Phase 7.5 — Identity, accounts and product users

[b5463]

Part of Milestone D — Paid Products. Ref: #27

Adds the central identity, account, product-user, and integration-webhook subsystem defined in V4_IDENTITY_LICENSING_ADDITION.md. Connects verified commerce state to actual product access across three integration modes.

---

Alex tasks

Tables

• accounts, account_emails, account_sessions, account_links
• product_users, product_user_links
• seats, seat_assignments
• signing_keys_metadata
• integration_clients, integration_credentials
• integration_webhook_endpoints, integration_webhook_deliveries

Identity modes

• Mode A — Acronym Identity: OIDC/OAuth 2.1 Authorization Code + PKCE for browser/native clients. Product receives stable subject ID and minimal approved claims.
• Mode B — Bring-your-own-identity (BYOI): product sends scoped external_user_id, SYSTEMS. stores product-user record and optional identity link. Product passwords and profiles remain outside SYSTEMS.
• Mode C — Licence-only: key/link binds to installation/device or optional account, no general login identity required.

Account rules

• Email is mutable contact/login attribute, not primary identifier
• Account merge is audited, never implicit from matching email alone
• One customer may link to multiple accounts and product users
• Products receive only claims/scopes needed for their function

Entitlement resolver (full multi-grant)

• Cancelling one grant must not revoke access provided by another valid source
• Handles: order + subscription + trial + manual + promo overlap
• Effective states: pending, trial, active, grace, read_only, suspended, expired, denied

Offline and degraded operation

• Ed25519 asymmetric signed licence leases with offlineUntil, key ID, features, and subscription state
• Clock-rollback/tampering detection
• Degraded access modes: read-only, export-only
• Lease refresh policy and expiry handling

Devices and seats

• Privacy-minimised device ID (no unrestricted hardware fingerprinting)
• Device activation limits with self-service reset
• Seats: assignable units within multi-user entitlements with invitation and release flows

Integration webhooks (outbound — for entitlement changes)

• Signed webhook delivery to products on access changes
• Retry with exponential backoff
• Idempotency and deduplication
• Dead-letter routing and failure handling
• POST /api/integration-webhooks/acknowledge endpoint

New APIs

• POST /api/identity/authorize and POST /api/identity/token (OIDC flows)
• POST /api/product-users/upsert and POST /api/product-users/link-account
• POST /api/entitlements/batch-check
• POST /api/integration-webhooks/acknowledge

Server SDK responsibilities

• Credential handling
• Local entitlement cache
• Signature verification
• Webhook verification and deduplication

Runbooks

• Emergency key-rotation runbook

---

Tomas tasks

• Dashboard — new Customers area with sub-sections: Accounts, Product Users, Entitlements, Licences, Activations, Access Incidents
• Admin actions UI: grant complimentary/time-limited access, extend grace, replace/revoke licence, reset device, assign/release seat, resend redemption link, reconcile with Stripe, export entitlement evidence
• Product-user analytics dashboard (active users, registered users, entitlement state breakdown per product)
• SDK documentation and integration guide for Mode A, B, and C

---

Exit gate

• Hosted product can authenticate a user via Acronym Identity (Mode A)
• External product can report product users via BYOI (Mode B)
• Desktop product can redeem and activate a licence without an account (Mode C)
• Multi-grant resolver correctly computes access when multiple sources overlap
• Offline lease works when SYSTEMS. is unreachable
• Device limit enforced and self-service reset works
• Entitlement change triggers signed webhook delivery to product
• All actions audited

Rollback

Disable identity and product-user endpoints. Commerce and legacy entitlement checks continue independently.