feat: establish core identity foundation

Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).

Co-Authored-By: Claude Sonnet 5 <[email protected]>

README.md

@@ -6,19 +6,29 @@ surfaces.
 
 ## Current status
 
-Phase 3 is underway. The repository now includes public module contracts, independently versioned
-capabilities, static module manifests, deterministic automatic discovery, compiled server loading,
-a staged capability registry, dependency-ordered lifecycle with rollback, module-owned Drizzle table
-contracts, deterministic schema aggregation, and a cloneable backend-only module template. Migration
-artifacts now have module-owned Drizzle contracts, deterministic offline discovery, explicit
-destructive-change declarations, and exact checksums. Core now provides read-only applied-history
-planning and a locked, whole-batch transactional PostgreSQL runner with exact external destructive
-approval matching. A hermetic live PostgreSQL suite now proves history, rollback, statement
-breakpoints, advisory-lock concurrency and release, exact destructive approvals, and sanitization
-against the production adapter. A Core-owned `pnpm doctor` dashboard now combines the existing
-static discovery and read-only migration-planning services into one concise readiness report.
-Phase 4 identity with Better Auth is next; production approval-provider composition, HTTP routing,
-jobs, physical storage provisioning, surfaces, and feature modules remain later vertical slices.
+Phase 3 is complete and Phase 4A (Core identity foundation) has landed. The repository includes
+public module contracts, independently versioned capabilities, static module manifests,
+deterministic automatic discovery, compiled server loading, a staged capability registry,
+dependency-ordered lifecycle with rollback, module-owned Drizzle table contracts, deterministic
+schema aggregation, and a cloneable backend-only module template. Migration artifacts have
+module-owned Drizzle contracts, deterministic offline discovery, explicit destructive-change
+declarations, and exact checksums. Core provides read-only applied-history planning and a locked,
+whole-batch transactional PostgreSQL runner with exact external destructive approval matching. A
+hermetic live PostgreSQL suite proves history, rollback, statement breakpoints, advisory-lock
+concurrency and release, exact destructive approvals, and sanitization against the production
+adapter. A Core-owned `pnpm doctor` dashboard combines the existing static discovery and read-only
+migration-planning services into one concise readiness report.
+
+Phase 4A adds Core-owned identity foundations: a Core-owned Better Auth database schema
+(`ekklesia_core_user`, `ekklesia_core_session`, `ekklesia_core_account`,
+`ekklesia_core_verification`), a first-class Core-owned migration source that coexists with
+module-owned migrations under the exact same migration system, minimal opaque-identity contracts
+in `@ekklesia/contracts`, and an explicit Better Auth construction boundary in Core. See
+[Identity](docs/development/identity.md) and
+[ADR 0010](docs/architecture/decisions/0010-core-identity-and-better-auth-adoption.md) for details.
+**No authentication endpoint or sign-in UI exists yet** — that, along with production
+approval-provider composition, HTTP routing, jobs, physical storage provisioning, surfaces, and
+feature modules, remains later vertical slices.
 
 ## Quick start
 
@@ -30,6 +40,7 @@ cp .env.example .env
 pnpm infrastructure:up
 pnpm modules:validate
 pnpm migrations:validate
+pnpm identity:schema:validate
 pnpm doctor
 pnpm migrations:plan
 pnpm test:migrations:integration
@@ -62,7 +73,8 @@ Data definitions
   ✓ Schemas validated
     0 modules · 0 tables
   ✓ Migrations validated
-    0 migrations · checksums valid
+    1 migration · checksums valid
+    core:0000_identity_core_tables · f8f2086ef06f
 
 PostgreSQL
   ○ Connection check skipped
@@ -70,6 +82,11 @@ PostgreSQL
   ○ Migration plan skipped
     A validated migration inventory and configured PostgreSQL connection are required.
 
+Identity
+  ○ Identity configuration skipped
+    Core identity schema defines 4 tables (ekklesia_core_account, ekklesia_core_session, ekklesia_core_user, ekklesia_core_verification).
+    Identity runtime configuration (signing key, base URL, trusted origins) is not set.
+
 Object storage
   ○ Check unavailable
     Core storage integration has not been implemented yet.
@@ -90,6 +107,12 @@ The runner has both deterministic unit coverage through a narrow database port a
 PostgreSQL integration suite. The live command creates and destroys disposable Docker
 infrastructure; it remains separate from the Docker-free `pnpm verify` gate.
 
+`pnpm identity:schema:validate` regenerates Better Auth's canonical schema with the pinned local
+CLI into a temporary location and structurally compares it against the checked-in
+`core/src/identity/schema.ts`, then removes the temporary output. It requires no `DATABASE_URL`
+and is part of `pnpm verify`. See [Identity](docs/development/identity.md) for the full upgrade
+workflow.
+
 Run `pnpm infrastructure:smoke` for an isolated end-to-end PostgreSQL and authenticated S3 check.
 
 The development services bind only to loopback:
@@ -106,6 +129,7 @@ environment.
 - [Repository boundaries](docs/architecture/repository-boundaries.md)
 - [Repository workflow](docs/development/repository-workflow.md)
 - [Testing](docs/development/testing.md)
+- [Identity](docs/development/identity.md)
 - [Module development](docs/module-development/README.md)
 - [Architecture decisions](docs/architecture/decisions/README.md)