[happy-v587]

Which issue or RFC does this PR close?

Closes #2299.

Rationale for this change

Data accepted with ACCESS_MODE=disabled has no Artifact owner or Candidate owner attestation. Enabling enforcement preserves reads but blocks old Artifact updates with 403 and Candidate approval with 503 artifact_owner_pending. Administrators need explicit attribution and a check of the background Principal's permissions.

What changes are included in this PR?

• Add offline powercontext server access-ownership-migrate plan/apply, explicit ownership, Scope selection, maintenance confirmation, and a pre-switch --background-principal check.
• Add administrator HTTP ownership plan/apply and dry-run. Inventory merged and retired Artifacts, preserve identities and revisions, and report existing-owner and Candidate-attestation conflicts.
• Preserve pending and completed recovery evidence through both CLI and HTTP. External migration writes use durable owner recovery; a same-owner retry completes the original ownership audit before success. Preview does not replay work. Migration keys preserve their accepted form; oversized keys use SHA-256 over the complete ordered identity parts instead of exceeding the Access limit. Offline CLI test fixtures use POSIX database URLs, and Windows portability CI runs the affected pre-switch and recovery cases.
• Check every selected Scope's background contribution permission and existing Profile write authority, including after ownership gaps have been filled.
• Document both locales, synchronize HTTP/integration/Desktop contracts and DSH/Cindy distributions, classify the new Access operations in the E2E harness, and add a source-specific Desktop protocol qualification.

Are there any user-facing changes?

Administrators can preview and assign missing ownership before or after enabling enforcement. HTTP apply requires enforcement and server.admin. Background checks without an Access store return an explicit unavailable error; the offline command supports this check before enforcement.

Ownership assignments are immutable. Back up the database and select the correct Principal for each Scope before applying. Rolling back application code does not undo ownership assignments. The migration changes authorization metadata, preserves domain history, and uses the existing ownership recovery schema.

How was this change tested?

• uv run --frozen pytest -q tests/e2e/test_access_ownership_migration.py tests/e2e/test_owner_recovery_http.py tests/test_owner_recovery.py tests/e2e/test_recall_manifest.py tests/e2e/test_atomic_memory_description_upgrade.py — 67 passed. These cover ownership migration, external recovery/audit retry, long identities, the merged manifest API, and description upgrades.
• make contract-test — 56 passed. Python, integration and Desktop artifacts were regenerated from the combined OpenAPI; pnpm --dir desktop generate:check also passes with the installed OpenJDK on PATH.
• UV_NO_SYNC=1 make check — passed, including lock checks, the combined persistence compatibility review, hooks, type checks and 61 integration-manifest tests.
• make js-test cindy-test with Node 24.14.1 / pnpm 11.13.1 — passed, including 439 DSH unit tests, 9 DSH integration tests, 20 Cindy tests, package creation and committed-bundle drift checks.
• The complete default-feature native Rust suite, Rust formatting, frontend typecheck and all 132 frontend tests pass. The unchanged bundled-qualification regression failed for the unqualified combined digest, then passed after the real built-wheel protocol qualification.

The existing desktop/tests/real_server.py native harness passed all four SQLite HTTP/TLS connection modes on clean Server sources db9c8d6edc49166504b39e0d8038dd0082368dee. All 625 packaged runtime source files match that commit byte for byte, excluding generated version metadata. The immutable source/contract/wheel evidence is recorded under desktop/VALIDATION.md#server-db9c8d6e-protocol-qualification; historical qualification records retain their original identities.

Migration tests use temporary SQLite databases with fault-injected external relationship/audit delivery. Protocol qualification uses independent built-wheel Server processes on macOS ARM64. These results do not establish native Windows/Intel execution, installed Desktop UI/credential acceptance, seekDB/OceanBase upgrade acceptance or real spawned Worker migration acceptance. Windows CI retains the three offline path cases; new remote CI results are separate from local validation.

AI usage statement

Codex (GPT-6.1 and GPT-6 family models) assisted with implementation, code review, regression tests, documentation, and PR preparation. Validation commands and their results are listed above.

[hidb4ai]

Two reproducible ownership/recovery defects remain in the offline and external-store migration paths. Please address the inline findings before merging.

[AlexStocks]

@happy-v587 please fix the file confliction

[hidb4ai]

@happy-v587 Re-reviewed 1ca415f5. The previously reported ownership/audit and Windows-path defects are addressed. A merge probe against current master 90355b8e still reports conflicts in desktop/VALIDATION.md, desktop/src-tauri/src/transport/operations.json, desktop/ui/src/generated/operations.ts, and release/upgrade-support.json. Please integrate current master, regenerate the combined contracts, recheck the Desktop qualification and persistence digest, and complete Main, including the newly added Windows cases, before merging.

[hidb4ai]

@happy-v587 Re-reviewed cf6741eb. The previously reported ownership/audit and Windows-path defects are fixed, and the merge conflicts reported on 1ca415f5 are resolved. I found no further blocking defect in the reviewed ownership migration paths. The merged Desktop contract has a matching qualification record, and the persistence-policy declaration is consistent. Current-head Main and acceptance checks are still pending; please complete those, including the affected Windows cases, before merging.

[hidb4ai]

Two ownership-maintenance defects remain: the offline preview schedules processing work, and HTTP migration drops the originating audit context. Please address the inline findings before merging.

[happy-v587]

Rebased onto master 22090cd and handled the P2 custom-family recovery finding in 0b39db6.

• OwnerRecovery.inventory_gaps now accepts the family set that migration already derives from persisted Artifact-Family declarations, and a family without a process-local profile reports its evidence instead of raising. The offline CLI process therefore sees pending custom-family intents before any competing owner is written.
• Regression tests/e2e/test_artifact_plugins.py::test_offline_migration_reports_pending_custom_family_owner fails without the change (Bob applied, conflicts: []) and passes with it (exit 1, owner-recovery-pending, no Bob relation).
• Rebase conflicts resolved by restoring the branch-side contract artifacts (master 22090cd changed no OpenAPI path or schema) and unioning master's new managed-Ops rationale into release/upgrade-support.json; the persistence review digest is now e3cb455c (includes the migration change in src/powercontext/builtin/persistence).
• Validation: ownership and recovery suites 53 passed, plugin e2e 13 passed (one search-readiness test needed a rerun under load), upgrade gate 115 passed / 6 skipped, contract 61 passed, desktop contract 68 passed / 49 skipped, prek 11 hooks passed.

CI is running on 0b39db6.

[happy-v587]

CI is green on 0b39db6: 86 checks pass, 11 skipped, 0 failed, including the desktop matrix, managed-resource candidates and upgrade acceptance. The PR is MERGEABLE again after the rebase onto 22090cd.

[AlexStocks]

@happy-v587 I have approved this PR. please fix the file confliction.

[happy-v587]

Conflicts are resolved on 7f2f42da: the branch includes master 5032075a, and GitHub reports no merge conflicts.

Main run 41289931395 completed successfully on this exact head: all 18 workflow jobs passed, including OceanBase acceptance. The PR shows 19 successful checks including CLA, with no pending or failed checks. This run's job selection is the evidence for this head; previous runs have separate matrix results.

All eight review threads are resolved. GitHub still reports mergeStateStatus=BLOCKED; successful CI and conflict resolution do not override the remaining review or repository requirements.

[happy-v587]

@hireview001 @hidb4ai Please re-review current head e08cc47903e8c283cc165f22a3c44d33e3d38368.

The Handoff recovery-evidence gap, published-Handoff inventory gap, and static background-permission check are fixed. The static check also preserves revoked grants. All 11 review threads are resolved, with fix details and regression evidence in the relevant replies. Local ownership/authorization/recovery tests, contract checks, and make check pass.

The formal review-request action is unavailable to the current integration/account, so I am requesting re-review here.

[hidb4ai]

Re-reviewed 2ee2da386b93e621404a96ac701233452ab19fc0. The previous custom Artifact and Handoff attribution cases are fixed. Two confirmed P2 cases remain:

• Prompt Candidate migration skips recorded owner-recovery evidence and can persist competing attribution: #2304 (comment)
• Static background permission preview falsely rejects supported long Scope IDs: #2304 (comment)

Please address these before merging.

[AlexStocks]

[P1] 合并 master 后契约摘要再次前移，compatibility.json 没有同摘要记录，CI preflight 在本 head 失败

0ba2f199（merge: sync master into ownership migration，父 126244e9 + 252ecac0）把本行摘要写成 c1bbeb2a…，而 desktop/src-tauri/src/connections/compatibility.json 的 36 条记录里没有一条 contractSha256 等于它。按固定 OID 直接读 blob，三个提交的状态：

提交	本行 contractSha256	compatibility.json 条数	命中的记录
f369ea3e（本 PR 合并前的上一提交）	4aeefdd602a11ebe…	25	sqlite-atomic-581be595-v1
252ecac0（被并入的 master）	c90024304fa0430c…	32	sqlite-atomic-2d782c2a-v1
0ba2f199（本 head）	c1bbeb2af91794fd…	36	无

两个父提交各自自洽，第三个摘要是合并本身造出来的：合并后的契约（master 的 openapi 加上本 PR 新增的 170 行）与两边都不同，摘要因此重算，但资格记录没有跟着重跑。这不是 merge ref 的问题——上表读的是 head 树本身。

CI 同一处失败（job 125134104473，Main / CI preflight）：

tests/test_desktop_contract.py ..F                                       [100%]
E  AssertionError: The bundled Desktop contract has no qualified profile for save, search and exact reads.
1 failed, 61 passed in 37.68s
make: *** [Makefile:150: contract-test] Error 1

CI preflight 红之后 32 个 job 全部 skipped（tests (*) 八个、desktop-validation 全套、harness-validation、cindy-package、dsh-package 都在其中），Upgrade release gate（job 125143396119）也判红，原因是 SCOPE_RESULT: failure 且 UPGRADE_RESULT: skipped。也就是说本 head 当前没有任何行为测试在执行，desktop-validation 的四个平台都没有跑过。

修复方向：在合并后的 head 上按仓库既有流程重跑 desktop/tests/fixture_qualification.py --server-commit <sha> 与 real_server.py，把产出的 sqlite-atomic-<sha>-v1 记录追加进 compatibility.json 并同步 desktop/VALIDATION.md 指向新 id；本 PR 上一版（f369ea3e）已经做过一次同样的资格重跑，这次是合并 master 后没有重做。如果这 170 行 openapi 变更不属于本 PR 的范围，把它移出可以避免每次同步 master 都要重算摘要与资格。