feat: Add verified household administration workspace (#27)

.github/workflows/ci_check.yml

@@ -240,11 +240,17 @@ jobs:
           enable-cache: false
       - run: uv sync --frozen
       - name: Build the installed immutable Edge.5 image for schema-7 compatibility
-        run: docker build --build-arg BUILD_ARCH=${{ matrix.arch }} -t domus-app-edge5 addon-edge
+        run: docker build --build-arg BUILD_ARCH=${{ matrix.arch }} -t domus-app-edge5 tests/fixtures/edge5-app
+      - name: Build the actual reviewed Edge preview installed by the Supervisor
+        run: docker build --build-arg BUILD_ARCH=${{ matrix.arch }} -t domus-app-edge addon-edge
       - name: Build the immutable published schema-8 image for profile migration compatibility
         run: >-
           docker build --build-arg BUILD_ARCH=${{ matrix.arch }}
           -t domus-app-schema8 tests/fixtures/schema8-app
+      - name: Build the immutable compatible schema-9 rollback application
+        run: >-
+          docker build --build-arg BUILD_ARCH=${{ matrix.arch }}
+          -t domus-app-schema9 tests/fixtures/schema9-app
       - name: Build the exact checked-out source and frontend
         run: >-
           docker build --file tests/fixtures/current-app/Dockerfile
@@ -270,8 +276,39 @@ jobs:
           DOMUS_PREVIOUS_IMAGE: domus-app-previous
           DOMUS_UPGRADE_IMAGE: domus-app-installed
           DOMUS_SCHEMA7_IMAGE: domus-app-edge5
+          DOMUS_EDGE_IMAGE: domus-app-edge
           DOMUS_SCHEMA8_IMAGE: domus-app-schema8
+          DOMUS_SCHEMA9_IMAGE: domus-app-schema9
         run: uv run pytest tests/containers --no-cov
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .node-version
+          package-manager-cache: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        with:
+          run_install: false
+          cache: false
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter @domus/frontend exec playwright install --with-deps chromium
+      - name: Execute administration in the actual isolated image from Chromium
+        env:
+          DOMUS_BROWSER_IMAGE: domus-app-ci
+          DOMUS_TEST_SOURCE_COMMIT: ${{ github.sha }}
+          DOMUS_TEST_ARCH: ${{ matrix.arch }}
+        run: >-
+          pnpm --filter @domus/frontend exec playwright test
+          -c playwright.entry.config.ts tests/e2e/administration.spec.ts
+      - name: Require all thirty-four actual-image administration journeys
+        run: >-
+          uv run python -c "import json; from pathlib import Path;
+          result=json.loads(Path('frontend/test-results/entry-results.json').read_text());
+          assert result['stats']['expected']==34 and result['stats']['unexpected']==0
+          and result['stats']['skipped']==0 and result['stats']['flaky']==0"
+
+      - name: Require no surviving image browser fixtures
+        run: >-
+          uv run python -c "import subprocess;
+          assert not subprocess.check_output('docker ps --all --quiet --filter label=domus.browser-fixture=true'.split()).strip()"
 
   aggregate:
     name: CI Check

addon-edge/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.0.0-edge.7
+
+- Require cold Supervisor backups so the app is stopped while its private SQLite data is copied.
+- Document the brief interruption and current-identity revalidation after restart.
+- Require explicit stop/backup/state-aware restart when capturing an older preview without this policy.
+- Preserve the Edge.6 immutable runtime, schema 9, UI bytes and existing permission scope.
+- Keep owner adoption, restore acceptance and required human UX verification pending.
+
+## 0.0.0-edge.6
+
+- Add the English/Spanish household administration workspace for roster, household, member,
+  HA mapping/profile, public alias and private preference changes.
+- Bind drafts and detached controls to the verified household; preserve exact original revisions
+  and require explicit recovery after an uncertain response.
+- Include SQLite schema 9 and verified upgrades from the installed Edge.5 schema-7 runtime.
+- Preserve original operation history through supported restoration and compatible application/data rollback.
+- Freeze Edge.5 independently and exercise the actual pinned Edge.6 image in both CPU jobs.
+- Retain the existing private listener, nonroot server and Core API permission scope.
+- Mark this configuration/schema boundary as breaking and pin the reviewed source/archive/payload.
+- Keep actual owner adoption, required human UX, remaining domains and complete Stable acceptance pending.
+
 ## 0.0.0-edge.5
 
 - Translate the technical membership status in both English and Spanish.

addon-edge/DOCS.md

@@ -35,7 +35,7 @@ it preserves later operation evidence without reapplying rolled-away effects. St
 restore preparation/activation. Inspect and resume the same activation ID after an uncertain result.
 The retained source-checkpoint supports deliberate rollback reconciled against the latest history.
 Do not switch root pointers or run an older image manually. See the
-[restoration guide](https://github.com/vypdev/domus/blob/271a3a07feb1535f0a5ec8b55abb3de9aac049a9/docs/restoration.md)
+[restoration guide](https://github.com/vypdev/domus/blob/3200bd9278f57f142ed03b54843a38a4138fc0af/docs/restoration.md)
 for the exact console commands. Restore is not available from the household entry interface.
 App removal with data
 deletion removes the app's private records; use deliberate operator backup procedures before removal.
@@ -49,6 +49,39 @@ Edge.5 keeps schema 7 and supports the same owned Edge.4 data without a schema t
 localizes the technical state as well as the main heading. Its reviewed immutable source is a new
 build; the previously published Edge.4 source pin is not changed.
 
+Edge.6 adds the household administration workspace and upgrades supported owned data to schema 9.
+An authorized participant can inspect permitted roster facts, review household/member/access-policy
+changes and manage their own private preferences. An optional alias changes presentation while the
+canonical HA account remains the identity. Each form preserves its independent original revision.
+A changed or missing verified household clears private drafts, including detached confirmation controls.
+Opening, translating or refreshing a view sends no household mutation.
+
+Edge.6 is listed in breaking_versions because it crosses the schema-9 boundary. Home Assistant
+requires attention before automatic updates install or cross a listed version; see its
+[app configuration reference](https://contributors.home-assistant.io/apps/reference/configuration/).
+Preserve a complete owned pre-upgrade checkpoint, installation marker and operation history.
+Restoring an earlier household state uses the schema-9 console workflow with the compatible runtime,
+retaining later original-operation evidence. A verified compatible application/data pair supports
+binary rollback. Old Edge.5 and earlier images refuse schema 9 without changing its files; choosing
+an earlier household snapshot does not make a schema-9 generation readable by those images.
+
+The [artifact declaration](artifact.json) fixes the reviewed source/archive and all 151 Python/four UI
+file fingerprints. Application CI builds the actual pinned installer image on amd64 and aarch64,
+checks those bytes, exercises its native restart/authority boundary and standalone UI, and runs
+the installed Edge.5 upgrade/replay/restore cycle. The separate current-source image retains its
+complete administration browser campaign. These fixtures use isolated owned data; actual owner
+adoption and required human UX are additional acceptance steps.
+
+Edge.7 retains the Edge.6 runtime/schema and declares `backup: cold`. Supervisor stops Domus while
+copying its private data, causing a brief interruption. In-memory sessions close; after restart,
+reopening the interface verifies the current HA identity. No backup hooks or data exclusions apply.
+See the [Supervisor backup policy](https://contributors.home-assistant.io/apps/reference/configuration/#backups).
+For an older preview without this declaration, explicitly stop it before a pre-update app backup,
+verify the stopped state and backup completion, and restart only if it was running beforehand.
+A readable archive/hash alone does not prove a consistent SQLite capture during concurrent writes.
+An app backup also does not preserve later operations by itself; use the console restoration protocol
+when reconciling newer original-operation evidence. Never replace a live data directory manually.
+
 The build fetches exact reviewed source, compiles with pinned Node/pnpm and includes the UI in the
 installed Python wheel. Node and browser test controls are absent from the runtime image. The
 interface uses the same private listener and accepted Ingress prefix; no extra port, credential,

addon-edge/Dockerfile

@@ -1,8 +1,8 @@
 # The Supervisor builds this folder. Fetch only the reviewed immutable runtime and UI.
 FROM ghcr.io/astral-sh/uv:0.11.29@sha256:eb2843a1e56fd9e30c7276ce1a52cba86e64c7b385f5e3279a0e08e02dd058fc AS uv
 FROM python:3.14.6-slim-trixie@sha256:7bec7ddcddeff7975d6ba9b4be7dd6f6b2f55e7491539145e2978f7f97ce9144 AS source
-ARG DOMUS_SOURCE_COMMIT=271a3a07feb1535f0a5ec8b55abb3de9aac049a9
-ARG DOMUS_SOURCE_SHA256=5cc9a963b6f064aa48be256a9d5a4274f8c52c878e4ad7f84517cd33f41056c8
+ARG DOMUS_SOURCE_COMMIT=3200bd9278f57f142ed03b54843a38a4138fc0af
+ARG DOMUS_SOURCE_SHA256=ca991d7b3560dbdb7a6a86a34eea19708f01f10c15da502e49ed8ab740a8533b
 ADD https://codeload.github.com/vypdev/domus/tar.gz/${DOMUS_SOURCE_COMMIT} /tmp/source.tar.gz
 RUN printf '%s  /tmp/source.tar.gz\n' "$DOMUS_SOURCE_SHA256" | sha256sum --check - \
     && mkdir /app \
@@ -24,9 +24,9 @@ RUN uv sync --frozen --no-dev --package domus-server --no-editable
 RUN .venv/bin/python -c "from pathlib import Path; import domus; from domus.entrypoints.ui_bundle import load_bundle; assert load_bundle(Path(domus.__file__).parent / 'ui') is not None"
 
 FROM python:3.14.6-slim-trixie@sha256:7bec7ddcddeff7975d6ba9b4be7dd6f6b2f55e7491539145e2978f7f97ce9144
-ARG BUILD_VERSION=0.0.0-edge.5
+ARG BUILD_VERSION=0.0.0-edge.7
 ARG BUILD_ARCH
-ARG DOMUS_SOURCE_COMMIT=271a3a07feb1535f0a5ec8b55abb3de9aac049a9
+ARG DOMUS_SOURCE_COMMIT=3200bd9278f57f142ed03b54843a38a4138fc0af
 LABEL io.hass.type="app" \
       io.hass.version="${BUILD_VERSION}" \
       io.hass.arch="${BUILD_ARCH}" \

addon-edge/README.md

@@ -3,11 +3,22 @@
 Development preview of Domus installed as a Home Assistant app. Open it through HA's Open Web UI;
 it uses your existing HA sign-in without another login.
 
-Edge 0.0.0-edge.5 packages the English/Spanish household entry interface: verified access, explicit
-household setup, own pending membership and original-request recovery. Technical status follows the
-selected language. It uses private SQLite schema 7 while retaining identity, household records and
-operation history; existing Edge.4 data remains compatible. The remaining domain
-screens and complete product acceptance remain under development. Set your Home Assistant browser
-origins in the app's Configuration tab before starting. It remains experimental, with no stable release.
-
-See [installation and permissions](DOCS.md).
+Edge 0.0.0-edge.7 includes the English/Spanish household administration workspace: participant roster,
+household settings, HA administrator mapping, member roles/ordinary permissions, public aliases
+and owner-private preferences. Reviewed changes retain exact revisions and original operation
+identity; a changed verified household retires private drafts. Saved preferences describe stored
+choices; notification delivery remains unavailable.
+
+Edge.7 also requests cold Supervisor backups: HA stops the app while copying its private data.
+The brief interruption closes in-memory sessions; reopening verifies the current HA identity.
+
+This version upgrades verified older data to SQLite schema 9. Preserve the original application/data
+checkpoint and use the documented compatible restore/rollback procedure. Existing identity,
+household records, history and original-operation evidence are retained. The installed Edge.5
+recipe is preserved separately as an immutable compatibility fixture.
+
+Set your Home Assistant browser origins in Configuration before starting. Edge remains experimental;
+the remaining domain screens, required human UX/owner adoption and complete Stable product are
+still in progress.
+
+See [installation and permissions](DOCS.md) and the [reviewed artifact declaration](artifact.json).