An administrator can now create a passwordless, pending account with optional profile fields, while account searches disclose only fields allowed by the caller's current scope. Disabling an account revokes its credentials and fences later account-owned work. Existing users cannot be taken over through the old admin password or recovery-key endpoints; owner initialization and proof-bound self-recovery use separate, audited paths.
After Backend main PR #199 added persisted run-process replay, this branch also checks current account state before and immediately before returning its private events, so an explicitly disabled auth-off local account cannot read them. The Backend also exposes the constrained directory contract consumed by RDM and guards delegated project projection writes with the real operator. A fresh PostgreSQL migration target now ignores its schema-seeded directory-revision row when checking for preexisting business data, then copies the source revision and cursor key. The migration integration test verifies that copy and still rejects foreign target rows and identities. The private-project SSE replay test now allows enough time to filter 1001 private events before asserting that the later shared event is visible; the privacy assertion itself is unchanged.
Evidence and review state
Fixed candidate: 6dadde47b04355147fd37efdb290f3e9fb26a36e, containing current origin/mainead5ade30e8a9475277ba72505f5029feea93304.
SELF: 6dadde4 passed full SQLite go test ./... -count=1 and go build ./...; preceding d53b20e passed the isolated PostgreSQL full suite. Main PR #200 only added prompt/skill assets and tests, leaving U3 server/store/account code unchanged. The earlier isolated account browser flow covers the same U3 account implementation, while the new process-event route has direct HTTP regression tests.
REPLAY: an independent reviewer reran the disabled-local HTTP regression five times against two PostgreSQL Store pools at d53b20e; the log prints dialect=postgres for every pass. Original log SHA256: 3dacb8e27602ba37abe1a212fdcbe132c4607779a7988365315822dfd022336f, imported into the Dev U3 task card. Earlier Backend candidates also have independent migration, Store and Server replay.
GATE: run 3190 passed vet-and-test on home-runner at the exact PR head. Earlier CI failures and fixes remain in the task-card history. The affected Stage 7 human review is pending; do not merge before that conclusion and final current-base checks.
Scope and dependencies
This PR delivers the Backend U3 component. RDM's formal Backend pin and the Dev fixed combination follow a trusted Backend release tag; publication of that tag is owner-executed under the repository's dual-key rule. No production migration, deployment, or real-account operation is included.
Refs: IAM U3 account contract and plan (2026-10-14-iam-u3-account-contract-and-plan.md), A1–A4 and delegated-actor amendments; Dev U3 task card at feature/iam-u3-account-directory-recovery.
## Summary
An administrator can now create a passwordless, pending account with optional profile fields, while account searches disclose only fields allowed by the caller's current scope. Disabling an account revokes its credentials and fences later account-owned work. Existing users cannot be taken over through the old admin password or recovery-key endpoints; owner initialization and proof-bound self-recovery use separate, audited paths.
After Backend main PR #199 added persisted run-process replay, this branch also checks current account state before and immediately before returning its private events, so an explicitly disabled auth-off `local` account cannot read them. The Backend also exposes the constrained directory contract consumed by RDM and guards delegated project projection writes with the real operator. A fresh PostgreSQL migration target now ignores its schema-seeded directory-revision row when checking for preexisting business data, then copies the source revision and cursor key. The migration integration test verifies that copy and still rejects foreign target rows and identities. The private-project SSE replay test now allows enough time to filter 1001 private events before asserting that the later shared event is visible; the privacy assertion itself is unchanged.
## Evidence and review state
- Fixed candidate: `6dadde47b04355147fd37efdb290f3e9fb26a36e`, containing current `origin/main` `ead5ade30e8a9475277ba72505f5029feea93304`.
- SELF: `6dadde4` passed full SQLite `go test ./... -count=1` and `go build ./...`; preceding `d53b20e` passed the isolated PostgreSQL full suite. Main PR #200 only added prompt/skill assets and tests, leaving U3 server/store/account code unchanged. The earlier isolated account browser flow covers the same U3 account implementation, while the new process-event route has direct HTTP regression tests.
- REPLAY: an independent reviewer reran the disabled-local HTTP regression five times against two PostgreSQL Store pools at `d53b20e`; the log prints `dialect=postgres` for every pass. Original log SHA256: `3dacb8e27602ba37abe1a212fdcbe132c4607779a7988365315822dfd022336f`, imported into the Dev U3 task card. Earlier Backend candidates also have independent migration, Store and Server replay.
- GATE: [run 3190](https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Backend/actions/runs/3190) passed `vet-and-test` on `home-runner` at the exact PR head. Earlier CI failures and fixes remain in the task-card history. The affected Stage 7 human review is pending; do not merge before that conclusion and final current-base checks.
## Scope and dependencies
This PR delivers the Backend U3 component. RDM's formal Backend pin and the Dev fixed combination follow a trusted Backend release tag; publication of that tag is owner-executed under the repository's dual-key rule. No production migration, deployment, or real-account operation is included.
Refs: IAM U3 account contract and plan (`2026-10-14-iam-u3-account-contract-and-plan.md`), A1–A4 and delegated-actor amendments; Dev U3 task card at `feature/iam-u3-account-directory-recovery`.
Why: preserve identity while supporting optional profiles and controlled account lifecycle.
Evidence: SELF complete SQLite store tests and real PostgreSQL account-model regressions; red receipts retained.
Impact: additive account schema with a security compatibility floor; no production migration executed.
Refs: IAM U3-1; approved Documents c236d3099dd3e20f7bdd35caf162e0be9a7d52eb
Why: Disabling an account must stop in-flight work as well as new HTTP requests.
Evidence: SELF receipts /tmp/iam-u3-u2-runtime-regression.json and /tmp/iam-u3-u2-app-compile.json.
Impact: Run start, tools, HITL, streaming output, child runs and final settlement recheck the account independently of project authorization.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Disabled accounts and mixed credentials could continue to authenticate, while web creation accepted passwords and administrator privileges.
Evidence: SELF receipts /tmp/iam-u3-u2-store-sqlite-green.json, /tmp/iam-u3-u2-store-pg-regression.json, and /tmp/iam-u3-u2-server-sqlite-green.json.
Impact: Adds versioned enable/disable, revokes existing handles, protects the last operable manager, and exposes pending-account/profile APIs. Recovery proposal and legacy-entry closure remain in U3-4.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: The old account lister exposed a global, always-valid directory without a domain locator or field authorization.
Evidence: SELF receipts /tmp/iam-u3-u3-backend-sqlite.json and /tmp/iam-u3-u3-backend-pg.json.
Impact: Adds versioned optional query and exact lookup, trusted RDM scope registration, visible-field cursor binding, and restricts legacy EXT-19 to effective system administrators. RDM consumption remains a separate U3-5 unit.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Administrator-issued password and login-key paths could take over target accounts, while old credentials and plugin handles ignored current account state.
Evidence: SELF receipts /tmp/iam-u3-backend-all-replay.json, /tmp/iam-u3-backend-final-pg-core.json, /tmp/iam-u3-backend-build.json, and focused HTTP/concurrency receipts in /tmp/iam-u3-*.json.
Impact: Adds trusted pending-account initialization and reissue, preexisting owner-session proof, proposal/rotation/grant transactions, server-side admin search, current Host guards, and legacy HTTP/CLI closure. Production cutover and downstream pins remain pending.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: A disable could commit after the run manager checked account state but before its final business message was stored.
Evidence: SELF receipts /tmp/iam-u3-final-settle-sqlite.json, /tmp/iam-u3-final-settle-pg.json, /tmp/iam-u3-backend-settle-all.json, /tmp/iam-u3-backend-settle-pg.json, and /tmp/iam-u3-http-two-instance-pg.json.
Impact: The final run transaction locks and rechecks the account, rejects post-disable business output, and permits only an account-denial failure record. Auth-off implicit local ownership remains explicit.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: Historical full sessions could reach self-profile actions, and a lost recovery response had no safe idempotent retry contract.
Evidence: SELF receipts /tmp/iam-u3-full-password-profile.json, /tmp/iam-u3-recovery-idempotent-sqlite.json, /tmp/iam-u3-recovery-idempotent-pg.json, /tmp/iam-u3-account-sse-pass.json, /tmp/iam-u3-backend-idempotent-all.json, and /tmp/iam-u3-backend-idempotent-pg.json.
Impact: Profile actions require a password-authenticated full cookie; duplicate owner confirmation or rotation returns status without plaintext; an active SSE stream stops before its next business frame after disable.
Refs: IAM U3 r1 stages 4-5; Dev feature/iam-u3-account-directory-recovery
Why: U7 account audit and identity gates advanced on main while U3 account initialization and recovery were in progress.
Evidence: SELF merge-tree checks passed with go test ./... and isolated PostgreSQL store/server tests; exact-head replay follows.
Impact: Preserve pending-account grants, proof-linked recovery, protected CLI delivery, account serialization, and atomic audit.
Refs: IAM U3 r1; U7 PR #185
Why: Account disable could be followed by late Backend business writes, API key creation could implicitly create users, account bootstrap locks could invert, and directory cursors were process-local or leaked out-of-scope changes.
Evidence: Local go test ./... and isolated PostgreSQL package suites passed on the staged candidate; exact committed-head SELF replay and stage 6 human review remain pending.
Impact: Adds final account transactions and external-effect checks across HTTP, Host, Bus and run manager; tightens API key issuance and persists versioned cursor signing. Delegated RDM rename still needs the separately proposed real-operator contract, so A1 and stage 6 are not complete.
Refs: Documents U3 r1, approved A1-A4 amendment fb3a821, pending delegated-projection amendment 5783940, Dev feature/iam-u3-account-directory-recovery.
Why: RDM delegated rename rebuilt the creator Host and could commit a Backend project rename after the delegated operator was disabled.
Evidence: SQLite and isolated PostgreSQL targeted checks cover operator/creator disable order, two processes, sorted locks, auth-off local compatibility, and HTTP/command Host wiring; exact committed-head replay remains pending.
Impact: Adds a request-bound single-project extension capability and checks operator plus creator in the final Backend transaction. Global ScopedHost cannot derive delegated authority; RDM cross-database atomicity remains outside the promise.
Refs: Approved Documents delegated-projection amendment 5783940, U3 A1-A4 candidate adcd8fe, Dev feature/iam-u3-account-directory-recovery.
Why: U3 seeds a directory revision in every new target database, which made an empty PostgreSQL target look occupied to the migration guard.
Evidence: Isolated PostgreSQL cmd/storage-migrate integration tests passed after the previously failing cases reproduced the error.
Impact: A fresh target remains eligible for migration; existing business rows and foreign migration identities still block it.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
Why: The U3 migration must replace the target schema seed with the source directory revision and cursor key.
Evidence: Isolated PostgreSQL TestMigrateEndToEndAndIdempotent passed with field-by-field source and target comparison.
Impact: Migration regressions that lose directory cursor identity now fail the existing end-to-end test.
Refs: IAM U3 Stage 7; docs/proposals/2026-10-14-iam-u3-account-contract-and-plan.md §10
weichen
marked the pull request as work in progress 2026-10-14 14:20:38 +00:00
Why: The SSE test canceled after 200 ms while filtering more than a thousand private events; CI and race builds stopped before the shared frame.
Evidence: The failure reproduced under go test -race with HTTP 200, no private leak, and no shared frame; after a two-second deadline the race case passed three times and the Server package passed.
Impact: The privacy assertion is unchanged and now reports which condition failed, while slower replay still reaches the event under test.
Refs: IAM U3 Stage 7; Backend PR #198; CI run 3170
Why: Merging run-process visibility introduced a read endpoint that bypassed U3 effective-account checks when authentication was off.
Evidence: A new regression first returned HTTP 200 for disabled local; with entry and final response checks it passed, and the event pagination test passed ten repeated runs after anchoring to its appended event sequence.
Impact: Explicitly disabled local accounts cannot read stored process events; missing implicit local remains compatible.
Refs: IAM U3 Stage 8 integration review; Backend PR #198; main PR #199
Why: The previous endpoint regression used an SQLite-only server fixture even when isolated PostgreSQL was configured.
Evidence: The revised HTTP test passed with dialect=sqlite and dialect=postgres; it creates data through one Store and reads through another before and after disabling the local account.
Impact: U3 effective-state checks for the new process replay route now have a direct two-store PostgreSQL regression without changing production behavior.
Refs: IAM U3 affected Stage 7 review; Backend PR #198
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
An administrator can now create a passwordless, pending account with optional profile fields, while account searches disclose only fields allowed by the caller's current scope. Disabling an account revokes its credentials and fences later account-owned work. Existing users cannot be taken over through the old admin password or recovery-key endpoints; owner initialization and proof-bound self-recovery use separate, audited paths.
After Backend main PR #199 added persisted run-process replay, this branch also checks current account state before and immediately before returning its private events, so an explicitly disabled auth-off
localaccount cannot read them. The Backend also exposes the constrained directory contract consumed by RDM and guards delegated project projection writes with the real operator. A fresh PostgreSQL migration target now ignores its schema-seeded directory-revision row when checking for preexisting business data, then copies the source revision and cursor key. The migration integration test verifies that copy and still rejects foreign target rows and identities. The private-project SSE replay test now allows enough time to filter 1001 private events before asserting that the later shared event is visible; the privacy assertion itself is unchanged.Evidence and review state
6dadde47b04355147fd37efdb290f3e9fb26a36e, containing currentorigin/mainead5ade30e8a9475277ba72505f5029feea93304.6dadde4passed full SQLitego test ./... -count=1andgo build ./...; precedingd53b20epassed the isolated PostgreSQL full suite. Main PR #200 only added prompt/skill assets and tests, leaving U3 server/store/account code unchanged. The earlier isolated account browser flow covers the same U3 account implementation, while the new process-event route has direct HTTP regression tests.d53b20e; the log printsdialect=postgresfor every pass. Original log SHA256:3dacb8e27602ba37abe1a212fdcbe132c4607779a7988365315822dfd022336f, imported into the Dev U3 task card. Earlier Backend candidates also have independent migration, Store and Server replay.vet-and-testonhome-runnerat the exact PR head. Earlier CI failures and fixes remain in the task-card history. The affected Stage 7 human review is pending; do not merge before that conclusion and final current-base checks.Scope and dependencies
This PR delivers the Backend U3 component. RDM's formal Backend pin and the Dev fixed combination follow a trusted Backend release tag; publication of that tag is owner-executed under the repository's dual-key rule. No production migration, deployment, or real-account operation is included.
Refs: IAM U3 account contract and plan (
2026-10-14-iam-u3-account-contract-and-plan.md), A1–A4 and delegated-actor amendments; Dev U3 task card atfeature/iam-u3-account-directory-recovery.