No way to provision households, members or identities except manual SQL #7

New Issue

2026-10-01T22:50:35Z

KofTwentyTwo commented

2026-10-01 22:50:35 +00:00

(Migrated from github.com)

Summary

CarlFamilyAccess.find(issuer, subject) resolves a verified principal by joining carl_identity to carl_member (src/main/java/com/kof22/carlai/domain/CarlFamilyAccess.java:28-40). Nothing in src/main or any migration inserts into carl_household, carl_member or carl_identity. The QQQ member table is registered without insert, update or delete capabilities (CarlMetadata.java:256). docs/OPERATOR-RUNBOOK.md:11 tells the operator to insert rows with psql.

Impact

A fresh deployment rejects every principal until an operator hand-writes SQL for the household, each member, each identity mapping and the initial permissions. There is no audited, validated path, no way to rotate an identity subject, and no test of first-run onboarding. This is a prerequisite for #4 (running the real UI with Authentik).

Suggested resolution

Add an ADMIN-only governed QQQ process (or a bootstrap CLI like the foundation's DatabaseBootstrap) that creates a household, members and issuer/subject identity rows with validation, permission-epoch bump and audit, plus a test that a fresh database can be onboarded through it.

Priority rationale

P1: blocks real use by anyone other than the person who wrote the schema.

Filed from the 2026-10-01 real-versus-fake audit of Carl (branch feature/cicd-liquibase-gitops, HEAD 5414d7a, main 1b334d1). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

## Summary `CarlFamilyAccess.find(issuer, subject)` resolves a verified principal by joining `carl_identity` to `carl_member` (`src/main/java/com/kof22/carlai/domain/CarlFamilyAccess.java:28-40`). Nothing in `src/main` or any migration inserts into `carl_household`, `carl_member` or `carl_identity`. The QQQ member table is registered without insert, update or delete capabilities (`CarlMetadata.java:256`). `docs/OPERATOR-RUNBOOK.md:11` tells the operator to insert rows with psql. ## Impact A fresh deployment rejects every principal until an operator hand-writes SQL for the household, each member, each identity mapping and the initial permissions. There is no audited, validated path, no way to rotate an identity subject, and no test of first-run onboarding. This is a prerequisite for #4 (running the real UI with Authentik). ## Suggested resolution Add an ADMIN-only governed QQQ process (or a bootstrap CLI like the foundation's `DatabaseBootstrap`) that creates a household, members and issuer/subject identity rows with validation, permission-epoch bump and audit, plus a test that a fresh database can be onboarded through it. ## Priority rationale P1: blocks real use by anyone other than the person who wrote the schema. --- Filed from the 2026-10-01 real-versus-fake audit of Carl (branch `feature/cicd-liquibase-gitops`, HEAD `5414d7a`, main `1b334d1`). Four read-only reviews covered domain and services, QQQ metadata and data model, tests/CI/evidence, and docs/integrations. A local offline build of a Carl copy against the installed foundation 0.5.0-SNAPSHOT is in progress; its result will be added as a comment. Existing issues #3, #4 and #5 (real Monarch accounts, Authentik with real data, CI/CD with Liquibase and ArgoCD) are referenced rather than duplicated.

This repo is archived. You cannot comment on issues.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/carl#7