[happy-v587]

Which issue or RFC does this PR close?

Closes #2299.

Rationale for this change

Data accepted with ACCESS_MODE=disabled has no Artifact owner or Candidate owner attestation. Enabling enforcement preserves reads but blocks old Artifact updates with 403 and Candidate approval with 503 artifact_owner_pending. Administrators need explicit attribution and a check of the background Principal's permissions.

What changes are included in this PR?

• Add offline powercontext server access-ownership-migrate plan/apply, explicit ownership, Scope selection, maintenance confirmation, and a pre-switch --background-principal check.
• Add administrator HTTP ownership plan/apply and dry-run. Inventory merged and retired Artifacts, preserve identities and revisions, and report existing-owner and Candidate-attestation conflicts.
• Preserve pending and completed recovery evidence through both CLI and HTTP. External migration writes use durable owner recovery; a same-owner retry completes the original ownership audit before success. Preview does not replay work. Migration keys preserve their accepted form; oversized keys use SHA-256 over the complete ordered identity parts instead of exceeding the Access limit. Offline CLI test fixtures use POSIX database URLs, and Windows portability CI runs the affected pre-switch and recovery cases.
• Check every selected Scope's background contribution permission and existing Profile write authority, including after ownership gaps have been filled.
• Document both locales, synchronize HTTP/integration/Desktop contracts and DSH/Cindy distributions, classify the new Access operations in the E2E harness, and add a source-specific Desktop protocol qualification.

Are there any user-facing changes?

Administrators can preview and assign missing ownership before or after enabling enforcement. HTTP apply requires enforcement and server.admin. Background checks without an Access store return an explicit unavailable error; the offline command supports this check before enforcement.

Ownership assignments are immutable. Back up the database and select the correct Principal for each Scope before applying. Rolling back application code does not undo ownership assignments. The migration changes authorization metadata, preserves domain history, and uses the existing ownership recovery schema.

How was this change tested?

• uv run --frozen pytest -q tests/e2e/test_access_ownership_migration.py tests/e2e/test_owner_recovery_http.py tests/test_owner_recovery.py tests/e2e/test_recall_manifest.py tests/e2e/test_atomic_memory_description_upgrade.py — 67 passed. These cover ownership migration, external recovery/audit retry, long identities, the merged manifest API, and description upgrades.
• make contract-test — 56 passed. Python, integration and Desktop artifacts were regenerated from the combined OpenAPI; pnpm --dir desktop generate:check also passes with the installed OpenJDK on PATH.
• UV_NO_SYNC=1 make check — passed, including lock checks, the combined persistence compatibility review, hooks, type checks and 61 integration-manifest tests.
• make js-test cindy-test with Node 24.14.1 / pnpm 11.13.1 — passed, including 439 DSH unit tests, 9 DSH integration tests, 20 Cindy tests, package creation and committed-bundle drift checks.
• The complete default-feature native Rust suite, Rust formatting, frontend typecheck and all 132 frontend tests pass. The unchanged bundled-qualification regression failed for the unqualified combined digest, then passed after the real built-wheel protocol qualification.

The existing desktop/tests/real_server.py native harness passed all four SQLite HTTP/TLS connection modes on clean Server sources db9c8d6edc49166504b39e0d8038dd0082368dee. All 625 packaged runtime source files match that commit byte for byte, excluding generated version metadata. The immutable source/contract/wheel evidence is recorded under desktop/VALIDATION.md#server-db9c8d6e-protocol-qualification; historical qualification records retain their original identities.

Migration tests use temporary SQLite databases with fault-injected external relationship/audit delivery. Protocol qualification uses independent built-wheel Server processes on macOS ARM64. These results do not establish native Windows/Intel execution, installed Desktop UI/credential acceptance, seekDB/OceanBase upgrade acceptance or real spawned Worker migration acceptance. Windows CI retains the three offline path cases; new remote CI results are separate from local validation.

AI usage statement

Codex (GPT-6.1 and GPT-6 family models) assisted with implementation, code review, regression tests, documentation, and PR preparation. Validation commands and their results are listed above.

[hidb4ai]

Two reproducible ownership/recovery defects remain in the offline and external-store migration paths. Please address the inline findings before merging.

[AlexStocks]

@happy-v587 please fix the file confliction

[hidb4ai]

@happy-v587 Re-reviewed 1ca415f5. The previously reported ownership/audit and Windows-path defects are addressed. A merge probe against current master 90355b8e still reports conflicts in desktop/VALIDATION.md, desktop/src-tauri/src/transport/operations.json, desktop/ui/src/generated/operations.ts, and release/upgrade-support.json. Please integrate current master, regenerate the combined contracts, recheck the Desktop qualification and persistence digest, and complete Main, including the newly added Windows cases, before merging.

[hidb4ai]

@happy-v587 Re-reviewed cf6741eb. The previously reported ownership/audit and Windows-path defects are fixed, and the merge conflicts reported on 1ca415f5 are resolved. I found no further blocking defect in the reviewed ownership migration paths. The merged Desktop contract has a matching qualification record, and the persistence-policy declaration is consistent. Current-head Main and acceptance checks are still pending; please complete those, including the affected Windows cases, before merging.

[hidb4ai]

Two ownership-maintenance defects remain: the offline preview schedules processing work, and HTTP migration drops the originating audit context. Please address the inline findings before merging.

[happy-v587]

@hireview001 @hidb4ai Please re-review current head e08cc47903e8c283cc165f22a3c44d33e3d38368.

The Handoff recovery-evidence gap, published-Handoff inventory gap, and static background-permission check are fixed. The static check also preserves revoked grants. All 11 review threads are resolved, with fix details and regression evidence in the relevant replies. Local ownership/authorization/recovery tests, contract checks, and make check pass.

The formal review-request action is unavailable to the current integration/account, so I am requesting re-review here.

[hidb4ai]

Re-reviewed 2ee2da386b93e621404a96ac701233452ab19fc0. The previous custom Artifact and Handoff attribution cases are fixed. Two confirmed P2 cases remain:

• Prompt Candidate migration skips recorded owner-recovery evidence and can persist competing attribution: #2304 (comment)
• Static background permission preview falsely rejects supported long Scope IDs: #2304 (comment)

Please address these before merging.

[happy-v587]

@hidb4ai Please re-review the ownership-migration changes. All review threads are now resolved, including the Prompt Candidate recovery preflight and long-Scope permission-preview fixes in 126244e9.

At 8544da90, the Python 3.11–3.14 unit/e2e matrix, all four Desktop platforms, and the selected upgrade acceptance matrix passed. The remaining CI failures were two SeekDB jobs cancelled by the 30-minute job deadline while migration cases continued passing. 26b169e6 gives their sequential checks a 60-minute total budget while preserving existing step and native-process deadlines. A fresh CI run is starting.

The formal re-review request API returned 404 because this account has read-only access to the upstream repository, so I am requesting re-review here.

[hidb4ai]

The ownership fixes are being revalidated. The newly qualified Desktop contract leaves the current setup guidance pointing at a disabled historical profile; please correct the guidance before merging.

[hidb4ai]

The Desktop qualification guidance is corrected. One P2 remains: on strict MySQL-compatible storage the long-Scope background plan can report ready even though static bootstrap cannot persist its key. See #2304 (comment). Please address this before merging.

[happy-v587]

Fixed the Python 3.11 CI failure in commit 0ba4f70. The test child writes its PID to a temporary file and atomically renames it to ready, so the parent cannot read a partially written PID.

Validation passed locally: tests/test_native_command.py (22 passed) and make check (including 61 integration checks). The commit is pushed, and CI run 41698931373 has started.

[happy-v587]

@hidb4ai Please re-review the current head 0ba4f70. It fixes the Python 3.11 test race by atomically publishing the child PID. The focused file has 22 passing tests and make check passes locally. GitHub Actions run 41698931373 is still queued before preflight, so remote CI has not produced a result yet.

[happy-v587]

@hidb4ai CI is now complete on current head 0ba4f70: 91 checks succeeded, 12 were skipped, and none failed or were cancelled. The Python 3.11 native-command regression is included. All review threads are resolved. Please re-review and update the review decision when ready.

[hidb4ai]

LGTM