feat(identity): serve the identity operation family

[Knucklessg1]

Closeout status — 2026-10-08

Draft; not merge-qualified. Reviewed repairs and regenerated artifacts are published at 083672fec0119be65220d6dba654e5473b959fdb, integrating main through f763ff2874359d4723e106077b70312660bd73d3. The exact candidate tree is e3b86afa090328cb24b325f1211a2f8c3e265aef.

The repairs bind replacement-password policy verdicts to the checked credential history, preserve transactional tenant grants and audit persistence, enforce MFA throttling and secret binding, and withhold managed tenant auto-binding when replicated fingerprint authority cannot identify the original subject. Legitimate fingerprint-shaped self IDs also require explicit Identity grants. The inherited unmanaged fallback and broader clustered provisioning/ordering gap remain documented and open.

Validation for this candidate:

• Normal commit and pre-push hooks: passed, including Ruff, mypy, pinned rustfmt, contract reachability, ownership, persistence, and privacy gates selected by those hooks.
• Staged complexity, architecture, public-spec checks and 10 artifact-ledger tests: passed.
• Canonical WASM build/check and contract generation/rebuild/check: passed. Exact alias-bearing source freshness also passed using the verified retained generator and canonical WASM checker after full input equality verification; API-doc freshness passed.
• The first root-native attempt stopped before compilation because the offline cache lacked a locked dependency. Normal official-registry locked fetch then succeeded; 924 cached archive checksums matched, and the source/lockfile remained unchanged.
• The single replacement root-native unit used server,security,query,raft,redb, offline, one Cargo job, a four-CPU/24-GiB limit, and a 45-minute cap. It timed out during compilation at 09:44:02 UTC. Zero native tests executed: the three alias regressions, two password-race regressions, SQL identity, and Raft filters remain unqualified.
• Matching Python codec/contract interop and downstream qualification remain incomplete. Earlier main/PR CI and older native snapshots do not qualify this head.

No main merge or deployment was performed. No compiler remains from the bounded unit. Complete source patch and raw receipts are retained in the task workspace; no follow-on build or repair is scheduled.

The validation above supersedes historical validation statements below for the current head.

---

Summary

This is a wire-contract change: it adds a new Method::Identity operation, new request/result schemas, a new scope registry (contract/scopes.json), and new IDENTITY_* server error codes. The contract digest moves (contract/receipt.json's contract_digest, method_count 456 → 457).

Lands the engine-owned identity store (EG-TYPED-PACKS-R085): users, credentials, sessions, tokens, MFA, API keys, roles, groups, identity providers, links, audit and throttle, dispatched through src/server/dispatch/identity_store.rs and registered in crates/eg-capabilities's security domain.

• Credential verification uses argon2id at the request boundary (src/server/dispatch/identity_store/stamp.rs, secrets.rs); every plaintext secret is cleared from the op before it is replicated or logged.
• The identity store and its full RBAC projection share one rbac.redb write-transaction with a hash-chained identity audit trail (IDM-03); RegisterIdentity/RbacAdmin gain the same audit trail and are fenced off the store's own idm: namespace.
• A pgwire/SQL projection (src/server/sql_catalog_acl/identity_view.rs) exposes the store's relations redacted, visible only to callers holding the exact identity:read/identity:admin scope.
• crates/eg-capabilities/src/scopes.rs is a new IDM-05 scope registry (contract/scopes.json), the single source of truth agent-utilities generates its session-scope allowlist from.
• Classified into the native consensus catalog (src/raft/command/native/catalog.rs) alongside RbacAdmin/RbacElevation so a clustered (raft) build replicates it correctly.

What was left on the source branch (feat/t7-eg-auth-reason-20260925)

Deliberately excluded from this slice (separate requirements, not needed for identity to compile or serve):

• EH-560 governed changes (governed_change, dispatch::governed, the GovernedChange method/scopes).
• IDM-02 multi-issuer OIDC trust (src/server/oidc/trust.rs) — the identity store's own identity-provider CRUD is self-contained and does not depend on it.
• EG-TYPED-PACKS-R087's AccessDecision/AccessReasonCode addition to access_policy.rs (stable graph-access reason codes) — unrelated to the identity operation family.
• RBAC elevation (EH-404) and the throttle capacity cell (EH-406) were already merged to main independently before this branch was rebased; nothing further was needed from those commits.

Regeneration

Regenerated with cargo run -p eg-capabilities --features "contract canonical-ledger contract-schema" --bin gen_contract (verified with -- --check), then python3 scripts/gen_api_docs.py --write. No generated artifact was hand-edited.

Gates run locally (R820 for Rust, this host for scanners)

• cargo check/clippy --all-targets -D warnings under --features security, --features cluster (raft), --no-default-features --features server, and --no-default-features --features full,ast-extended — all clean.
• cargo fmt --check — clean.
• Targeted cargo test across the touched modules (identity types, eg-core isolation, dispatch identity_store, elevation, sql_catalog_acl, access, mutation/mutation_batch, audit, raft native catalog, eg-capabilities contract/scopes) — all green.
• pre-commit default stage and the manual-stage complexity/dupehound/kiss/jscpd-differential/kiss-census/cccc-census/rust-arch-lint scanners — all green against origin/main.
• scripts/security/check_secret_history.py --base origin/main and scripts/security_sanitizer.py — clean.

Two eg-capabilities Python-interop tests (generated_python_is_ruff_clean_and_formatter_stable, generated_source_ingestion_imports_and_executes_with_rust_digest_parity) fail on the Rust build host used for this lane because it has no ruff/pydantic installed — an environment gap, not a regression; every other test in that suite is green.

🤖 Generated with Claude Code

[Knucklessg1]

Review of head 083672fec (Claude takeover; Codex closed out).

Verdict: one blocking authority bug, plus a jscpd regression. Not merged.

Blocking: CreateUser can take over a principal registered through RegisterIdentity.

• CreateUser accepts a caller-chosen principal_id (crates/eg-types/src/identity/requests.rs:34-38). The collision check looks only at the store's own users (store/users.rs:103). import_sql behaves the same way (store/import.rs:182).
• project_identity_store (crates/eg-core/src/isolation/identity_store_admin.rs:141-150) then deletes the existing AgentIdentity and writes role: AgentRole::Agent with only idm: roles (projection.rs:176).
• Effect: an identity:admin caller who creates a user named graph-os, a signer-registry id or the System id strips that principal's System role and its non-idm: roles. This is the same replace-not-merge failure that cost graph-os its admin before.
• Recovery is also locked. try_register_agent_audited refuses the id with IDENTITY_STORE_MANAGED, and RepairSystemIdentity refuses managed principals.
• Fix: in try_apply_identity, refuse with Collision when next manages an id that already exists in self.agents and is not store-managed. Add a regression test that creates a user with an id already registered through RegisterIdentity (and the System id) and expects a refusal with the agent unchanged.

Scanner regression: "Scanner + architecture quality" passes on main (run 37734422245) and fails here on jscpd only. There are 7 new duplicate pairs, all in new identity tests: identity_store_tests/tenant_and_audit.rs (x2), identity/tests/auth.rs/modes.rs, tests/recovery.rs, tests/tokens.rs/verdicts.rs (x2), dispatch/identity_store/tests/stale_verdict.rs.

Verified, not blocking

• No cross-tenant leak. There is one engine-global store routed through __commons__. Note that identity:admin can create roles whose graph_grants cover any tenant, so it is effectively a platform scope.
• No secret material is returned or logged. Views, sql_dump, audit entries and tracing carry only booleans, secret_ref and one-way handles. stamp_identity clears plaintext before consensus.
• Existing principals keep their authority. identity_actor keeps only exact identity:* scopes, so wildcard, kg:admin, System and existing signer entries gain no identity ops. The System bootstrap path is preserved. No op re-runs RegisterIdentity; the takeover above is the only implicit role replacement.
• Generated contract and client artifacts are consistent with their generators.

Open, documented (not blocking for merge):

• The replicated-tenant OPEN note in test-spec.md remains open. gates (slim server + raft cluster) was skipped on this run.
• R002 audit fields (tenant, old/new authorization digest, correlation ID) are missing from AuditRecord.
• Denial samples share the 4096-entry trail with admin mutations, so a burst of denials can evict admin records.
• try_record_denials writes outside consensus, so per-replica audit chains diverge.
• tasks.md I-1 through I-6 are still PENDING.