raw = strings.ReplaceAll(raw, ",", " ")
+	raw = strings.ReplaceAll(raw, "\n", " ")
+	raw = strings.ReplaceAll(raw, ";", " ")
+	fields := strings.Fields(raw)
+	out := make([]string, 0, len(fields))
+	seen := map[string]struct{}{}
+	for _, f := range fields {
+		f = strings.TrimSpace(f)
+		if f == "" {
+			continue
+		}
+		if _, ok := seen[f]; ok {
+			continue
+		}
+		seen[f] = struct{}{}
+		out = append(out, f)
+	}
+	return out
+}

internal/birdfmt/bgp_discovery_test.go

@@ -0,0 +1,47 @@
+package birdfmt
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRenderDynamicBGPDiscovery_v4(t *testing.T) {
+	out, err := RenderDynamicBGPDiscovery(DynamicBGPDiscoveryOptions{
+		RangesV4:        []string{"198.51.100.0/24", "203.0.113.0/24"},
+		RequireExternal: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{
+		"protocol bgp evobgp_discover_v4 from bgp_template",
+		"neighbor range 198.51.100.0/24 external;",
+		"neighbor range 203.0.113.0/24 external;",
+		`dynamic name "evobgp_dyn_";`,
+		"dynamic name digits 4;",
+		"multihop;",
+		"passive;",
+		"import none;",
+		"export none;",
+	} {
+		if !strings.Contains(out, want) {
+			t.Fatalf("missing %q in:\n%s", want, out)
+		}
+	}
+}
+
+func TestRenderDynamicBGPDiscovery_invalid(t *testing.T) {
+	_, err := RenderDynamicBGPDiscovery(DynamicBGPDiscoveryOptions{
+		RangesV4: []string{"not-a-cidr"},
+	})
+	if err == nil {
+		t.Fatal("expected error")
+	}
+}
+
+func TestParseDiscoveryRanges(t *testing.T) {
+	got := ParseDiscoveryRanges("198.51.100.0/24, 203.0.113.0/24\n198.51.100.0/24")
+	if len(got) != 2 {
+		t.Fatalf("got %v", got)
+	}
+}

internal/birdfmt/bgp_sessions.go

@@ -1,17 +1,28 @@
 package birdfmt
 
 import (
+	"strconv"
 	"strings"
 )
 
 // BGPSession is one BGP protocol block from `birdc show protocols all`.
 type BGPSession struct {
-	Name     string `json:"name"`
-	Neighbor string `json:"neighbor,omitempty"`
-	State    string `json:"state"`
+	Name       string `json:"name"`
+	Neighbor   string `json:"neighbor,omitempty"`
+	NeighborAS int64  `json:"neighbor_as,omitempty"`
+	NeighborID string `json:"neighbor_id,omitempty"`
+	State      string `json:"state"`
 }
 
-// ParseBGPSessions extracts BGP protocol name, state, and neighbor (if present) from birdc output.
+// DynamicPeerProtocolPrefix is the BIRD protocol name prefix for discovery-spawned sessions.
+const DynamicPeerProtocolPrefix = "evobgp_dyn_"
+
+// IsDynamicDiscoverySession reports whether the protocol was spawned by the discovery listener.
+func IsDynamicDiscoverySession(name string) bool {
+	return strings.HasPrefix(strings.TrimSpace(name), DynamicPeerProtocolPrefix)
+}
+
+// ParseBGPSessions extracts BGP protocol name, state, neighbor, Neighbor AS, and Neighbor ID from birdc output.
 func ParseBGPSessions(output string) []BGPSession {
 	var out []BGPSession
 	var cur *BGPSession
@@ -43,12 +54,41 @@ func ParseBGPSessions(output string) []BGPSession {
 		if cur == nil {
 			continue
 		}
-		for _, prefix := range []string{"Neighbor address:", "Neighbor Address:", "Neighbor:"} {
-			if idx := strings.Index(trim, prefix); idx >= 0 {
-				cur.Neighbor = strings.TrimSpace(trim[idx+len(prefix):])
-				break
-			}
-		}
+		parseBGPSessionDetailLine(cur, trim)
 	}
 	return out
 }
+
+func parseBGPSessionDetailLine(cur *BGPSession, trim string) {
+	for _, prefix := range []string{"Neighbor address:", "Neighbor Address:", "Neighbor:"} {
+		if idx := strings.Index(trim, prefix); idx >= 0 {
+			// Avoid matching "Neighbor AS:" / "Neighbor ID:" via bare "Neighbor:"
+			if prefix == "Neighbor:" {
+				rest := strings.TrimSpace(trim[idx+len(prefix):])
+				if strings.HasPrefix(strings.ToLower(rest), "as:") || strings.HasPrefix(strings.ToLower(rest), "id:") {
+					continue
+				}
+				if strings.Contains(strings.ToLower(trim), "neighbor as:") || strings.Contains(strings.ToLower(trim), "neighbor id:") {
+					continue
+				}
+			}
+			cur.Neighbor = strings.TrimSpace(trim[idx+len(prefix):])
+			return
+		}
+	}
+	for _, prefix := range []string{"Neighbor AS:", "Neighbor As:", "Neighbor as:"} {
+		if idx := strings.Index(trim, prefix); idx >= 0 {
+			raw := strings.TrimSpace(trim[idx+len(prefix):])
+			if n, err := strconv.ParseInt(raw, 10, 64); err == nil {
+				cur.NeighborAS = n
+			}
+			return
+		}
+	}
+	for _, prefix := range []string{"Neighbor ID:", "Neighbor Id:", "Neighbor id:", "BGP Identifier:", "BGP identifier:"} {
+		if idx := strings.Index(trim, prefix); idx >= 0 {
+			cur.NeighborID = strings.TrimSpace(trim[idx+len(prefix):])
+			return
+		}
+	}
+}

internal/birdfmt/bgp_sessions_test.go

@@ -10,17 +10,40 @@ device1    Device     ---        up     10:00:00
 evobgp_p_abc123 BGP      master4    up     10:00:05     Established
   Neighbor address: 198.51.100.2
   Neighbor AS:    65001
+  Neighbor ID:    192.0.2.50
 evobgp_p_def456 BGP      master4    up     10:00:06     Active
   Neighbor address: 2001:db8::2
+evobgp_dyn_0001 BGP      master4    up     10:00:07     Established
+  Neighbor address: 203.0.113.10
+  Neighbor AS:    65099
+  Neighbor ID:    203.0.113.10
 `
 	sessions := ParseBGPSessions(sample)
-	if len(sessions) != 2 {
-		t.Fatalf("got %d sessions want 2", len(sessions))
+	if len(sessions) != 3 {
+		t.Fatalf("got %d sessions want 3", len(sessions))
 	}
 	if sessions[0].Name != "evobgp_p_abc123" || sessions[0].State != "Established" || sessions[0].Neighbor != "198.51.100.2" {
 		t.Fatalf("session0: %+v", sessions[0])
 	}
+	if sessions[0].NeighborAS != 65001 || sessions[0].NeighborID != "192.0.2.50" {
+		t.Fatalf("session0 ids: as=%d id=%q", sessions[0].NeighborAS, sessions[0].NeighborID)
+	}
 	if sessions[1].Neighbor != "2001:db8::2" || sessions[1].State != "Active" {
 		t.Fatalf("session1: %+v", sessions[1])
 	}
+	if !IsDynamicDiscoverySession(sessions[2].Name) {
+		t.Fatalf("session2 should be dynamic: %+v", sessions[2])
+	}
+	if sessions[2].NeighborAS != 65099 || sessions[2].NeighborID != "203.0.113.10" {
+		t.Fatalf("session2 ids: %+v", sessions[2])
+	}
+}
+
+func TestIsDynamicDiscoverySession(t *testing.T) {
+	if !IsDynamicDiscoverySession("evobgp_dyn_0001") {
+		t.Fatal("expected true")
+	}
+	if IsDynamicDiscoverySession("evobgp_p_abc") {
+		t.Fatal("expected false")
+	}
 }

internal/birdfmt/scenarios_test.go

@@ -18,6 +18,7 @@ func TestBirdScenarioPaths_Table(t *testing.T) {
 		"bgp_ipv4_peer",
 		"bgp_ipv6_peer",
 		"domains_resolved",
+		"dynamic_discovery",
 		"empty_static",
 		"filter_export",
 		"large_prefix_list",

internal/birdfmt/testdata/scenarios/dynamic_discovery/bird.conf

@@ -0,0 +1,53 @@
+# tags: dynamic, discovery, bgp
+# Dynamic BGP discovery quarantine listener (neighbor range + import/export none).
+
+router id 192.0.2.1;
+
+protocol device {
+}
+
+protocol direct {
+    ipv4;
+    ipv6;
+}
+
+filter evobgp_export_v4 {
+    if net ~ [ 203.0.113.0/24 ] then accept;
+    reject;
+}
+
+filter evobgp_export_v6 {
+    reject;
+}
+
+template bgp bgp_template {
+    local as 65001;
+    ipv4 {
+        import none;
+        export filter evobgp_export_v4;
+    };
+    hold time 90;
+    keepalive time 30;
+}
+
+template bgp bgp_template_v6 {
+    local as 65001;
+    ipv6 {
+        import none;
+        export filter evobgp_export_v6;
+    };
+    hold time 90;
+    keepalive time 30;
+}
+
+protocol bgp evobgp_discover_v4 from bgp_template {
+    neighbor range 198.51.100.0/24 external;
+    dynamic name "evobgp_dyn_";
+    dynamic name digits 4;
+    multihop;
+    passive;
+    ipv4 {
+        import none;
+        export none;
+    };
+}

internal/httpapi/peers_discovery.go

@@ -0,0 +1,171 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/birdfmt"
+	"evobgp/internal/store"
+)
+
+func (s *Server) registerPeerDiscoveryRoutes(m *http.ServeMux) {
+	m.HandleFunc("GET /peers/discovered", s.handleListPeerDiscoveries)
+	m.HandleFunc("POST /peers/discovered/{id}/approve", s.handleApprovePeerDiscovery)
+	m.HandleFunc("POST /peers/discovered/{id}/reject", s.handleRejectPeerDiscovery)
+}
+
+func peerDiscoveryJSON(d *store.BGPPeerDiscovery) map[string]any {
+	if d == nil {
+		return nil
+	}
+	m := map[string]any{
+		"id":            d.ID,
+		"neighbor_id":   d.NeighborID,
+		"neighbor":      d.Neighbor,
+		"remote_asn":    d.RemoteASN,
+		"protocol_name": d.ProtocolName,
+		"session_state": d.SessionState,
+		"status":        d.Status,
+		"first_seen_at": d.FirstSeenAt.UTC().Format(time.RFC3339Nano),
+		"last_seen_at":  d.LastSeenAt.UTC().Format(time.RFC3339Nano),
+	}
+	if d.SpeakerID != "" {
+		m["speaker_id"] = d.SpeakerID
+	} else {
+		m["speaker_id"] = nil
+	}
+	if d.ApprovedPeerID != "" {
+		m["approved_peer_id"] = d.ApprovedPeerID
+	} else {
+		m["approved_peer_id"] = nil
+	}
+	return m
+}
+
+// syncPeerDiscoveriesFromLive upserts pending discoveries from dynamic BGP sessions.
+func (s *Server) syncPeerDiscoveriesFromLive(tenantID string, views []speakerBGPLive) {
+	if s.store == nil || tenantID == "" {
+		return
+	}
+	knownNeighbors := map[string]struct{}{}
+	for _, p := range s.store.ListPeers(tenantID) {
+		if p == nil {
+			continue
+		}
+		if n, ok := store.NormalizePeerNeighborString(p.Neighbor); ok {
+			knownNeighbors[n] = struct{}{}
+		}
+	}
+	now := time.Now().UTC()
+	for _, v := range views {
+		for _, sess := range v.Sessions {
+			if !birdfmt.IsDynamicDiscoverySession(sess.Name) {
+				continue
+			}
+			neighbor, ok := store.NormalizePeerNeighborString(sess.Neighbor)
+			if !ok {
+				continue
+			}
+			if _, known := knownNeighbors[neighbor]; known {
+				continue
+			}
+			_, _ = s.store.UpsertPeerDiscovery(tenantID, &store.PeerDiscoveryUpsert{
+				SpeakerID:    v.SpeakerID,
+				NeighborID:   strings.TrimSpace(sess.NeighborID),
+				Neighbor:     neighbor,
+				RemoteASN:    sess.NeighborAS,
+				ProtocolName: sess.Name,
+				SessionState: sess.State,
+				SeenAt:       now,
+			})
+		}
+	}
+}
+
+func (s *Server) handleListPeerDiscoveries(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok {
+		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
+		return
+	}
+	if !s.requirePerm(w, a, "bgp:network:read") {
+		return
+	}
+	status := strings.TrimSpace(r.URL.Query().Get("status"))
+	if status == "" {
+		status = store.PeerDiscoveryPending
+	}
+	// Refresh live discovery when listing pending.
+	if status == store.PeerDiscoveryPending || status == "all" {
+		views := s.collectSpeakerBGPLive(r.Context(), a.TenantID, true)
+		s.syncPeerDiscoveriesFromLive(a.TenantID, views)
+	}
+	listStatus := status
+	if status == "all" {
+		listStatus = ""
+	}
+	items, err := s.store.ListPeerDiscoveries(a.TenantID, listStatus)
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, d := range items {
+		out = append(out, peerDiscoveryJSON(d))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": out})
+}
+
+func (s *Server) handleApprovePeerDiscovery(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
+		return
+	}
+	var body struct {
+		Name         string  `json:"name"`
+		BGPSpeakerID *string `json:"bgp_speaker_id"`
+		Enabled      *bool   `json:"enabled"`
+	}
+	_ = json.NewDecoder(r.Body).Decode(&body)
+	peer, disc, err := s.store.ApprovePeerDiscovery(a.TenantID, r.PathValue("id"), &store.PeerDiscoveryApproveInput{
+		Name:      body.Name,
+		SpeakerID: body.BGPSpeakerID,
+		Enabled:   body.Enabled,
+	})
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	s.enqueuePeerReconcile(a.TenantID, "peer_discovery_approve")
+	s.recordCRUDAudit(r, a, "bgp.peer.discovery.approve", "Approved discovered peer "+peer.Neighbor, peer.ID, map[string]any{
+		"peer_id":      peer.ID,
+		"discovery_id": disc.ID,
+		"neighbor":     peer.Neighbor,
+		"neighbor_id":  disc.NeighborID,
+		"remote_asn":   peer.RemoteASN,
+	})
+	writeJSON(w, http.StatusOK, map[string]any{
+		"peer":      peerJSON(peer),
+		"discovery": peerDiscoveryJSON(disc),
+	})
+}
+
+func (s *Server) handleRejectPeerDiscovery(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
+		return
+	}
+	disc, err := s.store.RejectPeerDiscovery(a.TenantID, r.PathValue("id"))
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	s.recordCRUDAudit(r, a, "bgp.peer.discovery.reject", "Rejected discovered peer "+disc.Neighbor, disc.ID, map[string]any{
+		"discovery_id": disc.ID,
+		"neighbor":     disc.Neighbor,
+		"neighbor_id":  disc.NeighborID,
+	})
+	writeJSON(w, http.StatusOK, peerDiscoveryJSON(disc))
+}

internal/httpapi/peers_discovery_test.go

@@ -0,0 +1,113 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"evobgp/internal/store"
+)
+
+func TestPeerDiscoveryApproveReject(t *testing.T) {
+	srv, err := New(Options{InsecureDev: true, SeedDemo: true, BundleSeedHex: testBundleSeed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+	tenant, _, _, _, speaker := srv.Store().DemoIDs()
+	mustSetTestAPIKeys(t, srv, "edkey|"+tenant+"|operator")
+	h := srv.Handler()
+
+	disc, err := srv.Store().UpsertPeerDiscovery(tenant, &store.PeerDiscoveryUpsert{
+		SpeakerID:    speaker,
+		NeighborID:   "203.0.113.10",
+		Neighbor:     "203.0.113.10",
+		RemoteASN:    65099,
+		ProtocolName: "evobgp_dyn_0001",
+		SessionState: "Established",
+		SeenAt:       time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	listReq := httptest.NewRequest(http.MethodGet, "/v1/peers/discovered?status=pending", nil)
+	listReq.Header.Set("Authorization", "Bearer edkey")
+	listRec := httptest.NewRecorder()
+	h.ServeHTTP(listRec, listReq)
+	if listRec.Code != http.StatusOK {
+		t.Fatalf("list status %d body %s", listRec.Code, listRec.Body.String())
+	}
+
+	approveBody := `{"name":"client-a"}`
+	approveReq := httptest.NewRequest(http.MethodPost, "/v1/peers/discovered/"+disc.ID+"/approve", strings.NewReader(approveBody))
+	approveReq.Header.Set("Authorization", "Bearer edkey")
+	approveReq.Header.Set("Content-Type", "application/json")
+	approveRec := httptest.NewRecorder()
+	h.ServeHTTP(approveRec, approveReq)
+	if approveRec.Code != http.StatusOK {
+		t.Fatalf("approve status %d body %s", approveRec.Code, approveRec.Body.String())
+	}
+	var approveOut struct {
+		Peer struct {
+			ID       string `json:"id"`
+			Neighbor string `json:"neighbor"`
+			Name     string `json:"name"`
+		} `json:"peer"`
+	}
+	if err := json.Unmarshal(approveRec.Body.Bytes(), &approveOut); err != nil {
+		t.Fatal(err)
+	}
+	if approveOut.Peer.Neighbor != "203.0.113.10" || approveOut.Peer.Name != "client-a" {
+		t.Fatalf("unexpected peer: %+v", approveOut.Peer)
+	}
+
+	peers := srv.Store().ListPeers(tenant)
+	found := false
+	for _, p := range peers {
+		if p.ID == approveOut.Peer.ID {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Fatal("approved peer not in ListPeers")
+	}
+
+	disc2, err := srv.Store().UpsertPeerDiscovery(tenant, &store.PeerDiscoveryUpsert{
+		SpeakerID:    speaker,
+		NeighborID:   "198.51.100.99",
+		Neighbor:     "198.51.100.99",
+		RemoteASN:    65100,
+		ProtocolName: "evobgp_dyn_0002",
+		SessionState: "Active",
+		SeenAt:       time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rejReq := httptest.NewRequest(http.MethodPost, "/v1/peers/discovered/"+disc2.ID+"/reject", nil)
+	rejReq.Header.Set("Authorization", "Bearer edkey")
+	rejRec := httptest.NewRecorder()
+	h.ServeHTTP(rejRec, rejReq)
+	if rejRec.Code != http.StatusOK {
+		t.Fatalf("reject status %d body %s", rejRec.Code, rejRec.Body.String())
+	}
+	again, err := srv.Store().UpsertPeerDiscovery(tenant, &store.PeerDiscoveryUpsert{
+		NeighborID:   "198.51.100.99",
+		Neighbor:     "198.51.100.99",
+		RemoteASN:    65100,
+		ProtocolName: "evobgp_dyn_0002",
+		SessionState: "Established",
+		SeenAt:       time.Now().UTC(),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Status != store.PeerDiscoveryRejected {
+		t.Fatalf("expected rejected, got %s", again.Status)
+	}
+}

internal/httpapi/routes.go

@@ -83,6 +83,7 @@ func (s *Server) registerV1(m *http.ServeMux) {
 	m.HandleFunc("GET /speakers/{speaker_id}/bundle/{revision_id}", s.handleNodeBundle)
 	m.HandleFunc("POST /nodes/enroll", s.handleNodeEnroll)
 	s.registerCRUDRoutes(m)
+	s.registerAuditRoutes(m)
 	s.registerPostgresMonitoringRoutes(m)
 	s.registerPostgresMaintenanceRoutes(m)
 	s.registerMaintenanceRoutes(m)
@@ -298,6 +299,9 @@ func (s *Server) handleListPeers(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 12*time.Second)
 	defer cancel()
 	liveViews := s.collectSpeakerBGPLive(ctx, a.TenantID, fresh)
+	if fresh {
+		s.syncPeerDiscoveriesFromLive(a.TenantID, liveViews)
+	}
 	items := make([]map[string]any, 0, len(page))
 	for _, p := range page {
 		row := peerJSON(p)

internal/httpapi/routes_api_keys.go

@@ -131,6 +131,7 @@ func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&created.APIKey)
 	out["token"] = created.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.create", "Created API key "+created.Name, created.ID, map[string]any{"api_key_id": created.ID, "role": created.Role})
 	writeJSON(w, http.StatusCreated, out)
 }
 
@@ -187,6 +188,7 @@ func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.update", "Updated API key "+k.Name, k.ID, map[string]any{"api_key_id": k.ID, "role": k.Role})
 	writeJSON(w, http.StatusOK, apiKeyJSON(k))
 }
 
@@ -195,7 +197,8 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
-	if err := s.store.RevokeAPIKey(a.TenantID, r.PathValue("id")); err != nil {
+	keyID := r.PathValue("id")
+	if err := s.store.RevokeAPIKey(a.TenantID, keyID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
@@ -203,6 +206,7 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.revoke", "Revoked API key", keyID, map[string]any{"api_key_id": keyID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -222,5 +226,6 @@ func (s *Server) handleRotateAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&rotated.APIKey)
 	out["token"] = rotated.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.rotate", "Rotated API key "+rotated.Name, rotated.ID, map[string]any{"api_key_id": rotated.ID})
 	writeJSON(w, http.StatusOK, out)
 }

internal/httpapi/routes_audit.go

@@ -0,0 +1,171 @@
+package httpapi
+
+import (
+	"context"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/audit"
+	"evobgp/internal/store"
+)
+
+func (s *Server) registerAuditRoutes(m *http.ServeMux) {
+	m.HandleFunc("GET /audit", s.handleListAudit)
+}
+
+func (s *Server) handleListAudit(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") {
+		return
+	}
+	cursor := r.URL.Query().Get("cursor")
+	limit := parseLimitQuery(r, 20, 200)
+	filter := store.AuditListFilter{
+		Action:   strings.TrimSpace(r.URL.Query().Get("action")),
+		Severity: strings.TrimSpace(r.URL.Query().Get("severity")),
+	}
+	if filter.Severity != "" && !store.ValidAuditSeverity(filter.Severity) {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid severity")
+		return
+	}
+	items, next, hasMore, err := s.store.ListAudit(a.TenantID, cursor, limit, filter)
+	if err != nil {
+		writeInternalError(w, "audit_list", err)
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, row := range items {
+		out = append(out, auditEntryJSON(row))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": out, "next_cursor": next, "has_more": hasMore})
+}
+
+func auditEntryJSON(row *store.AuditEntry) map[string]any {
+	if row == nil {
+		return map[string]any{}
+	}
+	m := map[string]any{
+		"id":                   row.ID,
+		"tenant_id":            row.TenantID,
+		"event_id":             row.EventID,
+		"source_app":           row.SourceApp,
+		"action":               row.Action,
+		"severity":             row.Severity,
+		"actor_user_id":        strPtrOrNull(row.ActorUserID),
+		"actor_email":          strPtrOrNull(row.ActorEmail),
+		"actor_name":           strPtrOrNull(row.ActorName),
+		"actor_api_key_prefix": strPtrOrNull(row.ActorAPIKeyPrefix),
+		"target_type":          strPtrOrNull(row.TargetType),
+		"target_id":            strPtrOrNull(row.TargetID),
+		"summary":              row.Summary,
+		"details":              row.Details,
+		"ip":                   strPtrOrNull(row.IP),
+		"created_at":           row.CreatedAt.UTC().Format(time.RFC3339Nano),
+		"portal_pushed_at":     nil,
+	}
+	if row.PortalPushedAt != nil {
+		m["portal_pushed_at"] = row.PortalPushedAt.UTC().Format(time.RFC3339Nano)
+	}
+	if m["details"] == nil {
+		m["details"] = nil
+	}
+	return m
+}
+
+func (s *Server) recordCRUDAudit(r *http.Request, a Auth, action, summary, targetID string, details map[string]any) {
+	if s == nil || s.store == nil {
+		return
+	}
+	in := store.AuditAppendInput{
+		TenantID:   a.TenantID,
+		Action:     action,
+		Severity:   store.AuditSeverityInfo,
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   targetID,
+		Summary:    summary,
+		Details:    details,
+		IP:         clientIP(r),
+	}
+	fillAuditActor(&in, a)
+	entry, err := s.store.AppendAudit(in)
+	if err != nil {
+		log.Printf("httpapi: audit append action=%s: %v", action, err)
+		return
+	}
+	s.pushAuditToPortal(entry)
+}
+
+func fillAuditActor(in *store.AuditAppendInput, a Auth) {
+	if in == nil {
+		return
+	}
+	if a.Kind == AuthKindJWT {
+		in.ActorUserID = strings.TrimSpace(a.UserID)
+		in.ActorEmail = strings.TrimSpace(a.Email)
+		if in.ActorEmail != "" {
+			in.ActorName = in.ActorEmail
+		}
+		return
+	}
+	prefix := actorPrefix(a)
+	in.ActorAPIKeyPrefix = prefix
+	if prefix != "" {
+		in.ActorName = "apikey:" + prefix
+	}
+}
+
+func (s *Server) pushAuditToPortal(entry *store.AuditEntry) {
+	if s == nil || s.auditPusher == nil || entry == nil {
+		return
+	}
+	pusher := s.auditPusher
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+		defer cancel()
+		if err := pusher.PushEvent(ctx, entry); err != nil {
+			log.Printf("httpapi: audit portal push event_id=%s: %v", entry.EventID, err)
+		}
+	}()
+}
+
+func clientIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if xff := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); xff != "" {
+		parts := strings.Split(xff, ",")
+		if len(parts) > 0 {
+			return strings.TrimSpace(parts[0])
+		}
+	}
+	if xrip := strings.TrimSpace(r.Header.Get("X-Real-IP")); xrip != "" {
+		return xrip
+	}
+	host, _, err := net.SplitHostPort(strings.TrimSpace(r.RemoteAddr))
+	if err != nil {
+		return strings.TrimSpace(r.RemoteAddr)
+	}
+	return host
+}
+
+// initAuditPusher wires portal push when URL and secret are configured.
+func (s *Server) initAuditPusher(portalURL, ingestSecret string) {
+	base := strings.TrimSpace(portalURL)
+	secret := strings.TrimSpace(ingestSecret)
+	if base == "" || secret == "" {
+		return
+	}
+	s.auditPusher = &audit.PortalPusher{
+		BaseURL: base,
+		Secret:  secret,
+		MarkPushed: func(id string) error {
+			if s.store == nil {
+				return nil
+			}
+			return s.store.MarkAuditPortalPushed(id)
+		},
+	}
+}

internal/httpapi/routes_audit_test.go

@@ -0,0 +1,52 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"evobgp/internal/store"
+)
+
+func TestHandleListAudit(t *testing.T) {
+	mem := store.NewMemory()
+	mem.SeedDemo()
+	tenant, _, _, _, _ := mem.DemoIDs()
+
+	srv, err := New(Options{SeedDemo: false, InsecureDev: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.store = mem
+
+	_, err = mem.AppendAudit(store.AuditAppendInput{
+		TenantID: tenant,
+		Action:   "bgp.module.create",
+		Summary:  "Created module demo",
+		TargetID: "mod-x",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	rec := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body struct {
+		Items []map[string]any `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if len(body.Items) != 1 {
+		t.Fatalf("items=%d", len(body.Items))
+	}
+	if body.Items[0]["action"] != "bgp.module.create" {
+		t.Fatalf("action=%v", body.Items[0]["action"])
+	}
+}

internal/httpapi/routes_community_prefixes_test.go

@@ -0,0 +1,106 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+)
+
+func TestListCommunityPrefixesByIDAndLabel(t *testing.T) {
+	srv, err := New(Options{
+		InsecureDev: true,
+		SeedDemo:    true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer srv.Close()
+
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	mustSetTestAPIKeys(t, srv, "vwkey|"+tenant+"|viewer")
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+	client := ts.Client()
+	base := ts.URL
+
+	reqList, _ := http.NewRequest(http.MethodGet, base+"/v1/communities?limit=10", nil)
+	reqList.Header.Set("Authorization", "Bearer vwkey")
+	respList, err := client.Do(reqList)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respList.Body.Close() }()
+	if respList.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respList.Body)
+		t.Fatalf("communities status %d: %s", respList.StatusCode, b)
+	}
+	var listBody struct {
+		Items []struct {
+			ID        string `json:"id"`
+			Community string `json:"community"`
+			Title     string `json:"title"`
+		} `json:"items"`
+	}
+	if err := json.NewDecoder(respList.Body).Decode(&listBody); err != nil {
+		t.Fatal(err)
+	}
+	if len(listBody.Items) == 0 {
+		t.Fatal("expected seeded community")
+	}
+	comm := listBody.Items[0]
+
+	assertPrefixesOK := func(t *testing.T, path string) {
+		t.Helper()
+		req, _ := http.NewRequest(http.MethodGet, base+path, nil)
+		req.Header.Set("Authorization", "Bearer vwkey")
+		resp, err := client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer func() { _ = resp.Body.Close() }()
+		if resp.StatusCode != http.StatusOK {
+			b, _ := io.ReadAll(resp.Body)
+			t.Fatalf("%s status %d: %s", path, resp.StatusCode, b)
+		}
+		var body struct {
+			Items    []map[string]any `json:"items"`
+			Prefixes []string         `json:"prefixes"`
+			HasMore  bool             `json:"has_more"`
+		}
+		if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+			t.Fatal(err)
+		}
+		if body.Items == nil {
+			t.Fatalf("%s: expected items array (got nil)", path)
+		}
+		if body.Prefixes == nil {
+			t.Fatalf("%s: expected prefixes array (got nil)", path)
+		}
+	}
+
+	// UUID id
+	assertPrefixesOK(t, "/v1/communities/"+comm.ID+"/prefixes?limit=100")
+	// Community string (legacy / autocomplete label without title)
+	assertPrefixesOK(t, "/v1/communities/"+url.PathEscape(comm.Community)+"/prefixes?limit=100")
+	if comm.Title != "" {
+		// Full Base UI {value,label} display string
+		label := comm.Community + " · " + comm.Title
+		assertPrefixesOK(t, "/v1/communities/"+url.PathEscape(label)+"/prefixes?limit=100")
+	}
+
+	req404, _ := http.NewRequest(http.MethodGet, base+"/v1/communities/missing-community/prefixes", nil)
+	req404.Header.Set("Authorization", "Bearer vwkey")
+	resp404, err := client.Do(req404)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp404.Body.Close() }()
+	if resp404.StatusCode != http.StatusNotFound {
+		b, _ := io.ReadAll(resp404.Body)
+		t.Fatalf("expected 404, got %d: %s", resp404.StatusCode, b)
+	}
+}

internal/httpapi/routes_crud.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -56,6 +57,7 @@ func (s *Server) registerCRUDRoutes(m *http.ServeMux) {
 
 	m.HandleFunc("GET /communities", s.handleListComm)
 	m.HandleFunc("POST /communities", s.handlePostComm)
+	m.HandleFunc("GET /communities/{id}/prefixes", s.handleListCommPrefixes)
 	m.HandleFunc("GET /communities/{id}", s.handleGetComm)
 	m.HandleFunc("PATCH /communities/{id}", s.handlePatchComm)
 	m.HandleFunc("DELETE /communities/{id}", s.handleDeleteComm)
@@ -64,6 +66,7 @@ func (s *Server) registerCRUDRoutes(m *http.ServeMux) {
 	m.HandleFunc("GET /peers/{id}", s.handleGetPeer)
 	m.HandleFunc("PATCH /peers/{id}", s.handlePatchPeer)
 	m.HandleFunc("DELETE /peers/{id}", s.handleDeletePeer)
+	s.registerPeerDiscoveryRoutes(m)
 
 	m.HandleFunc("POST /speakers", s.handlePostSpeaker)
 	m.HandleFunc("GET /speakers/{speaker_id}", s.handleGetSpeakerByID)
@@ -113,6 +116,7 @@ func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.create", "Created module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "type": mod.Type, "name": mod.Name})
 	writeJSON(w, http.StatusCreated, moduleJSON(mod))
 }
 
@@ -174,6 +178,7 @@ func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.update", "Updated module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "name": mod.Name})
 	writeJSON(w, http.StatusOK, moduleJSON(mod))
 }
 
@@ -193,6 +198,7 @@ func (s *Server) handleDeleteModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.delete", "Deleted module", moduleID, map[string]any{"module_id": moduleID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -227,6 +233,9 @@ func writePostgresStoreErr(w http.ResponseWriter, err error) bool {
 	case "23505":
 		writeProblem(w, http.StatusConflict, "Conflict", "resource already exists")
 		return true
+	case "22P02":
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid id format")
+		return true
 	}
 	return false
 }
@@ -369,6 +378,7 @@ func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.create", "Created CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID, "url": x.URL})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_create")
 	writeJSON(w, http.StatusCreated, cdnSourceJSON(x))
 }
@@ -399,6 +409,7 @@ func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.update", "Updated CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_patch")
 	writeJSON(w, http.StatusOK, cdnSourceJSON(x))
 }
@@ -409,10 +420,12 @@ func (s *Server) handleDeleteCDNSource(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteCDNSource(a.TenantID, mid, r.PathValue("source_id")); err != nil {
+	sourceID := r.PathValue("source_id")
+	if err := s.store.DeleteCDNSource(a.TenantID, mid, sourceID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.delete", "Deleted CDN source", sourceID, map[string]any{"module_id": mid, "source_id": sourceID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -471,6 +484,7 @@ func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.create", "Created AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_create")
 	writeJSON(w, http.StatusCreated, asEntryJSON(x))
 }
@@ -491,6 +505,7 @@ func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.update", "Updated AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_patch")
 	writeJSON(w, http.StatusOK, asEntryJSON(x))
 }
@@ -501,10 +516,12 @@ func (s *Server) handleDeleteAS(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteASEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteASEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.delete", "Deleted AS entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -548,6 +565,7 @@ func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.create", "Created domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_create")
 	writeJSON(w, http.StatusCreated, domainEntryJSON(x))
 }
@@ -568,6 +586,7 @@ func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.update", "Updated domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_patch")
 	writeJSON(w, http.StatusOK, domainEntryJSON(x))
 }
@@ -578,10 +597,12 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteDomainEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteDomainEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.delete", "Deleted domain entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -625,6 +646,7 @@ func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.create", "Created IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_create")
 	writeJSON(w, http.StatusCreated, ipRangeJSON(x))
 }
@@ -645,6 +667,7 @@ func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.update", "Updated IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_patch")
 	writeJSON(w, http.StatusOK, ipRangeJSON(x))
 }
@@ -655,10 +678,12 @@ func (s *Server) handleDeleteIPRange(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.delete", "Deleted IP range entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -850,6 +875,7 @@ func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.create", "Created DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusCreated, dohJSON(x))
 }
 
@@ -868,6 +894,7 @@ func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.update", "Updated DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusOK, dohJSON(x))
 }
 
@@ -876,10 +903,12 @@ func (s *Server) handleDeleteDoh(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteDohProfile(a.TenantID, r.PathValue("id")); err != nil {
+	profileID := r.PathValue("id")
+	if err := s.store.DeleteDohProfile(a.TenantID, profileID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.delete", "Deleted DoH profile", profileID, map[string]any{"profile_id": profileID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -921,6 +950,39 @@ func (s *Server) handleGetComm(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, commJSON(x))
 }
 
+func (s *Server) handleListCommPrefixes(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
+		return
+	}
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	if limit == 0 {
+		limit = 500
+	}
+	cursor := r.URL.Query().Get("cursor")
+	rows, next, more, err := s.store.ListCommunityPrefixes(a.TenantID, r.PathValue("id"), cursor, limit)
+	if err != nil {
+		writeStoreErr(w, err)
+		return
+	}
+	items := make([]map[string]any, 0, len(rows))
+	prefixes := make([]string, 0, len(rows))
+	for _, pr := range rows {
+		m := map[string]any{"prefix": pr.Prefix}
+		if pr.Source != "" {
+			m["source"] = pr.Source
+		}
+		items = append(items, m)
+		prefixes = append(prefixes, pr.Prefix)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"items":       items,
+		"prefixes":    prefixes,
+		"next_cursor": strPtrOrNull(next),
+		"has_more":    more,
+	})
+}
+
 func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
 	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
@@ -936,6 +998,7 @@ func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.create", "Created community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusCreated, commJSON(x))
 }
 
@@ -954,6 +1017,7 @@ func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.update", "Updated community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusOK, commJSON(x))
 }
 
@@ -962,10 +1026,12 @@ func (s *Server) handleDeleteComm(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteCommunity(a.TenantID, r.PathValue("id")); err != nil {
+	commID := r.PathValue("id")
+	if err := s.store.DeleteCommunity(a.TenantID, commID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.delete", "Deleted community", commID, map[string]any{"community_id": commID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -988,6 +1054,7 @@ func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.create", "Created BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_create")
 	writeJSON(w, http.StatusCreated, peerJSON(x))
 }
@@ -1031,6 +1098,7 @@ func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.update", "Updated BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_patch")
 	writeJSON(w, http.StatusOK, peerJSON(x))
 }
@@ -1051,6 +1119,7 @@ func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.delete", "Deleted BGP peer", peerID, map[string]any{"peer_id": peerID})
 	s.enqueuePeerReconcile(a.TenantID, "peer_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -1074,6 +1143,7 @@ func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.create", "Created speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	resp := speakerJSONFromStore(s.store, x)
 	if meta := store.ParseSpeakerMeta(x.MetaJSON); meta.AgentSecret != "" {
 		resp["agent_secret"] = meta.AgentSecret
@@ -1109,6 +1179,7 @@ func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.update", "Updated speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	writeJSON(w, http.StatusOK, speakerJSONFromStore(s.store, x))
 }
 
@@ -1117,10 +1188,12 @@ func (s *Server) handleDeleteSpeaker(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
-	if err := s.store.DeleteSpeaker(a.TenantID, r.PathValue("speaker_id")); err != nil {
+	speakerID := r.PathValue("speaker_id")
+	if err := s.store.DeleteSpeaker(a.TenantID, speakerID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.delete", "Deleted speaker", speakerID, map[string]any{"speaker_id": speakerID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -1187,9 +1260,39 @@ func (s *Server) handlePatchSettings(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	if peerDiscoverySettingsChanged(body) {
+		s.enqueuePeerReconcile(a.TenantID, "peer_discovery_settings")
+	}
+	s.recordCRUDAudit(r, a, "bgp.settings.update", "Updated tenant settings", a.TenantID, map[string]any{"keys": settingsAuditKeys(body)})
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+func peerDiscoverySettingsChanged(body map[string]any) bool {
+	for _, k := range []string{
+		"peer_discovery_enabled",
+		"peer_discovery_ranges_v4",
+		"peer_discovery_ranges_v6",
+		"peer_discovery_require_external",
+	} {
+		if _, ok := body[k]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+func settingsAuditKeys(body map[string]any) []string {
+	if len(body) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(body))
+	for k := range body {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
 func parseRevisionRetentionMinutes(v any) (int, bool) {
 	const minMinutes = 15
 	const maxMinutes = 30 * 24 * 60

internal/httpapi/server.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"evobgp/internal/audit"
 	"evobgp/internal/jobs"
 	"evobgp/internal/maintenance"
 	"evobgp/internal/pgmonitor"
@@ -38,11 +39,13 @@ type Server struct {
 	mux                     *http.ServeMux
 
 	// Portal / dual-auth (JWT) configuration.
-	jwtSecret      string
-	authIssuer     string
-	authPortalURL  string
-	portalTenantID string
-	authRequired   bool
+	jwtSecret         string
+	authIssuer        string
+	authPortalURL     string
+	portalTenantID    string
+	authRequired      bool
+	auditIngestSecret string
+	auditPusher       *audit.PortalPusher
 }
 
 // Options configures the API server.
@@ -63,6 +66,8 @@ type Options struct {
 	AuthPortalURL  string // AUTH_PORTAL_URL (returned by /v1/auth/config for the UI)
 	PortalTenantID string // fallback when JWT has no bgp_tenant_id / tenants.bgp
 	AuthRequired   bool   // AUTH_REQUIRED / EVOBGP_AUTH_REQUIRED (surfaced via /v1/auth/config)
+	// AuditIngestSecret — AUTH_AUDIT_INGEST_SECRET for portal push (optional).
+	AuditIngestSecret string
 }
 
 // New constructs Server and wiring for async jobs.
@@ -123,10 +128,12 @@ func New(opts Options) (*Server, error) {
 		authPortalURL:           strings.TrimSpace(opts.AuthPortalURL),
 		portalTenantID:          strings.TrimSpace(opts.PortalTenantID),
 		authRequired:            opts.AuthRequired,
+		auditIngestSecret:       strings.TrimSpace(opts.AuditIngestSecret),
 	}
 	if s.authIssuer == "" {
 		s.authIssuer = "https://auth.shnt.top"
 	}
+	s.initAuditPusher(s.authPortalURL, s.auditIngestSecret)
 	s.mux = http.NewServeMux()
 	s.registerRoutes()
 	return s, nil

internal/pipeline/refresh.go

@@ -940,6 +940,50 @@ func uint32FromSettingsMap(m map[string]any, key string) uint32 {
 	return 0
 }
 
+func boolFromSettingsMap(m map[string]any, key string, defaultVal bool) bool {
+	v, ok := m[key]
+	if !ok || v == nil {
+		return defaultVal
+	}
+	switch x := v.(type) {
+	case bool:
+		return x
+	case float64:
+		return x != 0
+	case int:
+		return x != 0
+	case string:
+		s := strings.ToLower(strings.TrimSpace(x))
+		if s == "true" || s == "1" || s == "yes" {
+			return true
+		}
+		if s == "false" || s == "0" || s == "no" {
+			return false
+		}
+	}
+	return defaultVal
+}
+
+func renderPeerDiscoveryBirdFragment(st store.Backend, tenantID string) (string, error) {
+	settings, err := st.ListGlobalSettings(tenantID)
+	if err != nil || settings == nil {
+		return "", nil
+	}
+	if !boolFromSettingsMap(settings, "peer_discovery_enabled", false) {
+		return "", nil
+	}
+	rangesV4 := birdfmt.ParseDiscoveryRanges(stringFromSettingsMap(settings, "peer_discovery_ranges_v4"))
+	rangesV6 := birdfmt.ParseDiscoveryRanges(stringFromSettingsMap(settings, "peer_discovery_ranges_v6"))
+	if len(rangesV4) == 0 && len(rangesV6) == 0 {
+		return "", nil
+	}
+	return birdfmt.RenderDynamicBGPDiscovery(birdfmt.DynamicBGPDiscoveryOptions{
+		RangesV4:        rangesV4,
+		RangesV6:        rangesV6,
+		RequireExternal: boolFromSettingsMap(settings, "peer_discovery_require_external", true),
+	})
+}
+
 func intFromSettingsMap(m map[string]any, key string) int {
 	v, ok := m[key]
 	if !ok || v == nil {
@@ -1004,6 +1048,11 @@ func renderPeersBirdFragment(st store.Backend, tenantID string, loc birdLocals)
 	peers := st.ListPeers(tenantID)
 	var parts []string
 	parts = append(parts, birdfmt.ManagedBanner("peers"))
+	if disc, err := renderPeerDiscoveryBirdFragment(st, tenantID); err != nil {
+		return "", err
+	} else if disc != "" {
+		parts = append(parts, disc)
+	}
 	for _, p := range peers {
 		if p == nil || !p.Enabled {
 			continue

internal/repository/postgres.go

@@ -1237,12 +1237,32 @@ func (p *Postgres) ListCommunities(tenantID string) ([]*store.Community, error)
 	return out, nil
 }
 
-func (p *Postgres) GetCommunity(tenantID, id string) (*store.Community, error) {
+func (p *Postgres) GetCommunity(tenantID, idOrKey string) (*store.Community, error) {
 	ctx := context.Background()
+	key := strings.TrimSpace(idOrKey)
+	if key == "" {
+		return nil, store.ErrNotFound
+	}
 	var c store.Community
 	c.TenantID = tenantID
-	err := p.pool.QueryRow(ctx, `SELECT id::text, community, title, value_json::text FROM bgp_community WHERE id=$1 AND tenant_id=$2`, id, tenantID).Scan(
-		&c.ID, &c.Community, &c.Title, &c.ValueJSON)
+	// Prefer UUID id; fall back to community / title so clients that store the
+	// autocomplete label (Base UI {value,label} → label) still resolve.
+	var err error
+	if _, perr := uuid.Parse(key); perr == nil {
+		err = p.pool.QueryRow(ctx, `SELECT id::text, community, title, value_json::text FROM bgp_community WHERE id=$1 AND tenant_id=$2`, key, tenantID).Scan(
+			&c.ID, &c.Community, &c.Title, &c.ValueJSON)
+	} else {
+		err = p.pool.QueryRow(ctx, `
+			SELECT id::text, community, title, value_json::text FROM bgp_community
+			WHERE tenant_id=$1 AND (
+				community = $2
+				OR title = $2
+				OR (NULLIF(trim(title), '') IS NOT NULL AND (community || ' · ' || title) = $2)
+			)
+			ORDER BY community
+			LIMIT 1`, tenantID, key).Scan(
+			&c.ID, &c.Community, &c.Title, &c.ValueJSON)
+	}
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, store.ErrNotFound
@@ -1252,6 +1272,91 @@ func (p *Postgres) GetCommunity(tenantID, id string) (*store.Community, error) {
 	return &c, nil
 }
 
+func (p *Postgres) ListCommunityPrefixes(tenantID, communityID, cursor string, limit int) ([]store.PrefixRow, string, bool, error) {
+	comm, err := p.GetCommunity(tenantID, communityID)
+	if err != nil {
+		return nil, "", false, err
+	}
+	resolvedID := comm.ID
+	if limit <= 0 {
+		limit = 500
+	}
+	if limit > 5000 {
+		limit = 5000
+	}
+	off := 0
+	if cursor != "" {
+		if n, err := strconv.Atoi(cursor); err == nil && n >= 0 {
+			off = n
+		}
+	}
+	ctx := context.Background()
+	useSnap := prefixSnapshotTableExists(ctx, p.pool)
+	var rows pgx.Rows
+	if useSnap {
+		rows, err = p.pool.Query(ctx, `
+			WITH latest AS (
+				SELECT DISTINCT ON (module_id) id, prefix_snapshot_id
+				FROM config_revision
+				WHERE tenant_id = $1::uuid AND module_id IS NOT NULL
+				ORDER BY module_id, created_at DESC
+			),
+			combined AS (
+				SELECT rmp.prefix::text AS prefix, COALESCE(rmp.source, '') AS source
+				FROM revision_materialized_prefix rmp
+				JOIN latest l ON l.id = rmp.revision_id
+				WHERE l.prefix_snapshot_id IS NULL AND rmp.community_id = $2::uuid
+				UNION
+				SELECT psr.prefix::text, COALESCE(psr.source, '')
+				FROM prefix_snapshot_row psr
+				JOIN latest l ON l.prefix_snapshot_id = psr.snapshot_id
+				WHERE l.prefix_snapshot_id IS NOT NULL AND psr.community_id = $2::uuid
+			)
+			SELECT prefix, source FROM combined
+			ORDER BY prefix
+			LIMIT $3 OFFSET $4`, tenantID, resolvedID, limit+1, off)
+	} else {
+		rows, err = p.pool.Query(ctx, `
+			WITH latest AS (
+				SELECT DISTINCT ON (module_id) id
+				FROM config_revision
+				WHERE tenant_id = $1::uuid AND module_id IS NOT NULL
+				ORDER BY module_id, created_at DESC
+			)
+			SELECT DISTINCT rmp.prefix::text, COALESCE(rmp.source, '')
+			FROM revision_materialized_prefix rmp
+			JOIN latest l ON l.id = rmp.revision_id
+			WHERE rmp.community_id = $2::uuid
+			ORDER BY 1
+			LIMIT $3 OFFSET $4`, tenantID, resolvedID, limit+1, off)
+	}
+	if err != nil {
+		return nil, "", false, err
+	}
+	defer rows.Close()
+	var all []store.PrefixRow
+	for rows.Next() {
+		var pr store.PrefixRow
+		if err := rows.Scan(&pr.Prefix, &pr.Source); err != nil {
+			continue
+		}
+		pr.CommunityID = &resolvedID
+		all = append(all, pr)
+	}
+	more := len(all) > limit
+	if more {
+		all = all[:limit]
+	}
+	next := ""
+	if more {
+		next = fmt.Sprintf("%d", off+limit)
+	}
+	if len(all) == 0 {
+		return nil, "", false, nil
+	}
+	return all, next, more, nil
+}
+
 func (p *Postgres) CreateCommunity(tenantID string, in *store.Community) (*store.Community, error) {
 	if in == nil {
 		return nil, store.ErrInvalidInput

internal/repository/postgres_audit.go

@@ -0,0 +1,186 @@
+package repository
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"evobgp/internal/store"
+)
+
+// AppendAudit inserts a tenant-scoped audit row.
+func (p *Postgres) AppendAudit(in store.AuditAppendInput) (*store.AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, store.ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = store.AuditSeverityInfo
+	}
+	if !store.ValidAuditSeverity(sev) {
+		return nil, store.ErrInvalidInput
+	}
+	ctx := context.Background()
+	id := uuid.NewString()
+	eventID := "bgp-" + uuid.NewString()
+	var detailJSON []byte
+	if in.Details != nil {
+		detailJSON, _ = json.Marshal(in.Details)
+	}
+	var createdAt time.Time
+	err := p.pool.QueryRow(ctx, `
+		INSERT INTO audit_log
+			(id, tenant_id, event_id, source_app, action, severity,
+			 actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+			 target_type, target_id, summary, details_json, ip, created_at)
+		VALUES ($1, $2, $3, 'bgp', $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, now())
+		RETURNING created_at`,
+		id, strings.TrimSpace(in.TenantID), eventID, strings.TrimSpace(in.Action), sev,
+		nullIfEmpty(in.ActorUserID), nullIfEmpty(in.ActorEmail), nullIfEmpty(in.ActorName),
+		nullIfEmpty(in.ActorAPIKeyPrefix), nullIfEmpty(in.TargetType), nullIfEmpty(in.TargetID),
+		strings.TrimSpace(in.Summary), nullJSONBytes(detailJSON), nullIfEmpty(in.IP),
+	).Scan(&createdAt)
+	if err != nil {
+		return nil, err
+	}
+	return &store.AuditEntry{
+		ID:                id,
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           eventID,
+		SourceApp:         store.AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         createdAt.UTC(),
+	}, nil
+}
+
+// ListAudit returns paginated audit rows for a tenant.
+func (p *Postgres) ListAudit(tenantID, cursor string, limit int, filter store.AuditListFilter) ([]*store.AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	off := 0
+	if cursor != "" {
+		if n, err := strconv.Atoi(cursor); err == nil && n >= 0 {
+			off = n
+		}
+	}
+	ctx := context.Background()
+	args := []any{tenantID}
+	where := "tenant_id = $1"
+	argN := 2
+	if a := strings.TrimSpace(filter.Action); a != "" {
+		where += " AND action = $" + strconv.Itoa(argN)
+		args = append(args, a)
+		argN++
+	}
+	if s := strings.TrimSpace(filter.Severity); s != "" {
+		where += " AND severity = $" + strconv.Itoa(argN)
+		args = append(args, s)
+		argN++
+	}
+	args = append(args, limit+1, off)
+	q := `
+		SELECT id, tenant_id, event_id, source_app, action, severity,
+		       actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+		       target_type, target_id, summary, details_json, ip, created_at, portal_pushed_at
+		FROM audit_log
+		WHERE ` + where + `
+		ORDER BY created_at DESC, id DESC
+		LIMIT $` + strconv.Itoa(argN) + ` OFFSET $` + strconv.Itoa(argN+1)
+	rows, err := p.pool.Query(ctx, q, args...)
+	if err != nil {
+		return nil, "", false, err
+	}
+	defer rows.Close()
+	var out []*store.AuditEntry
+	for rows.Next() {
+		row, err := scanAuditEntry(rows.Scan)
+		if err != nil {
+			return nil, "", false, err
+		}
+		out = append(out, row)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, "", false, err
+	}
+	more := len(out) > limit
+	if more {
+		out = out[:limit]
+	}
+	next := ""
+	if more {
+		next = strconv.Itoa(off + limit)
+	}
+	return out, next, more, nil
+}
+
+// MarkAuditPortalPushed sets portal_pushed_at for a row.
+func (p *Postgres) MarkAuditPortalPushed(id string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `UPDATE audit_log SET portal_pushed_at = now() WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func scanAuditEntry(scan func(dest ...any) error) (*store.AuditEntry, error) {
+	var row store.AuditEntry
+	var actorUserID, actorEmail, actorName, actorPrefix, targetType, targetID, ip *string
+	var detailRaw []byte
+	var portalPushed *time.Time
+	if err := scan(
+		&row.ID, &row.TenantID, &row.EventID, &row.SourceApp, &row.Action, &row.Severity,
+		&actorUserID, &actorEmail, &actorName, &actorPrefix,
+		&targetType, &targetID, &row.Summary, &detailRaw, &ip, &row.CreatedAt, &portalPushed,
+	); err != nil {
+		return nil, err
+	}
+	row.CreatedAt = row.CreatedAt.UTC()
+	if actorUserID != nil {
+		row.ActorUserID = *actorUserID
+	}
+	if actorEmail != nil {
+		row.ActorEmail = *actorEmail
+	}
+	if actorName != nil {
+		row.ActorName = *actorName
+	}
+	if actorPrefix != nil {
+		row.ActorAPIKeyPrefix = *actorPrefix
+	}
+	if targetType != nil {
+		row.TargetType = *targetType
+	}
+	if targetID != nil {
+		row.TargetID = *targetID
+	}
+	if ip != nil {
+		row.IP = *ip
+	}
+	if len(detailRaw) > 0 {
+		_ = json.Unmarshal(detailRaw, &row.Details)
+	}
+	if portalPushed != nil {
+		t := portalPushed.UTC()
+		row.PortalPushedAt = &t
+	}
+	return &row, nil
+}

internal/repository/postgres_peer_discovery.go

@@ -0,0 +1,274 @@
+package repository
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"time"
+
+	"evobgp/internal/store"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+)
+
+func (p *Postgres) ListPeerDiscoveries(tenantID, status string) ([]*store.BGPPeerDiscovery, error) {
+	ctx := context.Background()
+	status = strings.TrimSpace(strings.ToLower(status))
+	q := `
+		SELECT id::text, tenant_id::text, COALESCE(speaker_id::text,''), COALESCE(neighbor_id,''),
+			neighbor::text, remote_asn, COALESCE(protocol_name,''), COALESCE(session_state,''),
+			status, first_seen_at, last_seen_at, COALESCE(approved_peer_id::text,'')
+		FROM bgp_peer_discovery WHERE tenant_id=$1`
+	args := []any{tenantID}
+	if status != "" {
+		q += ` AND status=$2`
+		args = append(args, status)
+	}
+	q += ` ORDER BY last_seen_at DESC`
+	rows, err := p.pool.Query(ctx, q, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []*store.BGPPeerDiscovery
+	for rows.Next() {
+		d, err := scanPeerDiscovery(rows)
+		if err != nil {
+			continue
+		}
+		out = append(out, d)
+	}
+	return out, nil
+}
+
+func (p *Postgres) GetPeerDiscovery(tenantID, id string) (*store.BGPPeerDiscovery, error) {
+	ctx := context.Background()
+	row := p.pool.QueryRow(ctx, `
+		SELECT id::text, tenant_id::text, COALESCE(speaker_id::text,''), COALESCE(neighbor_id,''),
+			neighbor::text, remote_asn, COALESCE(protocol_name,''), COALESCE(session_state,''),
+			status, first_seen_at, last_seen_at, COALESCE(approved_peer_id::text,'')
+		FROM bgp_peer_discovery WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	d, err := scanPeerDiscovery(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, err
+	}
+	return d, nil
+}
+
+type peerDiscoveryScanner interface {
+	Scan(dest ...any) error
+}
+
+func scanPeerDiscovery(row peerDiscoveryScanner) (*store.BGPPeerDiscovery, error) {
+	var d store.BGPPeerDiscovery
+	var first, last time.Time
+	err := row.Scan(
+		&d.ID, &d.TenantID, &d.SpeakerID, &d.NeighborID,
+		&d.Neighbor, &d.RemoteASN, &d.ProtocolName, &d.SessionState,
+		&d.Status, &first, &last, &d.ApprovedPeerID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	d.FirstSeenAt = first.UTC()
+	d.LastSeenAt = last.UTC()
+	return &d, nil
+}
+
+func (p *Postgres) UpsertPeerDiscovery(tenantID string, in *store.PeerDiscoveryUpsert) (*store.BGPPeerDiscovery, error) {
+	if in == nil {
+		return nil, store.ErrInvalidInput
+	}
+	neighbor, ok := store.NormalizePeerNeighborString(in.Neighbor)
+	if !ok {
+		return nil, store.ErrInvalidInput
+	}
+	neighborID := strings.TrimSpace(in.NeighborID)
+	seenAt := in.SeenAt
+	if seenAt.IsZero() {
+		seenAt = time.Now().UTC()
+	}
+	ctx := context.Background()
+
+	var existingID string
+	if neighborID != "" {
+		_ = p.pool.QueryRow(ctx, `
+			SELECT id::text FROM bgp_peer_discovery
+			WHERE tenant_id=$1 AND neighbor_id=$2 LIMIT 1`, tenantID, neighborID).Scan(&existingID)
+	}
+	if existingID == "" {
+		_ = p.pool.QueryRow(ctx, `
+			SELECT id::text FROM bgp_peer_discovery
+			WHERE tenant_id=$1 AND neighbor=$2::inet AND remote_asn=$3 AND neighbor_id='' LIMIT 1`,
+			tenantID, neighbor, in.RemoteASN).Scan(&existingID)
+	}
+	if existingID != "" {
+		cur, err := p.GetPeerDiscovery(tenantID, existingID)
+		if err != nil {
+			return nil, err
+		}
+		if cur.Status == store.PeerDiscoveryRejected {
+			return cur, nil
+		}
+		var sp any
+		if s := strings.TrimSpace(in.SpeakerID); s != "" {
+			sp = s
+		}
+		_, err = p.pool.Exec(ctx, `
+			UPDATE bgp_peer_discovery SET
+				neighbor=$3::inet, remote_asn=$4,
+				neighbor_id=CASE WHEN $5 <> '' THEN $5 ELSE neighbor_id END,
+				protocol_name=$6, session_state=$7, last_seen_at=$8,
+				speaker_id=COALESCE($9::uuid, speaker_id),
+				updated_at=now()
+			WHERE id=$1 AND tenant_id=$2 AND status <> 'rejected'`,
+			existingID, tenantID, neighbor, in.RemoteASN, neighborID,
+			strings.TrimSpace(in.ProtocolName), strings.TrimSpace(in.SessionState), seenAt, sp)
+		if err != nil {
+			return nil, err
+		}
+		return p.GetPeerDiscovery(tenantID, existingID)
+	}
+
+	id := uuid.NewString()
+	var sp any
+	if s := strings.TrimSpace(in.SpeakerID); s != "" {
+		sp = s
+	}
+	_, err := p.pool.Exec(ctx, `
+		INSERT INTO bgp_peer_discovery (
+			id, tenant_id, speaker_id, neighbor_id, neighbor, remote_asn,
+			protocol_name, session_state, status, first_seen_at, last_seen_at
+		) VALUES ($1,$2,$3::uuid,$4,$5::inet,$6,$7,$8,'pending',$9,$9)`,
+		id, tenantID, sp, neighborID, neighbor, in.RemoteASN,
+		strings.TrimSpace(in.ProtocolName), strings.TrimSpace(in.SessionState), seenAt)
+	if err != nil {
+		return nil, err
+	}
+	return p.GetPeerDiscovery(tenantID, id)
+}
+
+func (p *Postgres) ApprovePeerDiscovery(tenantID, id string, in *store.PeerDiscoveryApproveInput) (*store.BGPPeer, *store.BGPPeerDiscovery, error) {
+	ctx := context.Background()
+	tx, err := p.pool.Begin(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+
+	d, err := p.getPeerDiscoveryTx(ctx, tx, tenantID, id)
+	if err != nil {
+		return nil, nil, err
+	}
+	if d.Status != store.PeerDiscoveryPending {
+		return nil, nil, store.ErrInvalidInput
+	}
+	if d.RemoteASN == 0 {
+		return nil, nil, store.ErrInvalidInput
+	}
+	neighbor, ok := store.NormalizePeerNeighborString(d.Neighbor)
+	if !ok {
+		return nil, nil, store.ErrInvalidInput
+	}
+
+	name := ""
+	enabled := true
+	var speakerID *string
+	if in != nil {
+		name = strings.TrimSpace(in.Name)
+		if in.Enabled != nil {
+			enabled = *in.Enabled
+		}
+		if in.SpeakerID != nil {
+			v := strings.TrimSpace(*in.SpeakerID)
+			if v != "" {
+				speakerID = &v
+			}
+		}
+	}
+	if name == "" {
+		if d.NeighborID != "" {
+			name = "discovered-" + d.NeighborID
+		} else {
+			name = "discovered-" + neighbor
+		}
+	}
+	if speakerID == nil && strings.TrimSpace(d.SpeakerID) != "" {
+		sp := d.SpeakerID
+		speakerID = &sp
+	}
+
+	peerID := uuid.NewString()
+	meta, _ := json.Marshal(map[string]any{"name": name, "session_state": d.SessionState})
+	var sp any
+	if speakerID != nil {
+		sp = *speakerID
+	}
+	_, err = tx.Exec(ctx, `
+		INSERT INTO bgp_peer (id, tenant_id, bgp_speaker_id, neighbor, remote_asn, enabled, policies_json, meta_json)
+		VALUES ($1,$2,$3::uuid,$4::inet,$5,$6,'{}'::jsonb,$7::jsonb)`,
+		peerID, tenantID, sp, neighbor, d.RemoteASN, enabled, string(meta))
+	if err != nil {
+		return nil, nil, err
+	}
+	_, err = tx.Exec(ctx, `
+		UPDATE bgp_peer_discovery SET status='approved', approved_peer_id=$3::uuid, last_seen_at=now(), updated_at=now()
+		WHERE id=$1 AND tenant_id=$2`, id, tenantID, peerID)
+	if err != nil {
+		return nil, nil, err
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return nil, nil, err
+	}
+	peer, err := p.GetPeer(tenantID, peerID)
+	if err != nil {
+		return nil, nil, err
+	}
+	disc, err := p.GetPeerDiscovery(tenantID, id)
+	if err != nil {
+		return nil, nil, err
+	}
+	return peer, disc, nil
+}
+
+func (p *Postgres) RejectPeerDiscovery(tenantID, id string) (*store.BGPPeerDiscovery, error) {
+	ctx := context.Background()
+	cur, err := p.GetPeerDiscovery(tenantID, id)
+	if err != nil {
+		return nil, err
+	}
+	if cur.Status == store.PeerDiscoveryApproved {
+		return nil, store.ErrInvalidInput
+	}
+	tag, err := p.pool.Exec(ctx, `
+		UPDATE bgp_peer_discovery SET status='rejected', last_seen_at=now(), updated_at=now()
+		WHERE id=$1 AND tenant_id=$2`, id, tenantID)
+	if err != nil {
+		return nil, err
+	}
+	if tag.RowsAffected() == 0 {
+		return nil, store.ErrNotFound
+	}
+	return p.GetPeerDiscovery(tenantID, id)
+}
+
+func (p *Postgres) getPeerDiscoveryTx(ctx context.Context, tx pgx.Tx, tenantID, id string) (*store.BGPPeerDiscovery, error) {
+	row := tx.QueryRow(ctx, `
+		SELECT id::text, tenant_id::text, COALESCE(speaker_id::text,''), COALESCE(neighbor_id,''),
+			neighbor::text, remote_asn, COALESCE(protocol_name,''), COALESCE(session_state,''),
+			status, first_seen_at, last_seen_at, COALESCE(approved_peer_id::text,'')
+		FROM bgp_peer_discovery WHERE id=$1 AND tenant_id=$2 FOR UPDATE`, id, tenantID)
+	d, err := scanPeerDiscovery(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, store.ErrNotFound
+		}
+		return nil, err
+	}
+	return d, nil
+}

internal/store/audit.go

@@ -0,0 +1,67 @@
+package store
+
+import (
+	"strings"
+	"time"
+)
+
+const (
+	AuditSourceAppBGP      = "bgp"
+	AuditTargetAppResource = "app_resource"
+	AuditSeverityInfo      = "info"
+	AuditSeverityWarning   = "warning"
+	AuditSeverityCritical  = "critical"
+)
+
+// AuditEntry is a persisted CRUD / settings audit row (local + portal ingest).
+type AuditEntry struct {
+	ID                string
+	TenantID          string
+	EventID           string
+	SourceApp         string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+	CreatedAt         time.Time
+	PortalPushedAt    *time.Time
+}
+
+// AuditAppendInput is input for AppendAudit.
+type AuditAppendInput struct {
+	TenantID          string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+}
+
+// AuditListFilter optional query filters for ListAudit.
+type AuditListFilter struct {
+	Action   string
+	Severity string
+}
+
+// ValidAuditSeverity reports whether s is an allowed severity.
+func ValidAuditSeverity(s string) bool {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case AuditSeverityInfo, AuditSeverityWarning, AuditSeverityCritical:
+		return true
+	default:
+		return false
+	}
+}

internal/store/backend.go

@@ -60,6 +60,8 @@ type Backend interface {
 	CreateCommunity(tenantID string, in *Community) (*Community, error)
 	UpdateCommunity(tenantID, id string, patch *CommunityPatch) (*Community, error)
 	DeleteCommunity(tenantID, id string) error
+	// ListCommunityPrefixes returns unique prefixes tagged with community from latest revision per module.
+	ListCommunityPrefixes(tenantID, communityID, cursor string, limit int) (prefixes []PrefixRow, nextCursor string, hasMore bool, err error)
 
 	// ListPeers returns all BGP peers for a tenant (control plane may paginate in httpapi).
 	ListPeers(tenantID string) []*BGPPeer
@@ -68,6 +70,13 @@ type Backend interface {
 	UpdatePeer(tenantID, id string, patch *PeerPatch) (*BGPPeer, error)
 	DeletePeer(tenantID, id string) error
 
+	// Peer discovery (dynamic BGP quarantine → approve/reject).
+	ListPeerDiscoveries(tenantID, status string) ([]*BGPPeerDiscovery, error)
+	GetPeerDiscovery(tenantID, id string) (*BGPPeerDiscovery, error)
+	UpsertPeerDiscovery(tenantID string, in *PeerDiscoveryUpsert) (*BGPPeerDiscovery, error)
+	ApprovePeerDiscovery(tenantID, id string, in *PeerDiscoveryApproveInput) (*BGPPeer, *BGPPeerDiscovery, error)
+	RejectPeerDiscovery(tenantID, id string) (*BGPPeerDiscovery, error)
+
 	ListSpeakersForTenant(tenantID string) []*Speaker
 	GetSpeaker(tenantID, speakerID string) (*Speaker, error)
 	GetSpeakerAnyTenant(speakerID string) (*Speaker, error)
@@ -132,6 +141,11 @@ type Backend interface {
 	AppendRuntimeLogCleanupAudit(tenantID, actor, filename, action string, sizeBefore int64, sizeAfter *int64, detail map[string]any) (string, error)
 	ListRuntimeLogCleanupAudit(tenantID, cursor string, limit int) ([]*RuntimeLogCleanupAudit, string, bool, error)
 
+	// CRUD audit log (tenant-scoped; optional portal ingest push from httpapi).
+	AppendAudit(in AuditAppendInput) (*AuditEntry, error)
+	ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error)
+	MarkAuditPortalPushed(id string) error
+
 	// Firewall blocklist clients and policy rules.
 	ListFirewallClients(tenantID string) ([]*FirewallClient, error)
 	GetFirewallClient(tenantID, id string) (*FirewallClient, error)

internal/store/memory.go

@@ -33,6 +33,8 @@ type Memory struct {
 
 	peers map[string]*BGPPeer
 
+	peerDiscoveries map[string]*BGPPeerDiscovery
+
 	dohProfiles            map[string]*DohProfile
 	communities            map[string]*Community
 	cdnSources             map[string]*CDNSource
@@ -50,6 +52,7 @@ type Memory struct {
 	maintenancePolicies    map[string]*MaintenancePolicy
 	maintConfigAudit       []*MaintenancePolicyConfigAudit
 	runtimeLogCleanupAudit []*RuntimeLogCleanupAudit
+	auditLog               []*AuditEntry
 
 	// DemoIDs valid after SeedDemo()
 	demoTenantID   string
@@ -142,6 +145,7 @@ func NewMemory() *Memory {
 		speakers:               make(map[string]*Speaker),
 		publishedRevision:      make(map[string]publishedInfo),
 		peers:                  make(map[string]*BGPPeer),
+		peerDiscoveries:        make(map[string]*BGPPeerDiscovery),
 		dohProfiles:            make(map[string]*DohProfile),
 		communities:            make(map[string]*Community),
 		cdnSources:             make(map[string]*CDNSource),

internal/store/memory_audit.go

@@ -0,0 +1,117 @@
+package store
+
+import (
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func (m *Memory) AppendAudit(in AuditAppendInput) (*AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = AuditSeverityInfo
+	}
+	if !ValidAuditSeverity(sev) {
+		return nil, ErrInvalidInput
+	}
+	now := time.Now().UTC()
+	row := &AuditEntry{
+		ID:                uuid.NewString(),
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           "bgp-" + uuid.NewString(),
+		SourceApp:         AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         now,
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.auditLog = append(m.auditLog, row)
+	return cloneAuditEntry(row), nil
+}
+
+func (m *Memory) ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	var filtered []*AuditEntry
+	for _, row := range m.auditLog {
+		if row.TenantID != tenantID {
+			continue
+		}
+		if a := strings.TrimSpace(filter.Action); a != "" && row.Action != a {
+			continue
+		}
+		if s := strings.TrimSpace(filter.Severity); s != "" && row.Severity != s {
+			continue
+		}
+		filtered = append(filtered, row)
+	}
+	sort.Slice(filtered, func(i, j int) bool {
+		if filtered[i].CreatedAt.Equal(filtered[j].CreatedAt) {
+			return filtered[i].ID > filtered[j].ID
+		}
+		return filtered[i].CreatedAt.After(filtered[j].CreatedAt)
+	})
+	off := parseMaintCursor(cursor)
+	end := off + limit
+	next := ""
+	hasMore := false
+	if end > len(filtered) {
+		end = len(filtered)
+	} else if end < len(filtered) {
+		hasMore = true
+		next = formatMaintCursor(end)
+	}
+	if off >= len(filtered) {
+		return nil, "", false, nil
+	}
+	out := make([]*AuditEntry, end-off)
+	for i := off; i < end; i++ {
+		out[i-off] = cloneAuditEntry(filtered[i])
+	}
+	return out, next, hasMore, nil
+}
+
+func (m *Memory) MarkAuditPortalPushed(id string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, row := range m.auditLog {
+		if row.ID == id {
+			now := time.Now().UTC()
+			row.PortalPushedAt = &now
+			return nil
+		}
+	}
+	return ErrNotFound
+}
+
+func cloneAuditEntry(row *AuditEntry) *AuditEntry {
+	if row == nil {
+		return nil
+	}
+	cp := *row
+	if row.Details != nil {
+		cp.Details = make(map[string]any, len(row.Details))
+		for k, v := range row.Details {
+			cp.Details[k] = v
+		}
+	}
+	return &cp
+}

internal/store/memory_audit_test.go

@@ -0,0 +1,70 @@
+package store
+
+import "testing"
+
+func TestMemoryAppendAndListAudit(t *testing.T) {
+	m := NewMemory()
+	tenantA := "tenant-a"
+	tenantB := "tenant-b"
+
+	entry, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantA,
+		Action:   "bgp.module.create",
+		Summary:  "Created module test",
+		TargetID: "mod-1",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if entry == nil || entry.EventID == "" || entry.SourceApp != AuditSourceAppBGP {
+		t.Fatalf("unexpected entry: %+v", entry)
+	}
+
+	if _, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantB,
+		Action:   "bgp.peer.delete",
+		Summary:  "Deleted peer",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	items, _, hasMore, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || hasMore {
+		t.Fatalf("items=%d hasMore=%v", len(items), hasMore)
+	}
+	if items[0].Action != "bgp.module.create" {
+		t.Fatalf("action=%s", items[0].Action)
+	}
+
+	filtered, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{Action: "bgp.peer.delete"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(filtered) != 0 {
+		t.Fatalf("expected empty filter result, got %d", len(filtered))
+	}
+
+	if err := m.MarkAuditPortalPushed(entry.ID); err != nil {
+		t.Fatal(err)
+	}
+	items2, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if items2[0].PortalPushedAt == nil {
+		t.Fatal("expected portal_pushed_at")
+	}
+}
+
+func TestMemoryAppendAuditValidation(t *testing.T) {
+	m := NewMemory()
+	if _, err := m.AppendAudit(AuditAppendInput{}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+	if _, err := m.AppendAudit(AuditAppendInput{TenantID: "t", Action: "x", Summary: "s", Severity: "bad"}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+}

internal/store/memory_crud.go

@@ -1,6 +1,8 @@
 package store
 
 import (
+	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -583,14 +585,97 @@ func (m *Memory) ListCommunities(tenantID string) ([]*Community, error) {
 	return out, nil
 }
 
-func (m *Memory) GetCommunity(tenantID, id string) (*Community, error) {
+func (m *Memory) GetCommunity(tenantID, idOrKey string) (*Community, error) {
 	m.mu.RLock()
 	defer m.mu.RUnlock()
-	c, ok := m.communities[id]
-	if !ok || c.TenantID != tenantID {
+	key := strings.TrimSpace(idOrKey)
+	if key == "" {
 		return nil, ErrNotFound
 	}
-	return c, nil
+	if c, ok := m.communities[key]; ok && c.TenantID == tenantID {
+		return c, nil
+	}
+	for _, c := range m.communities {
+		if c.TenantID != tenantID {
+			continue
+		}
+		if c.Community == key || c.Title == key {
+			return c, nil
+		}
+		if strings.TrimSpace(c.Title) != "" && c.Community+" · "+c.Title == key {
+			return c, nil
+		}
+	}
+	return nil, ErrNotFound
+}
+
+func (m *Memory) ListCommunityPrefixes(tenantID, communityID, cursor string, limit int) ([]PrefixRow, string, bool, error) {
+	commRow, err := m.GetCommunity(tenantID, communityID)
+	if err != nil {
+		return nil, "", false, err
+	}
+	resolvedID := commRow.ID
+	if limit <= 0 {
+		limit = 500
+	}
+	if limit > 5000 {
+		limit = 5000
+	}
+	off := 0
+	if cursor != "" {
+		if n, err := strconv.Atoi(cursor); err == nil && n >= 0 {
+			off = n
+		}
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	latestByModule := map[string]*Revision{}
+	for _, rev := range m.revisions {
+		if rev.TenantID != tenantID || strings.TrimSpace(rev.ModuleID) == "" {
+			continue
+		}
+		cur := latestByModule[rev.ModuleID]
+		if cur == nil || rev.CreatedAt.After(cur.CreatedAt) {
+			latestByModule[rev.ModuleID] = rev
+		}
+	}
+	seen := map[string]struct{}{}
+	var all []PrefixRow
+	for _, rev := range latestByModule {
+		for _, pr := range m.revPrefixes[rev.ID] {
+			if pr.CommunityID == nil || *pr.CommunityID != resolvedID {
+				continue
+			}
+			pfx := strings.TrimSpace(pr.Prefix)
+			if pfx == "" {
+				continue
+			}
+			if _, ok := seen[pfx]; ok {
+				continue
+			}
+			seen[pfx] = struct{}{}
+			all = append(all, PrefixRow{Prefix: pfx, CommunityID: &resolvedID, Source: pr.Source})
+		}
+	}
+	sort.Slice(all, func(i, j int) bool { return all[i].Prefix < all[j].Prefix })
+	if off > len(all) {
+		return nil, "", false, nil
+	}
+	end := off + limit
+	more := false
+	next := ""
+	if end < len(all) {
+		more = true
+		next = strconv.Itoa(end)
+		all = all[off:end]
+	} else {
+		all = all[off:]
+	}
+	if len(all) == 0 {
+		return nil, "", false, nil
+	}
+	return all, next, more, nil
 }
 
 func (m *Memory) CreateCommunity(tenantID string, in *Community) (*Community, error) {

internal/store/memory_peer_discovery.go

@@ -0,0 +1,213 @@
+package store
+
+import (
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func (m *Memory) ListPeerDiscoveries(tenantID, status string) ([]*BGPPeerDiscovery, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	status = strings.TrimSpace(strings.ToLower(status))
+	var out []*BGPPeerDiscovery
+	for _, d := range m.peerDiscoveries {
+		if d == nil || d.TenantID != tenantID {
+			continue
+		}
+		if status != "" && !strings.EqualFold(d.Status, status) {
+			continue
+		}
+		out = append(out, copyPeerDiscovery(d))
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return out[i].LastSeenAt.After(out[j].LastSeenAt)
+	})
+	return out, nil
+}
+
+func (m *Memory) GetPeerDiscovery(tenantID, id string) (*BGPPeerDiscovery, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	d, ok := m.peerDiscoveries[id]
+	if !ok || d.TenantID != tenantID {
+		return nil, ErrNotFound
+	}
+	return copyPeerDiscovery(d), nil
+}
+
+func (m *Memory) UpsertPeerDiscovery(tenantID string, in *PeerDiscoveryUpsert) (*BGPPeerDiscovery, error) {
+	if in == nil {
+		return nil, ErrInvalidInput
+	}
+	neighbor, ok := NormalizePeerNeighborString(in.Neighbor)
+	if !ok {
+		return nil, ErrInvalidInput
+	}
+	neighborID := strings.TrimSpace(in.NeighborID)
+	seenAt := in.SeenAt
+	if seenAt.IsZero() {
+		seenAt = time.Now().UTC()
+	}
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if _, ok := m.tenants[tenantID]; !ok {
+		return nil, ErrTenantScope
+	}
+
+	existing := m.findPeerDiscoveryLocked(tenantID, neighborID, neighbor, in.RemoteASN)
+	if existing != nil {
+		if existing.Status == PeerDiscoveryRejected {
+			return copyPeerDiscovery(existing), nil
+		}
+		if existing.Status == PeerDiscoveryApproved {
+			existing.SessionState = strings.TrimSpace(in.SessionState)
+			existing.ProtocolName = strings.TrimSpace(in.ProtocolName)
+			existing.LastSeenAt = seenAt
+			if sp := strings.TrimSpace(in.SpeakerID); sp != "" {
+				existing.SpeakerID = sp
+			}
+			return copyPeerDiscovery(existing), nil
+		}
+		existing.Neighbor = neighbor
+		existing.RemoteASN = in.RemoteASN
+		if neighborID != "" {
+			existing.NeighborID = neighborID
+		}
+		existing.ProtocolName = strings.TrimSpace(in.ProtocolName)
+		existing.SessionState = strings.TrimSpace(in.SessionState)
+		existing.LastSeenAt = seenAt
+		if sp := strings.TrimSpace(in.SpeakerID); sp != "" {
+			existing.SpeakerID = sp
+		}
+		return copyPeerDiscovery(existing), nil
+	}
+
+	id := uuid.NewString()
+	d := &BGPPeerDiscovery{
+		ID:           id,
+		TenantID:     tenantID,
+		SpeakerID:    strings.TrimSpace(in.SpeakerID),
+		NeighborID:   neighborID,
+		Neighbor:     neighbor,
+		RemoteASN:    in.RemoteASN,
+		ProtocolName: strings.TrimSpace(in.ProtocolName),
+		SessionState: strings.TrimSpace(in.SessionState),
+		Status:       PeerDiscoveryPending,
+		FirstSeenAt:  seenAt,
+		LastSeenAt:   seenAt,
+	}
+	m.peerDiscoveries[id] = d
+	return copyPeerDiscovery(d), nil
+}
+
+func (m *Memory) ApprovePeerDiscovery(tenantID, id string, in *PeerDiscoveryApproveInput) (*BGPPeer, *BGPPeerDiscovery, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	d, ok := m.peerDiscoveries[id]
+	if !ok || d.TenantID != tenantID {
+		return nil, nil, ErrNotFound
+	}
+	if d.Status != PeerDiscoveryPending {
+		return nil, nil, ErrInvalidInput
+	}
+	if d.RemoteASN == 0 {
+		return nil, nil, ErrInvalidInput
+	}
+	neighbor, okN := NormalizePeerNeighborString(d.Neighbor)
+	if !okN {
+		return nil, nil, ErrInvalidInput
+	}
+
+	name := ""
+	enabled := true
+	var speakerID *string
+	if in != nil {
+		name = strings.TrimSpace(in.Name)
+		if in.Enabled != nil {
+			enabled = *in.Enabled
+		}
+		if in.SpeakerID != nil {
+			v := strings.TrimSpace(*in.SpeakerID)
+			if v != "" {
+				speakerID = &v
+			}
+		}
+	}
+	if name == "" {
+		if d.NeighborID != "" {
+			name = "discovered-" + d.NeighborID
+		} else {
+			name = "discovered-" + neighbor
+		}
+	}
+	if speakerID == nil && strings.TrimSpace(d.SpeakerID) != "" {
+		sp := d.SpeakerID
+		speakerID = &sp
+	}
+
+	peerID := uuid.NewString()
+	peer := &BGPPeer{
+		ID:           peerID,
+		TenantID:     tenantID,
+		SpeakerID:    speakerID,
+		Name:         name,
+		Neighbor:     neighbor,
+		RemoteASN:    d.RemoteASN,
+		Enabled:      enabled,
+		SessionState: d.SessionState,
+		PoliciesJSON: "{}",
+	}
+	m.peers[peerID] = peer
+
+	d.Status = PeerDiscoveryApproved
+	d.ApprovedPeerID = peerID
+	d.LastSeenAt = time.Now().UTC()
+
+	peerCopy := *peer
+	return &peerCopy, copyPeerDiscovery(d), nil
+}
+
+func (m *Memory) RejectPeerDiscovery(tenantID, id string) (*BGPPeerDiscovery, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	d, ok := m.peerDiscoveries[id]
+	if !ok || d.TenantID != tenantID {
+		return nil, ErrNotFound
+	}
+	if d.Status == PeerDiscoveryApproved {
+		return nil, ErrInvalidInput
+	}
+	d.Status = PeerDiscoveryRejected
+	d.LastSeenAt = time.Now().UTC()
+	return copyPeerDiscovery(d), nil
+}
+
+func (m *Memory) findPeerDiscoveryLocked(tenantID, neighborID, neighbor string, asn int64) *BGPPeerDiscovery {
+	for _, d := range m.peerDiscoveries {
+		if d == nil || d.TenantID != tenantID {
+			continue
+		}
+		if neighborID != "" && d.NeighborID == neighborID {
+			return d
+		}
+		if neighborID == "" && d.NeighborID == "" && d.Neighbor == neighbor && d.RemoteASN == asn {
+			return d
+		}
+		if neighborID != "" && d.NeighborID == "" && d.Neighbor == neighbor && d.RemoteASN == asn {
+			return d
+		}
+	}
+	return nil
+}
+
+func copyPeerDiscovery(d *BGPPeerDiscovery) *BGPPeerDiscovery {
+	if d == nil {
+		return nil
+	}
+	cp := *d
+	return &cp
+}

internal/store/peer_discovery.go

@@ -0,0 +1,44 @@
+package store
+
+import "time"
+
+// PeerDiscoveryStatus values for bgp_peer_discovery.status.
+const (
+	PeerDiscoveryPending  = "pending"
+	PeerDiscoveryApproved = "approved"
+	PeerDiscoveryRejected = "rejected"
+)
+
+// BGPPeerDiscovery is a live-detected dynamic BGP session awaiting operator action.
+type BGPPeerDiscovery struct {
+	ID             string    `json:"id"`
+	TenantID       string    `json:"tenant_id,omitempty"`
+	SpeakerID      string    `json:"speaker_id,omitempty"`
+	NeighborID     string    `json:"neighbor_id,omitempty"`
+	Neighbor       string    `json:"neighbor"`
+	RemoteASN      int64     `json:"remote_asn"`
+	ProtocolName   string    `json:"protocol_name,omitempty"`
+	SessionState   string    `json:"session_state,omitempty"`
+	Status         string    `json:"status"`
+	FirstSeenAt    time.Time `json:"first_seen_at"`
+	LastSeenAt     time.Time `json:"last_seen_at"`
+	ApprovedPeerID string    `json:"approved_peer_id,omitempty"`
+}
+
+// PeerDiscoveryUpsert is input for syncing a live dynamic session into the store.
+type PeerDiscoveryUpsert struct {
+	SpeakerID    string
+	NeighborID   string
+	Neighbor     string
+	RemoteASN    int64
+	ProtocolName string
+	SessionState string
+	SeenAt       time.Time
+}
+
+// PeerDiscoveryApproveInput optional fields when promoting a discovery to BGPPeer.
+type PeerDiscoveryApproveInput struct {
+	Name      string
+	SpeakerID *string
+	Enabled   *bool
+}

migrations/postgres/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/postgres/000030_audit_log.up.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json JSONB,
+    ip TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    portal_pushed_at TIMESTAMPTZ,
+    CONSTRAINT audit_log_severity_chk CHECK (severity IN ('info', 'warning', 'critical')),
+    CONSTRAINT audit_log_source_app_chk CHECK (source_app = 'bgp'),
+    CONSTRAINT audit_log_summary_chk CHECK (length(trim(summary)) > 0)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);

migrations/postgres/000031_peer_discovery.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_neighbor_asn;
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_neighbor_id;
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_status;
+DROP TABLE IF EXISTS bgp_peer_discovery;

migrations/postgres/000031_peer_discovery.up.sql

@@ -0,0 +1,30 @@
+-- Peer auto-discovery pending / rejected / approved records.
+
+CREATE TABLE IF NOT EXISTS bgp_peer_discovery (
+    id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id        UUID NOT NULL REFERENCES tenant (id) ON DELETE CASCADE,
+    speaker_id       UUID REFERENCES bgp_speaker (id) ON DELETE SET NULL,
+    neighbor_id      TEXT NOT NULL DEFAULT '',
+    neighbor         INET NOT NULL,
+    remote_asn       BIGINT NOT NULL DEFAULT 0,
+    protocol_name    TEXT NOT NULL DEFAULT '',
+    session_state    TEXT NOT NULL DEFAULT '',
+    status           TEXT NOT NULL DEFAULT 'pending',
+    first_seen_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    last_seen_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    approved_peer_id UUID REFERENCES bgp_peer (id) ON DELETE SET NULL,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT bgp_peer_discovery_status_chk CHECK (status IN ('pending', 'approved', 'rejected'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_status
+    ON bgp_peer_discovery (tenant_id, status);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_neighbor_id
+    ON bgp_peer_discovery (tenant_id, neighbor_id)
+    WHERE neighbor_id <> '';
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_neighbor_asn
+    ON bgp_peer_discovery (tenant_id, neighbor, remote_asn)
+    WHERE neighbor_id = '';

migrations/sqlite/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/sqlite/000030_audit_log.up.sql

@@ -0,0 +1,27 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json TEXT,
+    ip TEXT,
+    created_at TEXT NOT NULL,
+    portal_pushed_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);

migrations/sqlite/000031_peer_discovery.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_neighbor_asn;
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_neighbor_id;
+DROP INDEX IF EXISTS idx_bgp_peer_discovery_tenant_status;
+DROP TABLE IF EXISTS bgp_peer_discovery;

migrations/sqlite/000031_peer_discovery.up.sql

@@ -0,0 +1,30 @@
+-- Peer auto-discovery pending / rejected / approved records.
+
+CREATE TABLE IF NOT EXISTS bgp_peer_discovery (
+    id               TEXT PRIMARY KEY NOT NULL,
+    tenant_id        TEXT NOT NULL REFERENCES tenant (id) ON DELETE CASCADE,
+    speaker_id       TEXT REFERENCES bgp_speaker (id) ON DELETE SET NULL,
+    neighbor_id      TEXT NOT NULL DEFAULT '',
+    neighbor         TEXT NOT NULL,
+    remote_asn       INTEGER NOT NULL DEFAULT 0,
+    protocol_name    TEXT NOT NULL DEFAULT '',
+    session_state    TEXT NOT NULL DEFAULT '',
+    status           TEXT NOT NULL DEFAULT 'pending',
+    first_seen_at    TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    last_seen_at     TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    approved_peer_id TEXT REFERENCES bgp_peer (id) ON DELETE SET NULL,
+    created_at       TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    updated_at       TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    CHECK (status IN ('pending', 'approved', 'rejected'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_status
+    ON bgp_peer_discovery (tenant_id, status);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_neighbor_id
+    ON bgp_peer_discovery (tenant_id, neighbor_id)
+    WHERE neighbor_id != '';
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_bgp_peer_discovery_tenant_neighbor_asn
+    ON bgp_peer_discovery (tenant_id, neighbor, remote_asn)
+    WHERE neighbor_id = '';