postgres

Identity PostgreSQL

Protected explicit account linking

NewAccountLinkUnitOfWork(coordinator, repository, AccountLinkUnitOfWorkConfig{RetentionPolicyVersion: revision}) implements the root identity.UnitOfWork for AccountLinkService. The exact repository, audit/lifecycle, capability, current-counter and native OAuth account-link participants must already be registered with their complete typed recovery and execution phases. Missing phases fail before reservation. This is trusted backend composition, not an application SQL gateway or provider proof API.

The native AccountLinkContributor enriches the original signed command with its retained counter context without changing that intent. Current provider, original session, policy and factor admission run inside the kernel transaction; the native owner must enforce them rather than accepting caller assertions. AccountLinkWork expires with each invocation and poisons ignored denials. It reuses the kernel's directory, credential and authorization checks. Its credential-authority getter permits only the original epoch initially and this transaction's actual successor at the final check, never a refreshed session.

One coordinator reserves the command/counters/proof, applies identity-owned link/credential changes and provider-owned effects, persists audit/lifecycle, rechecks admission and finalizes proof/provider custody. A failed phase rolls back all provisional changes. Required denial auditing and proof release follow the existing proven-rollback protocol. Exact replay returns its historical receipt. Expired pending recovery requires every frozen owner to prove noncommit; provider uncertainty leaves custody reserved. Current rows never reconstruct a successful receipt. Historical bare-link bytes remain unchanged.

Original OAuth callback preparation

The trusted native adapter calls AccountLinkUnitOfWork.ExecutePrepared with the root AccountLinkPreparationCommand and its closed declaration. Original code/state/session intent uses the existing keyed command claim; the later verified subject and signed link command do not replace it. This is an adapter seam, not an application callback API or permission to invent missing owners.

Install AccountLinkPreparationMigrationSource after the existing CounterPreparationMigrationSource and all installed successors. The forward profile preserves earlier migration checksums and rejects other operations. The declaration fixes six consuming/domain owners, original callback-state capability, counters, audit and lifecycle, with no final link grant yet. The registry additionally contains the actual capability.issuance owner.

Original state reservation, current native admission, counter charge and start marker commit before the native owner may decrypt PKCE, exchange or sign. Lost start acknowledgment does not permit generation. Started-without-output stays pending; retained authenticated ciphertext resumes under its original generation without another exchange or renewed expiry. Matching terminal replay does not restore provider output. AccountLinkWork.Preparation lends original typed input and copied ciphertext only during that exact owner's invocation.

Attachment persists and reserves the one matching final grant atomically via the existing issuer/consumer. The issuer is a preparation prerequisite, not a final domain recovery participant: its positive issuance row must not turn a rolled-back account link into a committed result. Both distinct one-use inputs then apply/finalize with the protected mutation; proven rollback releases both.

This contract still does not provide the actual OIDC provider/session owner, token vault, HTTP callback or session-producing social flow. Native OAuth owns those required implementations and their current policy, fresh credential and source-proof expiry checks. No network exchange runs in open AccountLinkWork; no feature wrapper or second ledger substitutes for the root owner. Implicit, administrative linking and unlink remain outside this explicit-self profile.

Provider-account storage and trusted reads

Append AccountMigrationSource{Base: installedHistory, Version: nextVersion} after the credential-reference migration and every installed successor. Apply it through the normal migrations runner; do not alter an installed migration. The forward source preserves existing users, passwords, sessions and epochs. It installs identity-owned account/link tombstones and credential associations, not a provider engine, token vault or public account-link workflow.

Repository.ListAccounts implements the existing bounded AccountRepository: one primary statement, exact tenant/user partition, account-ID ordering, no partial result on overflow, and ErrUserAbsent for a missing user. It returns stored status rather than turning blocked users into active users. Configure MaximumAccounts in 1..100 and the repository's finite operation budget.

Repository.GetAccountLinkState reads the same user's complete account set, candidate/tombstone versions, credential epoch/references and tenant-wide exact provider/issuer/subject collision in one read-only repeatable-read transaction. The explicit and administrative query modes are structural reads, not authority to use either policy. Implicit linking is unavailable until its consistent identifier projection is composed. Returned methods conservatively have Usable=false: reference enablement alone cannot prove provider, factor or credential-owner eligibility. A disabled provider reference whose link was removed remains a retained tombstone, not a live login method. Disabled non-provider references, including removed passkeys, likewise remain in storage without consuming the bound on current methods. Enabled references and provider methods currently associated with live links still count. Disabled provider references without an association are retained credential tombstones, not current methods. Enabled references missing their association, and invalid or non-provider associations, still fail closed rather than being omitted.

The live subject index uses a database-checked SHA-256 commitment of the length-framed UTF-8 provider tuple so valid maximum-size metadata does not exceed PostgreSQL's B-tree entry bound. Lookups compare original exact tuple bytes; a collision denies instead of selecting another identity. No bearer, token or PKCE verifier is stored here. Account IDs and historical versions are retained; an absent account in a user's list never proves tenant-wide subject absence.

These are trusted storage ports. Consumers must not write account rows directly or treat these snapshots as authorization, provider proof, authentication, usable-final-access evidence or a renewable validity lease. The protected link owner must recheck current state, consume proof/risk, and commit account, credential, audit, lifecycle and recovery effects through the sole coordinator. That consumer workflow and its session/HTTP composition remain unfinished.

For a known-user native feature invocation, Work.RequireActiveProviderAccount fences an original ProviderAccountAdmission: exact account/provider tuple, account and social-link versions, associated provider credential and independent kernel user/identifier/credential epochs. It retains user, credential, account and association share locks and checks credential expiry again after obtaining the link locks. Denials poison the original Work even when ignored. These are read/locking checks only; they do not mutate a link, resolve an anonymous flow, validate provider cryptographic proof or current provider configuration, choose factor policy, consume risk/capability state or issue a session. A prior success cannot renew the original evidence or be cached as a new validity lease.

The private link writer now locks the current partition and applies the core's pure ApplyAccountLink transition in that same transaction. Account records, credential associations and independent epochs commit or roll back together; retained IDs cannot be reassigned or revive an old disabled credential. The tenant exclusion and live-subject unique constraint serialize competing owners. Relinking retires only disabled credential associations on that exact account; credential-reference tombstones and their versions remain stored. Association rows describe current access, not historical credential lineage. This prevents repeated same-ID relinks from reattaching the entire retired credential history. This storage phase alone is not a callable account-link service. The protected unit of work above requires proof, original session/policy, risk, required effects and recovery participants; missing native composition fails closed.

Native command fingerprinting recognizes the separate canonical protected-link counter variant. It binds network attribution through a keyed, domain-separated commitment and retains the original preparation time and digest-version aliases. The original link command ID, scope, proof and bare-link byte format stay intact; safe journal metadata contains no raw network. This codec support does not enable unsupported reservation, Begin, or a public linking service by itself.

Source-version snapshot imports

Trusted feature schemas may explicitly select FeatureVersionSnapshotImport when importing an absent local record with a positive source version. The coordinator binds that exact policy in command intent, collision scope, request-preparation identity, historical plans, lifecycle and journal receipts. Existing sequential schemas retain their bytes and adjacent-version rules. Policy changes cannot borrow a registered schema or its original preparation. The native importing owner must authorize the source and atomically fence local absence; this declaration grants neither import authority nor overwrite rights.

Atomic API-key verification effects

The exact opt-in apikey-verify-organization-v1 schema represents a known organization-owned key without a human UserID. Its AnonymousFlowID is the original command ID (the authentication attempt), while the actual API-key actor remains the audit target and owns the positive original key version. It uses the same closed plan, typed comparison, required effects and original recovery as known user-owned keys, not the unknown-key denial profile. The trusted native producer must bind the actual organization and credential epochs in command fields and fence current organization authority inside Work; this kernel support supplies no organization authority or browser session.

The native verifier uses ExecutePreparedAPIKeyVerification to submit original preparation and obtain the coordinator fingerprint actually matched under its claim lock, including when acknowledgement is lost. ObserveAPIKeyVerificationCommand is an effect-free intent check; absence supplies only a prospective fingerprint, which must never replace the actual submission commitment after a concurrent retained-key claimant wins. Authorized primary absence supplies only the prospective current-key commitment; it is not a reservation or rollback proof. Existing attempts compare complete intent under their retained fingerprint key. RecoverAPIKeyVerificationCommand requires that original nonzero fingerprint before pending recovery, and repeats the check under existing recovery locks. Neither method compares a credential, returns a native principal, renews freshness or adds an attempt journal. Generic command metadata remains fingerprint-free.

Prepared native submissions bind APIKeyVerification.KeyVersion in the original uint64 apikey.verify.key-version field. An unattached preparation remains fingerprint-bound pending metadata, even after its lease expires; missing output never authorizes generation or proves rollback.

The closed CommandPlan.APIKeyVerification profile is a trusted native-adapter composition seam, not a standalone API-key backend. Its exact APIKeyVerificationContributor compares the credential and checks current owner, tenant and policy authority inside the existing Work. It must first require the unchanged command through Work.RequireFeatureCommand, and its mandatory CheckFeatureCommit fences the original facts and expiry again after required effects. It cannot renew freshness or create a private transaction.

ApplyAPIKeyVerification returns a record-free FeatureReceipt and an independent APIKeyVerificationOutcome:

• Ordinary success or denial persists one protected authentication audit, without advancing key versions or emitting lifecycle events.
• A genuine strict permission reduction also persists its successful update audit and api_key.permissions_changed.v1, even if the resulting grant denies authentication. Both effects remain atomic with the actual native reduction.
• An unknown key can only deny, with an authentication_attempt subject bound to the original command. It cannot authenticate or reduce any key's grant.

Known-key plans freeze the original positive, incrementable KeyVersion, the API-key actor as audit target, protected authentication/update slots and nominal zero-version lifecycle declaration. Unknown-key plans use version zero and only the authentication slot. The coordinator selects actual slots from the native result; the retained plan never changes. Actual reductions use the frozen key's adjacent version transition while the record-free receipt stays at zero. All other feature profiles retain their existing mandatory mutation effects. The declared native verification schemas require this closed plan and cannot fall back to a generic mutation contributor. The envelope discriminator does not reserve an operation name belonging to another registered feature owner.

CommitOutcomeCommitted describes durable command effects, not successful authentication. Native adapters must retain and reconcile their original result under the sole command journal, never infer a principal from that receipt or rerun comparison after an ambiguous commit. Missing required audit, lifecycle or final authority rolls back the entire provisional reduction; unproven closure remains unknown. This support alone does not supply native credential storage, verification, reconciliation, HTTP or cache adapters.

After the original lease expires, unanimous negative evidence from every frozen participant may close the attempt as not committed. That recovery writes only the failed authentication audit, never the possible update/lifecycle. It retains the existing dependency-failure error classification alongside the durable noncommit result. Composed authentication and reduction records share original command/correlation identity and retain distinct canonical causation IDs.

Independent user-owner status admission

Work.RequireActiveUserStatus admits only the exact registered feature owner during its live invocation. Freeze the real Repository.GetStatus result in the command's intent, then require the command-bound tenant/user's active state and original positive user-security epoch. The existing user-row SHARE lock fences lifecycle changes until the coordinator commits or aborts. Acquire this guard before API-key or other feature-aggregate locks and repeat the original expectation at the final check; do not adopt a newer epoch to make it pass.

The user's aggregate revision is not an authority epoch. This guard does not require password, identifier or session credentials and does not authenticate an API-key actor as its human owner. Native callers must separately prove the actual credential, directory/tenant status and permission ceiling. Existing credential-specific guards remain mandatory for operations relying on them. Missing/inactive/stale owners deny uniformly; every live failure poisons Work, including an already-open cursor, while expired invocations cannot poison a later call. No transaction, authority state or freshness window is created.

Passkey eligibility during anonymous TOTP completion

Work.RequireMFAPasskeyCredential fences the exact passkey reference and user epochs for the subject frozen in the protected TOTP completion plan. The child must already be consumed in that Work; the same guard remains available in its original final check. MFATOTPAttemptWork.RequirePasskeyCredential supplies the matching current-credential prerequisite before counted comparison/denial. Both retain the original anonymous command, poison live Work on denial and use existing credential locks/time checks. Neither authenticates an assertion or factor, authorizes an operation, supplies an email recipient or issues a session.

Before output generation, Work.RequireMFAPasskeyPreparationCredential uses the original input-admission command and frozen continuation subject to perform the same eligibility read. It does not consume the child or admit Apply; the existing consumption-required guard must still run during Apply and final checks.

Recovery when an original request precedes its journal

An opted-in native RequestKeyRecoveryContributor authenticates its original prepared-request ciphertext and returns its complete original command binding. RecoverPreparedFeatureCommand checks current query policy, actual immutable mapping, exact registered owner and every query field before outcome disclosure. A mapping with no claim returns CommitOutcomeUnknown and UnknownCommitError for that original command. It never proves rollback or permits another execution; the first invocation may still be starting. Existing journals use the same sole recovery owner. Generic outcome queries keep uniform missing/denied responses. The decoder performs no preparation or effects; native session/domain disclosure checks remain required. Retain the original envelope configuration and keys.

Definitive refusal of an expired, never-started original

An explicitly registered RequestKeyExpiryContributor also authenticates the original exclusive preparation deadline. It must restore the earliest original session/preparation validity ceiling from the immutable envelope, not calculate a new deadline from current time or a replacement session. Its bounded decoder performs no reads, generation, counters or effects. Native possession and current session/domain disclosure checks remain required around this kernel operation.

Install RequestKeyExpiryMigrationSource{Base, Version} after the selected request-preparation history, then select ExpirePreparedFeatureCommand. Before the deadline, an absent claim remains Unknown. After primary-database expiry, the operation arbitrates with every ordinary/prepared writer through the existing global command-ID primary key. Only a never-claimed original can become an irreversible, scope-free retired claim carrying a keyed original-envelope digest. This is an explicit exception to retirement after terminal-result retention: the fence proves effects can never start, rather than removing an existing result. An existing claim is never retired; its ordinary recovery owner still decides.

An exact restarted retry returns metadata-only CommitOutcomeNotCommitted. It never permits that command ID to execute again or renews any authority. A lost commit acknowledgement remains Unknown until the same original is reconciled. Generic queries and ordinary retired claims retain their non-disclosure behavior; retain fingerprint keys and the original native codec/configuration for retries. No second journal, mutable mapping, background cleanup or HTTP route is added.

The optional forward migration preserves earlier checksums and populated rows. It adds a nullable digest/check constraint and small invoker-rights triggers; typed fences reject UPDATE/DELETE, and command-claim TRUNCATE is rejected. Trusted schema owners can still bypass database enforcement and must not be application roles. Apply this upgrade before enabling the API. The ALTER/check validation and trigger installation take table locks and may scan existing claims; use the migration runner's bounded deployment window, including lock/statement budgets, and roll forward on failure. No downgrade, production-scale latency or live-rollout safety is claimed by the disposable PostgreSQL correctness tests.

Challenge-only MFA after an original UV passkey

The exact registered PasskeyMFAChallengeContributor can prepare a challenge-only identity.passkey.signin-verify.native-v1 command through the existing original-output journal. It retains the verified self-user assertion's command, original browser custody, current factor/policy versions and frozen continuation. Its only lifecycle is mfa.challenge.created.v1, version 0 to 1; ordinary known-empty-factor signin retains its historical representation.

Work.PasskeyMFAChallenge exposes that declaration only during the original owner's protected Apply. The owner must consume the genuine protocol assertion and persist its original primary, continuation and exact single-use child in that same Work, without a session. Apply and final checks must fence original expiry and current directory/credential/passkey/factor/policy/risk authority. The native flow must bound the child by the actual original primary; a scalar declaration or implementation of this interface authenticates nothing.

QueryPasskeyMFAChallenge observes the original profile under current query authorization. Only committed history discloses frozen child scope. Pending, aborted or foreign history cannot create a session or renew proof/expiry; recovery never repeats assertion verification or reveals another credential. These kernel APIs are not a complete native passkey/TOTP login or HTTP endpoint.

Additional passkey under an existing session

Work.CreatePasskeyCredential also admits exactly identity.passkey.register-verify.session-registration-v1 from the registered passkey/postgres owner. Bind the original PasskeyCredentialCreationFields and positive user/identifier/credential authority epochs. Its only lifecycle is identity.passkey.create_credential, event index zero and version 0 to 1. The historical passkey.registered.v1 alias remains limited to .native-v1.

This writer does not authenticate a session, assertion or registration. Native passkey orchestration must verify genuine action-bound UV and retain original session/CSRF, intent/expiry, current factor/directory/policy and mapping checks inside the same Work. Existing or disabled references conflict rather than being replaced; creation does not advance user security epochs. Complete native enrollment and reference composition are required before reporting that journey usable. No new migration, transaction, proof or replay owner is introduced.

Passkey-only prospective creation

After actual initial session persistence and its full current-owner checks, the session owner calls Work.StagePasskeyRegistrationSession with that exact original command and its command-bound session.result.session.id. This is provisional event staging, not session validation or token issuance. Duplicate, foreign, mismatched or overflowing staging aborts. The existing outbox participant must implement PasskeySignupSessionLifecycleContributor and persist StagedPasskeyRegistrationSessionLifecycle when present. An older account-only contributor aborts instead of silently omitting this required event. Its next unused index follows the unchanged credential/account indexes; existing effect IDs and encoded plans remain unchanged. Legacy account-only profiles produce no session event. The native signup journey must prove all three events and actual session persistence atomically; these kernel contracts alone do not.

PasskeyRegistrationIntent contains a trusted generated prospective user, already admitted attributes and an initial passkey-owned CredentialRef, not authenticator material or signup permission. Bind PasskeyRegistrationFields unchanged into the original identity.passkey.register-verify.signup-v1 command: its subject is the original anonymous flow and its actor is the configured service account. registration.user binds the real protocol participant's prospective subject. The command record is the new credential reference.

Append PasskeyRegistrationMigrationSource{Base: installedHistory, Version: next} after credential references, registration/acceptance and all selected historical magic-link/username suffixes. It extends the existing original-command evidence; it adds no journal, backfill, email, password or recovery method. Old rows and predecessor migration bytes remain unchanged. Native signup is explicit opt-in; installing this schema does not enable it.

Enlist the actual repository, PasskeyRegistrationContributor and PasskeyRegistrationLifecycleContributor. Freeze the prospective IDs, complete creation digest and distinct account-creation event index in CommandPlan.PasskeyRegistration. During that exact native Apply, after real WebAuthn verification, NewPasskeyRegistrationDomain.Apply creates the active initial user/attributes and passkey reference inside the sole Work. Duplicate, foreign/reconstructed commands, changed intent and existing subjects deny. The returned user is provisional. Work.PasskeyRegistrationUser lends only that actual creation during Apply/final Check, including original correlation and current initial user/reference authority; it is not a renewable proof.

The outbox must persist both the canonical zero-to-one identity.passkey.create_credential primary event and Work.StagedPasskeyRegistrationLifecycle (user.created.v1). Native risk, pre-auth consumption, protocol finalization, known-empty MFA, authorization initialization and session issuance must commit in this same Work. This kernel seam alone is not a working signup/session API. Retained original-command creation evidence and canonical plan decoding support recovery without inferring success from an existing user or revealing session material.

Anonymous placeholder namespace

Append AnonymousIdentityMigrationSource{Base: installedHistory, Version: next} after identifier retirement, normalization and every installed successor before selecting anonymous identity storage. It adds the non-contact placeholder kind without changing existing contact rows or predecessor migration bytes. Database constraints reject verification, primary selection, display/contact values and noncanonical opaque IDs; ordinary email/phone recipient discovery stays separate. No destructive down migration or anonymous workflow is provided by this source. The native anonymous lifecycle and session effects remain in development.

NewAnonymousCreationDomain borrows the exact enlisted kernel repository. Include AnonymousCreationFields unchanged in the original native command; its closed identity.anonymous.signin.native-v1 profile uses an anonymous-flow scope, not a fabricated credential or permanent-user actor. Apply owns user, admitted-attribute and placeholder SQL in that same Work; changed/foreign or repeated intent poisons it. Work.AnonymousCreation lends only actual provisional creation to the current native invocation. The suffix also retains immutable original-command creation bindings for recovery after payload pruning; it is not an anonymous lifecycle store or a second command journal. Native risk, expiry, session, deletion and upgrade still require their owning composition.

Closed anonymous self-disposal

Append AnonymousDisposalMigrationSource after the installed anonymous creation and status/legal-hold histories. GetAnonymousDisposal preserves actual anonymous creation, placeholder and independent user/identifier/credential generations plus legal-hold version. It authenticates no bearer and grants no disposal permission. Freeze AnonymousDisposalFields before fingerprinting. The exact native identity.anonymous.delete.native-v1 owner then calls NewAnonymousDisposalDomain.Apply inside its original Work after real session, risk and pure retention admission. It rejects extra contacts/credentials, changed epochs/hold and missing/duplicate/reconstructed invocation. Delete/anonymize erase kernel attributes/profile and retain distinct irreversible identity tombstones; retain preserves those payloads but terminalizes authentication. All ordinary kernel SQL stays here. Check is the final same-Work read fence; original retained effect correlation supports recovery without inferring success from absent data. Anonymous lifecycle and complete session/family revocation remain their owners' atomic effects, not private SQL in the workflow. No general privacy endpoint, permanent-user deletion or upgrade is enabled by this component alone.

Guest disposal during permanent upgrade

Append AnonymousUpgradeDisposalMigrationSource after the installed disposal history before selecting the closed identity.anonymous.upgrade.native-v1 profile. Existing migration bytes and guest tombstones are preserved. The native AnonymousUpgradeContributor must independently validate the verified permanent target, guest possession and typed merge decisions. UserID and ActorID remain the permanent target; the distinct guest is RecordID. Missing one-use proof, protected counters or exact owner/schema/audit/lifecycle declarations deny.

During that exact Apply invocation, Work.AnonymousUpgradeConsumption exposes only the original provisionally consumed declaration. Call ApplyUpgrade with the unchanged AnonymousDisposalFields; all its SQL addresses the guest, never the permanent target. Work.AnonymousUpgradeDisposal exposes the actual guest effect only to that owner. CheckUpgrade repeats guest state and original hold before commit. Original retained disposal evidence supports recovery without reinterpreting target IDs or relying on prunable payloads. The native workflow must still fence target authority, apply supported merges and enlist the real session owner for guest revocation and exactly one permanent session. No generic capability feature, separate transaction or automatic endpoint is introduced.

Internal anonymous-upgrade issuance

The closed identity.anonymous.upgrade.prepare.native-v1 profile is a native preparation phase, not another public HTTP operation or the upgrade mutation. It selects only AnonymousUpgradePreparationContributor under the existing anonymous owner, with permanent user/actor, no record transition and one protected preparation audit. Original admission is issuance-free; only acknowledged generation may add exactly one identity.anonymous.upgrade grant through the existing capability issuance participant. A final command without that grant, recipient overrides, delivery, consumption or a schema alias is rejected. Both commands retain the canonical identity.anonymous.upgrade action and permission, with distinct exact schemas, record policies and command IDs.

The native owner must freeze both real sessions, merge intent, unchanged remember choice and original deadlines in the existing encrypted preparation. Signing alone is not durable issuance: commit this phase before the real one-use owner reserves the grant for the protected upgrade. Only that later command consumes the target action proof and applies risk, guest disposal, merge and session effects atomically. Neither preparation nor a retained signature authenticates an upgrade by itself. No additional transaction, journal or public endpoint is introduced.

OAuth authentication-age continuation handoff

The canonical native OAuth owner can select OAuthContinuationPreparationContributor for an original human authorization continuation. Ordinary preparation admission remains read-only. Only the separate checked start callback may CAS that existing continuation's current attempt pointer, atomically with this coordinator's acknowledged start marker. It requires Work.RequireOAuthContinuationHandoff and a locked, exact same-human/tenant/grant/schema/policy predecessor whose immutable receipt is NotCommitted with OAuthReauthenticationRequiredError. Unknown, pending, committed, missing and other failed history cannot authorize another attempt.

Append OAuthReauthenticationMigrationSource{Base: installedHistory, Version: nextVersion} before enabling this profile. It extends the terminal shape constraint without rewriting existing migration bytes or receipts. Use upgraded readers for the new denied classification. The OAuth owner must independently require genuine newer authentication and all current/original source, client and expiry checks, preserve the original token/request/deadline, and retain recovery access to every original attempt even after pointer advance. An unacknowledged start grants no generation or retry; recover its original command through the existing coordinator. This adds no transaction, journal, credential, freshness renewal or OAuth protocol implementation to the kernel.

Pending phone enrollment

NewPhoneEnrollmentDomain freezes the phone owner's exact metadata-bound normalization profile and positive identifier recycling cooldown. Install IdentifierNormalizationMigrationSource and IdentifierMutationMigrationSource in the selected history; no existing identifier is relabeled or reverified. PhoneEnrollmentFields binds the new candidate, tenant, subject, record and original user/identifier-authority predecessors before fingerprinting.

The closed identity.phone.send-verification.native-v1 profile requires a PhoneEnrollmentContributor under identity/phone/postgres / identity.phone version one, a self-bound original session, identifier.attached.v1 lifecycle 0→1 and required protected audits. It cannot consume an OTP or capability: this initiation profile issues a challenge; confirmation is a separate flow.

The coordinator locks and checks the original directory and number reservation, then invokes the native owner while those original epochs still hold. The owner must check/consume its actual action-bound fresh proof, current session, factor and risk policy and stage its purpose-bound OTP/SMS delivery in the same Work. Work.RequirePhoneEnrollmentCandidate accepts only that exact prepared candidate during this invocation, before the kernel mutation. It does not fabricate an existing or verified RecipientRecord or establish authority. The kernel then persists a pending, non-primary, unverified phone and bumps the user/identifier epochs through the existing CAS writer. Errors roll back all enlisted effects; absent kernel apply cannot produce a committed receipt. The final native check conserves original validity, not a newer admission.

Recovery treats an existing target as unknown, never as proof of commitment. Only target absence can contribute negative evidence; all other participants and the original command journal must independently reconcile the outcome. Construction, fields and the storage participant alone are not a public phone enrollment service, OTP verifier, delivery sender or HTTP endpoint.

Native username rename and advisory discovery

NewUsernameRenameDomain freezes the explicit comparison profile, retained identifier-reuse keys and cooldown. UsernameRenameFields binds every original user/identifier/verification predecessor. The exact registered native username contributor must supply real password/session/factor/risk admission; the kernel alone swaps the owned identifier and writes keyed retirement history. The identifier.updated.v1 lifecycle and required protected audit share that Work. Same-canonical display edits preserve possession/time and create no retirement; actual canonical changes reset possession and conserve the original cooldown. This typed storage seam is not a standalone public rename workflow.

domain.UsernameAvailable reads primary occupancy and live keyed cooldowns. Historical/unbound or inactive-account reservations still block uniqueness; missing historical keys or schema deny. Supply only an exact canonical value and profile, never an owner-exclusion selector. The owning workflow must enforce trusted tenant/network rate policy before exposing this advisory result. It locks/reserves nothing and cannot promise a later signup or rename will succeed.

Username lookup and protected admission

ResolveUsername reads one tenant-scoped canonical username only when its stored normalization profile/version matches UsernameQuery. Legacy unbound names, absent, inactive and revoked users/names return the same suppressed record. Pending username state is permitted; it proves neither a verified delivery channel nor authentication. Install status and credential-authority histories alongside identifier metadata before using this reader.

The workflow must independently verify its required email, password and factor policy, then call Work.RequireUsername on the exact original record during its registered native invocation. The fence locks current user and identifier rows until transaction termination, denies changed ownership/profile/versions and poisons the Work on failure. It grants no lease, session or new freshness. The exact username password-signin profile may apply an atomic password hash upgrade through the existing credential owner, not a separate write path.

Username registration provenance

The exact identity.username.signup/username-signup v1 and identity.username.signin/username-signin v1 profiles reuse the registered identity/password/postgres contributor's paired custody and sole coordinator. No other cross-owner tuple is admitted. This registration is not an enabled workflow, proof of username policy, or HTTP exposure.

For required-email username signup, install normalization binding, original registration/acceptance and email-verification histories, then append UsernameRegistrationMigrationSource{Base: history, Version: nextVersion}. Install any already-selected historical magic-link registration suffix first; this successor retains its disposition arm without activating that workflow. It adds no account, inferred origin, backfill, transaction owner or journal. Legacy password origins retain their exact bytes and empty operation selection. Username confirmation supplies EmailVerificationIntent.RegistrationOperation as identity.username.signup; this freezes its distinct original purpose in the command and retained foreign-key evidence. Never relabel the origin.

This experimental adapter uses authentication v2, authorization v3, capability v2 and password v2 together with the matching identity kernel. Update supplied primitive values to those major imports. Existing migration source bytes and stored database history remain unchanged.

Optional canonical-policy binding

Compose IdentifierNormalizationMigrationSource{Base: existingHistory, Version: nextVersion} before selecting username support. The forward migration preserves existing values as explicitly unbound empty/zero metadata; it does not normalize or backfill legacy identities. Existing readers remain usable without this optional schema. Bound records retain the exact profile/revision through primary/locked reads and CAS writes; malformed or partial stored pairs fail closed. The feature owner, not this storage layer, proves canonicalization.

PasswordRegistrationIntent.Username can reserve one supplementary username atomically with its required email, user, password reference and original registration receipt. Include PasswordRegistrationFields unchanged in the original command. Collision checks cover both values under the existing tenant fence; neutral occupancy creates neither account nor credential, and rollback removes every provisional row. This native storage capability is not by itself a public username signup service or authentication proof.

Closed invitation and OAuth consent contributions

Native organization invitation send uses the existing preparation journal, capability issuer and encrypted delivery effects, not another workflow owner. OrganizationInvitationIssuanceContributor must validate original owner/session, organization, recipient and limits before generation. In each protected Work, RequireOrganizationInvitationRecipient reuses primary recipient/authority locks and retains an invocation-bound verified-email selection. Apply must repeat the fence before StageCapabilityIssuanceFor; a preparation Work cannot grant later issuance. Final checks can call the existing RequireRecipient again without recording a second issuance selection. Original invitation expiry, recipient, member role and all five signed scope caveats must match; no subject override is added. The native owner separately enforces current owner and organization policy.

The separate identity.organization.invitation.resend operation selects only organization-invitation-resend v1 with the same typed native owner. Its exact positive invitation version advances once, and the new capability binds that successor; initial send still uses 0-to-1. Resend requires the canonical identity.organization.resend_invitation audit with standard retention and the informational invitation.resent.v1 event. It cannot reuse send's created event or audit. Native ownership must atomically supersede the old proof, preserve the original exclusive expiry/recipient/member role, and enforce current authority and limits alongside one issued grant and one encrypted delivery. This kernel profile alone does not implement resend or confer permission to renew a grant. Pending/aborted preparation history uses the original frozen journal declaration, not regenerated credentials. Resend's existing immutable invitation row anchors its organization; the optional send-origin profile below is unchanged.

Send owners additionally freeze OrganizationInvitationOrigin with the exact original command's organization.id and organization.version. The existing preparation declaration retains it before generation; final attachment cannot change it. QueryOrganizationInvitationOrigin lets that exact registered owner, under current command-query policy, resolve safe original organization metadata even when no invitation row or generated output exists. Authenticate a fresh session and current organization/action access separately before asking the sole coordinator to reconcile. The returned version is historical correlation, not current authority. Missing/legacy correlation fails closed; neither row absence nor this read proves noncommit, renews a lease or authorizes redelivery.

Acceptance requires OrganizationInvitationConsumptionContributor, the actual one-use capability participant and OrganizationInvitationLifecycleContributor. OrganizationInvitationConsumption exposes original custody only during the exact owner's Apply, after provisional consumption. After successful native membership SQL, record OrganizationInvitationMembership with the real retained member version; StagedOrganizationInvitationMembership emits index1 alongside the primary index0 invitation's exact positive-version successor event (initial acceptance is 1-to-2). Rejoining a removed member advances its actual tombstone, not invitation versions. No ignored recording failure can leave usable Work. Capability finalization, both events, audit and mutation must commit together; any failure rolls back. Metadata is not proof or a commit receipt.

For the exact public-password OAuth continuation or native device approval, OAuthConsentContributor records an independent OAuthConsentMutation after its actual successful SQL. The authenticated command freezes oauth.consent-id, oauth.consent-before-version, oauth.consent-after-version and oauth.consent-created; native validation also binds the original client. OAuthConsentLifecycleContributor persists primary grant index0 and the StagedOAuthConsent index1 event in the same outbox. Creation is consent.created.v10-to-1; repeat explicit approval retains the consent ID and emits consent.reconfirmed.v1 with its real positive predecessor. This does not invent a grant scope change, expose consent fields as permissions or acknowledge downstream consumption. Zero, foreign, wrong-phase or repeated mutation receipts deny; required secondary owners cannot be replaced by a single-event contributor.

The optional device child declares only identity.oauth-server.device-authorize, device-token, device-approve and device-deny through the existing oauth-server/postgres contributor, using each exact native-device-v1 schema. Authorize/token use anonymous-flow bindings; approve/deny use authenticated-user bindings. Only human approval with grant.authorized.v1 selects the independent consent contribution. Registration alone authenticates neither client nor user and does not initialize device storage or expose a route.

For client-authenticated polling of an approved human grant, RequireOAuthDeviceGrantSource fences the source user's exact credential, independent user/identifier/credential epochs and user-policy authority in the same Work. It admits only the exact native device-token command during its owner's preparation, apply or final invocation, checking its original source, client and grant selectors. The command's client actor and anonymous flow never become the source user. Current withdrawal poisons Work; credential expiry is checked again after authorization lock waits. Derive expectations through the session owner's OriginalDeviceGrantAdmission; the native owner must still match the complete original session to its locked grant, fence directory, session, client and consent authority, and retain original temporal bounds. This check is neither authentication nor a renewable validity lease.

These are library prerequisites. Complete native invitation/OAuth consumers, their public dependency pins, real delivery/denial/replay/rollback acceptance and whole-unit qualification remain separate requirements; these declarations alone do not deliver either complete consumer milestone. Existing migrations and non-selected declaration encodings are unchanged.

Scoped lifecycle-catalog additions for these profiles are invitation.created.v1 (invitation0-to-1), invitation.accepted.v1 (positive invitation successor), invitation.resent.v1 (the same invitation's positive successor, not a membership/organization-authority cascade), and consent.reconfirmed.v1 (independent retained consent successor). The existing membership.created.v1 and consent.created.v1 semantics remain unchanged. These safe informational envelopes do not alter current-authority epochs, grant membership or acknowledge cascade completion; consumers selecting the new transitions must register their exact event names.

Pending managed email attachment

The independently selected OTP profile uses OTPEmailVerificationFields and RequireOTPEmailVerificationTarget with the actual registered OTP contributor, not a capability/link substitute. It binds the original OTP Send, exact pending identifier/CAS and email_verification_otp before comparison. The user partition is locked before credential/factor/session rows. Only this Work's exact persisted identifier successor is admitted to its final authority checks; no original credential, user, authorization, session freshness or expiry is renewed. The shared directory writer and protected audit remain the mutation owners.

Primary-change OTP uses OTPEmailChangeFields for genuine replacement and the additive OTPEmailInitialPrimaryFields for explicitly selected first-primary establishment. Both authenticate the original change and independent Send; RequireOTPEmailChangeTarget locks the complete partition before comparison. Initial establishment requires the original sole verified predecessor and no primary, preserves the old row's versions and cannot reinterpret a generic add.

Native verified-phone replacement

NewPhoneChangeDomain selects the existing directory/recycling owner and a purpose-bound IdentifierChangeCascadeConfig. Retain a distinct policy version from removal when both are installed in the same tenant. Apply PhoneChangeCascadeMigrationSource after its phone-removal predecessor and all other selected migrations before enabling replacement.

The exact identity.phone.update.native-v1 participant must implement PhoneChangeContributor, preserve both numbers/profile bindings and original send custody in PhoneChangeFields, and use RequirePhoneChangeTarget during input admission before any OTP comparison or debit. The sole coordinator applies one versioned verified replacement, retires the old canonical value under the existing keyed cooldown policy, and admits ten pending identifier-change consumers. It never acknowledges downstream cleanup or creates a second journal. Only this Work's own persisted successor can advance OTP's final identifier expectation. Historical recovery cannot infer success from today's directory. The self-only consuming profile requires the canonical identity.identifier.change audit with standard retention; an unrelated action or a protected-retention declaration does not match this selected profile.

The actual native phone owner must still prove new-number OTP possession, recent action-bound authentication, current session/factors/risk, independent recovery, session effects and the encrypted old-number notification in the same transaction. This directory extension is not that workflow or an HTTP route; ordinary replacement and existing enrollment/removal semantics are unchanged.

Native safe removal

Administrative intents additionally freeze EmailRemovalAdministration with the actor's original global/tenant authority epochs. RequireEmailRemovalSubjects locks those authorities and both users in canonical order before either user's credential/factor/session checks; execution repeats this before identifier locks. Use RequireActiveActorCredential and RequireActiveActorAuthorization for the actual human actor, without replacing the target-scoped command binding. These fences grant no policy permission or proof. Native participants still own fresh original proof consumption, both MFA generations and exact target access.

EmailRemovalContributor supplies frozen EmailRemovalIntent and the enlisted EmailRemovalDomain. The coordinator alone locks the complete partition and applies the existing directory writer. Native Apply owns original proof, factor/risk and actual remaining signin/reset eligibility, with capability retirement through Work.EmailRemovalScope. That scope denies foreign, reconstructed, unprepared, already-applied and returned invocations.

Install IdentifierRemovalCascadeMigrationSource after status admission and identifier-retirement histories. It extends the existing identity-owned cascade tables without another journal or rewriting installed source. All ten versioned consumer contracts are required; unavailable adapters stay pending, never implicitly acknowledged/not-applicable. Cascade policy versions share the status namespace: incompatible definitions require distinct versions. Admission retains exact identifier authority, event, generation, legal hold/version and deadline atomically. The pending receipt is not consumer closure/whole-unit qualification.

The distinct identity.email.verification-send.resend-v1 declaration reuses EmailAttachmentContributor for IdentifierRestartVerification. Its intent requires ExistingCanonicalAddress and exact identifier/verification versions; attachment leaves that field empty. Resend preserves the pending mailbox and advances its verification generation through the same private writer. The native owner must still enforce fresh authority, cooldown and shared family fencing, and commit replacement issuance/encrypted delivery together. This storage seam does not supply a complete public resend service.

ManagedEmailVerificationContributor supplies exact authenticated original management intent for identity.email.verification-confirm.managed-v1. The coordinator uses the same identifier writer and capability transaction, while keeping signup verification and generic execution closed to this profile. ManagedEmailVerificationFields binds the original request, mailbox and pending predecessors. Only a pending non-primary address can transition to verified; this profile performs no primary swap or session issuance. Recovery reconciles all enlisted owners; a changed/missing successor is not proof of noncommit.

EmailAttachmentContributor is the typed native port for authenticated identity.email.verification-send and identity.email.change-request attachment under their version-one native schemas. It maps frozen EmailAttachmentFields and an immutable EmailAttachmentDomain tied to the exact enlisted repository. The coordinator locks the complete partition, checks optimistic versions and canonical reuse restrictions, then applies the shared kernel-owned CAS writer after native admission. The new address remains pending/non-primary and the existing verified primary is unchanged. Proof and required audit/lifecycle writes roll back with late final-admission failure. Generic identifier Begin stays closed.

The native email owner must provide original fresh-proof/session/factor/risk checks and enlisted capability issuance/encrypted delivery. This kernel port is not an application-written email workflow, delivery service or verification endpoint. Original command recovery must remain scoped and cannot infer a committed receipt merely because an address currently exists.

Anonymous MFA login-send counter source

MFALoginSendCounterContributor lets the registered native MFA owner lend its authenticated original resolved account to the exact counter invocation. CommandCounterWork.MFALoginSendScope and the current-check counterpart accept only the closed anonymous OTP-send profile, preserve original browser identity and reject foreign, returned or other-profile custody. The journal remains anonymous; these methods create no session, fake child-consumption plan, store or proof. The source's protected input/commit checks remain mandatory.

Native OTP enrollment confirmation

The closed authenticated identity.mfa.otp-verify / mfa-otp-enrollment-confirm profile can retain one native consuming attempt in the existing preparation journal. Original protected counters, factor lifecycle, audit and static intent stay unchanged. Restoration adds only OTP's actual consuming contributor/plan; it cannot introduce a login child, capability, delivery or session effect. Ordinary OTP admission profiles remain separate.

FeatureInputAdmissionContributor supplies the exact registered MFA owner's original primary/factor/recipient checks before OTP counted denial and consuming reservation, and again after waits before commitment. Its synchronous scope does not acquire Apply-only command authority. Failures poison the complete transaction; no callback result becomes independent authentication evidence. The existing counted-denial phase commits wrong-attempt/audit/history together. Correct verification proceeds through the real reservation, protected Work.OTPConsumption, feature activation and OTP finalization in the sole coordinator. Retained output and terminal replay never generate another attempt.

Use the native MFA confirmation service, not application-written orchestration. The profile is not OTP login completion or an authorization to omit a pending feature's current admission, configured protected risk or consuming history.

Atomic MFA completion

CommandPlan.MFACompletion selects the session-producing alternative of the anonymous-flow identity.mfa.totp-verify, identity.mfa.otp-verify, identity.mfa.recovery-use or identity.mfa.security-key-assert-verify version-one operation. Their schemas are the corresponding mfa-* names. The command remains the named factor operation; identity.mfa.complete is the original child's capability purpose, not another public endpoint. Enrollment verification without this declaration retains its existing profile.

The closed declaration binds the original child ID, subject, immutable scope digest and expected continuation/factor/policy versions. It requires the exact identity/mfa/postgres, identity.mfa version-one native owner implementing MFACompletionContributor, protected authentication audit and session.created.v1. OTP verification additionally requires its consuming OTP plan/owner; other factor methods reject OTP consumption. No new capability issuance, delivery, signup or challenge-only branch is permitted.

The native owner must validate original grant/browser/primary/remember custody, fence current authority and shared attempts, verify the actual selected factor and persist continuation completion plus session effects in the sole Work. Work.MFACompletionConsumption(owner) returns owned frozen metadata only after provisional consumption, only to the exact protected Apply invocation. It is not a factor proof or session grant. Preparation and restoration preserve all original versions, capability and optional OTP submission. The existing coordinator owns finalization, audit/lifecycle, commit and recovery; late denial rolls back protected effects, and a committed retry returns the original receipt.

For TOTP failed attempts, PrepareMFATOTPAttemptPlan and RecordMFATOTPAttemptDenial enlist the exact MFATOTPAttemptContributor. The existing journal transaction locks the original command before calling the native owner through bounded MFATOTPAttemptWork. Native wrong-attempt accounting, denial audit and an aborted command result commit together; exact replay does not compare or charge again. Unchanged rolls back and grants no successful-factor authority. No child, OTP or session reservation is invoked. When protected counters are declared, the native callback must call MFATOTPAttemptWork.ReserveCommandCounters once after browser/current-authority admission and before comparison. Risk denial must return native denial without comparing the factor. Missing charging or ignored denial aborts. Wrong-code denial commits risk, MFA budget and audit in the same transaction; correct-code Unchanged rolls the provisional charge back. Sealed counter scope access binds the original MFA subject and child without granting factor/consumption authority. The native owner must verify the real factor and lock/recheck the current continuation and shared budget. Successful completion uses the retained preparation route, preserving the original opaque TOTP submission and verifying it again under protected current authority; ordinary opaque execution denies.

These kernel seams do not implement factor verification, the production shared-budget mutation, continuation store or MFA session issuance. Public MFA remains disabled until those owners and the consumer journey are connected.

Atomic magic-link consumption

Original MFA challenge preparation may declare only selected user/policy/factor while omitting ID, scope digest and both timestamps together. Only PrepareFeaturePreparationPlan admits that ungenerated form; ordinary reservation and history decoding reject it. The acknowledged original generator supplies the complete child through the existing retained output and issuance owner. Final scope preserves selected authority, original primary consumption, required audits and challenge-only lifecycle. This enables native composition; it does not itself implement public MFA challenge issuance.

The exact anonymous-flow identity.magic-link.consume, magic-link-consume version-one profile enlists identity/magiclink/postgres and the existing capability/postgres one-use owner. Declare the original purpose-bound CapabilityPlan, command counters, protected authentication audit and session.created.v1 lifecycle with zero directory-version transition. Proof-free, reset, OTP and issuance/delivery profiles cannot substitute.

The native owner must implement MagicLinkConsumptionContributor, including pure original-input validation and a final current-authority check. Its exact ApplyFeature invocation may inspect Work.MagicLinkConsumption(owner) only after provisional capability consumption in the same transaction. The returned binding is not a bearer, authorization or a committed result; foreign, retained and final-check invocations deny. The owner must authenticate the original grant and issuance, pre-auth possession, callback and recipient, enforce current factor/risk policy, and persist the complete native session.

Capability finalization, native effects, audits, lifecycle and journal share the sole coordinator transaction. Any late denial rolls them back; original exclusive expiry is rechecked by the capability owner without renewal. A committed retry returns the existing journal receipt. No additional replay store or original-intent journal is created. This kernel profile does not itself provide public magic-link APIs or native session composition.

Magic-link recipient issuance

CommandPlan.MFAContinuation has a separate challenge-only historical profile. It freezes the target, MFA scope digest, policy/factor generations and original time bounds together with primary consumption and exactly one identity.mfa.complete issuance. Its lifetime is at most five minutes and never extends the parent proof. It cannot carry signup, delivery or a session-created lifecycle. Original preparation declares these immutable fields without an issuer or signed child. Restoration must add exactly one child without changing any original field or primary proof. Historical session-producing bytes remain unchanged. Registry admission requires MagicLinkMFAChallengeContributor and its pure original-scope validation; session-only owners deny. During protected Apply, Work.MagicLinkMFAChallenge exposes an owned projection only after provisional primary consumption. It grants neither current factor authority nor completed MFA. Public MFA composition remains incomplete until native continuation persistence and the real issuer's challenge recovery are integrated. CapabilityIssuancePlan.MFAContinuationUserID selects only the frozen challenge subject after primary consumption. Staging checks the signed child's tenant, subject, resource, original time bounds and exact profile/scope caveats; it is not a general anonymous subject override. Original preparation without a signed child cannot begin protected domain work.

For signup-by-link preparation, the native owner calls MagicLinkRegistrationDomain.AdmitProspectiveMailbox with its email-owned canonical address. This checks all occupants and live retirement policy under the original preparation invocation, without allocating future IDs or staging issuance. An eligible-recipient lookup's suppressed result is not proof of absence. Preparation availability is not reusable authority: its locks end before generation.

Declare CommandPlan.MagicLinkRequestAcceptance in both original and restored plans to preserve the neutral no-delivery branch. At protected request Apply, SelectProspectiveRecipient repeats the current collision check with the original generated identity. A canonical collision can commit the request audit/lifecycle without invoking its prepared issuer or delivery. Structural future-ID conflicts and unavailable retained keys still abort. Missing branch declaration or kernel admission cannot silently suppress planned effects. This does not authorize account creation, email possession or session issuance.

For prospective signup, the selected native request calls MagicLinkRegistrationDomain.RequireProspectiveRecipient with its frozen MagicLinkRegistrationIntent. This reuses the kernel's tenant and identifier retirement fences, rejects occupied account/identifier/email selections, and creates no account or MFA state. The issuer's explicit PrepareMagicLinkProspectiveRecipient profile signs the creation digest, mailbox-policy version and future identity versions; ordinary existing-recipient preparation cannot select that profile. The original anonymous command and issuance plan envelope remain unchanged. Consumption must independently create the exact account, prove possession, initialize real factor authority and issue the session atomically. Public signup composition remains in development.

Native magic-link request contributors use the exact identity/magiclink/postgres owner, identity.magiclink contract version one and anonymous identity.magic-link.request operation. CapabilityIssuancePlan.MagicLinkRecipientUserID selects one existing verified-email recipient for one identity.magic-link.consume grant. It cannot coexist with either password-specific target and does not change the command's original anonymous flow. Existing plan encodings stay unchanged when this field is empty; readers without this additive profile deny new plans.

Before StageCapabilityIssuanceFor, call Work.RequireMagicLinkRecipient with the frozen original RecipientRecord during the exact contributor invocation. The kernel locks and rechecks current user, identifier, verification and security versions. The authenticated grant must match that recipient, original command, resource identity.magiclink/<identifier ID> and the magiclink.identifier, magiclink.canonical-email, magiclink.identifier-version, magiclink.verification-version, magiclink.identifier-authority-version, magiclink.user-authority-version and magiclink.credential-authority-version caveats. Versions use canonical unsigned decimal strings. Metadata alone cannot select a recipient; failures poison the existing transaction.

This seam supplies neither authentication nor factor permission. The native workflow still owns original pre-auth/device/callback intent, current factor and risk admission, encrypted delivery, supersession and atomic consume/session composition. It must not relabel a password reset grant or call ordinary session issuance after a separate consumption commit. Complete public magic-link composition and package release qualification remain in development.

Reset completion uses the canonical Authentication risk profile, which counts the attempt before credential work. PrepareFeaturePreparationPlan accepts its original NewFeaturePasswordResetInputCommand under the exact native FeatureAdmissionPreparationContributor and CredentialResetContributor. ExecutePreparedFeature retains the admitted generation in the existing journal; its final plan must preserve every original capability field and contributor. No delivery, issuance, new counter or renewed proof may appear during generation. Ordinary reservation rejects original input, and counter-free reset execution requires original admission, ciphertext, generation and generated execution custody. The kernel rechecks retained admission before mutation and commit. Historical session-counter-bound reset plans retain their original encoding. Native admission must still authenticate the original risk/HIBP facts and enforce all current recovery fences; public workflow composition remains in development.

Reset command intent binds the exact original opaque proof (including signature) and replacement verifier through separate keyed fields, never raw journal values. The fingerprint does not verify, transfer, reserve or consume the proof and stays stable for retained-key recovery after expiry. Keep original proof custody alive through bounded execution; terminal upstream transfer denies further binding. Generic reset metadata cannot substitute for the paired command. The distinct reset transaction profile requires CredentialResetContributor, a one-use capability participant and CredentialResetLifecycleContributor; authenticated password-change admission cannot substitute for reset admission. Append CredentialResetMigrationSource after the credential-replacement migration, using a new allocated version. Historical migration checksums remain unchanged.

CredentialResetFields binds independent user, authority and credential predecessors plus the original reference enablement. Only explicitly authorized reset can restore a disabled reference; blocked users and expired references remain denied. Native verifier mutation, kernel version increments, protected audit, required lifecycle/session effects and capability finalization share one Work. The native owner must validate original signed recovery scope, factors, current identifier authority and password policy, including HIBP. Pending-journal recovery never reconstructs success from a retained effect. This kernel seam is not complete public password-reset orchestration; production password/session composition and release qualification remain required.

Original anonymous password signup uses PrepareFeaturePreparationPlan followed by ExecutePreparedFeature. The original root input command carries the real password Secret and pre-auth cookie, not an already-generated hash. Keep the Secret alive for bounded execution and destroy it afterward. Ordinary PrepareCommandPlan and reservation reject this input; the native owner must restore its generated verifier and recheck admission before atomic execution. The same command journal and retained-key codec own original replay identity.

Native registration domain

NewPasswordRegistrationDomain(repository, config) constructs the kernel participant used by the native password-registration workflow. It does no IO, starts no goroutines and borrows the exact repository/pool enlisted with the sole coordinator. Configure the exact versioned identifier comparison profile and the retained reuse keys used by identifier removal; missing keys fail closed while live retirement history references them.

PasswordRegistrationFields(intent) binds prepared permitted attributes, their schema, the created user, canonical identifier, initial credential and comparison profile into the original signup command. Include every returned field unchanged before admission. Attributes are committed without putting a serialized attribute blob into feature metadata. Neither helper authenticates, canonicalizes input, approves fields or grants registration policy.

The native password owner calls domain.Apply(ctx, work, participant, command, intent) only during its original protected Apply invocation, after HIBP/risk, pre-auth and password preparation. The kernel creates user/attributes, an unverified non-primary identifier and an enabled version-one password reference; the native owner must insert its material through the same Work. Provisional results are not authentication or durable success. The coordinator refuses a signup receipt without its actual kernel creation and commits required audit/outbox/native effects together. Never chain UserCreate, identifier attachment and password persistence as separate registration commits.

For enumeration-safe anonymous signup, freeze CommandPlan.SignupAcceptance as true before reservation and call domain.ApplyOrAccept instead. The creation declaration remains user.created.v1; the opt-in profile additionally declares identity.password.signup.accepted.v1 at the same event index and zero versions. Canonical occupancy and live retirement are classified under the existing tenant fence. A neutral result is (zero User, true, nil): insert no password material, session, verification grant or delivery, but still run original pre-auth/risk and final admission checks. The coordinator commits the protected audit, neutral event and retained original acceptance binding together. Generated structural-ID collisions, unavailable retirement keys and other failures are never neutralized. Neither provisional result authenticates or reveals an existing account.

Append PasswordSignupAcceptanceMigrationSource after the registration migration before enabling this profile. Its forward migration preserves creation receipts and adds a closed all-NULL record arm for neutral acceptance; it does not create another journal. Historical plans retain their exact bytes and strict creation requirement. The new opt-in plan fails closed in older readers, so deploy compatible readers before enabling it. Prepared restoration must retain the original opt-in flag; it cannot add/remove the branch after admission. A prepared neutral commit intentionally leaves declared prospective issuance and delivery unused; any staged credential or envelope instead denies the commit. Original replay/recovery cannot regenerate effects or expose account identifiers.

Append PasswordRegistrationMigrationSource at an explicitly allocated version after the complete credential-reference and identifier-retirement history. Existing history and populated accounts are not rewritten or inferred to be signups. identity.registration_bindings is retained original domain evidence, not another journal: it links the signup command to its created record IDs and survives pruned account payloads. Primary recovery keeps the original command namespace and cannot regenerate an account or infer rollback from cancellation.

This kernel operation is a development prerequisite. The complete native signup service, verification delivery, optional session issuance and release qualification remain pending; applications should not implement their own workflow around this low-level seam.

Construct the original native password-signup v1 command with identity.NewFeaturePasswordSignupCommand(spec, preparedHash, originalCookie). The coordinator fingerprints the exact hash and cookie in distinct retained-key domains, with no raw material in the journal or safe collision scope. Scalar and cookie-only commands cannot impersonate this profile. Changing either input changes command intent; recovery must keep the original command, not regenerate its hash or submit a replacement cookie. Other independently registered signup schemas are unaffected. This identity binding neither admits the cookie nor proves password policy; the native workflow owns those checks.

Exact native command custody

Adapters staging a native feature command must call Work.RequireFeatureCommand with the supplied command before using its payload. It admits only an unchanged copy of the original command in that registered owner's active Apply invocation. Reconstruction, even from equal-looking fields and the same secrets, denies and poisons Work: ignoring the error cannot commit earlier provisional writes. FeatureCommandIdentity only returns correlation metadata; it does not validate a candidate command. Existing metadata and successor accessors remain unchanged.

The closed joint phone-reset plan retains capability, SMS OTP and distinct completion risk as separate atomic participants; it cannot use a generic or emailed-reset command. Install PhonePasswordResetMigrationSource after the canonical credential-reset receipt history before selecting this profile. During its final OTP check, OTPApplyWork.RequireFeatureOrigin lets the native MFA receipt owner correlate its actual provisional replay write with the exact same live protected Work and registered feature owner. Scalar copies, another transaction, an incomplete Apply and returned callbacks cannot supply that correlation. The guard performs no IO and supplies no factor verdict or SQL authority. Ordinary RequireFeatureCommand and FeatureCommandIdentity remain Apply-only. Native complete workflow and factor/risk/password/session checks remain required; these kernel contracts expose no recovery endpoint.

The separate native request uses otp_challenge with otp.sent.v1 0→1 and original initiation-only risk. Its original preparation cannot consume an OTP or capability. Final attachment must retain the exact risk artifact and add one identity.phone.password-reset-complete grant plus encrypted delivery, with no recipient override. Current pre-auth, verified phone/password, independent factor, actual risk and issuer checks remain the registered native owners' responsibility. The existing phone domain-risk declaration stays readable and unchanged; it does not gain this preparation path.

Original-signin hash upgrades

The registered identity/password/postgres owner can compose a hash-only upgrade inside the original paired password-signin command. Freeze independent predecessor versions with PasswordHashUpgradeFields before fingerprinting. After directory admission, call Work.PreparePasswordHashUpgrade before any shared user/credential admission. This exclusively locks current predecessor authority and admits the unchanged selected recipient without a lock upgrade.

The native owner compares the original password and prepares bounded replacement material before opening Work. It performs its material CAS in that Work, calls ApplyPasswordHashUpgrade, and binds PasswordHashUpgradeSuccessor into its own proof/session effects. Every failure must abort. Credential record, credential-authority and user aggregate versions advance independently; user and identifier authority and the original observation time do not change. Advancing credential authority invalidates predecessor-bound sessions: any continuation must follow an explicit session-owner policy, not this receipt.

The lifecycle participant can read StagedPasswordHashUpgrade after staging. Receipts remain provisional until the sole original command commits. A final kernel fence rejects missing application, expiry or changed successor authority, rolling back material and all effects. Only the exact original native Apply invocation can mutate or obtain successor admission; scalar fields grant no authentication. This API neither adds a password-change journal nor delivers tokens. Existing admission and replacement contracts are unchanged. Public signin composition with this seam remains required separately.

Final native feature admission

A native feature owner may implement FeatureCommitContributor in addition to the unchanged execution contract. The coordinator invokes CheckFeatureCommit with the original command after required audit/outbox, journal writes and other final checks, immediately before SQL commit. Use original expiry/admission facts and bounded primary reads; never renew facts, mutate, stage effects, perform network IO or retain Work. Existing owners without this optional contract keep their behavior.

Only the exact selected owner's synchronous check can use FeatureScope. Apply-only FeatureCommandIdentity remains unavailable. Callback failures, panics or unfinished rows roll back all provisional effects; SQL commit ambiguity keeps its existing unknown classification. This seam grants neither password authentication nor token delivery and creates no additional journal.

Original password-signin intent

The coordinator explicitly selects identity.NewFeaturePasswordSigninCommand for identity.password.signin, password-signin v1, record-free user or anonymous-flow scope. The original primitive-owned password and pre-auth cookie are borrowed together, fingerprinted in distinct password-signin-password and password-signin-cookie domains under the retained command key, and never persisted as raw bytes. Changed password or cookie is conflicting intent even after key rotation. Busy or destroyed password owners fail closed; callers must destroy the original owner after bounded execution. Plain scalar metadata cannot impersonate this exact profile. Other independently registered signin schemas, including existing CAPTCHA-protected commands, retain their historical mapping.

Native preparation and final-plan attachment preserve the disjoint command and its complete scope rather than using legacy accessors that omit its secrets. This structural transport grants no password authentication, cookie possession or session authority. Execution still requires an exact registered native owner to compare the password, enforce current policy and pre-auth state, and commit all session and security effects together. The complete native signin workflow remains under development. Recovery uses secret-free command correlation, not resubmission of destroyed secrets or reconstruction from a persisted digest.

Authenticated password-change intent

The coordinator explicitly selects identity.NewFeaturePasswordChangeCommand and fingerprints its original encoded hash, source bearer and complete upstream reauthentication proof under separate retained-key domains. Seconds and nanoseconds remain separate: timestamp rounding cannot make two proofs the same intent. Original versions retain all 64 bits. Equivalent time zones encode the same instant. Neither journal intent nor safe collision metadata retains raw verifier, bearer or proof values, and key rotation rebinds the original custody under the claim's retained key. Existing hash-only command encodings are unchanged.

This is structural mapping, not authentication or proof consumption. Execution still requires the exact registered native replacement participant, complete policy checks and the existing protected effect plan. The existing hash-only password repository rejects the authenticated variant. Native signed-proof and current-source validation, atomic consumption and the public password-change workflow remain under development; adding custody alone does not enable them.

Exact consuming OTP recovery

RecoverOTPFeatureCommand is the native consuming counterpart to metered-check and counted-denial recovery. Supply the exact original code-free OTPAttemptPlan and historical query scope under current QueryPolicy. It matches every attempt, fingerprint, scope, challenge and version field before disclosure and under the existing command locks before pending reconciliation. It does not compare a code, charge again, require the consumed pre-auth to remain executable, or return a session/bearer. Native orchestration must separately authenticate original possession and current disclosure scope. Historical outcomes grant no authority or credential redelivery; unavailable reconciliation preserves Unknown rather than inferring rollback. Existing recovery profiles remain separate.

Committed managed-email origin reads

QueryManagedEmailPreparation authorizes the actual current confirmation caller before reading the original committed management request. Signed origin, tenant, user and address must match its historical self-user native operation. Only verification-send -> verification-confirm and change-request -> change-confirm are admitted. The exact registered preparation owner must first authenticate the issued proof, then authenticate/decrypt output and authorize original intent. No historical live session or original-actor impersonation is needed. Original binding and journal generation are preserved, not renewed.

Returned ciphertext is an owned sensitive copy; clear it after use. Reads grant no mailbox ownership, remaining proof use or mutation permission. Noncommitted, foreign, retired and corrupt history fail closed. Existing preparation histories suffice; generic original-actor query/recovery rules are unchanged.

Request-key correlation before command preparation

For a signup verification link, the native owner can use QueryRegistrationPreparation(ctx, query, caller, feature, inputOwner). The query's command ID identifies the original signup, while its user, actor and identity.email.verification-confirm action describe the current confirmation context. Current query policy must permit that user/action; the kernel separately matches the committed anonymous signup, positive selected registration user and exact immutable input provenance. Never impersonate the original actor or invent a live pre-auth session to read this history.

This returns only caller-owned encrypted original input and its binding. The native owner must first authenticate the original signed registration proof, then authenticate the ciphertext and reconstruct/authorize its original email intent. Reading cannot verify an address, consume or renew the proof, issue a session, regenerate input or recover an outcome. Confirmation must still check current identity/capability state and perform all protected effects atomically. Existing registration, request-key/input and preparation migrations are required; no new schema or workflow authority is added. Clear returned bytes after use.

QueryRequestPreparation(ctx, query, caller, feature, inputOwner) returns only the original input binding and encrypted bytes. Use it for password-free native recovery when a mapping exists before its journal, generation is incomplete, or the command rolled back. The exact registered owner and current query policy are required. Original actor/tenant/POST route, namespace identity, feature and retained fingerprint keys are checked without callbacks, generation or mutation. Existing claims also fence complete query scope and original journal identity.

A mapping alone does not contain plaintext subject/flow/record scope. Before disclosing anything, the native owner must authenticate the complete envelope binding, compare its decrypted original scope with the recovery query, and check original bearer possession and current disclosure authority. Clear the owned returned ciphertext after use. Reading input establishes neither an outcome nor permission to execute. Use the existing coordinator's command query and recovery for outcomes; a missing journal never proves rollback. No migration beyond existing request-key/input custody history is added. This low-level seam is not the public signup/recovery workflow, which remains in development.

Native feature adapters can use QueryPreparedFeature to restore an existing committed workflow by its server-issued command ID without a new initiating key or caller-written store. The exact registered request/preparation owner and current CommandQueryPolicy must authorize the complete historical scope. The result contains independently owned encrypted input/output and their original binding/generation. Both envelopes still require native authentication, separate bearer possession and current authority checks; historical custody is not renewed authority. Missing, retired, pending, aborted or legacy incomplete history returns no custody. Lookup never recovers, generates, mutates or charges anything. Install the existing request-key and feature-preparation migrations; no additional schema is required. Generic QueryCommand remains metadata-only.

Native generated workflows can opt into ResolvePreparedRequestKey after installing RequestKeyPreparationMigrationSource{Base, Version} over the original request-key history. The exact registered feature owner prepares bounded authenticated code-free input outside SQL. The allocated command ID and ciphertext commit together in the existing immutable mapping; matching retries recover the original input without reselecting recipients or renewing times. Race losers recover the winner, and legacy mappings cannot be backfilled. Preparation may perform bounded reads/encryption, not risk charges, domain writes, delivery or OTP generation. Those follow acknowledged custody through the existing journal. Authenticate the complete returned binding and immutable configuration; include configuration in the initiating intent. Restore original input without treating it as current authority, and verify bearer possession separately. Unknown acknowledgement returns no usable input. This kernel seam does not itself implement the public OTP Send service.

Compose RequestKeyMigrationSource{Base, Version} after kernel history and use NewCoordinatorWithRequestKeys with a separate RequestKeyConfig. Existing CoordinatorConfig and NewCoordinator remain unchanged; the ordinary constructor leaves request correlation disabled. Construction performs no SQL. Use NewRequestKeyConfig(namespace, lookupKey, policy) to copy the nonzero 32-byte key into opaque custody; there is no raw key projection and nested configuration diagnostics cannot traverse its bytes. The first authorized resolve pins the configured random lookup key to its trusted deployment namespace; changing that key fails closed. Keep it secret and stable. Command-fingerprint keys rotate separately; retain every version referenced by a mapping. Stage new keys in both old/new processes before changing the current issuance version, so overlapping processes can verify the winner.

ResolveRequestKey accepts identity.IdempotencyKey, a trusted canonical RequestKeyScope and a complete immutable identity.RequestIntent. The lookup is namespace plus tenant, actual actor (ID/kind), method, canonical route ID and keyed client-key digest. Body, target user, purpose and options are not lookup dimensions: they belong in the independently keyed intent. Feature owners map every behavior-affecting field, including policy/schema and expected versions; applications do not supply private fingerprints, SQL or workflow callbacks.

The separate configured policy must authorize the current actor/tenant, route-ID action and resource identity.request-admission with that route ID. Owned resource attributes identity.request.admission, .method and .namespace replace caller overrides. Earlier cancellation/deadlines win. Policy decisions run outside transactions; database errors and panic are redacted.

Matching retries return the original random command and stored fingerprint-key version; different intent returns conflict without an ID. A lost commit acknowledgement returns unknown with no usable admission: retry the same key and intent, not a new key or namespace. Mapping never grants execution or a result. Recover the original command journal/native prepared state before generating another credential or provider effect. OTP Send composition is still pending.

Rows retain correlation indefinitely, including absent/pending/unknown journal state and retired command tombstones; there is no 24-hour reassignment. Immutable database fences reject updates, deletes and truncation. Operational storage retention is therefore an explicit tradeoff, not an implicit cleanup policy. Existing immutable migrations and default-disabled coordinator behavior remain unchanged; unsupported destructive downgrade must not remove retry identity.

Pre-generation journal custody

PreparationMigrationSource{Base, Version} adds optional columns to the same identity.commands journal; it does not create another workflow authority or enroll historical commands. The private preparation phases match the original immutable claim, acquire its journal lease, and commit a generation-start marker before any entropy, rendering or sealing outside the transaction. A competing caller cannot generate. An abandoned lease without a start marker can transfer; a start marker with missing ciphertext remains uncertain and cannot regenerate.

The original live generation can retain one bounded encrypted output. Exact byte retries are idempotent, replacement and erasure are fenced, and takeover receives the original ciphertext with its original generation—not permission to generate a new code. Lease checks use primary time after acquiring the row lock. The native feature codec must authenticate and bind that encrypted output; the journal does not interpret or decrypt it. A lost start-commit acknowledgement cannot authorize entropy. No SQL transaction is held across generation callbacks.

Installing these columns alone enables no public workflow. An opt-in stable native FeaturePreparationContributor can use ExecutePreparedFeature to consume the journal preparation and final execution path. Its original request is schema-validated and primary-admitted before committing the start marker. The owner generates bounded authenticated ciphertext outside SQL, then restores the exact original generated command and plan from retained output. The final plan preserves the initial feature, subject, mandatory audits and lifecycle; only original encrypted delivery may be added. The coordinator preserves the caller-request fingerprint, separately binds reconstructed execution fields, and executes through its existing atomic Begin/Apply/Commit owner.

Generated password hash/authenticated-change commands retain their disjoint native custody variant when the coordinator attaches the final plan. The legacy Feature accessor stays closed to those variants; native selection and the existing complete keyed hash/bearer/proof intent remain mandatory. The registered password owner still authenticates retained output and the original proof, checks current source authority, and owns atomic proof consumption. This is not a public password endpoint or a substitute for its native policy.

An optional FeatureAdmissionPreparationContributor can assess external facts before generation. Install AdmissionPreparationMigrationSource after the existing preparation source, with a later explicit version, before selecting this owner. The coordinator acknowledges its existing lease reservation and closes SQL before PrepareFeatureAdmission. It then reacquires that same generation/owner, repeats current primary admission, checks original local facts and commits the start marker. Admission is checked again after that acknowledgement before calling its invocation-local Generate.

FeaturePreparationAdmission.Check is strictly bounded and IO-free. The returned invocation captures the original request and admission, not shared request state. Its generated authenticated ciphertext must retain original admission custody; RestoreFeatureAdmission reconstructs a local check from that unchanged output/generation without provider, counter or generation IO. The coordinator checks local admission again after final Begin waits and just before commit. Current account/flow authority remains the native owner's job; this seam does not supply risk facts, authentication or a one-use artifact.

Busy, terminal and started-without-output replay never assesses externally. Retained output calls only IO-free restoration. Failed external admission leaves its acknowledged pending lease but no generation marker; retry remains under the existing journal and native risk owner's original-attempt replay rules. Nil/failed admission denies; provider diagnostics are redacted and cancellation/deadlines remain attributable. Unknown start acknowledgements cannot generate. Immutable profile 2 rejects legacy/profile-1 takeover rather than silently bypassing admission; historical profile 1 is not enrolled or reinterpreted. This is native composition support, not public OTP Send or proof of real risk/provider integration.

During final ApplyFeature, that exact registered preparation owner can read Work.FeaturePreparationOutput to restore invocation-local custody. It returns an owned ciphertext copy and the original output generation, even after a later lease generation takes over. Admission, ordinary execution, recovery, foreign instances and returned/closed handles have no access. This avoids shared per-request state and does not expand generic command-field size limits. The adapter must still authenticate its existing envelope, separately verify bearer possession and recheck current authority and expiry before staging effects.

Use one immutable comparable native owner across all phases, with per-invocation state; never replace the registry after generation or share mutable prepared delivery between requests. AdmitFeaturePreparation borrows Work only for current checks, not generation, effect staging or domain mutation. It can reuse existing exact-owner directory/user/credential/authorization helpers. Every final execution must recheck current admission after waits. Restore authenticates the complete original request/generation and separately submitted bearer; it cannot remap output, manufacture authority or renew expiry.

Terminal matching replay returns the original receipt without another native generation/restore invocation. Started-but-unretained output stays in progress after lease expiry. Lost start acknowledgement runs no generation; lost retained output acknowledgement returns unknown and retry can recover the original bytes. One-use preparation profiles remain rejected, not skipped. Protected counters are an explicit opt-in: install CounterPreparationMigrationSource after admission preparation history, with a later version, and register the exact native CommandCounterAdmissionContributor. Profiles 3/4 freeze the complete code-free declaration in the existing journal before charging. The charge and generation-start marker commit before generation; externally admitted profile 4 charges before external admission and commits its start marker afterwards. Denied charges retain their audit and original terminal receipt without output. Final restoration must preserve the exact counter scope, and final Apply/Commit still recheck current counter authority; an allowed reservation is not permission to mutate. Lease takeover transfers the original charge without recounting or renewing its observation. Lost start acknowledgements cannot generate, and lost retention acknowledgements resume the original output. A changed declaration conflicts, including after fingerprint-key rotation. Old readers reject the new profiles rather than bypass their charge; legacy profile 1/2 history is unchanged. These are trusted compile-time adapter phases, not consumer workflow callbacks or a public authentication endpoint. Public OTP Send and its real native composition remain unfinished. Ordinary command and migration bytes are unchanged.

Code-free identity.NewFeaturePreAuthCommand and identity.NewFeatureSessionCommand use these same private fingerprint domains, without an OTP entry. Identical scalar scope with changed bearer bytes or a different custody variant cannot reuse the original command intent. Retained-key replay retains original custody. This does not bypass native authorization or enable OTP comparison/reservation without a code. The owned issuance workflow must still authenticate the actual submitted bearer and original primary state.

Separate opaque pre-auth cookies use the existing identity-command-secret-v1 framing under the exact field path pre-auth-cookie; its HMAC enters private canonical intent as pre_auth_cookie. Different submitted cookies cannot reuse the same command fingerprint. Safe collision fields contain no bearer or cookie digest. Cookie-free and code-only commands retain their exact historical bytes. Fingerprinting is not active-flow admission. Generic execution still rejects all opaque OTP submissions; native counted and consuming phases must own their primary checks. No storage or migration change is introduced by this framing.

Workflow recipient selection

Work.RequireResetRecipientCredential is the reset-only password predecessor fence. The native anonymous reset owner supplies original trusted enabled/disabled state alongside the recipient and independent credential epochs. It may recover a disabled password reference without permitting sign-in; ordinary RequireRecipientCredential and RequireActiveCredential still require enabled credentials. Current account status, verified email, expiry and exact versions remain required. Factor authority and recovery permission are separate checks.

Repository.ResolveRecipient selects an exact owner-canonical email or phone identifier within one tenant. It never normalizes addresses. Supply UserID for an original known subject; omit it only for trusted discovery, keeping the resolved user separate from the anonymous command binding. Signin/reset require RecipientVerified; verification/change may use RecipientPendingOrVerified. Missing, inactive, foreign-subject and ineligible records return Suppressed without a selected identity. Infrastructure errors remain errors.

When the workflow requires a versioned comparison policy, explicitly set both RecipientQuery.NormalizationProfile and NormalizationVersion from that owner. Discovery and the same protected reread retain the actual persisted pair; absent/unbound/incompatible pairs suppress selection even when canonical bytes match. The phone/password profile requires this selection. Neither a missing optional schema nor a legacy row may be relabeled by the query. Omitting both fields preserves the historical channel projection and retained old intent; it does not prove a current normalization profile.

Freeze the selected record into original workflow custody. The exact native feature invocation calls Work.RequireRecipient before staging delivery: primary user and identifier locks fence original versions until commit/abort, and an ignored denial poisons Work. A suppressed record cannot authorize real delivery. Records are snapshots, not authentication, risk evidence or renewable validity leases; callers must not log or serialize them. Install the existing identifier, status and credential-authority migrations before using this port. Public OTP Send orchestration remains under development.

Protected OTP effect binding

Inside its registered ApplyFeature callback, a native feature can call work.OTPConsumption(theExactFeatureOwner) to obtain a scalar copy of the original checked consuming reservation. Bind composed effects to its command, attempt, generation and fingerprint; it is not a completed proof or a commit. Unchecked reservations, non-consuming checks, foreign owners and returned Work deny access. This performs no comparison, mutation or token delivery. Session issuance still needs its own complete native effect and commit-gated delivery.

OTP current-authority checks

The generic native feature invocation also exposes Work.RequireActiveUserAuthority(ctx, participant, UserAuthorityAdmission). Only its exact live FeatureExecutionContributor may compare the active primary user and all three original security epochs. No credential is fabricated for passwordless issuance, and aggregate user versions remain separate. The lock lasts until commit or abort; a live failure poisons Work, while returned or foreign invocations cannot borrow it. This does not replace directory, policy, flow or credential-specific admission.

OTPAttemptWork, OTPReservationWork, OTPApplyWork and OTPFinalizeWork expose RequireActiveDirectoryAuthority, RequireActiveCredential and RequireActiveUserAuthorization to their exact registered OTP owner. They also expose RequireActiveUserAuthority for passwordless users without credential references: compare original user, identifier and credential-security epochs and active status under a primary user share lock. Aggregate User.Version is not an authority epoch. Credential-bearing workflows still require their exact credential check, including eligibility and expiry. These reuse primary kernel and authorization-owner checks in the original transaction, with unchanged frozen expectations, locks and bounded deadlines. A live failure poisons Work even if ignored; a returned handle cannot affect a later phase.

Expected epochs and scope must be authenticated parts of the original native command, not values adopted from a current read. Success checks only the named dimension: it does not authenticate a code, establish current session/pre-auth authority, decide policy, renew validity, issue a session or consume proof. OTPReleaseWork deliberately has no current-authority admission gate, because coordinator-proven noncommit must permit terminal release after revocation. Production OTP session/pre-auth orchestration remains under development.

Protected apply/finalize handles lend the separately submitted bearer through PreAuthCookie to the exact live owner, without exposing the OTP code or full command. Missing or returned custody denies. The owner must independently authenticate the original cookie commitment and admit current session-owned flow state; access itself grants no authority. Never retain or disclose the borrowed bearer. Recovery/release have no cookie accessor.

CAPTCHA consuming declaration

CommandPlan.CaptchaEvidence carries bounded signed consuming custody, distinct from issuance replay ownership. Its deterministic historical profile binds issuance identity, original signature, evidence lookup, consuming signature, retained key/risk-policy versions and unchanged validity interval. The immutable native command must additionally bind the full original trusted flow/configuration and all protected target/version fields; this declaration cannot substitute for them or authenticate its own inputs. Risk policy is separate from authorization policy. CAPTCHA, phone evidence and counters share one exact risk-store contributor and must agree on risk-policy version.

Existing plan bytes are unchanged when this declaration is absent. Preparation requires the exact registered CaptchaUseReservationContributor and its pure native validation before SQL. ReserveCommand invokes reserve or exact predecessor rebind through CaptchaUseReservationWork inside the same primary command reservation transaction as every other declared participant. Errors, panic, unfinished rows, poisoned SQL or cancellation roll back that whole unit. Live/terminal replay invokes no new evidence reservation. Callback return expires every handle and native-input alias; copies cannot renew ownership.

Begin additionally requires the complete CaptchaExecutionContributor phase set. Reservation-only owners remain rejected without consuming their handle. The coordinator invokes CheckCaptchaEvidence before the protected mutation and again after provisional effects, then FinalizeCaptchaEvidence in the same domain transaction as the mutation, audit/outbox and command result. Only the exact native owner receives invocation-bound CaptchaApplyWork reads or CaptchaFinalizeWork terminal SQL; no provider callbacks or private commits. Failures poison the whole Work, including ignored SQL errors and open rows.

After proven domain rollback and current owner/tenant exclusion, the coordinator invokes ReleaseCaptchaEvidence through CaptchaReleaseWork at the unchanged generation. Unresolved recovery requires every frozen participant to prove noncommit under primary exclusion before exact predecessor release at its successor. Unknown/conflicting/absent proof retains the reservation. Release must be terminal and never grants a new reservation. RecoveryWork.CaptchaBinding supplies frozen linkage only to the exact risk owner, not release authority. Elapsed expiry or lease time is never noncommit proof.

The native risk adapter implements consuming reservation but not yet this complete execution phase set. SQL integration fixtures prove the coordinator's atomicity, lifetime and primary noncommit protocol, not production CAPTCHA authentication, protected workflows or final consuming composition.

Native CAPTCHA replay reservation

CommandPlan.CaptchaReplayReservation explicitly selects the native risk store's CaptchaReplayContributor before domain work. Only the exact user or anonymous-flow CAPTCHA issuance schemas admit it; declaration alone supplies no authority. The existing coordinator commits the alias reservation with the original command reservation, then invokes domain work separately. A domain rollback cannot erase that independently committed replay winner.

CaptchaReservationWork exposes only bounded SQL, primary time and the exact original immutable command, authoritative fingerprint and owner generations. The registered native participant authenticates signed custody/configuration and enforces alias uniqueness. Callback return or panic expires every handle copy; takeover uses exact predecessor CAS, never a timeout-based release. False leaves historical plan bytes unchanged. The risk PostgreSQL adapter now supplies production issuance and original-result recovery; protected consumption remains pending; applications must not implement private replay stores to fill these gaps.

Exact original final-authentication outcome recovery

QueryMFATOTPCommand is the owned TOTP completion adapter's exact-input history lookup. It compares opaque original code/cookie custody under the retained fingerprint key and validates the historical native completion plan, without requiring today's mutable continuation version. Current query policy remains mandatory. Only authorized absence returns found=false with no error; matching denied attempts retain their original receipt, changed input conflicts, and incomplete or retired history fails closed. Receipts never authorize a new session or credential delivery. This read performs no factor comparison, attempt charge, participant callback, reservation or mutation.

For native anonymous TOTP commands enriched with protected counters, use PrepareMFATOTPAttemptPlanWithOriginal / RecordMFATOTPAttemptDenialWithOriginal and PrepareMFATOTPFeaturePlanWithOriginal / ExecutePreparedMFATOTPFeature. Supply the exact submitted code/browser command and its native counter-enriched counterpart. Only the six known, independently validated counter fields may be added. Original input owns journal history; the complete counter declaration still owns preparation and charging. Generic command codecs are unchanged.

For the closed anonymous OTP completion profile, use PrepareMFAOTPFeaturePlanWithOriginal / ExecutePreparedMFAOTPFeature. Besides those six counter fields, only the two authenticated native OTP custody fields may enrich original input. Bind the unchanged trusted network as transport.network in original opaque intent. The existing immutable declaration retains only encrypted OTP custody and original counter time/key metadata before session generation or comparison; raw network/base intent is not persisted there. On retry, QueryMFAOTPPreparation authenticates the exact original opaque code/browser/intent identity and reconstructs independently owned metadata for the native OTP owner's RestorePrepared; never prepare another attempt or refresh its counter time. It also restores checkpoints that have no generated session output. QueryMFAOTPCommand observes pending or terminal history before any mutable continuation/factor read. A pending receipt cannot justify new generation, and terminal history cannot reveal credentials. The native OTP, MFA, risk and session owners still must implement the protected complete login transaction; these coordinator APIs alone are not a public OTP authentication service.

QueryAuthenticatedCommand is a read-only bridge for the owned authenticated session adapter. Supply the original mapped command, opaque final proof, prepared plan and trusted current actor context. The configured QueryPolicy must allow disclosure. The bridge compares the complete original input using the global claim's exact retained fingerprint-key version, original proof namespace and frozen plan before returning the safe feature receipt and audit event ID. Generic QueryCommand remains metadata-only.

Expired proof metadata is historical: the bridge validates original private provenance at the original issuance instant; it cannot renew authentication, authorize a session, consume a proof or return a credential. Wrong input/plan conflicts; missing, retired, malformed or unavailable evidence fails closed. Absence never becomes rollback proof or an implicit reservation.

RecoverAuthenticatedCommand first establishes that same original input and current access policy, then uses the existing sole reconciliation owner only for an already observed pending command. It repeats exact-input lookup after reconciliation. Live leases remain pending, and unresolved effects remain unknown. It never reserves missing input, executes a session transition or reveals a bearer. Retain original safe request/proof custody and old keys for this request-bearing path; general restart recovery from command identity and the complete public session execution service remain unfinished.

Final-authentication proof-use storage

SignInProofUseMigrationSource{Base, Version} appends bounded proof-use tombstones after the complete existing history. Existing IDs, status and versions are unchanged; no destructive downgrade or pruning is provided. Proof IDs are unique within a stable trusted authentication-source namespace, across tenants and versions. Changing that namespace must not bypass prior use. The original full-width proof version and nanosecond expiry remain exact.

The private staging phase writes through the original Work only. A unique command cannot acquire another proof; concurrent commands cannot commit use of the same proof. Rollback discards provisional use with every other effect. Primary time is checked after the uniqueness lock, so a proof expiring during a wait cannot leave usable Work. A denied or ambiguous attempt must follow the coordinator's existing abort/recovery path, never guess rollback or mint another proof or bearer. Session deletion cannot make a committed proof reusable.

This is not authenticated issuance. The private storage phase neither authenticates its metadata nor checks current authority or creates a session. The native issuer still needs configured opaque-proof validation, immutable command binding, current locked eligibility, session/family effects, final temporal checks, audit/lifecycle and terminal recovery. No ordinary feature or public session issuance is activated by this migration or storage phase.

Privacy admission storage

The native private command codec now binds the complete closed privacy request and its original authenticated proof to the existing global command claim. It reuses the core's deterministic intent digest, wrapping it and the exact opaque proof-envelope digest in separate framed, retained-key HMAC domains. Proof header/payload validation retains the existing bounded capability codec. Session IDs, projection choices and proof correlation fields do not enter persisted collision fields. Historical non-privacy command bytes are unchanged.

Exact replay regenerates the original fingerprint under its stored key version; it never re-signs the proof, changes its lifetime or promotes a changed session or privacy epoch. Even another valid signature over identical proof metadata is distinct submitted custody. This encoding and private claim check neither consume a one-time use nor expose public privacy reservation/execution. Full native proof consumption, all cuts, audit/lifecycle and terminal recovery must still be composed under the sole coordinator.

Journal persistence and request-bearing replay also compare the queued receipt against the retained original intent: identity/authority/privacy versions, artifact policy and every contributor projection must match. A structurally valid receipt from a changed session or policy cannot replace the original. Scope-only observation remains structural and preserves the stored bytes for the service's separate retained-key snapshot verification. Neither path proves cut provenance or authorizes new execution, and neither needs a live proof.

PrivacyExportAdmissionContributor is the native session owner's read-only eligibility role. The private invocation selects the already registered exact identity/session/postgres participant; registration alone cannot enable it as a public command. Its PrivacyExportAdmissionWork has no constructor or write/transaction-closure methods. Initial checks precede allocation; terminal checks require the same Work's stored allocation/snapshot and frozen request. The role borrows existing kernel credential, directory and authorization checks and bounded primary reads without defining another policy owner. Every ignored denial poisons Work, handles expire when the invocation returns, and repeated or reentrant phases cannot renew authority. Session/proof freshness remains the original authority owner's responsibility, never a new lease from this handle. The actual native session adapter must implement these checks; this invocation plumbing is not proof of session validity or complete queued admission.

Compose PrivacyExportJobMigrationSource{Base, Version} after the privacy epoch migration to add bounded immutable request/snapshot metadata and the closed six-state job profile. Existing applied migrations are unchanged. The private persistence phase uses the same Work's allocation and frozen intent, verifies the retained evidence key, rejects changed scope/time/projections and rechecks active identity, authority and privacy fences at its write. Command ID, export ID and per-subject epoch uniqueness prevent metadata rebinding; no upsert or snapshot re-signing is used. Exact JSON bytes retain full unsigned counters without JSONB coercion; the deterministic-CBOR MAC remains key-owned. Returned receipts are copied, provisional and not publication evidence. The metadata includes personal scope correlations, so restrict database access and apply the eventual legal-hold/erasure owner; do not log it. No worker or public admission API is activated by this migration or storage phase.

PrivacyExportMigrationSource{Base, Version} appends authoritative privacy_epoch and privacy_disposition fields to existing user rows. Compose Base with StatusMigrationSource first and allocate Version after every Base version. The migration preserves existing IDs, user/authority versions and blocked state; defaults keep explicit-column old creation/read paths compatible. No destructive down is supported. Resetting the epoch would resurrect prior export authority.

The private native allocation phase locks the exact user row, rejects blocked, pending-anonymization/deletion, stale or overflowing authority, samples primary time after locking, generates a random export ID and advances only privacy epoch inside the existing Work. All failures poison that Work. No transaction is opened or closed by allocation; rollback removes its entire provisional prefix.

This is not queued admission. Allocation does not prove session freshness, configured authorization, original proof consumption or cut provenance, and cannot make an export runnable. Public privacy execution remains disabled until the protected owner captures every contributor cut and persists the immutable snapshot, job, proof consumption, audit/lifecycle and command result atomically. Pending destructive lifecycle owners must set the disposition under the same user lock before initiating cascades. The initial wire profile still rejects unmapped imported directory IDs rather than rewriting them; profile reconciliation is unfinished. Worker, publication, download and recovery composition remain work.

KernelAuthorityKeys derives canonical version-one keys for kernel-owned global, tenant and user lifecycle dimensions. Session admission must compare these exact keys as well as current positive versions. They are correlation values, not authentication evidence; do not log them. Existing custom keys require explicit adoption and cannot be silently refreshed into this profile.

Protected identifier admission

Identifier reservation requires CapabilityPlan.ProofFingerprint to equal the submitted verified Grant.EnvelopeDigest(). Equal ID, expiry and use limits alone cannot substitute another signed envelope. The capability owner derives keyed replay metadata; callers must not invent it. This comparison changes no historical command encoding or frozen-plan decoding and grants no authentication or execution authority.

CommandPlan.IdentifierAdmission selects the exact registered identity/session/postgres checker through IdentifierAdmissionContributor. This role is frozen into the journal, separately from mutation contributors: it cannot claim a durable recovery outcome. Nil retains historical plan bytes.

IdentifierAdmissionWork is available only during the coordinator's check callback. Its complete command and initial/final phase are available only to the selected instance. Bounded queries and existing credential, directory and user-authorization checks share the original transaction and lock lifetime; there is no write or transaction-closure method. Ignored denial poisons Work. Close all rows before returning; do not retain the handle or perform network callbacks. The private persistence pipeline invokes initial admission before locking/mutating the identifier partition or consuming its proof. Final admission runs after provisional effects and before proof finalization and terminal journal persistence. Each phase runs once; reentrant, duplicate, out-of-order or failed checks poison the same Work.

IdentifierAuthorityVersion returns the original expected epoch initially. At final admission it returns only the exact successor from this Work's owned mutation receipt, with matching subject, intent, record, action and predecessor. It does not replace the original session snapshot or renew its freshness. Historical role-free provisional plans are unchanged; this optional role is not sufficient to activate public execution.

These checks alone do not authorize mutation, consume proof, or establish credential-specific reauthentication. Public identifier Begin remains disabled until complete native session, access policy and recovery composition exists.

Scoped user authorization authority

Native participants can call Work.RequireActiveUserAuthorization with their exact instance and a frozen UserAuthorizationAdmission. Bind all three authorization/postgres.AuthorityScope fields and the expected positive epoch into the native keyed command before reservation; compare that frozen intent at execution. The namespace is trusted native configuration owning user-ID uniqueness, not a request-selected subject kind. Subject must match the command's effective UserID, not its separate actor or calling workload. Organization and impersonation profiles require their own explicit authority contracts; this user-only helper cannot approximate them.

The existing authorization owner performs its exact primary lookup through the generation-bound WorkRows, retaining a share lock until the sole coordinator commits or aborts. Missing or unequal epochs deny without creating defaults. Malformed input, foreign invocation, cancellation and storage failures poison live Work even if ignored. Earlier deadlines win and no freshness is renewed. Use the owner's separately allocated forward-only authority migration through the owned migration composition; do not copy its SQL or bootstrap during login.

This is a lifecycle epoch check, not policy Allow, authentication proof or a completed session issuer. The existing policy engine, every other contributing authority owner and atomic one-time proof finalization remain mandatory. These admission checks are opt-in and existing participants remain compatible.

Deployment and tenant authority

Compose DirectoryAuthorityMigrationSource into the single owned migration history after its complete existing source. Allocate a permanent later version, one explicit GlobalAuthorityID, and up to 256 exact initial TenantIDs from trusted bootstrap configuration. The source creates independent full-width epochs at version 1; it does not discover tenants from users, create missing authority during authentication or modify user/credential versions. An empty tenant set deliberately enables none. Tenant order is canonicalized; duplicate IDs fail. Never edit the source configuration after its version is applied.

Repository.GetDirectoryAuthority returns a bounded structural primary projection, including disabled tenant state. It is not authentication, an authorization decision or renewable validity evidence. Missing exact scope returns redacted identity.ForbiddenError; corrupt/unavailable storage fails closed. No replica/cache fallback exists.

An exact active native participant can call Work.RequireActiveDirectoryAuthority with DirectoryAuthorityAdmission. Bind the deployment/tenant IDs and both expected epochs into the native command before reservation, deriving deployment identity from trusted composition. The helper retains share locks until the original coordinator terminalizes Work. Missing, disabled or changed epochs poison the transaction, including when a participant ignores denial after provisional writes. Earlier deadlines still win; driver cancellation may leave Unknown, requiring existing command recovery, never another command or an invented rollback acknowledgement.

These are current kernel checks only. Credential admission, scoped existing authorization-owner checks, optional owners and one-time proof finalization remain required before session issuance. Public tenant onboarding/transitions and global-compromise lifecycle/cascade acknowledgements remain in development; consumers must not replace them with SQL callbacks or mutate migration history.

Locked credential eligibility

During its synchronous native feature invocation, a registered participant can call Work.RequireActiveCredential with its exact instance and a frozen CredentialAdmission. The native command must bind all expected fields before reservation: credential reference/version plus independent user-authority, identifier and user-wide credential epochs. The aggregate user version is not a security epoch. Existing participants need not opt in.

The helper checks the current kernel rows under share locks retained until the coordinator commits or aborts, then samples primary time for exclusive expiry. Absent, blocked, disabled or stale credentials deny uniformly; an ignored denial poisons Work and prevents commit, including earlier provisional writes. No callbacks, external services or separate transactions run in this helper.

This is only kernel eligibility, not session issuance or bearer authentication. Native issuers must additionally establish private proof provenance, current global/tenant/authorization and optional-owner authority, and atomic one-time finalization. The returned time is not a renewable validity lease. Real-primary coordinator tests use a synthetic participant, not a completed session issuer.

Anonymous email/phone sign-in can use Work.RequireRecipientCredential with the original RecipientRecord and CredentialAdmission. Their tenant, selected user and all three security epochs must agree. The kernel rechecks the original identifier/verification under retained locks before checking that exact credential. It does not replace the anonymous command binding with the selected user or rediscover a newer recipient. Bind both snapshots into original intent; password verification and every other issuance policy remain the native owner's responsibility.

During protected Apply only, Work.FeatureCommandIdentity returns owned copies of the original binding, keyed fingerprint and reservation generation for native effect correlation (including pre-auth consumption). Foreign, admission-only, expired and returned invocations deny. This tuple is not proof, a new command, or refreshed authority evidence; never log it or use it to reset freshness.

Original-command capability issuance

CommandPlan.CapabilityIssuance declares 1..16 one-use grants and the exact capability/postgres owner, contract capability.issuance, version 1. This participant follows the base contributors and precedes optional delivery. Its purposes name future protected operations, not the originating mutation. Only immutable IDs, signed expiry/maximum, original-envelope fingerprints and independently keyed replay metadata enter the journal. Nil retains historical kernel, feature and delivery plan bytes.

The trusted issuing adapter stages authenticated capability.Grant values with Work.StageCapabilityIssuanceFor. Every grant must match its plan position, tenant, command user, purpose, ID, whole-second expiry and single-use maximum. This profile requires subject-bound grants, not subjectless bearer authority. Descriptor equality does not allow a foreign instance to stage custody.

For anonymous native password signup only, RegistrationUserID may explicitly select the newly registered verification subject. This bounded target is part of the frozen plan digest and recovery metadata; it does not replace the original anonymous command binding. Only identity.identifier.verify grants are admitted and staging requires successful kernel registration of that exact user in this same Work. Missing registration or a different subject/tenant poisons Work. Empty selection retains the existing command-user behavior and identical bytes. Older readers fail closed on the additional field. The native capability issuer and journal-prepared signup workflow must separately adopt this profile; kernel support alone does not enable an end-user verification flow.

For the closed anonymous password reset-request profile, ResetRecipientUserID instead binds exactly one existing recipient and one reset-complete grant. It is mutually exclusive with signup selection and preserves the anonymous command. Staging requires this native invocation's successful RequireRecipientCredential primary fence for a verified email and password reference. The grant must match the original command, selected user, identifier and independent predecessor versions. Declaration metadata alone cannot select a recipient. Current factor and risk policy remain mandatory workflow admission, not supplied by this fence. The issuer adapter and full reset workflow must adopt this separate profile; these kernel contracts alone do not enable reset. Empty target retains prior plan bytes; older readers deny the new target rather than dropping it.

ExecutePreparedFeature also permits that exact issuance profile in the authenticated restored final plan: original admission must declare neither issuance nor delivery. The final plan preserves every original contributor and its order, followed by the exact issuer and optional delivery owner. Feature, lifecycle, subject, audits and counters cannot change. The original journal retains ciphertext and its generation before execution; retries cannot replace the grant or renew its expiry. Existing consumption, OTP, identifier-admission, risk-evidence and CAPTCHA preparation profiles remain closed. This composition seam does not supply native issuer checkpoint/restoration or SignupService; those owners must still authenticate their original encrypted custody.

The exact owner receives CapabilityIssuanceWork only during coordinator-owned persistence; its aliases and SQL authority expire on return, including panic. The owner must verify original-envelope and keyed replay provenance, insert absent issued state and retain originating command/fingerprint/generation separately from subsequent consuming-command identity. It must never resurrect terminal records, open a transaction, sign, call providers, or retain the handle.

Issuance runs after the actual mutation and before delivery/audit/lifecycle and the sole commit. Missing staging, failure/panic, later phase failure and expiry before terminalization roll back the original mutation and issued records. RecoveryWork.CapabilityIssuanceBinding exposes frozen metadata only to the exact registered issuer; recovery never signs or reveals replacement tokens. The optional versioned envelope composes with encrypted delivery and bounded historical decoding, without a second ledger or coordinator.

No bearer bytes are staged or returned by this adapter. Queued credentials must use independently authenticated encrypted delivery custody; synchronous custody must not be revealed before a proven commit. Coordinator tests use an owned SQL phase to prove transaction and lifetime semantics, not the unfinished native capability producer, encrypted-delivery interoperability or end-user workflow. Consuming capability-bearing domain execution remains disabled.

Original-command encrypted delivery

CommandPlan.Delivery optionally declares 1..16 required effects and the exact last contributor identity/delivery/postgres, contract identity.delivery.effects, version 1. Its logical IntentDigest must bind all behavior-affecting inputs using the owning workflow's confidential fingerprint; randomized ciphertext is not logical replay identity. Safe effect/resource and template IDs are 1..128 printable non-space ASCII bytes. Purpose is a canonical lowercase event name; template/provider versions are positive. Expiry is an exclusive post-epoch microsecond-exact instant, never renewed on replay.

The original owned delivery adapter stages prepared secret-envelope ciphertext with Work.StageDeliveryFor and its exact enlisted pointer. Equal descriptors or configuration do not allow another instance to stage its own preparation. The existing Work.StageDelivery remains a trusted low-level composition seam, not participant authentication. Each envelope is at most 524288 bytes and total custody is at most 1MiB. Encryption/provider work must happen before opening the mutation transaction. Only the coordinator invokes the exact enlisted DeliveryContributor.PersistDelivery. During that synchronous invocation, DeliveryScope exposes an owned original-command declaration and StagedDelivery returns copied ciphertext. The owner must verify complete AAD and confidential logical input, and persist custody plus outbox admission via this Work. Neither a descriptor nor this plan authenticates an HTTP caller.

Missing staging, persistence error/panic, later audit/lifecycle failure, or expiry before terminalization rolls back the original mutation and delivery. Recovery invokes every frozen participant; RecoveryWork.DeliveryScope allows only the exact enlisted owner to inspect its original declaration. Unknown or conflicting delivery evidence cannot prove noncommit. No second enqueue command, transaction, sender invocation, or workflow engine exists here. The optional versioned plan envelope conserves historical base-plan bytes and excludes ciphertext from command journals. Closed Work drops custody references; this does not promise secure erasure of Go heap bytes or caller-owned copies.

Coordinator integration tests use a deliberate owned SQL seam. They are not production queue/envelope/provider interoperability proof: those remain part of the separate, unfinished identity/delivery/postgres implementation.

Typed one-use risk reservation

CommandPlan.RiskEvidence declares the scalar projection of risk's signed PreparedEvidenceUse. No bearer, provider facts or keys belong in the plan. Preparation owns copies and freezes every declaration field in the distinct identity-feature-risk-plan-v1 profile. Existing feature v1/v2 bytes are unchanged. Only the exact native identity/phone operation identity.phone.password-reset-request, schema identity.phone.password-reset-request.native-v1 version 1, required-record profile with subject kind phone, is admitted. This is not the public HTTP request schema. Other schemas and reset completion are rejected, not approximated.

Enlist the exact identity/risk/postgres / identity.risk.store / 1 participant implementing RiskReservationContributor alongside the identity, audit, outbox and native phone contributors. ReserveCommand invokes ReserveRiskEvidence or exact-predecessor RebindRiskEvidence inside its existing command reservation transaction. Participant failure, panic, poisoned SQL or unclosed rows rolls back both command and evidence ownership. A live command replay skips mutation. The invocation-only RiskReservationWork.Binding(participant) verifies the exact registered instance; retained copies cannot run SQL or disclose bindings.

The risk adapter must authenticate the projection, compare the native command's complete recovery scope and current policy, then lock the already-issued row using primary time and original expiry. Structural preparation is not that authentication. CheckedAt preserves nanoseconds; compare it against returned primary time without rounding or passing it as a microsecond-only SQL parameter. No method refreshes the precheck or evidence lifetime.

RiskReleaseContributor adds native retained noncommit evidence through RecoveryWork.RiskBinding(participant) and terminal release through an invocation-only RiskReleaseWork. Recovery requires this phase before taking over ownership. Under the primary command and tenant fences, every frozen participant must prove noncommit before risk release, failure audit and aborted receipt commit in one transaction. Missing, mismatched or unknown native custody must remain unknown. Evidence expiry neither proves rollback nor reactivates a reservation; proved noncommit releases even expired reservations. Audit/release errors, panics, poisoned SQL and open rows roll back takeover, release and terminal receipt together. The new recovery generation never grants domain authority. Terminal receipt replay invokes no new participant mutation.

After a proved nonretryable domain rollback, Abort instead rechecks the same live owner and frozen plan, acquires the tenant exclusion, and releases custody in the failure-audit/aborted-receipt transaction. RiskReleaseWork.Binding returns that current generation in both generation fields; an owner that took over generation 2 releases generation 2, not its former predecessor. Private coordinator provenance distinguishes this path from successor-generation recovery without widening reservation/rebind authority. Missing failure audit, release phase, matching custody or live ownership retains pending/Unknown; errors, panic, open rows and poisoned SQL leave no durable terminal prefix.

The same proven-rollback rule applies to CapabilityReleaseWork: Abort terminal-releases the exact reserved capability under the current generation only after rollback, live-owner/frozen-plan rechecks and tenant exclusion. Release, failure audit and aborted receipt commit together; a missing phase, wrong custody, failed rollback, lost owner or callback failure leaves Unknown and no terminal prefix. Recovery release still advances exactly one generation. Private release provenance cannot be reused as reserve/rebind authority. Release is terminal, not permission to reuse the proof, and does not enable the still-incomplete protected identifier workflow.

RiskExecutionContributor is the separate opt-in for domain execution. The exact registered owner must implement pure ValidateRiskEvidenceCommand, read-only CheckRiskEvidence and terminal FinalizeRiskEvidence in addition to reservation, recovery and release. Reservation/release-only owners remain closed at Begin. The coordinator compares the entire original command before any effect, checks risk immediately before native feature mutation, and checks again after provisional audit/outbox persistence. It then finalizes the exact reserved row in that same transaction before terminalizing the command receipt. The native owner must authenticate complete recovery scope, current policy and provider versions, original exclusive expiry, current counters and journal custody; finalization must recheck expiry and CAS the original generation.

RiskApplyWork exposes bounded reads/primary time and immutable native input only to its exact owner. RiskFinalizeWork additionally permits bounded trusted terminal SQL. Both are invocation-only, redact diagnostics, reject serialization and share the domain Work's nonrenewing budget; no raw driver or transaction closure is exposed. A retained apply handle is already invalid when finalization begins. Neither copies nor late effects renew original evidence freshness. Errors, panic, SQL poisoning and unclosed rows roll back domain effects, finalization, audit/outbox and receipt together; the existing proved-noncommit release protocol then terminally releases custody. Unknown commit never implies release or reuse. Exact committed replay does not invoke the phases again.

This boundary does not yet enable phone recovery. The official risk adapter still supplies only reservation/release, and must implement native current checks and finalization before adoption. OTP/capability issuance/consumption and phone orchestration remain required. Applications must not provide their own SQL participant to substitute for the owned adapters.

Trusted command admission observation

Protected counter reservation

Counter-bearing domain execution additionally requires the exact registered owner to implement CommandCounterAdmissionContributor. Reservation-only participants still cannot open Begin. The new CheckCommandCounters phase receives CommandCounterAdmissionWork immediately before native feature mutation and again after audit/lifecycle persistence, before terminal commit. It must recheck exact current-generation charge custody, policy, original evidence expiry, authoritative counters and any explicitly selected lockout/override policy. It must not increment, refund, refresh original observations, invoke providers or open its own transaction. This bounded invocation exposes reads/primary time and the original immutable command only to that instance, then expires. The coordinator retains command input only in memory until Work closes. The feature owner still owns current user/credential/organization/factor checks.

Late denial rolls back all provisional domain effects and persists classified failure audit/aborted receipt through the ordinary proved-rollback path. Its original charged attempt remains committed. Errors, panics, SQL poisoning or unclosed rows fail closed. Counter and one-use risk declarations are distinct closed profiles; neither substitutes for the other's authority. The native adapter must implement the selected current-check contract before real protected workflow composition can use either opt-in.

Native protected-feature composition may declare CommandPlan.CommandCounters with the core's complete keyed counter fingerprint and risk-policy version. It must enlist exactly one identity/risk/postgres participant implementing CommandCounterContributor, in addition to the native feature, kernel, audit and lifecycle participants. Both the feature owner and risk participant perform pure native validation before the first SQL write. No raw subject/network dimensions are serialized into the frozen plan; historical feature-plan bytes remain unchanged when this profile is absent.

ReserveCommand calls that exact participant under the existing primary command/tenant exclusions. CommandCounterWork returns frozen binding and the immutable original native command only during its invocation; aliases and rows must not be retained. Allowed disposition commits the charge and its original snapshot with pending command ownership. Denied disposition commits the charge, all declared denied audit slots and the aborted command receipt together, with no domain mutation or successful lifecycle event. Returning an error instead rolls back the reservation unit; SQL before commit is provisional. A commit attempt error returns Unknown even when a deferred constraint rejects commit.

Live/terminal replay bypasses mutation. Expired-owner takeover supplies the exact predecessor/current generation and must reuse the original charge, never increment or refund it. RecoveryWork.CommandCounterBinding exposes exact charge linkage to its registered owner for read-only reconciliation: a charged reservation is prerequisite evidence, not proof that the domain committed.

The real risk adapter's durable counter storage/rotation/algorithm and current domain checks are still being implemented. Counter-bearing Begin and ApplyFeature therefore remain disabled. SQL integration seams prove this coordinator boundary, not password workflows or native risk interoperability; applications must not supply a replacement counter store to fill the gap.

Native feature adapters may configure CoordinatorConfig.AdmissionPolicy separately from QueryPolicy and call ObserveCommandAdmission(ctx, query, caller) before evaluating external providers. The current policy receives owned identity.command.read-admission=true and identity.command.recovery=false attributes; caller, tenant, operation and identity.user resource must match the query at the configured revision. Only an authorized actual absent global claim returns CommandAdmission{Absent: true}. Denial, wrong scope, retired claims, orphan journals, corrupt history and outages never become absence.

Existing claims return only safe CommandRecord history and its original terminal classification; expired pending commands remain pending. No command or participant is reserved, repaired, locked, renewed or invoked. This is a trusted native composition API, not a client lookup route. QueryPolicy alone does not enable admission, and AdmissionPolicy alone does not enable lookup.

Absence is a point-in-time observation, not a reservation or proof that an earlier ambiguous submission rolled back. A concurrent command may appear immediately afterward. Native adapters must compare their own retained pre-evaluation intent before replaying protected results, and must still submit through ReserveCommand for the full immutable command collision fence. This method neither returns nor verifies native bearer/proof payloads.

Primary credential eligibility metadata

Compose CredentialMigrationSource{Base: existingHistory, Version: allocated} with the owned migrations runner, after every installed kernel/session/status migration. It adds non-secret references and the independent tenant/user credential_version; existing status, aggregate and identifier epochs are unchanged. Old creation writers receive epoch 1 but no fabricated reference. Keep disabled references as retained state; this migration never re-enables one. Down SQL is unsupported. Expiry is nullable (indefinite), otherwise finite UTC microsecond precision, strictly after the Go zero instant and before year10000.

Repository.GetCredentialAuthority(ctx, identity.CredentialAuthorityQuery{...}) implements the core port with one consistent primary statement matching exact tenant, user and credential ID. Missing schema fails unavailable, not absent; missing exact references return identity.ErrUserAbsent. All versions preserve full uint64 precision, with no aggregate/security/credential substitution. Blocked users, disabled references and expired instants remain visible to identity.CheckCredentialAuthority, which denies them rather than repairing stored state. Earlier caller/configured deadlines bound reads; driver details and partial records do not escape failures.

This is metadata eligibility, not secret verification, factor/provider status, authentication proof, authorization or a cache freshness lease. Credential reference mutations, their atomic epoch bump/audit/outbox and final proof consumption are still under development; applications must not supply private SQL callbacks to replace them. User-owned references do not represent organization-owned API-key authority, which belongs to its separate owner.

Durable user-status admission

Opt in with StatusMigrationSource{Base: MigrationSource{}, Version: allocated} and the owned migrations runner. Allocate its version after every composed kernel/session migration; do not renumber installed history. Migration defaults persist user-security epoch 1 and no legal hold while preserving every existing status, aggregate version and identifier epoch. They also keep prior creation and ordinary field writers compatible. A database missing this migration fails closed; readers never invent security versions.

Repository.GetStatus(ctx, identity.UserStatusQuery{TenantID: tenant, UserID: user}) implements the core primary status port. User.Version is aggregate CAS; AuthorityVersion is the independent user-security epoch. Profile and ordinary administrative field edits advance only aggregate CAS. Suspend/ban and restore/unban advance both, so restoring eligibility cannot restore old vectors. Expired restrictions remain blocked until a fresh audited restore/unban.

Construct NewStatusUnitOfWork(coordinator, repository, config) with the exact enlisted repository and typed audit/outbox contributors, then pass it and the repository to identity.NewUserStatusService. That service supplies current authorization, policy admission and redaction; calling the adapter directly is not an authenticated endpoint. Configuration contains the same explicit status policy/reasons as the service, a positive status-policy revision, finite cascade deadline and reviewed version/fingerprint for every exact manifest consumer. These are deployment metadata, not consumer stores or callbacks. Every change to that configuration needs a new status-policy revision. The owner durably rejects conflicting definitions for an already-used tenant/revision.

One shared commit persists status, reason/absolute expiry, both successors, random cascade ID/generation 1, exact manifest and ordered consumer contracts, trigger event/version, deadline, current legal-hold state, audit, lifecycle and original receipt. Row locks precede the final primary-time expiry check. Exact replay precedes current CAS and retains original IDs, timestamps and consumers, even after restoration or a composition change. Preserve command identity and use Recover after unknown closure; recovery never reexecutes the mutation. Retain cascade admission rows alongside non-reassignable command evidence; current user state or pruned payloads cannot substitute for retained evidence.

The returned cascade is pending. This admission path does not acknowledge consumers, complete cleanup, manage legal holds, or implement cascade closure. Those remain distinct generation-bound phases. Nor does a primary status read alone establish authenticated session issuance or the shared-issuer 30-second cache/resource guarantee; actual proof consumption and all authority owners must still be composed. All epochs retain full unsigned 64-bit precision; exhaustion denies a successor rather than resetting or wrapping.

Experimental Go 1.27 module implementing identity.UserDirectoryRepository using the owned go-postgres pool. Tenant and user IDs are matched exactly; lifecycle states and the full uint64 version range are preserved. Reads are primary-only, bounded and uncached. Configure primary endpoints explicitly.

Construct with NewRepository(pool, Config{MaximumDuration: time.Second}), then compose it through identity.NewUserQueryService for policy and redaction. The caller owns pool shutdown. No globals or background goroutines are created. Driver errors are discarded rather than exposed through errors.As or logs. Cancellation and deadline classifications remain observable.

Feature operation registration

Durable feature adapters may implement FeatureContributor alongside the existing Contributor. The same immutable registry snapshots their compile-time identity.FeatureOperation descriptors once, including all supported schemas, explicit record policy and exact adapter owner. An explicit SubjectRequirement also freezes the user or anonymous-flow namespace. Anonymous feature scope persists AnonymousFlowID, never a fake UserID; current-policy admission/query/recovery must use the exact identity.anonymous-flow resource and retain the separately verified actor. Record-free audit/lifecycle targets use that flow ID. User-only descriptors retain their existing canonical command/plan bytes and JSON receipt shape. This uses existing command claims/journals; no extra replay owner or schema migration is introduced. Concrete CAPTCHA persistence remains separate work.

Each core owner maps to its <owner>/postgres adapter; each operation belongs to one exact contributor across schema versions and subject namespaces. A schema/version may declare both user and anonymous-flow subjects; selection still matches the complete descriptor. Duplicate/conflicting schemas within a subject and foreign ownership fail construction before any transaction opens. Limits are 64 declarations per feature contributor and 1024 total. Legacy contributors need no new methods.

ContributorRegistry.FeatureOperations returns an owned scalar projection for trusted composition; it performs no callbacks. This is not enabled-feature discovery, registration of codecs, authorization or execution readiness. Kernel command plans remain closed. Native non-one-time feature execution uses the same coordinator; production session issuance remains in development. Do not advertise routes from these declarations or substitute private journals.

The existing private command codec also maps immutable identity.Command feature inputs for future owned phases. Exact owner/record policy and every named scalar kind/value affect the keyed fingerprint; all scalar values are conservatively digested before canonical encoding. Scope remains separate from private intent, and retained-key replay regenerates the original fingerprint. This is not schema validation or execution readiness.

Opaque Command.OneTimeCode custody contributes a separate one_time_code payload digest using the fixed canonical path one-time-code and the existing identity-command-secret-v1 profile. Raw code bytes never enter canonical payloads or safe collision fields. Absent custody preserves historical bytes; replay recomputes from the immutable submission under the stored retained key. The central preparation path rejects these commands before generic feature admission. Fingerprinting alone does not count attempts or consume challenges; native OTP reservation/current/finalize/recovery phases remain required.

CommandPlan.OTP freezes the complete server-issued attempt projection: random attempt ID, keyed attempt fingerprint and version, challenge/scope digest, digest-key version, expected challenge version and check/consume mode. It is private correlation, not proof or current authority. Historical decoding binds all fields and supports optional CAPTCHA/risk declarations without creating a second journal. Generic feature admission remains closed to OTP custody.

For a native OTPAttemptContributor, PrepareOTPAttemptPlan authenticates the original opaque submission through that exact registered owner before SQL. RecordOTPAttemptDenial then locks the existing command before the owner's bounded challenge comparison. The owner proposes the wrong-attempt charge and exhaustion; the coordinator commits these with required denial audits and the aborted command in one transaction. No risk, CAPTCHA, capability or session reservation runs on this narrow path. Exact retries return history without another comparison; changed code or attempt conflicts. OTPAttemptUnchanged rolls back provisional effects and grants no successful precheck or reservation. Returned callback handles cannot access SQL or opaque custody.

Native metered checks use the additive OTPMeteredCheckContributor, the same OTP owner as the declared record-free feature, and an exact OTPCheck plan. RecordOTPMeteredCheck uses the existing transaction and journal to commit check/total counters with required audit and a redacted check receipt. It does not invoke domain application, risk/capability consumption, lifecycle delivery or session effects. OTPAttemptChecked is accepted only on this explicit path; the existing denial path cannot turn a correct check into success.

For correct checks, CommitOutcomeCommitted describes committed metering only, not authentication proof, reservation or protected mutation. Wrong checks retain the denial outcome; disabled/exhausted checks roll back unchanged. Exact replay does not compare or charge again. RecoverOTPMeteredCheck binds the original attempt plan and current query authorization to retained check history without needing a bearer/code or granting current authority. Commit ambiguity remains Unknown and must be resolved through the original command, not a new attempt.

Any commit-attempt error is Unknown. Keep the original command and complete attempt identity; RecoverOTPAttemptDenial uses the configured current QueryPolicy and one primary read without code, comparison or mutation. A historical denied result is NotCommitted plus Forbidden. Changed attempt fields return no history. Pending remains InProgress, including after lease expiry; it never authorizes a replacement submission, takeover or challenge release. The production OTP adapter and composed protected workflow remain required before adopting a complete OTP workflow.

OTPReservationContributor additionally enables PrepareOTPReservationPlan and ReserveOTPCommand for consuming mode only. Its reserve callback runs last after the existing one-use participants inside their shared claim/journal transaction. Native failure rolls back every prefix; a commit-attempt error returns Unknown and no ownership. A live same-command retry does not compare again. Expired-owner takeover invokes only exact predecessor CAS rebind, never reserve/comparison, and cannot transfer another command or generation. Returned reservation handles enter Begin only when the same exact registered owner implements OTPExecutionContributor. Current checks run before protected mutation and again before finalization, without another code comparison or attempt charge. OTPApplyWork permits only primary reads; apply/finalize CommandSpec returns code-free feature scope. OTPFinalizeWork terminal CAS, domain effects, audits, outbox and original receipt commit together. Returned, foreign and wrong-phase handles deny. Callback failure, panic, unfinished rows or poisoned SQL roll back all provisional domain/finalization effects.

OTPReleaseWork runs only after proven domain rollback or unanimous retained primary noncommit evidence. RecoveryWork.OTPBinding exposes exact frozen challenge/attempt/command linkage to that native owner, never submitted code or release rights. Missing/divergent evidence, ambiguous commit and expired leases do not release a challenge. Release is terminal: a new challenge is required, not reuse of the released OTP. Release failure retains reserved custody and a pending journal. These coordinator phases are tested with native SQL fixtures; the production OTP store, cryptography and authenticated final-login admission remain required. They are not an adoptable complete OTP workflow.

CommandPlan.Feature selects one exact frozen registration. Public PrepareCommandPlan copies the matching contributor order, 1..64 strictly ordered required audit slots and lifecycle declaration, and computes FeaturePlanDigest using the current retained-key command fingerprint. The preparation profile requires identity, audit, lifecycle/outbox and the exact feature contributor; audit/outbox contributors must implement their typed phases. Each audit slot has exactly one record, schema 1, positive retention version and at most 16 KiB record/aggregate bounds. Required record lifecycle versions are one checked successor; record-free declarations keep both zero. Feature-owned adapters remain responsible for exhaustive native schemas and action policy. Feature capability/cascade inputs fail rather than being silently discarded, except the exact identity.email.verification-confirm.native-v1 declaration. That profile preserves the original signed identity.identifier.verify purpose, envelope fingerprint, expiry and retained replay identity. It requires the identity.email native owner, identifier lifecycle, protected audits and command counters, and excludes OTP reinterpretation, fresh issuance and delivery. Its canonical history is readable without granting execution authority. Execution requires an EmailVerificationContributor, the real kernel repository and typed capability reservation/execution contributors. The ten EmailVerificationFields bind the original committed signup, canonical address and current predecessors. The kernel locks and verifies the original pending identifier, advances user and identifier authority, and commits proof consumption, protected audit and outbox in one transaction. Counter denial never reserves the proof; rollback cannot retain a verified address or successful consumption. Install the additive EmailVerificationMigrationSource after the complete existing migration history. The native owner still supplies original proof/origin and current action policy; this kernel profile alone is not the public email workflow or session issuance.

An empty CommandPlan.SubjectType retains the historical v1 structural-only profile and cannot reserve. For native execution, select a valid subject type and explicit AuditPlan.RetentionClass (standard or protected) for every slot. These fields are bound into canonical feature-plan-v2 bytes. The native adapter must implement FeatureExecutionContributor, exhaustively validate the immutable command and full security plan before reservation, and inspect retained effects during recovery. Every selected participant must implement recovery.

Use FeatureAuditBindingDigest for exact feature scope, subject and actor binding.

Native adapters call Work.FeatureScope(themselves) during Apply and RecoveryWork.FeatureScope(themselves) during recovery to verify the exact registered instance, active invocation and frozen version transition. Matching descriptors or a still-open Work after Apply returns are not native authority. The check performs no IO and returns owned scalar scope declarations. Then PrepareCommandPlan, ReserveCommand, Begin, ApplyFeature and Commit execute through the sole coordinator-owned transaction; always defer Abort after a successful Begin. The native phase owns current authority checks and its domain mutation, never kernel-table writes, audit/lifecycle staging, external IO or transaction closure. The coordinator binds the provisional receipt to the frozen transition and stages all audit/lifecycle effects. Only a successful Commit proves durability; ambiguous commits return unknown and never locally retry or reveal a bearer. Exact replay returns the original safe receipt.

Historical feature plans and command scopes are decoded as bounded, canonical records. Authorized QueryCommand returns an owned CommandRecord.Feature descriptor for feature history; it remains nil for kernel history. The stored scope, frozen plan and terminal receipt must agree on owner, operation, schema and record policy. Observation does not consult today's contributor registry, replay commands, renew authority or expose native response/credential payloads. Missing, wrong-scope and denied callers retain the same policy/read shape.

RecoverCommand observes live/terminal history. Expired native v2 commands can take a new generation only with the exact frozen typed participants. Unanimous retained non-commit evidence permits failure auditing and an aborted receipt in one transaction. Unknown/conflicting evidence stays pending; success is never reconstructed from current rows. Audit recovery can obtain an owned copy of all slots through invocation-scoped RecoveryWork.AuditPlans; the existing singular getter still rejects multi-slot plans. Historical v1 remains observation-only and never takes over. Capability and OTP-consuming profiles remain disabled until their atomic typed phases exist; risk consumption additionally requires its native current-check/finalize owner. This is not a working session issuer. Kernel digest bytes and the kernel-only scope decoder remain unchanged.

Stable status-filtered listing

Compose the same repository through identity.NewUserDirectoryService for collection/row authorization, redaction and authenticated wire cursors. List materializes structural IDs, statuses and versions atomically in the primary database; it is not a live OFFSET query or an authorization cache. Migration 7 creates the owned snapshot/row tables without changing users or migrations 1–6. Existing get-only consumers keep their APIs and configuration.

Ordering is bytewise ascending canonical user ID. Filters are an exact closed status set. Continuations require the original tenant, status set and expiry, and survive repository replacement and live insertion/update/deletion. Expiry retains nanosecond identity, lasts at most 15 minutes and cannot be renewed; primary time plus a shortened local deadline bounds each operation. Snapshot status is historical directory data, never current identity authority. The public service must reauthorize every page and each scanned row.

Config.ListSnapshots defaults to 10,000 users and 32 retained snapshots per tenant. Explicit profiles require both positive limits, at most 100,000 users and 32 snapshots. Pages are at most 100 rows. Each status branch uses the existing tenant/status/user index and bounds candidates before materializing. Quota or size pressure is identity.UnavailableError, never a partial snapshot or silent truncation. Mismatched/expired continuations are redacted invalid input; database failures disclose no diagnostics. An ambiguous snapshot commit returns no page/cursor and remains bounded by retention/quota.

New snapshot admission removes at most one expired snapshot. Trusted platform maintenance must also call PruneUserListSnapshots(ctx, tenant, maximum) for inactive tenants, with maximum in 1–32; primary expiry and SKIP LOCKED keep active/in-use snapshots intact, and removal cascades to their rows. The library starts no worker and never closes the caller's pool. These storage APIs confer no tenant permission. Grant the selected storage role the snapshot-table CRUD and existing user SELECT permissions; no DDL or table ownership is required.

Remaining scope: exact identifier filters require the remaining identity- owned identifier lifecycle store and fail closed today. Arbitrary attribute search, complete fields, privacy/lifecycle snapshot erasure and full domain commands remain unfinished. Do not create a list-only identifier authority or application-written domain store to fill those gaps.

Current development boundary

Consistent self-profile reads

The repository also implements identity.ProfileRepository. Select it explicitly with Config.ProfileSchema: ProfileSchemaRef{ID: "fields", Version: 1} and declare that same schema in Config.AttributeSchemas and identity.ProfileConfig.Fields.Schema. Zero leaves profile reads disabled. The selected schema must contain at most 123 additional fields, without aliases for name/image, credentials, identifiers, roles or other privileged core fields.

GetProfile observes the user, name/image and typed attribute document in one primary SQL statement. The stored schema key and immutable definition must match the selected declaration exactly. A missing structural user is ErrUserAbsent; an incompatible/corrupt stored document is Unavailable, with no partial output. The whole document is validated even for a narrow projection. Empty requested fields select all output-readable fields; explicit fields must be unique and known, with schema output permission. Structural ID/tenant/version remain bound to the aggregate; unselected values are not returned. Returned collections own their memory. Existing false/zero/empty values and full versions remain exact.

Forward migration 8 adds the owned identity.user_profiles name/image table. It preserves migrations 1–7, structural-only users and old writers. Missing rows produce empty name/image, not invented additional-field defaults or backfills. No independent profile version or authority is created. Grant selected storage roles SELECT on profile, attribute and schema tables along with user reads.

Compose through identity.NewProfileService for current-human self scope, active status, authorization, schema output filtering and current redaction. Storage reads confer no caller authority. Database image strings are bounded, never fetched, and still require the public service's exact HTTPS origin policy. The existing creation UnitOfWork can supply the service's dependency for reads; select the profile composition below to enable mutation and recovery. Indexed/ secret storage and privacy erasure remain required platform work, not application-written repositories or SQL workflows.

Durable self-profile mutations

Use NewProfileUnitOfWork(coordinator, repository, CreationUnitOfWorkConfig{ RetentionPolicyVersion: revision}) as the identity.NewProfileService command dependency. It requires the exact registered repository, selected ProfileSchema and typed audit/outbox phases. The existing creation owner remains creation-only. This is an opt-in composition of the same Coordinator, not another transaction, claim, receipt or recovery engine. No caller-written plans or SQL are needed.

ProfileUpdate admits current self scope and per-field policy before SQL. The storage owner resolves exact command replay before CAS, then requires an active user at the expected aggregate version. Name/image omissions preserve existing values; explicit additional false/zero/empty values replace only their named fields, preserving all omitted values without default backfills. Selected schema definitions must agree exactly. Name/image, the canonical typed document, one full-uint64 version increment, privacy-safe identity.user.update audit, identity.updated.v1 outbox event and original receipt commit atomically.

RecoverProfileUpdate and exact retries preserve the original result after later mutations; current authorization/redaction still control its disclosure. A changed command conflicts; stale or blocked new writes close with audited NotCommitted and no domain/outbox prefix. Participant failure/panic rolls back; unproved or ambiguous closure remains Unknown. Expired pending recovery requires all frozen participants' negative evidence. The domain's original unchanged version is negative evidence under the journal and tenant fences; a missing or changed aggregate remains unknown, never inferred success. No fresh authority, session, provider call or background worker is created.

Storage roles need UPDATE on users and SELECT/INSERT/UPDATE on profile/value tables, with SELECT/INSERT on immutable schema definitions and the existing command, audit and outbox permissions. Migration 8 already supplies profile storage; migrations 1–8 and existing structural writers are unchanged. The remaining kernel lifecycle profiles are unfinished.

Durable administrative attribute updates

NewUserUpdateUnitOfWork supplies the existing UserUpdateAdminService with the sole Coordinator's command protocol. Register the exact Repository and typed audit/lifecycle phases as for creation. Select frozen AttributeSchemas; the independent ProfileSchema feature is not required. Current operation and per-field authorization remain in the core service, not role labels or direct adapter calls. The current audit actor profile supports human and service accounts; API-key actor composition remains unsupported and fails closed.

ApplyUserUpdate locks the authoritative aggregate and replaces individual whole typed values, preserving omissions, explicit zeros, output-denied stored fields, and the existing lifecycle status. Deleted/anonymized users cannot be updated. The expected version fences exactly one full-width successor. Neither name/image storage nor credentials, identifiers, roles or authority versions are changed. Each command uses its exact registered schema ID/version; stored definition mismatches and corrupt documents fail without a partial result.

One transaction persists the values, protected identity.user.update audit, identity.updated.v1 lifecycle and original structural receipt. Exact replay precedes current-state CAS; a live parallel retry can return InProgress and must retain the same command ID. Recovery observes the original receipt under current core authorization/redaction. Expired pending commands close only with the unchanged original aggregate version and negative evidence from every frozen participant; missing/changed evidence remains unresolved. No second transaction owner, callback inside SQL or migration is introduced. Storage roles need the existing user and attribute/schema read/write permissions; administrative updates do not require writes on the self-profile table.

Focused real PostgreSQL tests exercise these adapter semantics through the public service with typed SQL audit/outbox test phases. Updated production audit/outbox administrative composition and complete lifecycle/release gates remain pending; the self-profile production composition is separately proven.

Owned creation service composition

NewCreationUnitOfWork(coordinator, repository, CreationUnitOfWorkConfig{ RetentionPolicyVersion: revision}) supplies the core identity.UnitOfWork dependency for identity.NewUserCreationService. The exact repository instance must already be registered with typed audit and lifecycle contributors. The adapter owns plan construction, privacy-safe audit records, primary time, reservation, execution, closure and scoped receipt lookup. Consumers do not implement a domain store or supply Work, audit-record builders or command plans.

This is a trusted storage seam, not a transport endpoint: only the core service provides current caller authorization, field preparation and output redaction. Creation supports human and service-account actors; API-key actor audit mapping remains unsupported and fails before reservation. Failure evidence is built before domain writes and staged after proven rollback, never by unpoisoning SQL Work. No success prefixes survive participant failure. A failed failure-audit commit or ambiguous transaction remains Unknown. Replay preserves the original receipt and audit ID, including after retained fingerprint-key rotation.

Recovery returns historical creation, not current user status. Live pending returns InProgress without changing ownership. Expired creation can take a new generation and atomically abort with failure auditing only when every exact frozen contributor supplies RecoveryContributor and proves non-commit. Missing, unknown or conflicting evidence remains pending. Existing users never become reconstructed success receipts. Other command profiles, recovery-deadline alerting and transaction retry policy remain unfinished. Existing test SQL contributors prove coordinator atomicity, not production audit/outbox adapter interoperability; that composition remains required before package completion.

RecoverCommand(ctx, query, caller) uses current QueryPolicy authorization and returns metadata only; owned core recovery uses the trusted storage seam without synthesizing caller identity. RecoveryWork is invocation-bound, exposes only scope, bounded evidence queries and the participant's frozen declaration, and cannot stage mutations or close transactions. Contributors read retained bindings even when payloads have been pruned. QueryCommand remains observational.

RecoverFeatureCommand(ctx, query, caller) uses that same current disclosure policy and recovery owner, but returns the full safe feature receipt: original binding/operation, terminal audit ID and declared before/after versions, or pending retry metadata. Kernel user/profile commands are forbidden before reconciliation; generic RecoverCommand remains metadata-only. Missing commands are never reserved. Unsupported expired participants leave pending evidence unchanged; ambiguous commits return UnknownCommitError without credentials. Feature receipts carry no session, proof or native response and grant neither current authority nor credential reveal permission. Native feature adapters must match their own exact retained intent/evidence and enforce current result-access policy before composing recovery. Original frozen participants, not today's domain state, determine the historical outcome.

Primary command lookup

CoordinatorConfig.QueryPolicy optionally enables QueryCommand(ctx, query, caller). Configure the existing authorization.Service, a trusted clock.Clock and positive current PolicyVersion; nil keeps lookup disabled. Policy callbacks run before the single primary read, never under an open transaction.

Trusted authenticated composition supplies the authorization.DecisionContext: the actor/kind, tenant, original operation and identity.user resource targeting the query's user must match at that current revision. Do not decode caller identity or authorization attributes from client overrides. Every historical query field—including optional record ID and link mode—must match the stored command. Current policy permits disclosure but never rewrites old policy/schema versions or correlation. Reserved identity.command.* attributes are rebuilt from the exact query: ID, record ID, decimal link mode and recovery/read-admission flags cannot be replaced by caller attributes. Missing, wrong-scope and denied requests all perform the bounded decision/read shape and expose zero receipt plus ForbiddenError; this is not an identical wall-clock latency guarantee.

Pending, including an expired lease, remains InProgress. CommandRecord exposes only historical scope, outcome and retry metadata, never stored profile, attribute, account or credential payloads. It is not current user status or fresh authentication authority. Protected replay values stay inside owned core recovery and its current field-redaction policy. Orphaned, legacy/incomplete or corrupt history fails closed. Lookup neither locks for mutation nor changes a lease, generation or contributor. RecoverCommand and the owned UnitOfWork service bridge remain unfinished; callers must not implement their own transactions or participant recovery to replace them.

Identifier and verification partitions

Apply forward migration9 before calling GetIdentifierState. It adds the positive identifier_version authority dimension to users (initial version1) and identity-owned identifier/verification rows. Existing users retain their aggregate versions; structural writers that omit the new column remain valid. The migration takes PostgreSQL DDL locks and validates the new user constraint; run it through the bounded migration Runner during a reviewed migration window. No destructive downgrade or application-written backfill is supported.

GetIdentifierState(ctx, identity.IdentifierQuery{TenantID: tenant, UserID: user, MaximumIdentifiers: 128}) implements the existing public storage port. One indexed SQL statement returns the complete ordered partition or an error with no partial state. The limit must be1..128; oversized partitions are unavailable, not truncated. Missing users return ErrUserAbsent. The configured repository budget and any earlier caller deadline bound pool acquisition and query execution. Returned slices own their memory; the pool remains caller-owned.

Canonical values are exact, case-sensitive, at most512 UTF-8 bytes with no C0/C1 controls. Optional display values have the same bounds but may be empty. IDs preserve the existing validated directory-ID profile. Record and canonical-value uniqueness is tenant-local; canonical uniqueness also includes kind. A user has at most one verified primary identifier of each kind. Verification state and identifier flags share a row and database constraints; pending has no timestamp, verified requires one, revoked may retain the original timestamp. Reads reject future or otherwise inconsistent verification timestamps and preserve uint64 versions without signed-bigint truncation. Neither snapshots nor structural validation grant authorization or prove a challenge.

IdentifierMutationMigrationSource{Base: source, Version: allocatedVersion} appends forward-only retirement history after all migrations in source. Allocate a unique version greater than every installed/composed Base version; do not replace or renumber existing migrations. The new table retains tenant, user and identifier IDs, exact retired record/verification versions, original retirement and reuse-expiry instants, and a keyed digest rather than retired canonical/display values. ID history remains necessary after a value cooldown expires; this source intentionally supplies no deletion or downgrade policy. Run it through the same bounded migration Runner in a reviewed DDL window.

Native provisional writes now implement all five identifier transitions under the existing Work transaction. They lock the complete bounded partition, preserve original verification instants, demote the old primary before promotion and atomically persist retirement history with exact optimistic version fences. Stored value-cooldown expiry is not renewed by key/policy changes; missing keys for still-active history deny, while expired history does not require those keys forever. Retired IDs cannot be attached anew even after value expiry.

This remains a storage foundation, not a complete identifier workflow. The writer is private and public capability-bearing Begin remains disabled. Use the existing IdentifierService for admission once native current-authority, challenge/final-access checks, atomic capability/risk consumption, audit, lifecycle, complete commit receipts and recovery composition are implemented. Do not supply application-owned SQL or transactions to bypass those requirements.

MigrationSource{} owns identity.users with tenant_id, user_id, status and version. Compose the source with the existing go-migrations/v3 Runner and PostgreSQL backend before constructing the repository. The source creates no private ledger or migration runner. Initial install requires an unoccupied identity schema and runs atomically. Replayed migrations preserve populated data; destructive downgrade is unsupported. Future changes append history.

It is not yet an adoptable complete durable identity adapter. Do not write application-owned identity tables or transactions to bridge that gap. Commands, snapshots, attributes, imports, lifecycle cascades, audit/outbox, reconciliation and the shared transaction coordinator remain unfinished.

The appended command-claim migration installs the global ID claim and scoped journal foundation. Private admission runs inside the Coordinator's transaction, never commits independently, and does not grant mutation authority. Exact replay selects the stored fingerprint-key version; missing retained keys or missing scoped rows fail closed. Retired IDs conflict permanently. The owned retirement policy and scoped recovery still require implementation; the later migrations provide leases, terminal receipts and frozen plans.

The private codec maps core commands, including privacy requests, account link/unlink and all identifier actions, through typed accessors. It uses the closed identity-command-v1 deterministic encoding profile, framed HMAC-SHA-256 digests for all private fields, and stored-key regeneration on rotated-key replay. Directory IDs retain their exact validated representation, including ULIDs; random command IDs become fixed-width byte strings. Attribute times must be microsecond-exact within PostgreSQL years 1..9999; no rounding is performed. Equivalent whole-field replacement ordering does not change intent, but list ordering does. No raw command, name, image or attribute value enters persisted collision fields. Invalid command values fail closed. Provider subjects/issuers, identifier values and the complete authenticated capability authority are represented by framed keyed digests. Capability owns its canonical payload representation; the adapter never JSON-serializes core commands or consumes a proof during encoding. Proof header/key metadata, all version fences, link modes, credential references, provider-revocation choice and session/pre-auth continuations are included. A changed authenticated proof is changed intent, not an implicit recovery credential. The claim phase does not yet reserve or finalize proof use with a domain mutation. The encoder follows RFC 8949; full protocol interoperability and release evidence remain pending.

The third forward migration extends the existing command journal with private pending ownership, positive generation/attempt counters and database-time lease, heartbeat and creation/update fields. Matching live reservations return bounded retry delays; expired reservations acquire a new generation inside their caller's transaction. Heartbeats cannot renew expired or stale ownership. A takeover is not public apply authority: all declared participants must still be rebound in that same transaction before the future Coordinator can commit it. No private helper owns commit/rollback or infers a terminal result from lease expiry. Foundation-only rows keep NULL ownership metadata and remain readable by older claim code; the new reservation path rejects them until authoritative recovery can prove their history. This migration does not fabricate ownership, classify them as aborted or enable terminal rows without complete safe receipts.

The fourth migration enables committed/aborted rows only with a positive supported receipt version, bounded body, database terminal time and closed classification. Private terminalization locks and rechecks live generation and owner; it never commits independently. Exact replay returns the original typed receipt, not current user authority. Core CommandResult.Validate owns receipt invariants; the private version-1 JSON storage representation rejects unknown fields, duplicates, alternate spelling, lossy values and trailing input by requiring exact re-encoding. JSON is not used for command fingerprints. Retained attribute instants are encoded from an owned UTC copy and must be microsecond-exact within PostgreSQL UTC years 1..9999. Second-offset time zones cannot lose offset seconds in JSON, and caller-owned receipt values are untouched. Receipts may retain authorized profile/attribute snapshots and private identifier intent digests; treat this restricted replay storage as identity data under retention/access policy, never logs, metrics or transport responses. Encoding validates bounded core values before allocation; decode rejects bodies over 8 MiB. Required audit/participant staging and public scoped recovery are not yet implemented, so private terminal SQL is not a conforming composed mutation API.

Final-authentication coordinator admission

Configure CoordinatorConfig.FinalAuthentication with an explicit trusted authentication.AuthorityAuthenticator and a stable durable namespace. Do not derive either from request data or change the namespace while proof-use tombstones exist. An exact registered AuthenticatedFeatureContributor owns exhaustive native-command mapping and initial/final current-authority checks. Its checks run inside the coordinator-owned Work and must not write, perform network IO, consume proofs, renew freshness, or retain transaction authority.

Use PrepareAuthenticatedCommandPlan and ReserveAuthenticatedCommand with the same original opaque proof and native command. The existing retained-key fingerprint binds the original namespace, credential/proof IDs and versions, scope, method, assurance, and exact original timestamps without exposing raw correlations in canonical intent. Ordinary ReserveCommand cannot execute identity.session.issue. Preparation validates provenance, not current eligibility; reservation does not consume the proof.

Initial admission stages the proof-use tombstone in the same transaction as native effects, audit, lifecycle and the terminal journal. Final admission rechecks original proof expiry and native current authority. Failure rolls back provisional effects and consumption. Exact replay returns historical metadata, never a new bearer or refreshed authority; retained fingerprint-key rotation preserves replay identity. Pending recovery cannot classify the kernel as effect-free when a proof-use tombstone exists.

This is coordinator admission, not a session service: complete native session/family issuance, their authority checks and recovery, bearer custody, and composed login remain unfinished. The integration fixture's synthetic feature proves coordinator atomicity only, not production session behavior.

Domain begin admission

Private domain-begin admission now revalidates the retained-key global claim, locks the scoped pending journal and verifies generation, owner and lease using database time read after lock waits. A key rotation with the retained original key preserves admission; changed intent, stale/foreign/expired ownership and terminal rows never become apply authority. Missing history or keys fails closed. The future Coordinator owns rollback on every failure and bounds Work by the remaining lease; this private snapshot neither renews validity nor begins/commits/rolls back a transaction or invokes participants. Public Work issuance and complete Begin orchestration are still unavailable.

Restricted Work execution

Work now provides Scope, Exec, Query and DatabaseTime for trusted compile-time enlisted adapters. Its constructor is private; application code cannot acquire valid Work until the complete Coordinator is available. All aliases share generation, scope, deadline, failure and closure. Work/WorkRows are serial, not concurrent APIs. The deadline starts before the authoritative clock read roundtrip, cannot restart on construction, and is never renewed by DatabaseTime. The coordinator must invalidate aliases/active rows before closing its transaction and retain sole commit/rollback ownership.

SQL must be a trusted compile-time SELECT/INSERT/UPDATE/DELETE/WITH statement up to 64 KiB with no more than 64 closed scalar parameters/1 MiB total. Inputs do not admit driver options, query rewriters or custom marshalers. Extended protocol executes the exact SQL through a fixed owned binary scalar profile, even without parameters; prepared-name aliases and caller-installed codecs cannot replace it. Multi-statements are rejected by PostgreSQL. Initial execution errors are resolved before returning rows. WorkRows exposes no driver or connection and permits only closed typed scan destinations, not RowScanner or custom scanners. It returns at most 256 rows, 64 columns and 1 MiB raw result bytes. Close rows before another query, inspect Err, and discard all destinations after a Scan error. SQL/scan/ budget/cancellation failures poison further execution; diagnostics are redacted. Empty byte parameters remain non-NULL and are copied before I/O.

This is not a sandbox for malicious adapter SQL, a tenant query rewriter, or a bound on server-side query work. Contributors must use scoped/indexed statements and cannot invoke functions changing transaction ownership/isolation or external state. No raw transaction, connection, nested transaction or closure API exists. Audit/effect writers, typed participant phases and complete Coordinator issuance remain required next; this partial execution surface is not full command authority.

Kernel audit admission

AuditPlan, AuditBindingDigest and Work.StageAudit now implement the kernel staging boundary. Coordinator-private admission freezes the plan before SQL; the current kernel mapping requires exactly one action for its command, including the canonical user action for profile/admin aliases. It rejects empty, duplicate, late or rebound plans. No public method can enlist an audit or obtain valid Work. Records must match the declared index/action/schema, command, tenant, actor, target aggregate, policy and correlation. Exactly one immutable record is staged per index; missing or duplicated staging fails closed. Invalid staging poisons Work. Record/aggregate bounds may lower the 16 KiB identity security ceiling.

The current kernel profile accepts privacy-processed no-change/redacted records, closed aggregate/version/reason attributes, safe opaque context IDs and bounded producer tokens. Free descriptions, raw network/user-agent data, unknown attributes, arbitrary structured changes and delegation are unsupported and rejected. Feature-specific fields, composed multi-action mappings and the typed complete IdentitySecurityEventV1 builder remain required implementation. The identity profile requires 128-bit-or-stronger opaque IDs: configure audit.Builder with a trusted random generator, such as identity.NewSubjectID, before Build. The primitive default UUID has fewer than 128 random bits and is not selected by this profile. Staging preserves IDs; it never derives them from a command or replaces them. Canonical base64url 128-bit and lowercase hex 128-bit ID profiles are accepted; format validation cannot attest randomness.

This is owned in-memory staging, not persistence, an independently committable audit transaction or complete command authority. The registered audit contributor must persist each canonical record and its command/index binding through the same Work; the future Coordinator must enforce completeness before commit and retain denial/unknown recovery evidence. Those durable paths are not yet present.

Contributor registration

CommandPlan.Lifecycle adds one typed kernel notification plus the exact outbox/postgres identity.lifecycle v1 contributor. Work.StageLifecycle constructs a safe scalar-only record with a stable command/class/index ID; StagedLifecycle returns an owned snapshot only after successful required audit staging agrees on its target and before/after versions. It accepts no arbitrary payload, identifier value or bearer. The trusted adapter obtains occurrence time from Work.DatabaseTime; staging itself does not perform I/O. Closed or failed Work cannot produce notifications. Mismatches poison the Work.

The open LifecycleContributor will persist these records through the same Work, not a separately committable transaction. Persistence, cascade consumer snapshots/checkpoints, encrypted delivery/provider effect profiles and complete Coordinator invocation are still pending. Older audit-only admission remains compatible, but cannot satisfy a successful future mutation commit. The deletion notification is identity.deletion_requested.v1, never proof of completed erasure.

AuditContributor supplies the open durable audit phase. Work.StagedAudits exposes owned declaration/record pairs only when every required slot is staged. The registered audit adapter uses this snapshot to write canonical records and immutable command/index bindings through that same Work. It cannot retain Work or own transaction closure; success is staging, not commit. Complete Coordinator phase invocation remains under development.

CommandPlan declares ordered contributor descriptors, required audit slots and a digest. KernelPlanDigest binds the current kernel-only profile to the exact command scope and authoritative fingerprint using deterministic CBOR. Admission snapshots the slices against the exact registry; later input mutation cannot change admitted work. Audit binding rejects foreign-registry Work, different commands and late/repeated enlistment before SQL.

This intermediate profile supports exactly one domain and one audit contributor. It does not accept feature, risk, capability or OTP contributors without their typed inputs; it cannot substitute for their atomic reservation. The Coordinator must resolve retained-key fingerprints before plan admission. Public command issuance, durable audit delivery and complete participant phases remain pending.

CommandPlan.Capability can now freeze one scalar, single-use capability input for deterministic digest preparation and bounded historical decoding. It binds the exact signed ID, purpose, expiry/use bound, independently keyed replay digest and retained key version, and immutable proof fingerprint. The enclosing command fingerprint binds target/version intent. Existing audit-only and lifecycle plan bytes are unchanged. Formatting redacts this input and JSON export is rejected. This declaration is not proof validation. Exact identifier commands can now prepare/reserve when the registry supplies a CapabilityReservationContributor. The coordinator freezes owned inputs, checks signed ID/expiry/use and target versions, and invokes Reserve or exact-predecessor Rebind under the same claim, journal and tenant locks. Failure, panic or unfinished rows rolls back every prefix; returned invocation handles and rows cannot outlive the phase. Retained fingerprint keys remain authoritative on replay. Contributors never own closure. The additive CapabilityExecutionContributor seam provides separate CapabilityApplyWork and CapabilityFinalizeWork invocations. Their bindings select the original frozen input and current generation, never predecessor release authority. Only the exact registered instance can inspect them; wrong phase, foreign registry and retained copies fail. SQL uses the existing bounded Work, with no pool, transaction closure or raw driver escape. Callback errors, panic and unfinished rows poison the underlying work. These custody contracts do not yet provide a production consumption algorithm or native identifier mutation, and cannot consume an authentication.AuthenticatedProof. Begin still rejects these reservations before consuming their opaque handle: domain/session/risk/apply/finalize phases and the production capability store are pending. No capability use or complete workflow is claimed by a reserved journal. Existing creation/profile/admin composition is unchanged.

Expired identifier-attachment commands additionally support primary recovery when every frozen contributor supplies RecoveryContributor and the capability participant supplies CapabilityReleaseContributor. Missing targets and exact reserved capability bindings are negative evidence, never sufficient alone. Only unanimous non-commit evidence under journal and tenant exclusions grants CapabilityReleaseWork; it CAS-releases the prior generation to a terminal state with the new recovery generation. Failure audit, terminal capability and aborted receipt commit together. Missing, conflicting or unknown evidence and callback errors/panics roll back the entire takeover. Capability expiry does not release an unknown outcome; terminal repeat returns the original receipt. These SQL fixture tests prove coordinator atomicity, not production capability-store composition. Other identifier operations and successful consumption remain open.

Contributor identities can now be composed with NewContributorRegistry([]Contributor{...}). The registry snapshots 1..64 trusted compile-time adapter descriptors once, preserves composition order, rejects nil/typed-nil, duplicate contract IDs and conflicting versions, and allows only exact registered descriptors in private command admission. Owners are bounded lowercase printable ASCII; contract IDs are bounded printable ASCII; neither admits whitespace or normalization. Composition roots own canonical IDs and contributor lifetimes. Returned Descriptors() slices are caller-owned copies and registry reads are concurrent-safe. Implementations remain open to independent modules. This is identity admission only: no transaction phase, typed participant input, Work issuance, late registration or commit API is provided by registration. Unsupported phase combinations and foreign plan rejection remain part of the forthcoming complete Coordinator, not guarantees of this constructor.

Command reservation

NewCoordinator(primaryPool, registry, CoordinatorConfig{...}) owns bounded reservation transactions. Configure positive operation/lease durations no longer than one minute, a microsecond-exact lease, and 1..32 retained nonzero 32-byte fingerprint keys with an explicit current version. Keep the pool primary-only and caller-owned. Configuration/Coordinator diagnostics hide keys and reject JSON serialization. Registration is immutable; contributor resources stay owned by the composition root.

Use PrepareCommandPlan(binding, typedCommand, plan) to obtain an owned digest with the current key, then ReserveCommand(ctx, binding, typedCommand, plan). The initial public profile requires user creation, one required audit slot and the matching lifecycle declaration with typed audit/outbox contributors. One-time and cascade profiles are rejected before SQL. Services must authorize commands first; preparation is not authentication or authorization.

Migration 5 adds a bounded immutable canonical plan to the existing journal. It leaves historical rows NULL, not invented participant history. A matching replay uses the stored key version and fingerprint; key rotation cannot rewrite the declaration. Changed scope, intent or plan conflicts; missing retained keys, NULL historical plans and corrupt history fail closed. Plan replacement is rejected by a SECURITY INVOKER trigger, not a defense against privileged administrators or DDL owners. Cleanup remains the retention owner's obligation and must preserve global non-reassignable claims.

A new or expired reservation returns opaque generation ownership and InProgress. Busy replay has no ownership; terminal replay retains the exact historical receipt, not current authority. A proven reservation commit is never a user commit. Failures before durable observation or after proven rollback return a zero result, not fabricated NotCommitted. Any commit-attempt failure or unproven rollback returns Unknown; no automatic retry or rollback follows a commit attempt. The detached rollback budget is finite and earlier operation deadlines win. No contributor callback executes during reservation.

Creation execution (development profile)

Coordinator.Begin(ctx, reservation) consumes exact ownership once and opens one bounded primary transaction. Reservation copies cannot issue another Work. The original lease is checked after command locks; waiting never renews it. Kernel mutations also take a transaction-scoped tenant lock. Work and its cursors are serial-use; every path must close through Commit or Abort, including panic (normally with deferred Abort). No closure goroutine is started. An idle transaction timeout limits abandoned server locks but does not substitute for releasing the caller-owned pool connection.

Repository.ApplyUserCreation(ctx, work, command) requires the exact registered repository and frozen creation command. It inserts an active version-1 user; the returned user is provisional until Commit. Declare up to 32 copied, versioned Config.AttributeSchemas for ordinary scalar/list storage. The exact tenant/schema/version definition becomes immutable in the same transaction; different definitions under that identity conflict. Undeclared fields/kinds or unsupported indexed/secret profiles fail closed, not silently disappear. Repeated apply poisons the transaction. Stage the required successful audit with redacted structural changes and the declared lifecycle record before Coordinator.Commit(work, result). Commit checks the caller result against the actual mutation, invokes the registered audit then lifecycle persistence phases through the same Work, terminalizes the journal and commits once. Missing evidence, open cursors, changed results or a phase failure roll back all prefixes. All aliases close before transaction closure. Any error after commit starts is Unknown, never automatically retried.

Coordinator.Abort(work, cause) proves rollback before a separate bounded terminal transaction. A complete matching pre-staged denial/failure audit is required for a known NotCommitted result; terminal audit and receipt commit together. Missing evidence or lost ownership leaves pending/Unknown for recovery, not fabricated success or denial. Detached cleanup remains bounded after caller cancellation; driver and caller error text is never exposed.

Attributes use a private bounded version-1 canonical CBOR document, preserving present false/zero/empty values, int64 extrema, ordered string lists and UTC microsecond-exact instants without float conversion or JSON escaping growth. They are private stored values, never diagnostic snapshots. Recoverable secret fields require the future owned secret-envelope profile; there is no plaintext fallback. Indexed fields need explicit field migrations, not arbitrary search. Migration 6 adds schema/value tables without inventing values for old users; old structural writers/readers remain supported. Definition update/delete/ truncate is rejected for ordinary writers, not hostile DDL/database owners. Public reads still return structural fields only; field authorization, redacted projection, attribute updates/backfills and secret/index profiles remain required.

This is not yet an adoptable identity.UnitOfWork: remaining attribute profiles, other domain commands, the owned service bridge, classified retries and scoped query/recovery remain required. The integration suite proves actual PostgreSQL transaction behavior with typed audit/lifecycle SQL seams, not production audit/outbox adapter interoperability. Do not supply application-owned identity transactions or stores to bridge the unfinished profile.

Denial-only credential compromise

The registered password or passkey participant may implement CredentialCompromiseContributor for its closed mark-compromised operation. Its frozen command includes CredentialCompromiseFields plus native detection and authorization metadata. The coordinator locks the exact user/reference and checks the independent aggregate, credential-authority and reference versions before invoking native verifier disablement. Banned/suspended and expired credentials may be disabled; deleted/anonymized users and already disabled or stale references are rejected. No credential is enabled or restored.

The existing outbox participant must also implement CredentialCompromiseLifecycleContributor. Its same-Work phase persists both StagedLifecycle and StagedCredentialCompromise, keeping all three version dimensions distinct. These provisional values grant no current authentication authority or cascade acknowledgement. Native mutation, kernel metadata, audit, outbox and the original journal receipt use the sole coordinator transaction. Only the shared commit establishes durability; replay preserves the original receipt even after later changes. Retained participant evidence cannot be replaced by a lookup of current credential state.

Compose CredentialCompromiseMigrationSource after credential-reference history with an explicitly allocated later version; retain its evidence with command tombstones. This is not password set/change/reset, passkey ceremony validation, or production password detection. Those workflows still need their real native owners, proof consumption and composed adapter evidence.

Existing-password replacement

CredentialReplacementContributor enlists the kernel-owned effect for identity.password.change. Its complete frozen command carries CredentialReplacementFields and the native workflow's original policy intent. For verifier writes use identity.NewFeaturePasswordHashCommand; native owners select PasswordHashFeature and explicitly borrow PasswordHash for parsing and SQL-driver storage. The coordinator binds exact hash bytes with the command fingerprint key, never raw journal metadata. Changed verifier bytes conflict with the original command ID, including terminal replay. Legacy hash-free commands keep their encoding but cannot supply material through this custody. The coordinator matches the native mapping, locks the primary user and password reference, and checks active status, enabled state, expiry and all three exact predecessors. Native hash replacement runs in the same Work; the kernel then advances the user aggregate, credential authority epoch and reference version. The credential's owner, identity, enabled state and expiry do not change.

Install CredentialReplacementMigrationSource after credential history with an explicitly allocated later version. The existing outbox participant also needs CredentialReplacementLifecycleContributor; persist StagedLifecycle and StagedCredentialReplacement without conflating their version dimensions. Native material, kernel metadata, audit, outbox and the original command result share one recoverable transaction. Any failed phase rolls back all effects. Pending-journal recovery treats retained effects as unknown, not success inferred from the current credential. Exact terminal replay returns the original receipt.

This is a trusted persistence seam, not an authenticated password-change endpoint. Native workflow composition must still own reauthentication proof validation/consumption, HIBP, reuse policy, secret custody and session policy. Do not supply application-written stores to bridge those unfinished workflows. Registration, provider-only set, reset/recovery and hash-only rehash remain separate pending profiles; this effect cannot enable or restore credentials.

FAQ

• Can I use a replica? No; the repository's primary consistency contract is required for security composition.
• Are reads authorization? No; use the identity query service.
• Can I request extra fields? Only id, tenant_id, status and version are supported; unknown or duplicate fields are rejected, not ignored.
• Is the pool closed by the adapter? No; the application retains ownership.
• Is this released? No. Full adapter implementation and release gates remain pending.

Integration testing

Initial phone confirmation participant

PhoneVerificationContributor selects only identity.phone.verify.native-v1 under the logical identity/phone/postgres owner. Use PhoneVerificationFields with the original committed enrollment command, canonical number, immutable normalization profile and exact pending identifier/verification versions 1/1. The selected PhoneEnrollmentDomain must borrow the same enlisted repository. The operation requires an authenticated-session command, consuming OTP, protected audit and identifier.verified.v1 1→2; it neither issues a session nor changes a primary number. No new migration or transaction owner is introduced.

Input admission calls RequirePhoneVerificationTarget before credential, session and factor locks. It exclusively locks and compares the original user/ identifier partition before an OTP comparison can charge an attempt. Kernel preparation does not write possession; Apply rechecks the actual enlisted OTP reservation before persisting verification in the coordinator transaction. Final OTP checks may map only that Work's exact persisted identifier successor; all other authority dimensions and original validity times remain unchanged. Current rows never reconstruct historical success during recovery.

These are trusted storage/admission contracts, not a complete phone endpoint. The native workflow must authenticate original enrollment/session possession, derive only the enrollment's exact authority successor, enforce factor/risk/ CSRF policy and provide code-free unknown-outcome recovery. Ordinary session validation is not relaxed. The focused storage test deliberately does not claim genuine caller, SMS or complete OTP interoperability.

The private identifier storage path provisionally consumes its enlisted capability through the same Work after locked state/cooldown checks and before identifier writes. Only the owned exact identifier receipt can reach Commit; the coordinator finalizes consumption after provisional audit/outbox effects and before its terminal receipt. Phase failures poison Work and require Abort. Public identifier Begin remains disabled until native session, current policy, challenge, final-access and recovery composition is complete. Private tests use a phase probe to prove invocation and storage rollback, not native capability-store interoperability or an executable verification endpoint.

go test -tags integration ./... requires IDENTITY_POSTGRES_TEST_DSN pointing to an explicitly disposable loopback PostgreSQL cluster with database identity_test and database-creation permission. Each invocation creates and removes its own random database; it never drops the supplied seed database. Missing infrastructure fails the selected lane rather than skipping it.

PostgreSQL numeric with scale/range checks preserves all uint64 versions and rejects fractional values; a scale-constrained type would round before checks. See PostgreSQL numeric semantics.