[efraespada]

Refs #25. Add protected household/profile APIs and a current-authority browser administration controller for native Ingress and standalone deployments. Original receipts remain bound to the verified household even when current aggregate reads fail or are not permitted. The complete administration UI remains in progress.

Public alias and owner-private preferences have independent revisions and current original-action guards. Shared audit/events and ordinary roster projections omit private values, inferable fingerprints and masked linkage. Bounded HA reads stay outside SQLite locks; denied, unavailable and confirmed-absent source facts remain distinct and grant no authority.

The separate bounded journal and exact int64 HTTP codec support only five closed actions. The controller refreshes proof/current access before commands and original-result queries, binds private facts to the current member, rejects authority drift and fences late results. Commands preserve original payload/key/revision, persist before one send and reject stale/exhausted revisions or replacement of unresolved same-aggregate work.

Capability contract version 2 now provides the server-owned household routing ID, independently of aggregate-read permission. Facts and new/recovered/retained household receipts must match that scope. Legacy unbound capability version 1 and unknown versions fail closed; journal version 1 and all five command payloads remain unchanged. Recovery uses only protected key/ID GET without new aggregate-read, expected-revision or mutation-CSRF preconditions. Existing read-only outage leases retain those local reads until unchanged expiry, while new mutations remain blocked. There is no automatic lookup, resend, replacement or rebase.

Current source b60b7677c07faf62c534943c09748b70ad4a6408:

• 1,020 Chromium frontend executions; all 28 authored runtime files at 100% lines (1,242), statements (1,821), functions (361) and branches (1,313), independently audited.
• Hosted complete backend: 4,364 passed, 151 modules, 10,434 statements and 2,928 branches at 100% globally/per-module. Local complete and focused measurements are retained separately.
• Runtime/catalog and backend types, Ruff (374 files), 38 Node architecture-policy tests, three Python architecture contracts, documentation and unchanged original SDK validation pass. Actual new wheel matches every module and all four compiled entry resources. Both composed OpenAPI contracts are regenerated with exact int64 bounds.
• Tests first reproduce the valid foreign-household receipt finding. Positive controls preserve original lookup after reload without household.read. Both actual backends prove read-only original GET changes no database bytes. Distinct fixture-typo and sandbox socket failures are retained separately from the passing campaigns.

The valid scope-binding finding is independently confirmed fixed by current native review 41516134181/job125520053158: complete context, all 13/13 partitions, zero candidate/published/open/reopened/verification-required findings, fixed 3/dismissed 1 historical, outcome completed. No valid finding was manually resolved.

Current CI Check 41516134220 passes every applicable suite. Both actual CPU images pass all 32 container checks each; frontend also passes the actual 51 entry/Python/SQLite and 18 catalog journeys plus wheel acceptance. These entry journeys do not establish the unfinished administration UI. The separate progress-publication contract failure remains reported in copilot#828; merge is held under the latest all-green condition.

Remaining: browser composition/lifetime coordination, complete accessible EN/ES roster/settings/member/mapping/alias/preferences forms, Storybook and real administration Python/SQLite journeys, safe avatar-source feasibility and all retained acceptance. HADM 72/HADI 8 owner documents and all original 80 workspace rows remain unchanged; two independent scope/lookup cases raise the prospective workspace floor to 82. Unit counts and prior 51 entry/18 catalog journeys are not full administration acceptance.

Copilot code/resources/workflows/configuration/credentials/bounds, gateway, schema 9 DDL/history and installed owner Edge.5 are unchanged. No full workspace, owner adoption or Stable/all-domain release is claimed.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/domus~26

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on b60b767. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 2 potential problems when commit b14c308 was analyzed. This snapshot is historical; use the status block above for current state. 2 findings are linked to changed code.

Findings

• low: Migration guide link points to a missing file — docs/household-administration.md:27
• low: Revision maximum exceeds the supported int64 limit — docs/contracts/household-api.openapi.json:2003

[vypbot]

Bugbot: review complete

Current status: No active findings on b60b767.

Pull request · Verified commit · Workflow run

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on b60b767. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit f491b57 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• low: Accepts household receipts without verifying their household ID — frontend/src/application/administration-controller.ts:180

[efraespada]

PR #26 is now merged at 8b1cbc1. The merge tree 9386f2ea5249b5ea0c0bb4e83f814f503012be47 exactly matches reviewed head b60b767. Product CI, full supported coverage and native review with no unresolved findings passed; the owner-authorized exception applies only to the separately reported Copilot progress-publication failure (copilot#828).

The earlier description's merge-hold sentence records the previous state and is superseded by this verified merge. Complete unfinished administration work is retained in #27, including all 72 HADM / 8 HADI / 82 HADW cases, actual browser composition, accessible EN/ES forms and real administration journeys. The complete workspace and all-domain product remain unfinished. Copilot, gateway and the owner's installed Edge.5 remain unchanged.