@modelprofile.com/authswitch 7.0.0 → 8.0.0

package/readme.md

@@ -92,8 +92,8 @@ digests and sealed values, while managed Codex reports durable, in-memory and ob
 state independently with fixed problem categories. Continue each independent cursor to inspect
 the complete inventory. Pages are later observations rather than one atomic global snapshot,
 and the authority metadata revision is not a change clock for every native-home record. If the
-management socket is unavailable, an offline caller must leave database and admission state
-unknown instead of starting the database to inspect it.
+management socket is unavailable, an offline caller must leave the database state unknown
+instead of starting the database to inspect it.
 
 The authority CLI uses that daemon surface without constructing the legacy native harness adapters:
 
@@ -176,7 +176,7 @@ both status requests and publication, and revalidate the exact credential and co
 source even when serving a cached result. Native grants are never refreshed by the daemon.
 Pending, quarantined, setup-token-without-profile-scope and other unsupported contexts
 return explicit unavailable status without a provider request. Production native home
-adoption still requires the separate verified migration and backup cutover.
+adoption still requires the separate verified migration cutover.
 
 `AuthSwitchClient.startPreuse()` accepts one client-generated operation UUID and one exact
 OpenAI account/login/purpose. The daemon resolves an access-only grant, optionally reads the
@@ -187,8 +187,6 @@ marker remains `outcome_unknown` and is never replayed. Before-marker refusals a
 Only the request hash, selected model, timing and safe token counts are stored; the prompt,
 generated prose and credentials are absent from persistence and management responses. Account
 removal and targeted reauthentication refuse while that account has an active preuse request.
-Historical restore marks every unresolved preuse receipt `outcome_unknown`, including snapshots
-captured before the marker, because the original authority may have sent after snapshot capture.
 
 A trusted in-process daemon host can call `AuthSwitchAuthorityDaemon.startManagedCodex()`
 for a bound account and workspace. It owns a private Codex 0.155.1 app-server, passes only
@@ -226,27 +224,25 @@ The backend-only Claude native handoff journals an exact two-file write and tran
 ownership between two account grants in one SmartData transaction. An inactive Claude
 grant is refreshed by the daemon only after a durable pre-send marker; pending, native,
 and quarantined grants cannot enter that exchange. A native home and incoming grant
-require source-mapped migration receipts with backup metadata. The ledger field does
-not itself verify a SmartBucket backup, so the default daemon does not configure a
-Claude native home or run this path against real credentials. One-time migration and
-backup verification must precede production activation. Handoff receipts are queryable
-after a lost response. `runningEffectiveAuth: unsupported_effective_auth` means the
-native store changed, while an already-running Claude process's effective login cannot
-be proven externally; qualified live native-store switching still works.
-
-The authority database uses one versioned collection registry for startup preparation,
-ordered backup capture and exact restore readback. Startup rejects unknown collections,
-unknown metadata schemas and an incomplete restored database. Published 6.4/6.5 metadata
-is upgraded in place while account IDs, sealed grants, enrollments and uncertain states
-remain intact. A restored database keeps a durable closed-admission marker across restart;
-the daemon refuses provider and runtime work until a separate ownership-reconciliation
-step can prove it safe to open. Backup capture pins its paged records in one SmartData
-transaction and stages each retry anew before any SmartBucket publication. The closed
-restore rehearsal runs in a separate package-owned child, keeps its temporary source and
-record stream encrypted, restores metadata closed before any other record, then stops and
-reopens the same disposable database for exact stored readback. A receipt is issued only
-after the child has closed and its temporary root has been removed. This rehearsal does
-not perform a production restore or authorize a new authority instance to take ownership.
+require a verified import receipt: a migration ledger row that binds the exact source
+digest to one account and grant. A source counts as migrated only after such a verified
+import. Nothing in this package writes that ledger yet, so the default daemon does not
+configure a Claude native home or run this path against real credentials. Handoff
+receipts are queryable after a lost response.
+`runningEffectiveAuth: unsupported_effective_auth` means the native store changed, while
+an already-running Claude process's effective login cannot be proven externally;
+qualified live native-store switching still works.
+
+The authority database admits exactly the collections of one registry and prepares each
+at startup. Startup rejects unknown collections, unknown metadata schemas and an existing
+store without its metadata document. Published 7.0.0 metadata is upgraded in place to the
+shape 6.4/6.5 already wrote, while account IDs, sealed grants, enrollments and uncertain
+states remain intact. A 7.0.0 store that a restore had marked closed is refused, not opened.
+Startup also removes the backup digest that 6.4.0 to 7.0.0 stored on native handoff and
+migration ledger rows, and refuses a store holding a record only the retired backup and
+restore system could have written.
+The store is deliberately not backed up: its refresh grants are sealed to this host's TPM,
+so a lost store is recovered by one device re-login per account.
 
 ## Usage
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@modelprofile.com/authswitch',
-  version: '7.0.0',
+  version: '8.0.0',
   description: 'Manage Codex, OpenCode and Claude Code accounts with guided switching and live usage status'
 }

package/ts/authority-contract.ts

@@ -169,8 +169,6 @@ export interface IAuthSwitchDoctorPage {
   database: {
     state: 'available';
     observedAt: string;
-    schemaVersion: 2;
-    admission: 'open' | 'closed_restored';
     epoch: string;
     revision: number;
   };
@@ -229,7 +227,7 @@ export interface IAuthSwitchPreuseOperation {
   result: { inputTokens: number | null; outputTokens: number | null; totalTokens: number | null } | null;
   problem: 'none' | 'target_unavailable' | 'access_unavailable' | 'catalog_unavailable'
     | 'account_busy' | 'cancelled' | 'authority_closing' | 'interrupted'
-    | 'request_uncertain' | 'restored_history_uncertain';
+    | 'request_uncertain';
   createdAt: string;
   updatedAt: string;
   finishedAt: string | null;

package/ts/classes.authoritybroker.ts

@@ -131,7 +131,6 @@ export class AuthSwitchAuthorityBroker {
   public notifyChanged(): void { this.publish(); }
 
   public async start(): Promise<void> {
-    await this.database.assertOpenAdmission();
     const probe = plugins.crypto.randomBytes(32);
     const probeId = idHash('authswitch-custody-probe-v1');
     try {
@@ -199,7 +198,6 @@ export class AuthSwitchAuthorityBroker {
 
   public async refreshDueAccounts(): Promise<void> {
     if (this.closed) return;
-    await this.database.assertOpenAdmission();
     for (const state of ['ready', 'retry_wait'] as const) {
       let after: string | null = null;
       while (true) {
@@ -664,7 +662,6 @@ export class AuthSwitchAuthorityBroker {
   private async resolveManagedAccess(readView: () => Promise<{
     account: IStoredAuthorityAccount; grant: IStoredAuthorityGrant;
   }>, minValidityMs: number, rejectedGrantGeneration?: number): Promise<IAuthSwitchResolvedAccess> {
-    await this.database.assertOpenAdmission();
     for (let attempt = 0; attempt < 4; attempt++) {
       const { account, grant } = await readView();
       if (account.removed || grant.accountId !== account.id || grant.id !== account.primaryGrantId
@@ -732,7 +729,6 @@ export class AuthSwitchAuthorityBroker {
 
   private async performRefresh(accountId: string, minValidityMs: number,
     rejectedGrantGeneration?: number): Promise<void> {
-    await this.database.assertOpenAdmission();
     const initial = await this.database.readAccountAndPrimaryGrant(accountId);
     const initialGrant = initial.grant;
     if (!initial.account || initial.account.removed || !initialGrant || initialGrant.purpose !== 'openai_managed'

package/ts/classes.authoritycli.ts

@@ -289,7 +289,7 @@ const renderDoctorPage = (page: IAuthSwitchDoctorPage, pageNumber: number): stri
   const lines = [
     `Authority doctor page ${pageNumber} — observed ${safe(page.observedAt)}`,
     `  daemon=${safe(page.daemon.state)}; Claude native authority=${safe(page.daemon.claudeNativeAuthority)}; observed=${safe(page.daemon.observedAt)}`,
-    `  database=${safe(page.database.state)}; admission=${safe(page.database.admission)}; schema=${page.database.schemaVersion}; revision=${page.database.revision}; observed=${safe(page.database.observedAt)}`,
+    `  database=${safe(page.database.state)}; revision=${page.database.revision}; observed=${safe(page.database.observedAt)}`,
     `  accounts: ${page.accounts.length} stored evidence record(s); live provider check not performed`,
     `  logins: ${page.logins.length} stored evidence record(s); live provider check not performed`,
   ];

package/ts/classes.authoritydaemon.ts

@@ -79,10 +79,7 @@ export class AuthSwitchAuthorityDaemon {
     this.broker = new AuthSwitchAuthorityBroker(this.database, { ...options.broker, provider });
     this.usage = new AuthSwitchAuthorityUsage({
       ...options.usage,
-      readContext: async (accountId, loginId) => {
-        await this.database.assertOpenAdmission();
-        return this.database.readUsageContext(accountId, loginId);
-      },
+      readContext: (accountId, loginId) => this.database.readUsageContext(accountId, loginId),
       resolveAccess: (context, rejectedGrantGeneration, minValidityMs) =>
         this.broker.resolveUsageAccess(context, rejectedGrantGeneration, minValidityMs),
       resolveClaudeLogin: (context, rejectedGrantGeneration, minValidityMs) => {
@@ -450,8 +447,8 @@ export class AuthSwitchAuthorityDaemon {
       observedAt,
       daemon: { state: this.closing ? 'closing' : 'ready',
         claudeNativeAuthority: this.claudeNative ? 'configured' : 'not_configured', observedAt },
-      database: { state: 'available', observedAt: stored.observedAt, schemaVersion: stored.meta.schemaVersion,
-        admission: stored.meta.admission, epoch: stored.meta.epoch, revision: stored.meta.revision },
+      database: { state: 'available', observedAt: stored.observedAt,
+        epoch: stored.meta.epoch, revision: stored.meta.revision },
       accounts: stored.accounts.map(account => ({ id: account.id, providerId: account.providerId,
         removed: account.removed, statusObservedAt: account.statusObservedAt,
         evidence: 'stored', liveCheck: 'not_checked' })),
@@ -491,7 +488,6 @@ export class AuthSwitchAuthorityDaemon {
     if (this.managementServer || this.runtimeServer) throw new Error('Authswitch authority daemon is already started.');
     await this.database.start();
     try {
-      await this.database.assertOpenAdmission();
       await this.broker.start();
       await this.preuse.start();
       if (this.claudeNative) await this.claudeNative.start();
@@ -566,7 +562,6 @@ export class AuthSwitchAuthorityDaemon {
       let runtime: AuthSwitchManagedCodex | undefined;
       let claimed = false;
       try {
-        await this.database.assertOpenAdmission();
         const home = input.codexHomeDirectory;
         const parent = plugins.path.dirname(home);
         const parentStat = await plugins.fs.promises.lstat(parent);