feat: expose core identity transport

README.md

@@ -6,7 +6,8 @@ surfaces.
 
 ## Current status
 
-Phase 3 is complete and Phase 4A (Core identity foundation) has landed. The repository includes
+Phase 3 is complete, and Phase 4A (Core identity foundation) and Phase 4B (identity HTTP
+transport) have landed. The repository includes
 public module contracts, independently versioned capabilities, static module manifests,
 deterministic automatic discovery, compiled server loading, a staged capability registry,
 dependency-ordered lifecycle with rollback, module-owned Drizzle table contracts, deterministic
@@ -19,16 +20,25 @@ concurrency and release, exact destructive approvals, and sanitization against t
 adapter. A Core-owned `pnpm doctor` dashboard combines the existing static discovery and read-only
 migration-planning services into one concise readiness report.
 
-Phase 4A adds Core-owned identity foundations: a Core-owned Better Auth database schema
+Phase 4A added Core-owned identity foundations: a Core-owned Better Auth database schema
 (`ekklesia_core_user`, `ekklesia_core_session`, `ekklesia_core_account`,
 `ekklesia_core_verification`), a first-class Core-owned migration source that coexists with
 module-owned migrations under the exact same migration system, minimal opaque-identity contracts
 in `@ekklesia/contracts`, and an explicit Better Auth construction boundary in Core. See
 [Identity](docs/development/identity.md) and
-[ADR 0010](docs/architecture/decisions/0010-core-identity-and-better-auth-adoption.md) for details.
-**No authentication endpoint or sign-in UI exists yet** — that, along with production
-approval-provider composition, HTTP routing, jobs, physical storage provisioning, surfaces, and
-feature modules, remains later vertical slices.
+[ADR 0010](docs/architecture/decisions/0010-core-identity-and-better-auth-adoption.md).
+
+Phase 4B adds identity HTTP transport: a minimal Hono-based `apps/api` composition root
+(`pnpm api:start`) mounts Better Auth at `/api/auth/*` and exposes `GET /api/v1/principal` behind
+Core's own Fetch-compatible identity runtime — Core still does not depend on Hono, and modules
+still cannot reach any of this. Public email/password registration is intentional; every account
+receives identical lowest-privilege baseline status and signup order never grants elevation. See
+[API](docs/development/api.md) and
+[ADR 0011](docs/architecture/decisions/0011-identity-http-transport-and-public-enrollment.md).
+**No email verification, password recovery, Dashboard, or role/permission model exists yet** —
+that, along with production approval-provider composition, jobs, physical storage provisioning,
+surfaces, and feature modules, remains later vertical slices. Public registration is not yet ready
+for a real public launch.
 
 ## Quick start
 
@@ -113,6 +123,11 @@ CLI into a temporary location and structurally compares it against the checked-i
 and is part of `pnpm verify`. See [Identity](docs/development/identity.md) for the full upgrade
 workflow.
 
+`pnpm api:start` builds the workspace, then starts the identity HTTP transport
+(`GET /api/v1/principal`, Better Auth mounted at `/api/auth/*`) against an already-migrated
+`DATABASE_URL` — it never applies migrations itself. See [API](docs/development/api.md) for
+required configuration, routes, and a full request/response transcript.
+
 Run `pnpm infrastructure:smoke` for an isolated end-to-end PostgreSQL and authenticated S3 check.
 
 The development services bind only to loopback:
@@ -130,6 +145,7 @@ environment.
 - [Repository workflow](docs/development/repository-workflow.md)
 - [Testing](docs/development/testing.md)
 - [Identity](docs/development/identity.md)
+- [API](docs/development/api.md)
 - [Module development](docs/module-development/README.md)
 - [Architecture decisions](docs/architecture/decisions/README.md)