Retired baseline version stamps

Product model: New tenants use baseline_source = imported or msp_custom only. See Comparison baseline model.

Current behavior

Policytab does not load community catalogs from disk at runtime and does not expose a baseline-versions UI.

Tenants still on baseline_source = policytab or j0eyv in the database:

1. Auto-migrate to imported on the next drift, deploy, or settings load when a policy snapshot exists (lib/deploy/tenant-baseline.ts).
2. Otherwise, change the comparison baseline in tenant onboarding (imported snapshot or workspace baseline), or run the operator migration script below.

Historical: baseline_version column

public.tenant.baseline_version stored an upstream manifest label for retired enum values. It was intent-only and never pushed changes to Entra. Workspace baselines (msp_custom) and imported snapshots never used this column.

The column may still exist on old rows but is not shown or edited in the product UI.

Operator migration

npm run migrate:legacy-baselines -- --dry-run
npm run migrate:legacy-baselines -- --apply
npm run migrate:legacy-baselines -- --mode=msp_custom --apply --env-file .env.local

• --mode=imported (default): point legacy tenants at their latest snapshot baseline.
• --mode=msp_custom: import the GitHub catalog into msp_baseline and assign per tenant.

See Comparison baseline model for details.

Related

• Comparison baseline model
• Policytab upstream relationship