IAM/Profile Backfill Populated Smoke

Scope

This smoke proves the IAM/Profile backfill loader against an isolated Postgres fixture. It applies IAM/Profile target migrations, seeds representative legacy auth/profile rows, runs the confirmed migrator run --service iam-profile-backfill --confirm, checks postload reconciliation, and validates UUID shadow views.

The organization reconciliation is limited to records mapped by this backfill in migration_id_map. IAM bootstrap organizations created by target schema migrations are intentionally not treated as missing legacy records.

This is fixture evidence only. It does not approve default /api/auth*, profile, or KYC route promotion.

Run

Parser/self-test:

cd go-platform
IAM_PROFILE_BACKFILL_POPULATED_SELF_TEST=1 make test-iam-profile-backfill-populated

Hermetic populated fixture smoke with artifacts:

cd go-platform
IAM_PROFILE_BACKFILL_POPULATED_CONFIRM=populated-fixture \
IAM_PROFILE_BACKFILL_POPULATED_ARTIFACT_DIR=output/qa/iam-profile-backfill-populated-$(date +%Y%m%d-%H%M%S) \
make test-iam-profile-backfill-populated

The script removes its isolated Postgres container by default. Set IAM_PROFILE_BACKFILL_POPULATED_KEEP=1 only when debugging a failed run.

Latest Local Proof

On 2026-07-13, the populated fixture smoke passed with artifacts under:

output/qa/iam-profile-backfill-populated-20260713-1038/

Artifact files:

• backfill-run.json
• iam-schema-up.json
• profile-schema-up.json

The run report recorded:

• command=run, service=iam-profile-backfill, status=partial.
• 4 legacy User source rows.
• IAM owner run rowsWritten=63 into hoctapaz_iam_db, including one legacy organization while ignoring the target-only bootstrap organization.
• Profile owner run rowsWritten=17 into hoctapaz_profile_db.
• iam_reconcile_identities: sourceRows=4, targetRows=4, matched=true, issueCount=0, rejectedRows=0.
• profile_reconcile_users: sourceRows=4, targetRows=4, matched=true, issueCount=0, rejectedRows=0.
• iam_reconcile_staff_permission_scopes: sourceRows=0, targetRows=0, matched=true, proving the legacy fixture has no explicit staff per-account permission-scope rows to infer.
• profile_reconcile_teacher_profiles and profile_reconcile_parent_students both matched with zero issues.

The script also checked iam_uuid_shadow_validation and profile_uuid_shadow_validation after loader writes.

Same-Target Validation

The 2026-07-13 fixture run retained its isolated target only long enough to run the read-only live-populated validation with the required migrator report, UUID primary-key readiness, UUID primary-key promotion status, and UUID foreign-key validation. The artifacts are under:

output/qa/iam-profile-target-validation-20260713-1783939084132/

The run recorded 22 matched reconciliation items, completed IAM and Profile migration checkpoints with hashes, zero UUID and orphan-reference issues, and validated 26 IAM plus 10 Profile UUID foreign keys. The temporary Postgres container was removed after the checks.

Cutover Boundary

Use this smoke as loader and schema compatibility evidence only. Default route promotion still requires production-like populated target validation with the captured run report, UUID readiness/FK/promotion checks on the same target DSNs, gateway/browser proof through api-gateway, and rollback evidence.