Why: A password change could leave an unused recovery key redeemable. A verified login or restricted password-set request could race a concurrent credential replacement, and rejected active password changes lacked an audit outcome.
Result: Credential writes, recovery-key reissue/redemption, and session admission now serialize by account on PostgreSQL; checked operations revalidate authorization inside their transaction. Retired session versions fail closed. Account creation, password mutation, key issuance and success audit commit together; rejected checked mutations receive a separate audit row. CLI maintenance requires an existing database and writes newly issued credentials only to exclusive 0600 files. The schema change is additive migration 31.
Evidence: Fixed head a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1d includes current Backend main 5d5fc9891c0eb8994545ccb8b740535d9b99fb0e. SELF: go vet ./... && go test -count=1 ./... passed; the full internal/store suite, three deterministic PostgreSQL interleaving rounds, and two-process contention passed on an isolated database. Independent REPLAY by /root/merge_queue_review passed B1–B7 with 65 top-level tests (/tmp/mq-trial486-backend-independent-review-20261014-r2.json). Exact-head platform CI is pending and required before merge.
Impact: Existing live services and shared databases were not changed. The Dev combination PR #486 must pin the actual Backend merge and pass its own exact-head CI.
Refs: Agent-System-Dev #486; Dev docs/svc-deploy/u7-account-tx-audit.md; merge queue Issue #518.
Actual delivery: Root merged fixed head a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1d as 8e80e2618eb7471dd12d5f172ff3cd23622b7d2f; the complete merge tree equals the independently reviewed candidate. GATE run 3062 / vet-and-test job 4637 completed successfully on that exact head with actor weichen and home-runner/id3. Dev #486 must pin this merged component and pass its own final combination checks.
Why: A password change could leave an unused recovery key redeemable. A verified login or restricted password-set request could race a concurrent credential replacement, and rejected active password changes lacked an audit outcome.
Result: Credential writes, recovery-key reissue/redemption, and session admission now serialize by account on PostgreSQL; checked operations revalidate authorization inside their transaction. Retired session versions fail closed. Account creation, password mutation, key issuance and success audit commit together; rejected checked mutations receive a separate audit row. CLI maintenance requires an existing database and writes newly issued credentials only to exclusive 0600 files. The schema change is additive migration 31.
Evidence: Fixed head `a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1d` includes current Backend main `5d5fc9891c0eb8994545ccb8b740535d9b99fb0e`. SELF: `go vet ./... && go test -count=1 ./...` passed; the full `internal/store` suite, three deterministic PostgreSQL interleaving rounds, and two-process contention passed on an isolated database. Independent REPLAY by `/root/merge_queue_review` passed B1–B7 with 65 top-level tests (`/tmp/mq-trial486-backend-independent-review-20261014-r2.json`). Exact-head platform CI is pending and required before merge.
Impact: Existing live services and shared databases were not changed. The Dev combination PR #486 must pin the actual Backend merge and pass its own exact-head CI.
Refs: Agent-System-Dev #486; Dev `docs/svc-deploy/u7-account-tx-audit.md`; merge queue Issue #518.
<!-- mq-trial486-backend-actual -->
Actual delivery: Root merged fixed head `a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1d` as `8e80e2618eb7471dd12d5f172ff3cd23622b7d2f`; the complete merge tree equals the independently reviewed candidate. GATE [run 3062](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/actions/runs/3062) / [vet-and-test job 4637](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/actions/runs/3062/jobs/4637) completed successfully on that exact head with actor weichen and home-runner/id3. Dev #486 must pin this merged component and pass its own final combination checks.
Why: creating an account and its activation key, and changing a password, were separate commits, so a crash could leave a user without a key or a new password with a still-valid login key.
Evidence: SELF go test ./internal/store including TestConcurrentCreateOneWinner, TestPasswordChangeIsAtomic, TestOpenExistingDoesNotMigrateOrCreate, and TestBootstrapRefusesExistingBusiness. PostgreSQL cases are NOT_RUN locally.
Impact: strict insert returns ErrConflict instead of overwriting. Account CLI opens an existing database without migrating. --dsn and --password still work and warn. capabilities --json does not touch the database.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: a commit that only checks the password in the same process does not show the hash was durable.
Evidence: SELF go test TestPasswordSurvivesReopen.
Impact: test only.
Refs: docs/svc-deploy/u7-account-tx-audit.md
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: identity open and the unknown-subcommand check landed on main, and this branch still has to refuse account migration while advertising capabilities.
Evidence: go test ./internal/store ./internal/app ./cmd/agent-system ./pkg/identity passed after the merge.
Impact: identity verify uses the no-migrate opener and returns the schema version. Account open still does not migrate. v28 is registered as readable by older artifacts.
Refs: cmd/agent-system/main.go, internal/app/app.go, internal/store/store.go, internal/store/migrate_compat.go
Co-authored-by: Cursor <cursoragent@cursor.com>
Why: Deliver U7 account transactions and audit without losing main auth_version, restricted-session, project or migration behavior.
Evidence: SELF go vet and all Go tests passed; isolated PostgreSQL store tests, 20 repeated two-process admission rounds, and real SIGTERM/SIGKILL persistence passed. Original failures remain in receipts; exact-head CI and independent Review follow.
Impact: Adds schema v31, noncreating account CLI opens, preflight credential output, same-transaction audit, and bootstrap admission guards. No live database touched.
Refs: Backend PR #185; Dev PR #486; original U7 r2 account specification; 2026-10-14 Root takeover
Why: The safe open requirement covers user, apikey and identity verify, including default CLI paths.
Evidence: All three paths use private missing directories; previous full Go and PostgreSQL receipts cover the implementation, with a focused recheck before push.
Impact: Test coverage only; no runtime behavior or migration changes.
Refs: Backend PR #185; Dev PR #486
Why: API-key issuance shares the account maintenance no-create and credential-output contract; the old CLI printed its key and lacked --out-file.
Evidence: The new subprocess test failed before the flag existed, then passed for private output and pre-mutation collision refusal; current go vet and all Go tests pass.
Impact: apikey create accepts protected --dsn-file and --out-file, preserves stdout default, and never overwrites an existing destination.
Refs: Backend PR #185; Dev PR #486; U7 KTD14
Why: Concurrent password changes, recovery key reissue, and session admission could accept retired credentials or omit rejected audits.
Evidence: Local Go vet and full tests passed; real PostgreSQL store suite, deterministic interleavings, and two-process contention passed with SELF receipts.
Impact: Account writes and session admission serialize per owner; stale sessions fail closed; checked rejections carry an audit row.
Refs: Agent-System-Dev #486; Agent-System-Backend #185; merge queue Issue #518
weichen
changed title from Commit account changes and audits in one transaction to Serialize account recovery and session admission2026-10-14 04:13:34 +00:00
weichen
merged commit 8e80e2618e into main2026-10-14 04:14:47 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: A password change could leave an unused recovery key redeemable. A verified login or restricted password-set request could race a concurrent credential replacement, and rejected active password changes lacked an audit outcome.
Result: Credential writes, recovery-key reissue/redemption, and session admission now serialize by account on PostgreSQL; checked operations revalidate authorization inside their transaction. Retired session versions fail closed. Account creation, password mutation, key issuance and success audit commit together; rejected checked mutations receive a separate audit row. CLI maintenance requires an existing database and writes newly issued credentials only to exclusive 0600 files. The schema change is additive migration 31.
Evidence: Fixed head
a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1dincludes current Backend main5d5fc9891c0eb8994545ccb8b740535d9b99fb0e. SELF:go vet ./... && go test -count=1 ./...passed; the fullinternal/storesuite, three deterministic PostgreSQL interleaving rounds, and two-process contention passed on an isolated database. Independent REPLAY by/root/merge_queue_reviewpassed B1–B7 with 65 top-level tests (/tmp/mq-trial486-backend-independent-review-20261014-r2.json). Exact-head platform CI is pending and required before merge.Impact: Existing live services and shared databases were not changed. The Dev combination PR #486 must pin the actual Backend merge and pass its own exact-head CI.
Refs: Agent-System-Dev #486; Dev
docs/svc-deploy/u7-account-tx-audit.md; merge queue Issue #518.Actual delivery: Root merged fixed head
a4e33f192fbf5aa7ac6196b8ea1fcabc8832bd1das8e80e2618eb7471dd12d5f172ff3cd23622b7d2f; the complete merge tree equals the independently reviewed candidate. GATE run 3062 / vet-and-test job 4637 completed successfully on that exact head with actor weichen and home-runner/id3. Dev #486 must pin this merged component and pass its own final combination checks.Commit account changes and audits in one transactionto Serialize account recovery and session admission