# Wave 8A — People + AccountIdentity Boundary Validation

Date: 2026-08-04

## Scope and safety baseline

Wave 8A introduces ownership boundaries only for `AccountIdentity`, Clients,
Providers, and `ProviderMeta` reads. It does not alter models, indexes, route
registration, middleware order, endpoint contracts, feature-flag defaults, JWT
payloads, signup/login flows, or dashboard UI.

The frozen Auction model SHA-256 recorded before implementation is:

`ed06ce72c873bef1b32a47775f5d9acbb9f958ae2c9545481db4f842a946a04d`

## Discovery findings

- Public Auth routes retain the existing client/provider signup, sign-in,
  activation, code, password, and location paths.
- Authenticated Account routes remain:
  `POST /account/provider-request`, `POST /account/client-role`, and
  `POST /account/switch-mode`.
- `AccountIdentity` owns independent references to `Client`, accepted
  `Provider`, and pending `ProviderMeta`; no `_id` equality is assumed.
- `req.user` remains the resolved active profile and `req.authAccount` remains
  the linked identity when one exists.
- Account tokens resolve the database-authoritative active mode. Legacy tokens
  remain pinned to their original Client/Provider type.
- Provider mode remains unavailable to pending, rejected, blocked, deleted, or
  disabled providers.
- `AUTH_ACCOUNT_IDENTITY_SIGNUP_ENABLED` and
  `AUTH_ACCOUNT_IDENTITY_TOKEN_ENABLED` remain explicit opt-in flags and default
  to off.
- Account mode keeps its eight-field object-or-null contract. Client and
  Provider DTOs keep their existing public fields while excluding identity
  secrets and raw Mongoose documents.
- Legacy/unlinked and collision records are never auto-linked by read paths.

## Canonical ownership

- `src/modules/accounts/`: identity repository, resolution and mode
  orchestration, account access/mode policies, constants, and account-mode DTO.
- `src/modules/clients/`: Client repository/read service/access policy/DTO.
- `src/modules/providers/`: Provider + ProviderMeta read repository, Provider
  status/access policies, read service, and DTO.

The existing `src/services/accountAuthResolver.js`,
`src/services/accountModeService.js`, and
`src/helpers/validation/accountMode.rules.js` paths remain compatibility
delegates. The existing switch mutation and activation sync are owned by the
Accounts module only to preserve those delegates exactly; Wave 8A introduces no
new mutation.

## Contract evidence

- Focused AccountIdentity/Auth/People/architecture gate: 237/237 passed.
- Full repository suite: 1092/1092 passed.
- `node --check`: 383 changed/untracked JavaScript files passed.
- `git diff --check`: passed.
- Compatibility entries resolve to the same canonical singleton, classes, and
  policy objects.
- Read repositories/services contain no create/update/insert operations.
- Client, Provider, and accountMode DTO tests reject sensitive extra fields.
- Public-module boundary tests reject private cross-module imports.
- Mongoose registration uniqueness and frozen Auction ownership tests pass.
- Route, OpenAPI, Postman, model, and feature-flag source files were not changed
  by Wave 8A.
- Postman exported twice into isolated temporary directories: 108 requests,
  byte-identical SHA-256
  `c3404c019963ee43cdfca6ee5b00b770afd57b0bab63160afe5f3f18657e501e`.
- Secret-pattern scan: passed. Generated Postman metadata and screenshot paths
  remain absent from Git status.

## Remaining risks / next wave

- Legacy collision resolution and migration remain separate, explicitly
  approved work; no migration should be inferred from these boundaries.
- Role-add, provider approval, password ownership, and signup dual-write retain
  their current service implementations. A future Wave 8B may migrate those
  mutations one bounded contract at a time, with transaction and rollback
  snapshots, but must not combine that work with schema or auth redesign.