Preserve protected bootstrap credentials and fresh user evidence

[c1-squire-dev]

Changes

• Support SDK-decrypted supplied passwords without replacing or echoing them.
• Honor requested generated-password length/constraints and return generated material through the existing SDK encrypted-result path.
• Use one account-creation option contract. No new connector configuration flag, lifecycle profile fields, or success-with-non-enforcement annotations.
• Preserve existing resource IDs, raw status, provider options, fresh user reads, and error/filter handling.

Behavior

Requested password changes must be supported by the selected provider operation. No-password, inactive creation, or suppressed activation email cannot enforce mandatory password change; incompatible requests fail with InvalidArgument before writes. This deliberately replaces previously ignored combinations with explicit errors.

Creation success reports the account and its actual provider status, not sign-in readiness. The existing staged-create/activate-without-email flow stays; no InProgress response or transition-based readiness state machine is added. A known post-create activation/read failure uses standard ActionRequired and preserves generated material through the SDK protected-result channel instead of reporting success or losing the credential. Unresolved duplicate lookups remain errors; deprovisioned collisions retain their existing FailedPrecondition behavior.

New random-password creation honors the SDK range of 8–64 characters instead of silently truncating longer requested passwords to eight. Upgrading does not rotate existing passwords. Supplied-password and no-password modes do not use the random-length rule.

Validation

• Go 1.25.2: full go test -p 1 -count=1 ./...
• Focused -race tests, including actual SDK encryption/decryption of successful and partial creation results
• Canonical golangci-lint 2.11.4: 0 issues
• Config generation, CLI build, config/capabilities equality, and actual CLI help confirming the removed option is absent
• Canonical MDX validation

No SDK version change, CI change, C1 implementation, deployment, or merge. Local provider scenarios use HTTP fixtures.

[github-actions]

Connector PR Review: Preserve protected bootstrap credentials and fresh user evidence

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 8780cf0204bb.
Review mode: incremental since 3bf18258
View review run

Review Summary

The new commit converts current in TestUserResourceGetReflectsOutOfBandStatusChange to an atomic.Value (pkg/connector/user_observation_test.go:71-75,98), addressing the prior finding about a plain string written on the test goroutine and read from the httptest handler goroutine; the other new test files (user_observation_safety_test.go, user_filter_transport_test.go, user_creation_outcome_test.go) already use channels or atomic.Int32 / atomic.Value for the same pattern, so the race class is now consistent across the suite. The full PR diff was re-scanned for security and correctness — credential handling in CreateAccount, the getCredentialOption / applyProviderCredentials split, strict-vs-legacy branching in getAccountCreationQueryParams, the getUserWithCachePolicy RawPath/Path single-segment construction, group.Revoke treating provider-qualified NotFound as already-revoked, and the go.mod change promoting google.golang.org/genproto/googleapis/rpc from indirect to direct (which matches the new errdetails.ErrorInfo usage in user.go and the tests). No new issues found.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

Blocking issues found — see review comments.

[github-actions]

No blocking issues found.

[c1-squire-dev]

Addressed the remaining summary-only README help finding in 4376cda. The --strict-account-creation line is copied from the freshly built offline CLI and matches its description/environment variable exactly. This is a one-line documentation follow-up to bc4e1a4; native generator, full Go 1.25.2 tests/build, canonical lint 2.11.4, CLI config/capabilities metadata equality and MDX validation pass.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.