Handoff: RET-USER-user-service-quarantine user-service retirement quarantine

Scope

• Service/area: deprecated user-service compatibility scaffold
• Task pack: docs/agents/service-tasks/user-service-retirement.md
• Goal: accept the bounded retirement/quarantine guard evidence for services/user-service while IAM/Profile remain the canonical owners.
• Non-goals: deleting services/user-service, promoting default auth/profile routes, moving runtime manifests, creating new user-service work, or changing legacy source under /Users/velikho/Desktop/WORKING/HOCTAPAZ/.

Docs Read

• go-platform/docs/architecture/service-responsibility-matrix.md
• go-platform/docs/agents/service-agent-closeout-ledger.json
• go-platform/docs/agents/service-tasks/user-service-retirement.md
• go-platform/docs/agents/agent-handoff-format.md
• go-platform/services/user-service/README.md

Legacy Evidence Read

• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/auth/auth.controller.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/auth/auth.service.ts
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/prisma/schema.prisma
• Existing compatibility scaffold under go-platform/services/user-service/**.
• Legacy source was read-only evidence only; no legacy files were changed.

Files Changed

• go-platform/docs/agents/handoffs/RET-USER-user-service-quarantine.md
• go-platform/docs/agents/service-agent-closeout-ledger.json
• go-platform/docs/agents/service-agent-closeout-ledger.md
• go-platform/scripts/test/service-agent-closeout-ledger-coverage.sh

Behavior Implemented

• none in this handoff.
• Existing audited user-service runtime emits quarantine headers on successful and not-found responses: Deprecation: true, X-Hoctapaz-Service-Status: deprecated-compatibility, X-Hoctapaz-Canonical-Identity-Service: iam-service, and X-Hoctapaz-Canonical-Profile-Service: profile-service.
• Existing service marker GET /v1 returns status=deprecated-compatibility.
• Existing docs route all new authentication, credential, session, role, permission, invite, organization membership, and profile work to iam-service or profile-service, not user-service.

Tests And Verification

• Command: GOTOOLCHAIN=go1.25.11 go test ./services/user-service/... -count=1
• Result: passed.
• Evidence: user-service HTTP tests passed, including deprecated compatibility headers on success and missing-profile responses.
• Command: GOTOOLCHAIN=go1.25.11 go test ./services/profile-service/... ./services/iam-service/... -count=1
• Result: passed.
• Evidence: replacement IAM/Profile service tests passed in the same turn.
• Command: make test-profile-routes test-auth-routes
• Result: passed.
• Evidence: default profile/auth routes stayed legacy; native profile/auth examples passed route coverage; profile/auth live/browser/rollback smoke scripts passed self-test mode.

Route State

• Legacy route: default public auth/profile compatibility routes remain legacy-proxied through deploy/gateway/routes.json.
• Native route: replacement work is owned by iam-service and profile-service; user-service is not promoted as a native owner.
• Gateway state: no route table was changed by this handoff.
• Rollback: keep deploy/gateway/routes.json active. Do not add user-service to default runtime or route tables unless an explicit rollback-only compatibility incident requires it.

Data Notes

• Tables touched: none in this handoff run.
• Migration run: none.
• Validation report: not applicable because no data was migrated or backfilled.

Risks / Blockers

• This handoff quarantines the scaffold; it does not delete the code directory.
• Runtime removal still requires gateway, Compose/K8s/migrator inventory, backfill parity, and rollback evidence.
• Default auth/profile cutover remains gated by the IAM/Profile populated-target proof chain.

Next Step

• Run a final closeout audit across the service-agent ledger and IAM/Profile default-cutover packs to identify any remaining proof gaps before considering the broad goal complete.