# Wave 8B.1 — AccountIdentity Signup Ownership Validation

Date: 2026-08-04

## Scope

Wave 8B.1 moves only the existing feature-flagged AccountIdentity signup
dual-write orchestration behind the canonical `src/modules/accounts/` public
boundary. It changes ownership, not behavior.

The following contracts remain frozen:

- `AUTH_ACCOUNT_IDENTITY_SIGNUP_ENABLED` defaults to off.
- The off path performs no AccountIdentity lookup, write, session, or
  transaction and retains the legacy Client and Provider signup writes.
- Client dual-write creates AccountIdentity plus Client only.
- Provider dual-write creates AccountIdentity plus pending ProviderMeta only;
  Provider is not created before admin approval.
- Profile and identity identifiers are independent references.
- Existing conflict keys, status mapping, response envelopes, transactions,
  rollback, and session cleanup remain unchanged.
- No migration, collision repair, backfill, or legacy auto-link occurs.
- Login, Passport, JWT, token storage, role-add, provider approval,
  switch-mode, and password ownership are outside this wave.

## Canonical ownership

- `application/account-signup.service.js` owns normalization, conflict
  orchestration, transaction boundaries, and safe runtime result handling.
- `infrastructure/account-signup.repository.js` owns the four-model reads and
  the three approved dual-write persistence operations.
- `domain/account-signup.constants.js` owns conflict classifications, i18n
  message keys, and the runtime-sensitive field allowlist.
- `src/modules/accounts/index.js` exposes lazy public getters for the canonical
  singleton, class, error type, and error predicate.
- `src/services/accountIdentitySignupService.js` is a logic-free compatibility
  adapter to that public entry.

`src/services/providerSignupSubjectResolver.js` remains in place. It is a
read bridge used by activation, login, and location validation as well as the
signup rollout, so moving it was unnecessary for this bounded mutation wave.

## Contract evidence

- Baseline focused gate before edits: 68/68 passed.
- Final focused Auth/Account/architecture gate: 76/76 passed.
- Full repository test suite: 1100/1100 passed across 24 suites.
- Changed/untracked JavaScript syntax gate: 389 files passed `node --check`.
- `git diff --check`: passed.
- Worktree accountability and architecture boundary tests: passed.
- Secret-pattern scan on Wave 8B.1 files: passed.
- Generated Postman/export and screenshot status: clean.
- Frozen model, Auth/Account route, Auth validation, and OpenAPI hashes match
  the pre-change baseline.
- Auction model SHA-256 remains:
  `ed06ce72c873bef1b32a47775f5d9acbb9f958ae2c9545481db4f842a946a04d`.

## Remaining work

Role-add, provider approval, and canonical password ownership remain behind
their current services. They should be migrated as separate bounded waves:

1. Wave 8B.2 — Account role-add ownership (`provider-request`, `client-role`).
2. Wave 8B.3 — Provider approval bridge ownership.
3. Wave 8B.4 — Password ownership and token invalidation ownership.

None of those behaviors is changed or inferred by Wave 8B.1.