Handoff: SVC-003-default-auth-cutover-proof-bundle iam-service default auth cutover proof bundle

Scope

• Service/area: iam-service
• Task pack: docs/agents/service-tasks/iam-profile-default-cutover-proof.md
• Goal: package the bounded default-auth candidate evidence while keeping default gateway routing and production promotion gated.
• Non-goals: editing deploy/gateway/routes.json, broad auth write-route promotion, credential migration, or changes to legacy source.

Docs Read

• docs/architecture/service-responsibility-matrix.md
• docs/agents/service-tasks/iam-service.md
• docs/agents/service-tasks/iam-profile-default-cutover-proof.md
• docs/qa/iam-profile-default-cutover-proof.md
• docs/qa/iam-profile-target-validation-smoke.md
• docs/qa/service-agent-goal-completion-audit.md
• docs/agents/service-agent-next-slice-closeout-ledger.json

Legacy Evidence Read

• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/auth/**
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/api/src/modules/app-data/**
• /Users/velikho/Desktop/WORKING/HOCTAPAZ/node-platform/apps/web
• Legacy source was read-only evidence only.

Files Changed

• go-platform/docs/agents/handoffs/SVC-003-default-auth-cutover-proof-bundle.md
• go-platform/docs/agents/service-agent-next-slice-closeout-ledger.json
• go-platform/docs/agents/service-agent-next-slice-closeout-ledger.md
• go-platform/docs/agents/service-agent-accepted-handoffs.md

Behavior Implemented

• The candidate boundary remains limited to auth-google-config and auth-me; broad auth, admin, fallback, profile, and KYC routes remain legacy-backed.
• Candidate diff, gateway live, browser, and rollback rehearsals remain review-only artifacts and do not modify the default route table.
• IAM remains the owner of credentials, sessions, JWT/JWKS, roles, permissions, organization membership, and security events.
• The 2026-07-10 same-target fixture validation proves local backfill and UUID metadata behavior, but is explicitly not production-like target evidence.

Tests And Verification

• GOTOOLCHAIN=go1.25.11 go test ./services/iam-service/...
  • Passed in the current readiness run.
• IAM_SERVICE_POSTGRES_TEST_DATABASE_URL=postgres://... GOTOOLCHAIN=go1.25.11 go test ./services/iam-service/internal/repository -run TestPostgresIAMUUIDShadowDualWriteIntegration -count=1
  • Not run; no production-like DSN was configured.
• make test-auth-routes
  • Passed; native auth route guards remain non-default.
• make test-iam-profile-route-rollback
  • Passed as a static/non-default rollback rehearsal.
• make test-iam-profile-default-cutover-proof-bundle
  • Self-test/runtime guard passed; the resulting fixture bundle is not cutover-grade.
• make test-iam-profile-default-cutover-review-artifact
  • Correctly rejects the self-test bundle.
• IAM_PROFILE_DEFAULT_CANDIDATE_ISOLATED_CONFIRM=disposable-populated make test-iam-profile-default-candidate-isolated
  • Passed on 2026-07-14 with a fresh four-account owner-data backfill, IAM runtime, candidate Gateway/browser evidence, and a separate rollback Gateway. The artifact is output/qa/iam-profile-default-candidate-isolated-20260714-014803-522/; it explicitly remains disposable, non-default evidence.
• Required evidence: migrator run-report evidence is present only for the local same-target fixture rehearsal; candidate review is present under output/qa/iam-profile-default-candidate-diff-20260710-071914/; browser and rollback-after-candidate proof remain non-default candidate artifacts.

Route State

cutover gated; default IAM/Profile promotion requires populated-target proof bundle, browser proof, candidate review, and rollback proof

deploy/gateway/routes.json remains unchanged with broad auth, admin, and fallback on legacy_proxy.

Risks / Blockers

• Production-like populated target validation with a required migrator run-report is not attached.
• Candidate authenticated session restoration and a complete promotion-bound browser bundle remain open.
• Rollback-after-candidate evidence is not a production promotion approval.
• The fixture/self-test bundle must not be labeled production-like.

Next Step

Run the proof bundle against redacted production-like IAM/Profile DSNs with IAM_PROFILE_LIVE_VALIDATION_REQUIRE_RUN_REPORT=1, then attach matching candidate, browser, gateway, and rollback artifacts before any human route promotion review.