Identity moves: sanctioned mover (auth_at claims, identity_moves, POST /v1/apps/{app}/identity-moves) #16
2026-11-14
Identity moves: pin reversal-vs-reversal replay at the route and document the identityIds replay ruling
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Identity moves: pin Soul's mutation survivors, delete resolveAccount, lock order owned by the code
Tests now kill M09, M11, M14, M17, M18, M19, M21, M23, M28, M29, M31 (each re-run by hand). The account locks are taken one statement each in sorted order, so dropping the sort is observable (M01) instead of planner-dependent. resolveAccount had no caller and answered wrongly after a chain of moves: deleted with its docs claim; the alias test inside moveIdentities stays. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Identity moves: service contract, architecture, bifrost profile docs and changelog line
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Identity moves: POST /v1/apps/{app}/identity-moves, consumer-side tests and live-PG races
The route verifies proofs (resolveBearer, proofTier, proofCovers), maps the store's refusals to fixed codes, and writes the revocation receipts and audit. Tests drive it over HTTP; the store contract runs on memory and live Postgres; opposite concurrent moves over two pools never deadlock. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Identity moves: auth_at/auth_identity_id claims, proofTier, identity_moves table and moveIdentities on both stores
proofTier is the one freshness rule (unlink now reads it); the sign_in callback stamps auth_at and auth_identity_id; moveIdentities is the only writer that changes linked_identities.account_id, decided by one shared decideMove. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>