[efraespada]

Domus needs server-proven Home Assistant identity, recoverable administration and durable household state before its functional domains can run. This foundation implements both household APIs, managed SQLite persistence, console-approved recovery and manual snapshot/restoration. It closes the source foundation in issue #6; it does not complete M1 or the first usable product.

Household setup/enrollment, revisioned household/member/policy changes, own authorization, filtered roster and scoped operation lookup share clean application services in native and standalone modes. Writes require fresh HA proof, current Domus authority, fixed Origin, session CSRF, idempotency keys and expected revisions. Bounded HA outages permit local queries only until the original session deadline. Pending enrollment now explains that the verified account was linked but household access was not activated, and names the administrator review step. Original enrollment replay and current authorization remain distinct after activation or restoration.

Review fixes canonicalize scheme-default ports without widening Origin/CSRF checks, recover a bound console's original approval receipt after normal closure without reapproving/rearming/renewing it, document callback code/error XOR in actual OpenAPI, and correct stale schema/session/restore documentation. New approval and human-completion safeguards, including restoration closure guards, remain enforced. Historical proposed routes are archived; the published household API is authoritative. Partial snapshot destinations intentionally retain inspectable uncertainty evidence and cannot be silently overwritten or deleted.

Schema 4 retains complete original operation history independently of restored checkpoint state. Historical replay never repeats rolled-away work. Real acknowledgement, first archive provenance and event sequence survive; current authority precedes disclosure. Consumed/canceled recovery cannot be rearmed under a new key.

Offline restore prepare/inspect/activate/status/resume requires managed installation authority. Exclusive leases, exact source binding, durable startup-blocking intent, sealed input, source checkpoint and target-only migration/history import precede atomic generation selection. Same-ID resume recovers process interruption; historical activation retry cannot switch back. Rollback reconciles the retained checkpoint with the latest history. Restore and console approval have no HTTP endpoint.

Edge 0.0.0-edge.3 remains pinned to runtime faa1654 and archive SHA-256 15bcd701696204b3362cebe5901feb3d0072c9bac1db2ef2cbc5007e9ed73717. Its actual images exercise both entrypoints, real restore/restart, original-key historical replay, suppressed/acknowledged delivery, latest-history rollback and process death. The independently pinned previous Edge.2 image upgrades schema3 to4 and its old snapshot restores into a migrated generation; that older image refuses future schema/selected generations without changing files. The new source response explanations are not silently added to the immutable Edge.3 package or installed on the owner target.

Current-head CI at 72e3e87 passes all application groups: 1,411 backend tests, 4,704 statements/1,308 branches at 100%; 66 tooling tests, 73 statements/34 branches independently at 100%; 41 architecture fixtures and the actual 103-file/542-dependency graph, three application contracts kept. Ruff, formatting, mypy, local links and unchanged upstream SDD/catalog validators pass. The original audit traces 61 identity and 18 restoration cases; 24 additional review regression cases exercise canonical origins, native writes, callback XOR and inert console receipt replay. Current-head full CI and complete Bugbot reconciliation must finish before merge.

Owner HA Edge.3 update, configured origin, existing-session connection, actual Chrome reload and Domus-only restart passed. A later read-only About observation confirms Core 2026.10.4, Supervisor 2026.10.5, HA OS 18.3 and Frontend 20260930.5. No live household mutation, recovery, Domus restore or owner SQLite query was performed; no credentials/private Ingress routes enter evidence. Operational switches remain off. Complete standalone browser/companion, product UI, live household/recovery/restore, HA entity/service integration, channel/release gates and remaining launch domains continue separately.

Ready for complete review: prior Bugbot checks were skipped because draft reviews are disabled. Merge requires all current-head CI groups, full supported coverage and complete current-head Bugbot review without unresolved findings; neutral/skipped review is insufficient. The owner explicitly confirmed clarity of the pending/historical API text and exact target-bound console approval steps on 2026-10-31. Copilot and the existing gateway are unchanged. Upstream progress failures remain tracked in vypdev/copilot#828, #829 and #830; reproducible false-positive reports are in #831, #832 and #834. The UI SDD assembly issue is tracked separately in #833. No unchanged-input manual retry or weakened contract is used.

Closes #6.

• Acceptance audit
• Case-to-test evidence
• Restoration contract
• Actual-image evidence
• Owner acceptance

• Review regression evidence

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/domus~7

Documentation is deployed and generated using docs.page

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 72e3e87. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 3 potential problems when commit ead7dde was analyzed. This snapshot is historical; use the status block above for current state. 3 findings are linked to changed code.

Findings

• medium: Invalid exception handler prevents test module collection — tests/backend/test_household_commands.py:415
• medium: Invalid exception handler syntax prevents backend test collection — tests/backend/test_member_commands.py:407
• low: Snapshot capture documents the wrong current schema version — docs/snapshots.md:65

[vypbot]

Bugbot: review complete

Current status: No active findings on 72e3e87.

Pull request · Verified commit · Workflow run

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 72e3e87. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 8 potential problems when commit d67475a was analyzed. This snapshot is historical; use the status block above for current state. 8 findings are linked to changed code.

Findings

• medium: Household routes mismatch the agreed API contract — backend/src/domus/entrypoints/household_http.py:330
• medium: Explicit default ports cause valid browser origins to be rejected — backend/src/domus/infrastructure/ha_config.py:37
• medium: Console approval retries fail after recovery is consumed — backend/src/domus/application/recovery_commands.py:312
• low: Operations guide describes the obsolete schema version — docs/operations-identity-storage.md:3
• low: Status incorrectly says Supervisor read-grace sessions are pending — docs/ha-identity-protocol.md:6
• low: Snapshot guide says implemented restore activation is still pending — docs/snapshots.md:87
• low: Failed snapshot creation leaves a permanent partial destination — backend/src/domus/infrastructure/sqlite_snapshots.py:282
• low: Callback schema does not require exactly one result — docs/contracts/auth-api.openapi.json:178

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 72e3e87. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 3 potential problems when commit e26a1e6 was analyzed. This snapshot is historical; use the status block above for current state. 3 findings are linked to changed code.

Findings

• medium: The nested-destination assertion uses a sibling path — tests/backend/test_sqlite_snapshots.py:334
• low: Audit records an incorrect OpenAPI source hash — docs/evidence/m1-acceptance-audit.json:1022
• low: Snapshot evidence reports the business schema as version 3 — docs/evidence/m1-snapshots.json:58

[vypbot]

Current status: All findings originating in this review are resolved.
Last reconciled on 72e3e87. See aggregate Bugbot status.

🤖 Bugbot review snapshot

Bugbot reported 1 potential problem when commit 4505d82 was analyzed. This snapshot is historical; use the status block above for current state. 1 finding is linked to changed code.

Findings

• medium: Pending recovery test expects the wrong query order — tests/backend/test_sqlite_recovery.py:107

[efraespada]

/copilot recheck