feat: GitOps platform-user management (bootstrap superuser SA + reconcile CLI)

[rohilsurana]

What

This PR moves platform-superuser management to a file-based (GitOps) flow. Config seeds one protected bootstrap service account instead of a list of human superusers. From then on, you manage access by editing a file and running the new frontier reconcile command. This is the second of a 2-PR split of #1709, and it builds on #1719.

⚠️ Breaking change — this removes app.admin.users. Only merge it once the new flow is ready: the bootstrap service account is configured and pixxelhq/IAM#139 is in place. Otherwise human superadmins lose access until the first reconcile runs.

Changes

• Bootstrap superuser service account (app.admin.bootstrap.{client_id, client_secret}) — created and promoted to superuser at boot, with a fixed id. You rotate the secret by changing the config. client_id must be a UUID.
• Locked down — this service account cannot be changed through the API. It can't be removed, deleted, or have new credentials, tokens, or keys created, not even by a superuser. The reconcile flow skips it too. Rotating the secret at boot still works.
• frontier reconcile command — reads a file that lists who should have access and makes the platform match it. Anyone listed is added; anyone not listed is removed. It lives in internal/reconcile and can support more kinds later; PlatformUser is the first.
• Removes app.admin.users and MakeSuperUsers.
• Supporting change — org_name can now be null, so the platform service account (which has no org) can be stored.

Testing

Unit tests pass (-race -count 2). Vet, lint, and format are clean. Full e2e tests pass (the test bench seeds data using the bootstrap service account). I also ran a live security check: no one can remove or delete the service account, or create credentials for it, even when the per-object permission check is made to pass.

Related

• Builds on feat: manage platform users via GitOps (relation-level grants, bootstrap superuser SA, reconcile CLI) #1719.
• pixxelhq/IAM#139 — the repo that uses this flow (the desired-state files and the reconcile workflow).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 1, 2026 12:36pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 869c56dd-be0b-43d0-ac02-ca666255788c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 28517939074

Warning

No base build found for commit f31dda9 on feat/platform-user-correctness.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 44.629%

Details

• Patch coverage: 95 uncovered changes across 8 files (299 of 394 lines covered, 75.89%).

Uncovered Changes

File	Changed	Covered	%
cmd/reconcile.go	60	31	51.67%
internal/bootstrap/bootstrapuser.go	89	66	74.16%
internal/reconcile/platformuser_reconciler.go	97	74	76.29%
internal/reconcile/reconcile.go	30	21	70.0%
cmd/serve.go	4	0	0.0%
internal/bootstrap/service.go	3	0	0.0%
internal/reconcile/platformuser.go	67	65	97.01%
internal/store/postgres/serviceuser_repository.go	2	0	0.0%
Total (12 files)	394	299	75.89%

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	37574
Covered Lines:	16769
Line Coverage:	44.63%
Coverage Strength:	12.44 hits per line

---

💛 - Coveralls

[coderabbitai]

Actionable comments posted: 7

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ff2769d7-96b1-4439-9af0-8d1c887c9807

📥 Commits

Reviewing files that changed from the base of the PR and between c556cbd and 54ccfaa.

📒 Files selected for processing (20)

• cmd/reconcile.go
• cmd/root.go
• cmd/serve.go
• config/sample.config.yaml
• internal/api/v1beta1connect/platform.go
• internal/api/v1beta1connect/platform_test.go
• internal/api/v1beta1connect/serviceuser.go
• internal/api/v1beta1connect/serviceuser_test.go
• internal/bootstrap/bootstrapuser.go
• internal/bootstrap/bootstrapuser_test.go
• internal/bootstrap/schema/schema.go
• internal/bootstrap/service.go
• internal/reconcile/platformuser.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/platformuser_test.go
• internal/reconcile/reconcile.go
• internal/store/postgres/serviceuser_repository.go
• test/e2e/testbench/helper.go
• test/e2e/testbench/testbench.go

[whoAbhishekSah]

Three small notes, none blocking.

[whoAbhishekSah]

Added some comments. Approving.