command_tower 0.12.0 → 0.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 478979c1e8cabe23c8a2b666d7d42ec610abef048a302f4e8e7a5b5b7d9d74b0
-  data.tar.gz: 82a5c9c35c78c0a22f1cddf038b203fd0d32433a78be139e386024971189fa05
+  metadata.gz: 5243f531ae8a96ca6373b331d30665a0417078f9b799ca0491c78a26231b639e
+  data.tar.gz: 6d6ed873a0a3012fd8b09b952be2b4a32652980fea5ba6871c8089ffdba71ade
 SHA512:
-  metadata.gz: 22fe0f30d9fdd950b976dfad3cb8818bd51eb7cb4877a550fa1c58de69092e8e99ca940dc0c244c9c0343fb8d875b6ea2730f929ac722da7bcc980dabc45d1f0
-  data.tar.gz: b5db99a8faa23f2a9d872cae17354f4f005525e5105db924b338778912164fa52cab8c4456cc8c9ea0f6baab4a9a72de44243d713f0d4fa20abadd032294ecde
+  metadata.gz: 94aa74a9fe97771c5b690db1fa00298dd551ba9a0a62430097a3ffac583e4be5c66198768e8262f670863533fa90d18ddc5ab89e34a64fd5967d00bbf550f93b
+  data.tar.gz: 57431bc097a11ea361fe5e56d7ef797a6c07afbd076219745a0687fb33d456e809bf693785eb7d794e0a0cf9443f414d78522dc742e8d8bd5219a508155ef41d

data/app/controllers/command_tower/me/account_controller.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Me
+    class AccountController < CommandTower::ApplicationController
+      include CommandTower::Auth::AuthenticationBoundary
+      include CommandTower::Auth::AuthorizationBoundary
+
+      before_action :authenticate_request!
+      before_action :authorize_request!
+
+      def destroy
+        deserialized = CommandTower::Deserializers::Me::DeleteAccountDeserializer.call(params)
+        return render_deserializer_errors unless deserialized.success?
+
+        result = CommandTower::Workflows::Me::DeleteAccountWorkflow.call(
+          current_user: current_user,
+          password: deserialized.input.password
+        )
+        render_application_result(result)
+      end
+
+      private
+
+      def render_deserializer_errors
+        render_application_result(
+          CommandTower::Workflows::WorkflowResult.failure(
+            errors: [CommandTower::Errors::ValidationError.new(details: { base: "Missing required fields" })],
+            http_status: :unprocessable_entity
+          )
+        )
+      end
+    end
+  end
+end

data/app/deserializers/command_tower/deserializers/me/delete_account_deserializer.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Deserializers
+    module Me
+      class DeleteAccountDeserializer < CommandTower::Deserializers::ApplicationDeserializer
+        Input = Data.define(:password)
+
+        def call(params)
+          password = params[:password]
+
+          if blank?(password)
+            return failure(errors: { message: "missing_required_fields" })
+          end
+
+          unless password.is_a?(String)
+            return failure(errors: { message: "invalid_field_types" })
+          end
+
+          success(Input.new(password:))
+        end
+
+        private
+
+        def blank?(value)
+          value.nil? || (value.is_a?(String) && value.strip.empty?)
+        end
+      end
+    end
+  end
+end

data/app/errors/command_tower/errors/auth/account_deleted_error.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Errors
+    module Auth
+      class AccountDeletedError < CommandTower::Errors::UnauthorizedError
+        def code
+          "account_deleted"
+        end
+
+        def message
+          "Account has been deleted"
+        end
+
+        def log_level
+          :info
+        end
+      end
+    end
+  end
+end

data/app/models/user.rb

@@ -33,8 +33,14 @@ require "securerandom"
 class User < CommandTower::ApplicationRecord
   has_secure_password
 
-  validates :username, uniqueness: true
-  validates :email, uniqueness: true
+  TOMBSTONE_EMAIL_DOMAIN = "@invalid.local"
+  TOMBSTONE_EMAIL_PREFIX = "deleted+"
+  TOMBSTONE_USERNAME_PREFIX = "deleted_"
+
+  scope :not_deleted, -> { where(deleted_at: nil) }
+
+  validates :username, uniqueness: { conditions: -> { not_deleted } }
+  validates :email, uniqueness: { conditions: -> { not_deleted } }
 
   ###
   # Serialize the roles column to check for inclusion easily
@@ -49,6 +55,18 @@ class User < CommandTower::ApplicationRecord
     "#{first_name} #{last_name}"
   end
 
+  def deleted?
+    deleted_at.present?
+  end
+
+  def self.tombstone_email_for(id)
+    "#{TOMBSTONE_EMAIL_PREFIX}#{id}#{TOMBSTONE_EMAIL_DOMAIN}"
+  end
+
+  def self.tombstone_username_for(id)
+    "#{TOMBSTONE_USERNAME_PREFIX}#{id}"
+  end
+
   def reset_verifier_token!
     value = SecureRandom.alphanumeric(32)
     update!(verifier_token: value, verifier_token_last_reset: Time.now)

data/app/serializers/command_tower/serializers/me/delete_account_response_serializer.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Serializers
+    module Me
+      class DeleteAccountResponseSerializer
+        def self.serialize(message:)
+          { message: message }
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/jwt/authenticate_user.rb

@@ -27,7 +27,7 @@ module CommandTower::Jwt
       return invalid_token if expires_at.nil?
 
       user = User.find_by(id: payload[:user_id])
-      if user.nil?
+      if user.nil? || user.deleted?
         log_warn("user_id [#{payload[:user_id]}] was not found. Cannot Continue")
         return invalid_token
       end

data/app/services/command_tower/services/admin/users.rb

@@ -12,7 +12,7 @@ module CommandTower
           validate :scope_context, is_a: [CommandTower::AdminScope::ScopeContext, NilClass], required: false
 
           def call
-            relation = ::User.order(id: :desc)
+            relation = ::User.not_deleted.order(id: :desc)
             relation = CommandTower::AdminScope::ApplyUsersNarrowing.call(
               relation:,
               scope_context:,
@@ -48,7 +48,7 @@ module CommandTower
           validate :scope_context, is_a: [CommandTower::AdminScope::ScopeContext, NilClass], required: false
 
           def call
-            relation = ::User.where(id:)
+            relation = ::User.not_deleted.where(id:)
             relation = CommandTower::AdminScope::ApplyUsersNarrowing.call(
               relation:,
               scope_context:,

data/app/services/command_tower/services/auth/email_availability.rb

@@ -16,7 +16,7 @@ module CommandTower
             return
           end
 
-          if ::User.exists?(email: normalized)
+          if ::User.not_deleted.exists?(email: normalized)
             context.valid = true
             context.available = false
             context.message = "Email is already registered"

data/app/services/command_tower/services/auth/plain_text/login.rb

@@ -9,7 +9,7 @@ module CommandTower
           validate :password, is_a: String, required: true, sensitive: true
 
           def call
-            user = User.where(username: identifier).or(User.where(email: identifier)).first
+            user = User.not_deleted.where(username: identifier).or(User.not_deleted.where(email: identifier)).first
             if user.nil?
               audit_login_failed(affected_user: nil, outcome: "unknown_identifier")
               invalid_credentials!

data/app/services/command_tower/services/auth/purge_user_associated_data.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class PurgeUserAssociatedData < CommandTower::Services::ApplicationService
+        validate :user, is_a: User, required: true
+
+        def call
+          purge_user_secrets!
+          purge_messaging_inbox!
+          purge_messaging_endpoints!
+          revoke_impersonation_sessions!
+        end
+
+        private
+
+        def purge_user_secrets!
+          UserSecret.where(user_id: user.id).delete_all
+        end
+
+        def purge_messaging_inbox!
+          item_ids = CommandTower::Messaging::Inbox::Scope.for_recipient(user.id).pluck(:id)
+          return if item_ids.empty?
+
+          CommandTower::Messaging::Inbox.bulk_delete(recipient_id: user.id, inbox_item_ids: item_ids)
+        end
+
+        def purge_messaging_endpoints!
+          return unless defined?(CommandTower::Messaging::Endpoint)
+
+          CommandTower::Messaging::Endpoint.where(user_id: user.id).find_each(&:destroy!)
+        end
+
+        def revoke_impersonation_sessions!
+          CommandTower::Services::Impersonation::TerminateOpenSessions.call(
+            actor_user_id: user.id,
+            reason: "revoked"
+          )
+
+          CommandTower::Impersonation::Session.open.where(target_user_id: user.id).find_each do |session|
+            CommandTower::Services::Impersonation::End.call(
+              session_id: session.id,
+              reason: "revoked"
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/auth/tombstone_user.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Auth
+      class TombstoneUser < CommandTower::Services::ApplicationService
+        validate :user, is_a: User, required: true
+
+        def call
+          if user.deleted?
+            context.user = user
+            context.changed = false
+            return
+          end
+
+          user_id = user.id
+          scrub_password = SecureRandom.hex(32)
+          user.assign_attributes(
+            deleted_at: Time.current,
+            first_name: "",
+            last_name: "",
+            email: User.tombstone_email_for(user_id),
+            username: User.tombstone_username_for(user_id),
+            phone_number: nil,
+            phone_number_validated: false,
+            email_validated: false,
+            roles: []
+          )
+          user.password = scrub_password
+          user.password_confirmation = scrub_password
+
+          unless user.save(validate: false)
+            context.fail!(
+              application_error: CommandTower::Errors::InternalError.new
+            )
+            return
+          end
+
+          user.reset_verifier_token!
+
+          context.user = user.reload
+          context.changed = true
+        end
+      end
+    end
+  end
+end

data/app/services/command_tower/services/me/capabilities.rb

@@ -15,14 +15,15 @@ module CommandTower
 
         def project
           {
-            editName: { enabled: true },
+            editName: { enabled: !user.deleted? },
             editUsername: { enabled: false },
             changeEmail: { enabled: false },
-            changePassword: { enabled: true },
-            editPhone: { enabled: sms_enabled? },
-            editPushover: { enabled: pushover_enabled? },
+            changePassword: { enabled: !user.deleted? },
+            editPhone: { enabled: sms_enabled? && !user.deleted? },
+            editPushover: { enabled: pushover_enabled? && !user.deleted? },
             logoutAllDevices: { enabled: false },
-            verifyEmail: { enabled: !user.email_validated }
+            verifyEmail: { enabled: !user.deleted? && !user.email_validated },
+            deleteAccount: { enabled: !user.deleted? }
           }
         end
 

data/app/services/command_tower/services/me/delete_account.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Services
+    module Me
+      class DeleteAccount < CommandTower::Services::ApplicationService
+        FIELD_KEYS = {
+          password: :password
+        }.freeze
+
+        validate :user, is_a: User, required: true
+        validate :password, is_a: String, required: true, sensitive: true
+
+        def call
+          if user.deleted?
+            context.fail!(
+              application_error: CommandTower::Errors::Auth::AccountDeletedError.new
+            )
+            return
+          end
+
+          reject!(password: "Incorrect password") unless user.authenticate(password)
+
+          infrastructure_failure = false
+
+          ActiveRecord::Base.transaction do
+            unless invoke_host_finalizer!
+              infrastructure_failure = true
+              raise ActiveRecord::Rollback
+            end
+
+            purge_result = CommandTower::Services::Auth::PurgeUserAssociatedData.call(user:)
+            unless purge_result.success?
+              infrastructure_failure = true
+              raise ActiveRecord::Rollback
+            end
+
+            tombstone_result = CommandTower::Services::Auth::TombstoneUser.call(user:)
+            unless tombstone_result.success?
+              infrastructure_failure = true
+              raise ActiveRecord::Rollback
+            end
+
+            user.reload
+            audit(
+              :account_deleted,
+              subject: user,
+              affected_user: user,
+              changes: {},
+              metadata: { mechanism: "self_service" }
+            )
+          end
+
+          if infrastructure_failure
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+            return
+          end
+
+          user.reload
+          unless user.deleted?
+            log_error("Account deletion transaction did not persist for user [#{user.id}]")
+            context.fail!(application_error: CommandTower::Errors::InternalError.new)
+          end
+
+          log_info("Account deleted for user [#{user.id}]")
+          context.message = "Your account has been deleted"
+        end
+
+        private
+
+        def invoke_host_finalizer!
+          finalizer = CommandTower.config.account_deletion.host_finalizer
+          return true if finalizer.nil?
+
+          outcome = finalizer.call(user:)
+          return true if outcome.nil?
+          return true if outcome.respond_to?(:success?) && outcome.success?
+
+          false
+        end
+
+        def reject!(errors)
+          details = errors.each_with_object({}) do |(key, message), mapped|
+            mapped[FIELD_KEYS.fetch(key.to_sym, key)] = message
+          end
+
+          context.fail!(application_error: CommandTower::Errors::ValidationError.new(details:))
+        end
+      end
+    end
+  end
+end

data/app/workflows/command_tower/workflows/me/delete_account_workflow.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Workflows
+    module Me
+      class DeleteAccountWorkflow < CommandTower::Workflows::ApplicationWorkflow
+        retry_strategy :none
+
+        def call(current_user:, password:)
+          delete_result = CommandTower::Services::Me::DeleteAccount.call(
+            user: current_user,
+            password:
+          )
+
+          unless delete_result.success?
+            error = delete_result.errors.first
+            return failure(
+              errors: delete_result.errors,
+              http_status: CommandTower::Workflows::Me::ErrorStatus.http_status_for(error)
+            )
+          end
+
+          success(
+            payload: CommandTower::Serializers::Me::DeleteAccountResponseSerializer.serialize(
+              message: delete_result.data[:message]
+            ),
+            http_status: :ok,
+            response_effects: { clear_token: true }
+          )
+        end
+      end
+    end
+  end
+end

data/config/routes.rb

@@ -60,6 +60,7 @@ CommandTower::Engine.routes.draw do
   namespace :me do
     patch "name", to: "name#update"
     patch "password", to: "password#update"
+    delete "account", to: "account#destroy"
 
     resources :inbox, only: [:index, :show, :destroy], controller: "inbox" do
       collection do

data/db/migrate/20260826140000_add_deleted_at_to_users.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class AddDeletedAtToUsers < ActiveRecord::Migration[7.2]
+  def change
+    add_column :users, :deleted_at, :datetime
+    add_index :users, :deleted_at
+  end
+end

data/docs/upgrades/0.12.0.md

@@ -9,7 +9,7 @@ Minor release: canonical action-intervention envelope ser/de, and Admin Scope re
 
 | Change | Host impact |
 |--------|-------------|
-| Intervention envelope | `CommandTower::Serializers::Intervention::EnvelopeSerializer` / `EnvelopeDeserializer` (plus blocker/remediation serializers). Canonical `{ action, allowed, blockers[] }` with ordered blockers; **no** presentation-mode fields. Host/CT FE owns `callout` / `intercept` / `sheet` / `blocking_region`. |
+| Intervention envelope | `CommandTower::Serializers::Intervention::EnvelopeSerializer` / `EnvelopeDeserializer` (plus blocker/remediation serializers). Canonical `{ action, allowed, blockers[] }` with ordered blockers; **no** presentation-mode fields. Host/CT FE owns `callout` / `intercept` / `sheet` / `blocking_region`. Optional blocker `severity` strings: prefer `CommandTower::Intervention::Severity` (`blocking`, `warning`, `informational`) — transport hints only; FE `tone` remains host-owned. |
 | Admin Scope hook requirements | Every `admin_scope.register` still requires `options`, `validate`, and `availability`. Resource-narrowing hooks (`narrow_users`, `narrow_audit`, `affected_users_in_scope`) are required for CT-owned **`users`** / **`audit`**, or whenever any narrowing hook is set. Host product tools may register the three base hooks only. |
 
 ## Host actions

data/docs/upgrades/0.13.0.md

@@ -0,0 +1,18 @@
+# CommandTower 0.13.0
+
+Account self-service deletion (CANON-020 / M1).
+
+## Host actions
+
+1. `rails command_tower:install:migrations` (adds `users.deleted_at`)
+2. `rails db:migrate`
+3. Grant `me_account` to authenticated member role in `config/rbac_groups.yml`
+4. Optional: register `config.account_deletion.host_finalizer` for product cleanup
+
+## API
+
+- `DELETE /api/me/account` — body `{ "password": "..." }`; clears session on success
+
+## RBAC
+
+New entity: `me_account` → `CommandTower::Me::AccountController#destroy`

data/docs/upgrades/0.13.1.md

@@ -0,0 +1,24 @@
+# Upgrade: CommandTower 0.13.1
+
+**From:** `0.13.0`  
+**To:** `0.13.1`
+
+Patch release: canonical host-authored intervention severity constants. No public HTTP or persistence break.
+
+## Host-visible changes
+
+| Change | Host impact |
+|--------|-------------|
+| `CommandTower::Intervention::Severity` | Named constants for optional blocker `severity` strings: `BLOCKING` (`"blocking"`), `WARNING` (`"warning"`), `INFORMATIONAL` (`"informational"`). Transport hints only — CommandTower does not serialize FE `tone`. Hosts map severity → `@commandtower/frontend` `ActionIntervention` tone. |
+
+## Host actions
+
+1. Bump gem to `0.13.1` (or `>= 0.13.1`).
+2. **No new migration.**
+3. Prefer `CommandTower::Intervention::Severity::*` when setting `BlockerSerializer` `severity:` instead of ad-hoc strings.
+4. Existing envelopes with free-form `severity` strings remain valid.
+
+## Not in this release
+
+- Frontend `ActionIntervention` `tone` (ships in `@commandtower/frontend` **v0.1.6**)
+- New HTTP routes or RBAC entities

data/docs/upgrades/README.md

@@ -4,6 +4,8 @@ Host-facing upgrade / change summaries for CommandTower releases.
 
 | Version | Summary |
 |---------|---------|
+| [0.13.1](0.13.1.md) | Canonical `Intervention::Severity` constants (`blocking`, `warning`, `informational`) |
+| [0.13.0](0.13.0.md) | Account self-service deletion (`DELETE /api/me/account`); tombstone + PII scrub; `me_account` RBAC; `users.deleted_at` migration |
 | [0.12.0](0.12.0.md) | Intervention envelope serializers/deserializers; product-tool admin_scope without Users/Audit narrowing |
 | [0.11.1](0.11.1.md) | Audit Event `attribute :json` (MariaDB); audit migration without `utf8mb4_0900_ai_ci` |
 | [0.11.0](0.11.0.md) | Execution context, audit ledger, Admin Workspace, principal capabilities, impersonation, Admin Users |

data/lib/command_tower/authorization/default.yml

@@ -25,6 +25,9 @@ entities:
   - name: me_password
     controller: CommandTower::Me::PasswordController
     only: update
+  - name: me_account
+    controller: CommandTower::Me::AccountController
+    only: destroy
   - name: me_inbox
     controller: CommandTower::Me::InboxController
     only:

data/lib/command_tower/configuration/account_deletion/config.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require "class_composer"
+require "command_tower/configuration/base"
+
+module CommandTower
+  module Configuration
+    module AccountDeletion
+      class Config < ::CommandTower::Configuration::Base
+        include ClassComposer::Generator
+
+        add_composer :host_finalizer,
+          desc: "Optional host-owned callable invoked synchronously during account deletion " \
+                "before the user row is tombstoned. Receives keyword `user:` (non-deleted User). " \
+                "Return value is ignored; raise to abort the deletion transaction.",
+          allowed: [Proc, NilClass],
+          default: nil,
+          default_shown: "nil"
+      end
+    end
+  end
+end

data/lib/command_tower/configuration/config.rb

@@ -2,6 +2,7 @@
 
 require "singleton"
 require "class_composer"
+require "command_tower/configuration/account_deletion/config"
 require "command_tower/configuration/admin/config"
 require "command_tower/configuration/admin_scope/config"
 require "command_tower/configuration/application/config"
@@ -91,6 +92,11 @@ module CommandTower
         allowed: Configuration::Messaging::Config,
         default: Configuration::Messaging::Config.new
 
+      add_composer :account_deletion,
+        desc: "Account self-service deletion host hooks",
+        allowed: Configuration::AccountDeletion::Config,
+        default: Configuration::AccountDeletion::Config.new
+
       add_composer :admin,
         desc: "Admin configuration for the app",
         allowed: Configuration::Admin::Config,

data/lib/command_tower/configuration/registry/audit/config.rb

@@ -64,6 +64,20 @@ module CommandTower
               affected_user_required: true,
               global_visible_in_host_scope: true
             },
+            account_deleted: {
+              label: "Account deleted",
+              tags: %w[identity account deletion security],
+              enabled: true,
+              enablement_configurable: false,
+              user_history: true,
+              sensitive_fields: [],
+              allowed_changes: [],
+              retention: :permanent,
+              subject_required: true,
+              subject_type: "User",
+              affected_user_required: true,
+              global_visible_in_host_scope: true
+            },
             email_verified: {
               label: "Email verified",
               tags: %w[identity verification email],

data/lib/command_tower/install/baseline.rb

@@ -14,6 +14,7 @@ module CommandTower
         20260816000001_create_command_tower_audit_events.rb
         20260817000001_add_scope_columns_to_command_tower_audit_events.rb
         20260817000003_create_command_tower_impersonation_sessions.rb
+        20260826140000_add_deleted_at_to_users.rb
       ].freeze
 
       module_function

data/lib/command_tower/intervention/severity.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module CommandTower
+  module Intervention
+    # Canonical blocker severity strings for host-authored action interventions.
+    # Transport-only: CT FE presentation (`tone`) is host-owned and is not
+    # serialized on the envelope. Hosts may map these severities to FE tones.
+    #
+    # - BLOCKING — policy / hard stop (typical FE tone: destructive)
+    # - WARNING — attention without framing as an error (typical FE tone: warning)
+    # - INFORMATIONAL — soft notice (typical FE tone: informational)
+    module Severity
+      BLOCKING = "blocking"
+      WARNING = "warning"
+      INFORMATIONAL = "informational"
+
+      ALL = [BLOCKING, WARNING, INFORMATIONAL].freeze
+    end
+  end
+end

data/lib/command_tower/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CommandTower
-  VERSION = "0.12.0"
+  VERSION = "0.13.1"
 end

data/lib/command_tower.rb

@@ -19,6 +19,7 @@ require "command_tower/configuration/config"
 require "command_tower/install/baseline"
 require "command_tower/install/doctor"
 require "command_tower/credential_resolution"
+require "command_tower/intervention/severity"
 require "command_tower/jwt/authorization_helper"
 require "command_tower/jwt/csrf_helper"
 require "command_tower/password_recovery/authorization_helper"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: command_tower
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.1
 platform: ruby
 authors:
 - matt-taylor
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-24 00:00:00.000000000 Z
+date: 2026-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: phonelib
@@ -209,6 +209,7 @@ files:
 - app/controllers/command_tower/auth/session_controller.rb
 - app/controllers/command_tower/auth/signup_session/create_controller.rb
 - app/controllers/command_tower/auth/username/availability_controller.rb
+- app/controllers/command_tower/me/account_controller.rb
 - app/controllers/command_tower/me/audit_events_controller.rb
 - app/controllers/command_tower/me/inbox_controller.rb
 - app/controllers/command_tower/me/name_controller.rb
@@ -251,6 +252,7 @@ files:
 - app/deserializers/command_tower/deserializers/failure.rb
 - app/deserializers/command_tower/deserializers/intervention/envelope_deserializer.rb
 - app/deserializers/command_tower/deserializers/me/change_password_deserializer.rb
+- app/deserializers/command_tower/deserializers/me/delete_account_deserializer.rb
 - app/deserializers/command_tower/deserializers/me/phone_verification/verify_deserializer.rb
 - app/deserializers/command_tower/deserializers/me/pushover/credentials_deserializer.rb
 - app/deserializers/command_tower/deserializers/me/update_name_deserializer.rb
@@ -272,6 +274,7 @@ files:
 - app/errors/command_tower/errors/account/pushover_verification_failed_error.rb
 - app/errors/command_tower/errors/account/sms_capability_unavailable_error.rb
 - app/errors/command_tower/errors/application_error.rb
+- app/errors/command_tower/errors/auth/account_deleted_error.rb
 - app/errors/command_tower/errors/auth/admin_unavailable_during_impersonation_error.rb
 - app/errors/command_tower/errors/auth/csrf_mismatch_error.rb
 - app/errors/command_tower/errors/auth/csrf_missing_error.rb
@@ -359,6 +362,7 @@ files:
 - app/serializers/command_tower/serializers/intervention/remediation_serializer.rb
 - app/serializers/command_tower/serializers/me/account_serializer.rb
 - app/serializers/command_tower/serializers/me/change_password_response_serializer.rb
+- app/serializers/command_tower/serializers/me/delete_account_response_serializer.rb
 - app/serializers/command_tower/serializers/me/pushover_serializer.rb
 - app/serializers/command_tower/serializers/messaging/inbox.rb
 - app/serializers/command_tower/serializers/messaging/preferences/catalog_serializer.rb
@@ -619,6 +623,7 @@ files:
 - app/services/command_tower/services/auth/password_reset/validate.rb
 - app/services/command_tower/services/auth/plain_text/login.rb
 - app/services/command_tower/services/auth/principal_capabilities/project.rb
+- app/services/command_tower/services/auth/purge_user_associated_data.rb
 - app/services/command_tower/services/auth/register.rb
 - app/services/command_tower/services/auth/signup_rate_limits/check_availability.rb
 - app/services/command_tower/services/auth/signup_rate_limits/check_register.rb
@@ -628,6 +633,7 @@ files:
 - app/services/command_tower/services/auth/signup_session/decode.rb
 - app/services/command_tower/services/auth/signup_session/encode.rb
 - app/services/command_tower/services/auth/signup_session/validate.rb
+- app/services/command_tower/services/auth/tombstone_user.rb
 - app/services/command_tower/services/auth/username_availability.rb
 - app/services/command_tower/services/impersonation/create.rb
 - app/services/command_tower/services/impersonation/end.rb
@@ -635,6 +641,7 @@ files:
 - app/services/command_tower/services/impersonation/terminate_open_sessions.rb
 - app/services/command_tower/services/me/capabilities.rb
 - app/services/command_tower/services/me/change_password.rb
+- app/services/command_tower/services/me/delete_account.rb
 - app/services/command_tower/services/me/pushover_product_gate.rb
 - app/services/command_tower/services/me/sms_product_gate.rb
 - app/services/command_tower/services/me/update_name.rb
@@ -708,6 +715,7 @@ files:
 - app/workflows/command_tower/workflows/impersonation/stop_workflow.rb
 - app/workflows/command_tower/workflows/me/change_password_workflow.rb
 - app/workflows/command_tower/workflows/me/clear_phone_workflow.rb
+- app/workflows/command_tower/workflows/me/delete_account_workflow.rb
 - app/workflows/command_tower/workflows/me/error_mapping.rb
 - app/workflows/command_tower/workflows/me/error_status.rb
 - app/workflows/command_tower/workflows/me/phone_verification/send_workflow.rb
@@ -739,6 +747,7 @@ files:
 - db/migrate/20260816000001_create_command_tower_audit_events.rb
 - db/migrate/20260817000001_add_scope_columns_to_command_tower_audit_events.rb
 - db/migrate/20260817000003_create_command_tower_impersonation_sessions.rb
+- db/migrate/20260826140000_add_deleted_at_to_users.rb
 - docs/admin_workspace.md
 - docs/api_reference.md
 - docs/architecture.md
@@ -765,6 +774,8 @@ files:
 - docs/upgrades/0.11.0.md
 - docs/upgrades/0.11.1.md
 - docs/upgrades/0.12.0.md
+- docs/upgrades/0.13.0.md
+- docs/upgrades/0.13.1.md
 - docs/upgrades/README.md
 - lib/command_tower.rb
 - lib/command_tower/admin_scope.rb
@@ -787,6 +798,7 @@ files:
 - lib/command_tower/authorization/effective_entity_grants.rb
 - lib/command_tower/authorization/entity.rb
 - lib/command_tower/authorization/role.rb
+- lib/command_tower/configuration/account_deletion/config.rb
 - lib/command_tower/configuration/admin/config.rb
 - lib/command_tower/configuration/admin_scope/config.rb
 - lib/command_tower/configuration/admin_scope/tool_registration.rb
@@ -845,6 +857,7 @@ files:
 - lib/command_tower/impersonation/establish_identity.rb
 - lib/command_tower/install/baseline.rb
 - lib/command_tower/install/doctor.rb
+- lib/command_tower/intervention/severity.rb
 - lib/command_tower/jwt/authorization_helper.rb
 - lib/command_tower/jwt/csrf_helper.rb
 - lib/command_tower/logging/lifecycle_declaration.rb