Compose private owner admission, identity, storage and metered runner

[tako0614]

This PR composes shared identity reconciliation, private owner-operation admission, storage custody guards and the dormant metered runner into one OSS candidate. Dedicated issuer HTTP, named private RPC and release qualification share exact-current Control v74 verification; ordinary compatibility and feature-specific floors remain separate.

The complete diff against main dac30855915e49e5a4fb9782c489a023e7ed1f5a is 149 files, +19,631 / -448, including all source, schemas, tests, workflows and documentation from the components:

• Canonical Control identity reconciliation/context-plan consent, preserved historical Workspace/Org/owner references, credential unlink, reviewed recovery and the shared-profile legacy-human ingress guard.
• Route-less named Accounts owner-operation admission; fresh/historical/terminal projections; persisted original Core/context and durable owner-receipt journal; typed immutable review evidence in existing Accounts document storage; one captured owner bundle; distinct cryptographically verified issuer availability and opaque local precommit checkpoints across memory/D1/Postgres. The checkpoint establishes a local dispatch boundary, not queued database execution-time or 2PC.
• Stored-service inventory/custody, accepted Run/Backup ownership and D1 v74 indexed guards; no missing-coverage-as-zero or scan fallback. Original authority and pending/unknown ACK custody remain intact.
• Dormant metered-runner/native supervisor and immutable candidate/release-proof sources. The ordinary runner path is preserved; no metered image was built, published or qualified.

Provenance: ordinary merge 5118090a894f8fe0b1e4fb56b3a37d678ed454f1 has exact parents ab20cbb9bf91cc7859e82de9b6e52100ab9d9a6e and 2034d2aa7b33322a5e9ca4ce646be000061b07a2, with zero overlapping changed paths or merge conflicts. All 57 + 44 component blobs were initially preserved exactly. Follow-up 11d8acf5cae3d624dda6656d84bdcdccdc0585b6 changes only three descriptions and two native-test/fixture files: it states the actual v74 qualification and proves an intact v73 catalog is refused by the real named RPC before account/fence or Control identity mutations. Existing v74 success, ledger-gap and maintenance negatives remain; Node-hosted two-Worker/D1 runtime assertions increase from 42 to 46. All runtime guard/schema/B1/storage source blobs are unchanged from the components. The final follow-up below preserves every production/schema/authority blob from that frozen union. Component approvals are not transferred to this head.

Control capability	Exact supported heads
Ordinary profile-disabled bridge	71 / 72 / 73 / 74
Workspace billing	72 / 73 / 74
Generic identity reconciliation	73 / 74
Dedicated auth HTTP / owner RPC / release	74
Indexed Backup qualification	74, with exact index shape and maintenance recheck

Accounts D1 history through v5 and PostgreSQL 045, Control D1 migrations 1–73 and PostgreSQL catalog 120 are byte-identical to the frozen components. D1-only migration 74 is inherited from the storage component; no new migration or PG121 is added here. The ordinary profile-disabled Accounts v4/v5 bridge remains available. No request path applies DDL.

The final CI correction 451e69bfc6743b034ee2947992bafdc41b2c6fba changes four test-only files relative to 11d8; production/runtime, schema, authority, workflow, dependencies and lockfiles are unchanged. The original HTTP workflow test file also remains byte-identical.

Actual canonical GitHub run 38657030295 on 11d8 failed: 6,686 pass / 3 fail / 5 skips, despite the earlier local Bun 1.4.2 / Node 26.1.0 gate passing. The failed run used workflow-pinned Bun 1.4.0 (34cbb9a40) and resolved Node 22.23.3. Its immutable failed-log SHA-256 is ec4f8fb7e69e05a10d380fa146f4ac1244ea8e429049f3c948a384e1128feac9. These results are preserved separately.

• The temporary Node native-test host could not resolve bare miniflare. Unchanged-source reproduction showed Bun 1.4.0 retained that bare external specifier even when its resolver plugin returned the installed absolute path. The fixture now supplies the installed package's file URL for Node's runtime import. The full two-Worker/D1 test passes with all 46 native assertions, the original 45s/60s limits and process disposal unchanged.
• Two actual HTTP tests returned 409/503 after a long suite: the shared fixture captured timestamps at module import, then reused them to seed five-minute evidence when later fixtures were created. The same unchanged HTTP tests reproduced both codes with six minutes of simulated module age, under both Bun versions. Capturing time per fixture creation fixes the seed; TTLs and 40-vs10 budgets remain unchanged. A new isolated-child regression imports before aging and runs the original two real HTTP tests, with clock/process/temp cleanup and mandatory positive results.

Validation at 451e69bfc6743b034ee2947992bafdc41b2c6fba:

• Complete bun run check with Bun 1.4.0 (34cbb9a40) / Node 22.23.3 / npm 10.9.9, CI/GitHub environment flags and clean source: exit 0, all 20 phases passed, 641.077s. Main portable tests: 6,690 pass / 0 fail / 5 existing opt-in skips, 132,164 assertions, 618 files. Isolated workerd: 52 pass / 458 assertions; dashboard harness: 6 pass; browser: 42 pass / 2 existing public-live opt-in skips; docs browser: 3 pass; Worker builds pass. Exact head/tree and all 1,925 tracked-file hashes match before/after, worktree clean. Full raw-log SHA-256: 077805a87a82feea26c751d7526329a2bb86e5abea8ad80b3b9868c6e558f4dc. This was one complete gate on the frozen fix head.
• Focused pinned identity tests: 41 pass / 0 fail / 452 assertions; seven remaining fixture-dependent suites: 293 pass / 0 fail / 2,565 assertions. These include expiry, backward-clock and forged-checkpoint negatives. Native target: 1 pass / 0 fail / 6 Bun assertions + 46 real Node/workerd assertions, runtime disposed and process group closed.
• Permanent aged-HTTP regression was RED before the two-line fixture fix and GREEN afterward; the original full HTTP file is unchanged. Main TypeScript, format, test/source boundary and diff checks pass.
• Root boundary review and independent frozen four-file review: no blocking findings. These are not formal exact-head QA approval; the former head's QA does not transfer.
• Canonical GitHub CI run 38661770182 is SUCCESS for exact 451e69bfc6743b034ee2947992bafdc41b2c6fba. Root readback confirms all 20 phases / 806.73s, 6,690 main tests / 0 failures / 132,164 assertions; all three PR checks pass. The full successful GitHub log SHA-256 is 43da290c8b4cf54209bf358055da9751c0cb6a66cddf69dfec42cdda74eac390. This result is separate from the completed local pinned gate and the preserved old failed run; formal exact-head QA remains pending.

The earlier ab20/Hosted5002 paired 141-assertion proof remains component evidence; a new combined-head paired proof is not claimed here. Earlier component failure/reproduction artifacts remain preserved with their original scope.

Actual review issuer/key/status transport and authenticated recovery issuance, Financial/Hosted-intent/RP/resource receiving ports, and deployed source/target/binding custody qualification remain unconfigured. Missing capabilities refuse before fencing; metadata topology reports do not establish source custody or human approval. Hosted private reconciliation prototypes are not imported. Storage remains unpriced logical occupancy. No live target/configuration/key/registration, migration/apply, image publication, stage activation or production/auth deployment was performed. This PR requests fresh exact-head QA, not merge or rollout.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[tako0614]

品質・リリース担当へ、identity/storage/metered-runner と private Accounts owner-admission の統合候補に新しい exact-head QA を依頼します。

対象 full head: 11d8acf5cae3d624dda6656d84bdcdccdc0585b6。

umask 022; env -u NODE_ENV -u TAKOSUMI_ENVIRONMENT TAKOSUMI_E2E_PORT=43860 TAKOSUMI_DOCS_BROWSER_PORT=43861 bun run check

local CI exit0 / 20 of20 phases PASS / 660.391s。main 6689 pass / 0 fail / 既存5 skip / 132159 assertions、isolated workerd 52 pass、harness 6 pass、browser 42 pass / 既存2 skip、docs browser 3 pass、platform/auth/bootstrap builds PASS。開始・終了 head 一致、worktree clean。full log SHA256 636d40a0f4d6f7f044c0a44a9b029b0289d2f2935a40f9aa56051af9cb40745c。

通常 merge の両親は frozen ab20 +2034、重複path0、最初の101 component blobsは完全保持。最後の commit は3説明文+2native fixture/testのみ。実完全v73を専用named2Worker+D1 RPCが拒否しAccounts/Control identity mutationなし、実v74成功・ledgergap・maintenance負例を保持（native46assertions）。focused80/0/1360、独立read-only review指摘なしを full CI と区別して添えています。

確認対象は complete main diff148files（identity/原Context+owner journal/availabilityと全backend local precommit checkpoint、storage/D1-only74、未有効metered runner）です。専用issuer HTTP/RPC/release厳密current74、汎用identity73/74、billing72..74、通常bridge71..74を維持し、Accounts005/PG045/Control1..73/PG120履歴は不変です。checkpointはlocaldispatch直前保証で、remote queued DB execution-time/2PC保証ではありません。

Component #473/#474 のQAをこのheadへ流用しません。実issuer/approval/Financial/Hosted-intent/RP/resource受信port/実deployedsource資格は未構成で予約前拒否、Hosted private prototype未取込です。live migration/config/key/registration/stage/prod publishは未実施。正式判断は上記完全一致SHAでお願いします。merge/rolloutは依頼していません。

[tako0614]

head 11d8acf5cae3d624dda6656d84bdcdccdc0585b6 の canonical GitHub CI run 38657030295 は RED です。merge は HOLD とします。

ローカル完全 gate は Bun 1.4.2 / Node 26.1.0 で 6689 pass / 0 fail でしたが、GitHub CI は workflow が指定する Bun 1.4.0 (34cbb9a40) / Node 22.23.3 で 6686 pass / 3 fail / 5 skip でした。

• two actual Workers use the private named admission entry; public credentials and incomplete schema cannot acquire it: temporary host.mjs から miniflare を解決できず ERR_MODULE_NOT_FOUND。
• actual HTTP identity workflow has a separate bounded40 budget while PAT issuance retains10: context-plan の応答が expected 200 / actual 409。
• actual verified GitHub HTTP callback switches only the other original root and returns to the context portal: wrongBegin が expected 302 / actual 503。

CI と同じ toolchain を専用作業場所に用意して原因を再現・診断中です。guard・TTL・budget・assertion を維持し、修正凍結とレビューの後に新しい head で完全 gate を実行します。既存 QA 依頼は元 head に対する pending の履歴として保持します。このコメントは新しい QA 依頼・Approve・再実行の成功報告ではありません。

[tako0614]

品質・リリース担当へ。PR475 の新しい凍結 head 451e69bfc6743b034ee2947992bafdc41b2c6fba に対する fresh formal exact-head QA をお願いします。通常 fast-forward push（11d8→451）後、local / remote / PR head 一致・clean・全1,925 tracked-file hash と完全 gate 前後の一致を確認しています。PR 本文もこの head へ更新・readback 済みです。全 diff は REST pagination 100+49 の 149 files / +19,631 / -448 です。

• CI と同じ Bun 1.4.0 (34cbb9a40) / Node 22.23.3 で bun run check を1回実行し、20/20 phases、exit0、641.077秒。main 6690 pass / 0 fail / 5既存 opt-in skips、132164 assertions。isolated workerd52pass、dashboard harness6pass、browser42pass/2既存 public-live opt-in skips、docs3pass、全 Worker build 成功。raw log SHA-256 077805a87a82feea26c751d7526329a2bb86e5abea8ad80b3b9868c6e558f4dc。
• 元 head11d8 の canonical GHA38657030295 の3失敗を保持し、同じ pinned toolchain で RED→GREEN を確認しました。temporary Node host の bare Miniflare import を installed file URL にし、共有 fixture の import時刻を invocation時刻へ移動しました。TTL/budget/guard/46 native assertions・元HTTPテスト全文は変更していません。6分経過を子プロセスに隔離した元2actualHTTPテストの回帰を追加しています。
• この follow-up は4 TEST-only files。production/runtime/authority/schema/workflow/dependency/lockfile は11d8と同一です。独立4-file source review と root boundary review は blocking findingsなし。focused41/0/452、fixture dependents293/0/2565、native1/0/6 +46real Node/workerd assertions・dispose/processGroupClosed確認済みです。
• 新しい exact451の canonical GHA38661770182 は現時点 IN_PROGRESS です。local pinned成功と区別し、GitHub成功はまだ主張していません。

旧11d8のQA依頼やcomponent Approveは、このheadへ転用しません。full149-file source unionの fresh判定をお願いします。Hostedとの141-assertion paired proofは以前のcomponent範囲に限り、新しいcombined-headのpaired proofとは扱いません。実 owner/issuer/Financial/RP receiver と source/target/binding qualification は未構成で、profile/image/料金のactivation・staging/prod・実schema操作は行っていません。

判定は ## 品質・リリース判定: ✅ Approve（head 451e69bfc6743b034ee2947992bafdc41b2c6fba） またはこのheadの Request changes として記載してください。

[tako0614]

品質・リリース判定: ✅ Approve（head 451e69b）

品質・リリース担当による exact-head レビュー結果です（#469–#474 の判定はこの head に流用していません）。

確認事項

• Head: PR head = 451e69bfc6743b034ee2947992bafdc41b2c6fba（指定 short SHA 451e69bf と一致、移動なし）。
• Base: main（stacked ではない）。merge-base = 現 main dac30855915e49e5a4fb9782c489a023e7ed1f5a、mergeable=MERGEABLE / CLEAN。
• Local CI 記録: exact head に対する記録あり（PR コメント 2026-10-15 09:48 JST、Bun 1.4.0 / Node 22.23.3、bun run check 20/20 phases exit 0、main 6690 pass / 0 fail）。
• GHA: exact head で全 green — Takosumi OSS quality 38661770182、dependency audit 38661770308、website artifact 38661770191。旧 head 11d8 の RED（38657030295）は 451e で test-only 4 files 修正により解消。
• main: dac30855 の quality / audit / website すべて success（main は green、mainfix 制約なし）。

QA 側での再現

• worktree で bun install --frozen-lockfile、tsc --noEmit（tsconfig.json / tsconfig.worker.json）ともに exit 0。
• identity / owner admission / reviewed recovery / staging portal / owner bundle / legacy ingress / metered protocol / workspace-billing-bindings / deploy_control_seam の focused 18 files: 455 pass / 0 fail / 5019 expect。
• native: stored_service_usage + staging_owner_admission（2 Worker + D1）: 13 pass / 0 fail。

設計との整合

• アカウント: auth.takos.jp 共有アカウント前提。統合時も A の既存 personal Workspace を canonical anchor とし、W_B・Org・billing binding を保持（残高・ロール合算なし）。email 一致だけでは移管せず、両 leg の明示 consent が必須。設計（共有アカウント / Workspace 単位 / personal Workspace 1つ）と矛盾なし。
• 計測: metered runner は dormant（completeRunMeasurement:false、local-native-only）。cgroup usage_usec 差分のみ、欠損は 0 扱いせず unavailable/pending。stored-service は pending intent → 確定、unknown ACK で再送・解放しない、owner 不明は inventory をブロック — 欠損・二重計上なし / fail-closed の方針どおり。
• staging→production: staging portal は auth-staging.takos.jp に host 固定、storage staging profile は TAKOSUMI_ENVIRONMENT=staging 以外を拒否。本番設定・default binding の追加なし。
• workflow 変更は runner-image-proof の choice input（standard / hosted-metered-v1）のみで、値は env 経由。
• 金額・課金ロジックの変更なし（docs のみ）。

Secret チェック

diff の credential 形状スキャンで該当した 12 箇所はすべて tests 配下の fixture-* 値または env 変数名で、実 secret の疑いなし。

マージ順・フォローアップ

• docs(accounts): propose group and context continuation policy #476（docs）とは docs/internal/README.md が重複するが merge-tree はクリーン。Compose private owner admission, identity, storage and metered runner #475 → docs(accounts): propose group and context continuation policy #476 の順を推奨。
• Compose private owner admission, identity, storage and metered runner #475 merge 後に superseded の feat: fence optional whole-store R2 writers and native inventory #469–Compose identity, metered-runner and storage sources with D1 74 Backup guards #474 を close。
• 実 review issuer / Financial・Hosted-intent・RP 受信 port / deployed custody qualification は未構成（予約前に拒否）。activation 前に別途レビューが必要。live migration / deploy はこの承認の範囲外です。