[SergioTCG]

Scope

Implements owner-confirmed provider/email identities, stable account/group IDs, exact channel ceilings, alias deduplication, atomic revision/CAS enrollment, group CRUD and membership/preferences, drain/retire lifecycle, JSON-safe owner CLI/API, and revision-bound Slack account controls.

Adds isolated full Claude/Codex logins and native inactive-profile refresh under exclusive launch-fencing leases. Subscription quota reads are separate from ccusage. Sticky selection, headroom/reservations, reset refresh, conservative switch-back, and exact idle-session handovers are opt-in; default mode remains off.

Safety and review consolidation

Two read-only automated review passes completed. Concrete findings were fixed with regressions: provider-switch/fresh/automation route bypasses; uncertain handover input/resume fences and exact reconciliation; pre/post replacement identity verification; observational shadow launch and legacy switching; native Codex auth-store mismatch; idle reservations; Slack block bounds; and explicit same-target recovery after failed adoption. A real unused Claude quota window with no reset timestamp is now represented explicitly, without inventing reset proof.

Existing live checkout and daemon have NOT been changed, rolled, restarted, or duplicated. No real enrollment, credential, state, transcript, or personal account data is included. No manifest change is needed.

Validation

• npm ci
• npm run audit: zero production vulnerabilities
• npm test: 690 passed
• npm run check
• node --check for all daemon/channel/scripts mjs files
• PI_OFFLINE=1 pi --extension ./pi/sab-extension.ts --list-models
• full AGENTS.md ShellCheck invocation
• isolated scripts/smoke-pi-managed.mjs: complete, no live Slack connection
• read-only real default Claude/Codex identity/quota probes, no inference or credential writes

Rollout gates

Draft pending the controlled maintenance/canary boundary. Start with shadow; retain a known-good rollback tag and private config backup. Full OAuth login for additional scope-limited Claude accounts and bidirectional idle native-resume proofs are still required before automatic rotation. Instant active/delegated quota-blocked continuation is intentionally NOT implemented: current bridge contracts do not prove safe native checkpoints/background-job ownership, so active turns/tasks are never interrupted or replayed. No unrestricted unattended-rotation release is claimed.

Operational details and acceptance matrix: docs/account-pools.md.

[SergioTCG]

Final candidate verification for 396a303:

• 690 local tests passed; complete AGENTS.md validation passed, audit zero vulnerabilities, and the isolated managed-Pi smoke finished successfully.
• Exact-head GitHub CI passed on Node 20 and Node 24; ShellCheck passed.
• Two automated read-only review passes were consolidated. All concrete findings were fixed and regression-tested; no further speculative review expansion was added.
• Feature worktree is clean and pushed. Primary checkout and live daemon were not modified or restarted.
• No production enrollment, binding correction, credential migration, account rotation, Slack manifest change, or final release was performed.

This remains a gated rollout candidate: controlled shadow mode first, then owner full-scope login and bidirectional idle-native resume proofs before automatic selection. Active/delegated quota-blocked continuation is not claimed or enabled. The existing live commit remains the rollback starting point; create the maintenance rollback tag and private configuration backup before any approved roll.

[SergioTCG]

Controlled shadow rollout completed on merge commit b965a89 (tree identical to validated head 396a303). Exact-head and post-merge CI passed. A private configuration backup and pushed rollback tag were recorded first.

One existing daemon was replaced; all 31 live provider PIDs/tmux/native-session/channel identities and settings, 64 channel mappings, two teams, and 139 task lifecycle records were preserved. No provider restart, new channel, account handover, or team dispatch occurred. Runtime is shadow only; a controlled switch request returned account_pool_read_only without a journal receipt or process change.

Registry metadata is staged (four logical provider accounts, two groups); saved-session binding corrections remain unapplied. Both primary provider accounts returned quota observations; two additional Claude accounts remain scope-unavailable and are not automatic candidates. No cross-account native resume canary is claimed, and automatic rotation remains disabled. Full OAuth enrollment and explicit bidirectional idle-session manual canaries remain gates. No manifest update was needed.

This is experimental shadow activation, not a final unrestricted-rotation release.