Integrate atomic account maintenance with current authentication

Why: Deliver U7 account transactions and audit without losing main auth_version, restricted-session, project or migration behavior.

Evidence: SELF go vet and all Go tests passed; isolated PostgreSQL store tests, 20 repeated two-process admission rounds, and real SIGTERM/SIGKILL persistence passed. Original failures remain in receipts; exact-head CI and independent Review follow.

Impact: Adds schema v31, noncreating account CLI opens, preflight credential output, same-transaction audit, and bootstrap admission guards. No live database touched.

Refs: Backend PR #185; Dev PR #486; original U7 r2 account specification; 2026-10-14 Root takeover

cmd/agent-system/account_io_test.go

@@ -0,0 +1,90 @@
+package main
+
+import (
+	"agent-system-backend/internal/store"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func accountCLI(t *testing.T, args ...string) (int, string) {
+	t.Helper()
+	out, err := os.CreateTemp(t.TempDir(), "capture-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer out.Close()
+	oldOut, oldErr := os.Stdout, os.Stderr
+	os.Stdout = out
+	os.Stderr = out
+	defer func() { os.Stdout = oldOut; os.Stderr = oldErr }()
+	rc := runUser(args)
+	out.Seek(0, 0)
+	raw, err := io.ReadAll(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return rc, string(raw)
+}
+func cliStore(t *testing.T) (string, *store.Store) {
+	t.Helper()
+	t.Setenv("AGENT_SYSTEM_DSN", "")
+	dir := t.TempDir()
+	s, e := store.OpenSQLite(filepath.Join(dir, "agent-system.db"))
+	if e != nil {
+		t.Fatal(e)
+	}
+	t.Cleanup(func() { s.Close() })
+	if e := s.EnsureSystemIdentity("fixture", "sqlite"); e != nil {
+		t.Fatal(e)
+	}
+	return dir, s
+}
+func TestOutputFileAppliesToEveryCredentialCommand(t *testing.T) {
+	for _, sub := range []string{"create", "reset-password", "issue-login-key", "bootstrap-admin"} {
+		t.Run(sub, func(t *testing.T) {
+			dir, s := cliStore(t)
+			if sub != "create" && sub != "bootstrap-admin" {
+				if e := s.CreateAccount("ada", "Ada", "", false); e != nil {
+					t.Fatal(e)
+				}
+			}
+			out := filepath.Join(t.TempDir(), "secret")
+			rc, _ := accountCLI(t, sub, "--data", dir, "--owner", "ada", "--out-file", out)
+			if rc != 0 {
+				t.Fatalf("credential command failed: %d", rc)
+			}
+			info, e := os.Stat(out)
+			if e != nil {
+				t.Fatal("credential output file missing")
+			}
+			if info.Mode().Perm() != 0600 {
+				t.Fatal("credential output permissions are not private")
+			}
+		})
+	}
+}
+func TestExistingOutputAndConflictingFormatsRefuseBeforeMutation(t *testing.T) {
+	for _, kind := range []string{"existing", "conflicting"} {
+		t.Run(kind, func(t *testing.T) {
+			dir, s := cliStore(t)
+			out := filepath.Join(t.TempDir(), "secret")
+			args := []string{"create", "--data", dir, "--owner", "ada", "--out-file", out}
+			if kind == "existing" {
+				if e := os.WriteFile(out, []byte("existing"), 0600); e != nil {
+					t.Fatal(e)
+				}
+			} else {
+				args = append(args, "--out", filepath.Join(t.TempDir(), "json-secret"))
+			}
+			rc, _ := accountCLI(t, args...)
+			if rc == 0 {
+				t.Fatal("unsafe output selection succeeded")
+			}
+			if _, e := s.GetUser("ada"); e == nil {
+				t.Fatal("output refusal happened after account mutation")
+			}
+		})
+	}
+}

cmd/agent-system/main.go

@@ -240,6 +240,106 @@ func runAPIKey(args []string) int {
 	}
 }
 
+// deliverCredential 凭据单次交付（KTD14）：--out 时写 0600 JSON 文件，stdout 只报
+// 属主/用途/文件路径不含明文；缺省沿用 stdout 一次输出。文件含 expiresAt 便于交接。
+func deliverCredential(outPath, kind, owner, plaintext string, expiresAt any) error {
+	if outPath == "" {
+		fmt.Println(plaintext)
+		return nil
+	}
+	payload := map[string]any{"kind": kind, "owner": owner, "secret": plaintext}
+	if expiresAt != nil {
+		payload["expiresAt"] = expiresAt
+	}
+	buf, err := json.MarshalIndent(payload, "", "  ")
+	if err != nil {
+		return err
+	}
+	if err := writeExclusiveSecret(outPath, string(buf)); err != nil {
+		return err
+	}
+	fmt.Fprintf(os.Stderr, "凭据已写入 %s（0600，仅此一次生成；勿入库勿入日志）\n", outPath)
+	return nil
+}
+
+type credentialOutput struct {
+	path    string
+	file    *os.File
+	json    bool
+	mutated bool
+}
+
+// Reserve the destination before changing the account. O_EXCL also rejects an
+// existing symlink, so an existing secret can never be overwritten.
+func reserveCredentialOutput(rawPath, jsonPath string) (*credentialOutput, error) {
+	if rawPath != "" && jsonPath != "" {
+		return nil, fmt.Errorf("--out and --out-file are mutually exclusive")
+	}
+	out := &credentialOutput{}
+	out.path, out.json = rawPath, false
+	if jsonPath != "" {
+		out.path, out.json = jsonPath, true
+	}
+	if out.path == "" {
+		return out, nil
+	}
+	f, err := os.OpenFile(out.path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	out.file = f
+	return out, nil
+}
+
+func (out *credentialOutput) abort() {
+	if out == nil || out.file == nil {
+		return
+	}
+	info, err := out.file.Stat()
+	_ = out.file.Close()
+	if out.mutated || err != nil {
+		return
+	}
+	pathInfo, pathErr := os.Stat(out.path)
+	if pathErr == nil && os.SameFile(info, pathInfo) {
+		_ = os.Remove(out.path)
+	}
+}
+
+func (out *credentialOutput) deliver(kind, owner, plaintext string, expiresAt any) error {
+	if out.file == nil {
+		return deliverCredential("", kind, owner, plaintext, expiresAt)
+	}
+	out.mutated = true // Keep the private recovery artifact if delivery fails after DB commit.
+	var body []byte
+	if out.json {
+		payload := map[string]any{"kind": kind, "owner": owner, "secret": plaintext}
+		if expiresAt != nil {
+			payload["expiresAt"] = expiresAt
+		}
+		var err error
+		body, err = json.MarshalIndent(payload, "", "  ")
+		if err != nil {
+			return err
+		}
+	} else {
+		body = []byte(plaintext)
+	}
+	body = append(body, '\n')
+	if _, err := out.file.Write(body); err != nil {
+		return err
+	}
+	if err := out.file.Sync(); err != nil {
+		return err
+	}
+	if err := out.file.Close(); err != nil {
+		return err
+	}
+	out.file = nil
+	fmt.Fprintf(os.Stderr, "凭据已写入 %s（0600，仅此一次生成；勿入库勿入日志）\n", out.path)
+	return nil
+}
+
 // runUser：create / reset-password / list / issue-login-key / revoke-login-key / bootstrap-admin。
 // 默认 create 无初始密码并签发激活 Key；--generate-password 兼容旧随机密码路径。
 func runUser(args []string) int {
@@ -260,12 +360,13 @@ func runUser(args []string) int {
 	instanceID := fs.String("instance-id", "", "严格核验库内服务身份")
 	admin := fs.Bool("admin", false, "管理员")
 	role := fs.String("role", "user", "角色 user|admin")
-	openExisting := fs.Bool("open-existing", false, "只打开既有存储")
+	openExisting := fs.Bool("open-existing", false, "兼容旧参数；账户命令始终只打开既有存储")
 	generatePassword := fs.Bool("generate-password", false, "create 时生成随机初始密码")
 	purpose := fs.String("purpose", "recover", "issue-login-key：activate|recover")
 	ttlMin := fs.Int("ttl-minutes", 30, "登录 Key 有效分钟（5–120）")
 	revokeAll := fs.Bool("revoke-all-credentials", false, "签发时撤销全部长期 API Key 与会话")
 	keyID := fs.String("id", "", "revoke-login-key 凭据编号")
+	out := fs.String("out", "", "凭据交付文件（0600 JSON，代替 stdout 明文；非交互推荐）")
 	fs.Parse(args[1:])
 	resolvedDSN, err := resolveAccountDSN(*dsn, *dsnFile)
 	if err != nil {
@@ -282,6 +383,20 @@ func runUser(args []string) int {
 	}
 	*dsn = resolvedDSN
 	*password = resolvedPassword
+	credentialAction := sub == "create" || sub == "reset-password" || sub == "issue-login-key" || sub == "bootstrap-admin"
+	if !credentialAction && (*outFile != "" || *out != "") {
+		fmt.Fprintln(os.Stderr, "user: 此子命令不生成凭据")
+		return 2
+	}
+	var delivery *credentialOutput
+	if credentialAction {
+		delivery, err = reserveCredentialOutput(*outFile, *out)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "user:", err)
+			return 2
+		}
+		defer delivery.abort()
+	}
 	switch sub {
 	case "create":
 		if *owner == "" {
@@ -302,19 +417,17 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user create:", err)
 			return 1
 		}
-		if *outFile != "" {
-			if err := writeExclusiveSecret(*outFile, pw); err != nil {
-				fmt.Fprintln(os.Stderr, "user create:", err)
-				return 1
-			}
-			fmt.Fprintf(os.Stderr, "operation_id=%s\n", opID)
-			return 0
+		if err := delivery.deliver("login-key", *owner, pw, nil); err != nil {
+			fmt.Fprintln(os.Stderr, "user create:", err)
+			return 1
 		}
-		fmt.Println(pw)
-		if *password == "" && !*generatePassword {
-			fmt.Fprintln(os.Stderr, "一次性激活 Key 仅此一次输出；兑换后设置密码。")
-		} else if *password == "" {
-			fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
+		fmt.Fprintf(os.Stderr, "operation_id=%s\n", opID)
+		if *out == "" && *outFile == "" {
+			if *password == "" && !*generatePassword {
+				fmt.Fprintln(os.Stderr, "一次性激活 Key 仅此一次输出；兑换后设置密码。")
+			} else if *password == "" {
+				fmt.Fprintln(os.Stderr, "初始密码仅此一次输出；该用户首次登录须修改密码。")
+			}
 		}
 		return 0
 	case "reset-password":
@@ -327,8 +440,11 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user reset-password:", err)
 			return 1
 		}
-		fmt.Println(pw)
-		if *password == "" {
+		if err := delivery.deliver("password", *owner, pw, nil); err != nil {
+			fmt.Fprintln(os.Stderr, "user reset-password:", err)
+			return 1
+		}
+		if *out == "" && *outFile == "" && *password == "" {
 			fmt.Fprintln(os.Stderr, "新密码仅此一次输出；该用户下次登录须修改密码（其余会话已吊销）。")
 		}
 		return 0
@@ -355,8 +471,13 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
 			return 1
 		}
-		fmt.Println(plain)
-		fmt.Fprintln(os.Stderr, "一次性登录 Key 仅此一次输出。")
+		if err := delivery.deliver("login-key", *owner, plain, time.Now().Add(time.Duration(*ttlMin)*time.Minute).UTC()); err != nil {
+			fmt.Fprintln(os.Stderr, "user issue-login-key:", err)
+			return 1
+		}
+		if *out == "" && *outFile == "" {
+			fmt.Fprintln(os.Stderr, "一次性登录 Key 仅此一次输出。")
+		}
 		return 0
 	case "revoke-login-key":
 		if *keyID == "" {
@@ -379,8 +500,13 @@ func runUser(args []string) int {
 			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
 			return 1
 		}
-		fmt.Println(plain)
-		fmt.Fprintln(os.Stderr, "首位管理员激活 Key 仅此一次输出。")
+		if err := delivery.deliver("bootstrap-admin", *owner, plain, time.Now().Add(30*time.Minute).UTC()); err != nil {
+			fmt.Fprintln(os.Stderr, "user bootstrap-admin:", err)
+			return 1
+		}
+		if *out == "" && *outFile == "" {
+			fmt.Fprintln(os.Stderr, "首位管理员激活 Key 仅此一次输出。")
+		}
 		return 0
 	default:
 		fmt.Fprintln(os.Stderr, "user: 未知子命令", sub)

cmd/storage-migrate/main.go

@@ -284,7 +284,7 @@ var copyOrder = []string{
 	"projects", "users", "profiles", "settings", "plugins",
 	"conversations", "runs", "messages", "events", "artifacts",
 	"hitl_cards", "plans", "todos", "knowledge", "knowledge_vectors",
-	"activity_cards", "command_audit", "prompt_modules",
+	"activity_cards", "project_event_shares", "command_audit", "prompt_modules",
 	"sessions", "api_keys",
 	"plugin_grants", "plugin_schema", "plugin_kv", "background_tasks",
 	"memory_entries", "audit_events", "pending_confirms", "llm_usage_daily",
@@ -295,6 +295,8 @@ var copyOrder = []string{
 	"login_keys",
 	// U1 I3：服务实例 DB 身份（无外键；迁移须保留以免目标库丢锚）
 	"agent_system_identity",
+	"account_events",
+	"redeem_attempts",
 }
 
 const controlDDL = `
@@ -782,7 +784,7 @@ func advanceSequences(db *sql.DB, table string) error {
 // checkOwners：业务行引用的 owner 必须存在于 users（单租户默认 ”/'local'
 // 除外）。未知 owner 阻塞迁移（U4/R7：不静默带过未知归属）。
 func checkOwners(db *sql.DB, src *sql.DB) error {
-	ownerTables := []string{"projects", "conversations", "runs", "artifacts", "knowledge", "hitl_cards", "profiles", "activity_cards", "command_audit"}
+	ownerTables := []string{"projects", "conversations", "runs", "artifacts", "knowledge", "hitl_cards", "profiles", "activity_cards", "project_event_shares", "command_audit"}
 	for _, t := range ownerTables {
 		if !sqliteHasTable(src, t) {
 			continue