Account merge: ledger, Heimdall mover client, crash-safe saga (merge design cuts A+B+saga)

heimdall commented

2026-11-14 02:32:02 +00:00

Member

Ledger (suspension standing, atomic commit, unique index vs overlapping merges, sweeper), Heimdall identity-move client and fake, and the Confirm/Move/Commit/Undo saga with stable moveId. Soul: cut-merge-saga.s1 (not clean) then cut-merge-saga.s2 clean at 757ca2e. Not deployed; deploy list section 10. Open Lows: cut-merge-saga.s2.digest-pair-binding-unpinned, cut-merge-mover-client.s2.auth-clients-follow-redirects. Member notices and pages are later cuts.

🤖 Generated with Claude Code

Ledger (suspension standing, atomic commit, unique index vs overlapping merges, sweeper), Heimdall identity-move client and fake, and the Confirm/Move/Commit/Undo saga with stable moveId. Soul: cut-merge-saga.s1 (not clean) then cut-merge-saga.s2 clean at 757ca2e. Not deployed; deploy list section 10. Open Lows: cut-merge-saga.s2.digest-pair-binding-unpinned, cut-merge-mover-client.s2.auth-clients-follow-redirects. Member notices and pages are later cuts. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

heimdall added 2 commits

2026-11-14 02:32:02 +00:00

Test: snapshot has no drift from the design-time model (passes at base 425af74) ee700d4931

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge ledger: AccountMerge receipt, reductions, alias standing, undo and final sweep 84ff2c4578

AccountMergeLedger owns what a merge does to Bifrost records: PlanAsync (dry run, block codes),
CommitAsync (one save, total, idempotent), UndoLocalAsync (journal replay), FinalizeDueAsync
(AccountMergeSweeper) and StandingAsync/ResolveAsync. Votes and concept appraisals are voided by a
stamp that a model query filter hides from every tally. The actor accessor no longer ORs several
credentials under SingleOrDefault (a latent crash); a frozen or folded account resolves to no
account on every route, the OIDC authorize and chat refusal deny it, and patron intake follows the
alias. Migration AddAccountMerges is additive. No UI, no Heimdall call, nothing deployed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall added 2 commits

2026-11-14 04:13:55 +00:00

Account merge ledger: fix the first Soul pass (suspension carried into a memberless survivor, merged status terminal, standing at the desk door, linked accounts and write time, journalled grace intake, survivor weight on moved votes, one-hop alias, State token and database guards for overlapping merges, live-Postgres tests) f402eb13cc

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge ledger: link step refuses a frozen account (test), drop the redundant sync guard, accept a deadlock victim as the racing commit's loser aa348d3b43

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall added 2 commits

2026-11-14 05:23:20 +00:00

Account merge ledger: roll-forward-only Down guard, standing-at-write through one owner for every writer, one current Patron snapshot per membership, memberless Heimdall sign-in, intake and Stripe routing through one owner 537a477dc3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge ledger: test the migration's duplicate current Patron snapshot dedupe 10fc9803d7

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall changed title from ~~WIP: Account merge ledger (stacked merge saga, cut 1 of N; final PR opened later)~~ to Account merge: ledger, Heimdall mover client, crash-safe saga (merge design cuts A+B+saga)

2026-11-14 09:42:49 +00:00

heimdall added 15 commits

2026-11-14 09:42:49 +00:00

Heimdall identity-move client: closed Moved/Refused/Unknown outcome b54cf27101

POST /v1/apps/bifrost/identity-moves under the app secret (HeimdallAuthService.ConfigureClient,
same header redaction), 15 s timeout, request validated to the contract's closed body before any
I/O, 200 trusted only as a whole receipt answering this request. HeimdallRefusal gains ReadAsync
(code plus safe proof side and provider); CodeAsync delegates to it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Fake Heimdall mover and consumer-side move client tests fbb5853b1d

FakeHeimdall.Moves owns per-account logins, a bearer registry, revoked sessions and stored moves,
and answers the identity-moves route in decideMove's order (4fe367a): replay before proofs,
strict passkey coverage, freshness windows, first-receipt replay. Fault switches for status,
apply-then-fail and down.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Fake mover: port Heimdall 4fe367a's route schema and decision order 13ab2e3be7

400 for every body the route schema rejects (oneOf toProof/reversesMoveId, duplicate or empty
identityIds, proof bounds), 404 identity_not_found for a source holding nothing, coverage-all-null
403 before the store, store order not_reversible/already_moved/not_found/not_proved/provider_conflict,
replay by signature without liveness (409 move_id_conflict for unsigned proofs), future-dated proofs
stale. Soul's P1-P4 are committed as FakeHeimdallMoverTests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Move client: no redirects, one deadline over body reads, 64 KiB receipt cap, 409 move_id_conflict is Unknown baa70bcef0

A 3xx is Unknown and never carries the secret or proofs off origin (registration owns the handler);
the HttpClient timeout now bounds the body read and any IOException or stall is Unknown; receipts
over 64 KiB are Unknown; the request's ToString hides its proofs; move_id_conflict is Unknown because
a committed move answers it when its proofs no longer verify, which keeps the sealed proofs resumable;
identity ids need not be GUIDs, proofs are bounded to 8192 and identityIds unique.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Move client: Refused only for Heimdall's coded move refusals, any pipeline exception is Unknown, ids end at \z 1ffb8886c0

An uncoded 4xx (gateway 404, 408, 410, unknown code) is Unknown: Refused wipes sealed proofs. Unrecognized leaves the refusal enum.
The catch lists no types: only the caller's cancellation propagates. moveId and reversesMoveId patterns use \z in client and fake,
so a trailing line feed is refused as Heimdall's ajv refuses it; 64, 65 and newline are pinned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Move client: a 400 is RequestInvalid only with Heimdall's invalid_request body b7b33bc5db

An nginx HTML 400, an empty 400 or any other 400 is Unknown. The fake answers its schema 400 with Heimdall's error handler body.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge mover client (heimdall/account-merge-mover-client b7b33bc) into account merge ledger 41189e14d3

Move client: pin that invalid_request at 413 and 415 is Unknown, the rule is exactly 400 5df08bd94a

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge ledger: one write gate for every writer, held across the standing read and the save f726101207

WriteAsAsync takes a shared Postgres advisory lock on the account (the key the chain trigger locks exclusively) across the standing read and the writer's save; CommitAsync takes the exclusive lock before it reduces. Votes, appraisals, sealed commit and reveal, patron events (RecordSupportEventAsync routes and journals in the same save, so the manual Ledger door obeys it too) and the Heimdall sign-in pass through it; SupportTargetAsync, MayWriteAsync and JournalIntakeAsync are deleted. A folded or frozen account's sign-in writes no membership. A retry of an event stranded on the folded account journals nothing. Tests: Down refuses in every merge state, Stripe journal prior owner and undo, the lock racing a freeze and a commit on live Postgres. Docs say what the lock guarantees and what it does not.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge ledger: pin the Stripe refusal for a folded account whose survivor is suspended c62166c6ce

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge saga: Confirm with consent record and sealed proofs, one crash-safe step function for the Heimdall move and reversal, one merge loop cdf64b2a10

AccountMergeSaga is the only caller of the move client and the only writer of Confirmed, HeimdallMoved, Failed, UndoRequested and HeimdallReversed; the
ledger keeps Committed, Final and Undone. Migration AddAccountMergeSaga adds the saga columns and the two move-id keys; its Down is roll-forward only.
AccountMergeSweeper becomes the one loop: saga advance, then finalize, every 30 s.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge saga: consumer tests through the real host and the fake mover, live-Postgres races, docs 41f4cc3853

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Move client: pin duplicate identityIds and over-length proofs as refused before any request b47a6557cb

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge saga: pin that a receipt mismatch stays the recorded answer across later sweeps a2172349ba

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Account merge saga: plan digest ignores the id of a membership not yet created, pin grace boundary, unique move ids and the confirm write gate, ProofSeal prints no bearer, commit the mutant probe 757ca2eeab

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

heimdall merged commit 2d9eb868bf into main

2026-11-14 09:42:49 +00:00

heimdall referenced this pull request from a commit

2026-11-14 09:42:50 +00:00

Merge pull request 'Account merge: ledger, Heimdall mover client, crash-safe saga (merge design cuts A+B+saga)' (#86) from heimdall/account-merge into main

Rows
Columns

Account merge: ledger, Heimdall mover client, crash-safe saga (merge design cuts A+B+saga) #86