@@ -126,6 +126,11 @@ session, supply `ConnectionStrings:Default` (`learnstack_app`) and
 `ConnectionStrings:OutboxDispatcher` (`learnstack_outbox_admin`) through environment
 or the project's `learnstack-api-dev` user-secrets store. The mandatory API worker
 resolves its guarded source and verifies dispatcher connectivity at startup.
+Also supply `Identity:AuthorityId` (`Identity__AuthorityId`) and
+`Authentication:Tenant:Issuer` (`Authentication__Tenant__Issuer`) matching the
+installed deployment authority, following
+[Identity deployment](../../../docs/modules/identity/README.md#global-implementation-and-deployment).
+Authority qualification is mandatory before the API accepts requests.
 The dispatcher credential belongs only to the API; every Seeder invocation uses
 an explicit application-only environment, and the web launcher receives neither
 database credential. Both empty hop lists remain
 
@@ -79,10 +79,16 @@ frontend/apps/web/scripts/
 
 ### Step 3: Run unit tests
 
+Use `--configuration Release` for repository qualification, matching CI. The
+architecture suite includes exact compiled ownership/opcode controls; a Debug
+build is not interchangeable with that qualified population. Run heavy .NET and
+native frontend qualification sequentially on a workstation so cold development
+compilation does not compete with the architecture mutation census.
+
 Fastest; no Docker required.
 
 ```bash
-dotnet test backend/tests/LearnStack.Tests.Unit \
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Unit \
   --no-restore \
   --logger "console;verbosity=normal"
 ```
@@ -91,11 +97,12 @@ Typical runtime: < 30 s. Failures here are almost always domain-logic bugs.
 
 ### Step 4: Run architecture tests
 
-Also fast; no Docker. Failures here mean **structural drift** — the code violates
-a documented rule.
+No Docker. The full IL mutation census can take tens of minutes on a workstation;
+CI runs it in bounded shards. Failures here mean **structural drift** — the code
+violates a documented rule.
 
 ```bash
-dotnet test backend/tests/LearnStack.Tests.Architecture \
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Architecture \
   --no-restore
 ```
 
@@ -134,7 +141,7 @@ into native/ordinary execution jobs behind the required integration aggregate. L
 `--filter "Requires!=Docker"` gives you the Docker-free half.
 
 ```bash
-dotnet test backend/tests/LearnStack.Tests.Integration \
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Integration \
   --no-restore \
   --logger "console;verbosity=normal" \
   --filter "FullyQualifiedName~Enrollment"     # subset
@@ -273,17 +280,17 @@ processes on Ctrl+C; it does not run the CI browser/audit proof.
 
 ### Step 7: Single-test focus
 
-`dotnet test --filter`:
+`dotnet test --configuration Release --filter`:
 
 ```bash
 # Class
-dotnet test --filter "FullyQualifiedName~EnrollmentCreateTests"
+dotnet test --configuration Release --filter "FullyQualifiedName~EnrollmentCreateTests"
 
 # Method
-dotnet test --filter "FullyQualifiedName~EnrollmentCreateTests.Create_succeeds"
+dotnet test --configuration Release --filter "FullyQualifiedName~EnrollmentCreateTests.Create_succeeds"
 
 # Docker trait — native CI additionally uses NativeCrashProof=true and its complement
-dotnet test --filter "Requires=Docker"
+dotnet test --configuration Release --filter "Requires=Docker"
 ```
 
 `vitest`:
@@ -298,11 +305,11 @@ pnpm --filter @learnstack/web test -t "shows danger tone"  # name filter
 
 ```bash
 # From the repository root; collect behavioral suites separately.
-dotnet test backend/tests/LearnStack.Tests.Unit \
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Unit \
   --collect:"XPlat Code Coverage" --results-directory coverage/unit
-dotnet test backend/tests/LearnStack.Tests.Integration \
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Integration \
   --collect:"XPlat Code Coverage" --results-directory coverage/integration
-dotnet test backend/tests/LearnStack.Tests.Architecture
+dotnet test --configuration Release backend/tests/LearnStack.Tests.Architecture
 reportgenerator -reports:"coverage/**/coverage.cobertura.xml" \
                 -targetdir:"coverage/html" \
                 -reporttypes:Html
@@ -337,12 +344,12 @@ make install
 
 # The `backend` job — build with warnings as errors, then the Docker-free half
 (cd backend && CI=true dotnet build LearnStack.slnx --no-restore --configuration Release)
-(cd backend && dotnet test LearnStack.slnx \
+(cd backend && dotnet test --configuration Release LearnStack.slnx \
   --no-restore --no-build --configuration Release \
   --filter "Requires!=Docker" --logger trx)
 
 # The complete Docker complement; CI requires both native/ordinary partitions
-(cd backend && dotnet test LearnStack.slnx \
+(cd backend && dotnet test --configuration Release LearnStack.slnx \
   --no-restore --no-build --configuration Release \
   --filter "Requires=Docker" --logger trx)
 ```
 
@@ -65,8 +65,12 @@ ConnectionStrings__OutboxDispatcher='Host=localhost;Port=5432;Database=learnstac
 # ─── Keycloak (two realms per ADR-0004 Amendment 1) ──────────────────────
 # The Development API defaults to the loopback tenant issuer declared in
 # backend/src/LearnStack.Api/appsettings.Development.json. Other deployment modes
-# require an explicit canonical HTTPS issuer; this override goes only to the API.
-# Authentication__Tenant__Issuer=https://identity.example/realms/learnstack
+# require an explicit canonical HTTPS issuer; the API and authority installer use it.
+Authentication__Tenant__Issuer=http://localhost:8080/realms/learnstack
+# Global identity uses an explicit stable deployment ID, not a hash of the issuer.
+# `make migrate` installs/verifies BOTH explicit keys as one immutable registration.
+# This fixed ID is local development data; deployment owners choose their stable ID.
+Identity__AuthorityId=019a1929-5450-7bbb-8df1-516e8e002501
 KEYCLOAK_ADMIN=admin
 KEYCLOAK_ADMIN_PASSWORD=admin-dev-secret
 # Server-only BFF client source. Old local .env files must add it explicitly;
 
@@ -242,7 +242,7 @@ jobs:
   backend-integration-tests:
     name: backend ordinary-${{ matrix.index }}
     runs-on: ubuntu-24.04
-    timeout-minutes: 20
+    timeout-minutes: 25
     strategy:
       fail-fast: false
       matrix:
@@ -295,7 +295,23 @@ jobs:
 
       - name: Prepare pinned provider fixture images within the whole-job budget
         timeout-minutes: 2
-        run: python3 scripts/ci-test-shards.py prepare-fixtures
+        env:
+          LEARNSTACK_NATIVE_RUNNER_CONTEXT: ${{ runner.environment }}
+          LEARNSTACK_NATIVE_RUNNER_OS: ${{ runner.os }}
+          LEARNSTACK_NATIVE_RUNNER_ARCH: ${{ runner.arch }}
+          LEARNSTACK_NATIVE_RUNNER_LABEL: ubuntu-24.04
+          LEARNSTACK_NATIVE_JOB_CONTAINER: ${{ toJSON(job.container) }}
+          LEARNSTACK_NATIVE_JOB_SERVICES: ${{ toJSON(job.services) }}
+          LEARNSTACK_CI_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          LEARNSTACK_NATIVE_RUN_ID: ${{ github.run_id }}
+          LEARNSTACK_NATIVE_ATTEMPT: ${{ github.run_attempt }}
+          LEARNSTACK_NATIVE_JOB: ${{ github.job }}
+          LEARNSTACK_NATIVE_SHA: ${{ github.sha }}
+          LEARNSTACK_NATIVE_REPOSITORY: ${{ github.repository }}
+          LEARNSTACK_NATIVE_WORKFLOW_REF: ${{ github.workflow_ref }}
+          LEARNSTACK_NATIVE_WORKFLOW_SHA: ${{ github.workflow_sha }}
+          LEARNSTACK_NATIVE_WORKSPACE: ${{ github.workspace }}
+        run: python3 scripts/ci-test-shards.py prepare-fixtures ordinary-${{ matrix.index }}
 
       - name: Verify stock browser for admission navigation proof
         run: |
 
@@ -39,10 +39,12 @@ repository holds only LearnStack's side of the boundary, in
 
 ## What state this is in
 
-**Phase 01, Phase 02a and Phase 02d are complete; Phase 02b is the live phase.**
+**Phase 01, Phase 02a, Phase 02d and Phase 02b are complete; Phase 03 is in progress.**
 [Phase 02d](docs/roadmap/phase-02d-walking-skeleton.md) owns the two-tenant walking
-skeleton. [Phase 02b](docs/roadmap/phase-02b-events-auth.md) owns current packet
-and decision state for events, background jobs, identity and sessions.
+skeleton. [Phase 02b](docs/roadmap/phase-02b-events-auth.md) owns the delivered
+events, background jobs, API authentication and session baseline.
+[Phase 03](docs/roadmap/phase-03-identity-admin.md) owns identity, membership and authorization work; its Status block records
+current packet state. Acceptance of a contract does not complete its implementation.
 [Phase 06](docs/roadmap/phase-06-renderer-admin-studio.md) owns the full
 renderer/Studio expansion.
 
@@ -61,8 +63,8 @@ the foundation ports — is recorded packet by packet in
 frozen history, together with the 2026-08-08 restructure that moved correctness
 earlier, additive infrastructure later and proof earlier.
 
-**Four modules hold domain code:** Tenancy, Customization, Audit and Education.
-Content, Identity and Media remain scaffolded. Module-level references in the docs
+**Five modules hold domain code:** Tenancy, Customization, Audit, Education and
+Identity. Content and Media remain scaffolded. Module-level references in the docs
 to types such as `ILiveClassProvider` or `ITenantSearch` describe intended shape
 owned by their named phases.
 
@@ -77,10 +79,13 @@ For any task, read in this order:
 5. [docs/standards/00-principles.md](docs/standards/00-principles.md) — the beliefs every other standard descends from.
 6. [docs/glossary.md](docs/glossary.md) — terminology; the single source of truth for project-specific terms.
 
-Then read the phase that is live and the one it stands on:
+Then read the current phase and the completed baselines it stands on:
 
+- [docs/roadmap/phase-03-identity-admin.md](docs/roadmap/phase-03-identity-admin.md) —
+  **the current phase**. Read its identity,
+  membership, authorization and first-writer decisions before planning code.
 - [docs/roadmap/phase-02b-events-auth.md](docs/roadmap/phase-02b-events-auth.md) —
-  **the live phase**. Its Status block owns packet state; its decision register owns
+  complete. Its Status block owns packet state; its decision register owns
   gate state and links each Accepted decision package in the delivery log, which is
   normative — read it before writing the code its gate governs. Navigate a delivery
   log by the generated index at its top; never read the whole file.
@@ -177,6 +182,8 @@ rules:
 - OpenTelemetry + correlation id end to end ([10](docs/standards/10-observability.md)).
 - WCAG 2.2 AA across all surfaces ([16](docs/standards/16-accessibility.md)).
 - Audit-coverage matrix required per module ([18](docs/standards/18-audit-coverage.md)).
+- Global User identity consumes the existing typed `UserId`; global and tenant
+  transaction owners never join or retarget each other ([ADR-0072](docs/decisions/0072-application-owned-identity-bootstrap.md)).
 - Permission keys `{module}.{resource}.{action}` with closed action set + scope
   (Platform / Tenant / Organization) ([19](docs/standards/19-permissions.md)).
 - Infrastructure-stack rules (foundation ports and their default
@@ -294,9 +301,12 @@ rules:
   and every module's `IAuditCatalogSource` names the first two. Declaring them
   in the module is a project cycle. `AuditEntry` consumes them; it does not
   declare them.
-- **Announce `TenantId.PlatformSentinel` as a request's tenant.** Exactly one
-  class of row carries it — a platform-scope operation with no resolvable
-  tenant, written standalone — and Packet 9 puts the guard where the value
+- **Announce `TenantId.PlatformSentinel` as a request's tenant.** Exactly two named
+  classes of audit row may carry it: platform-scope standalone operations and
+  ADR-0072 global `identity.user.create` attempts under its confined common
+  owner. Neither class grants tenant authority or permits a tenant setter to
+  announce the sentinel.
+  Packet 9 puts the guard where the value
   enters: `SetProvisioningTenantContextAsync` refuses the sentinel exactly as it
   already refuses `Guid.Empty`, and `Tenant.Create` refuses it in the factory
   ([ADR-0044 Amendment 3](docs/decisions/0044-audit-write-path.md)). The
 
@@ -120,106 +120,15 @@ build-frontend: ## `pnpm -r build` the frontend monorepo.
 
 .PHONY: migrate
 migrate: ## Apply every EF migration chain (platform + each module) as `learnstack_migration` (the ONLY sanctioned carrier of that credential).
-	@# Every dotnet command in this recipe runs from `backend/`, because that is where
-	@# the SDK pin lives (`backend/global.json`). Run from the repository root there is
-	@# no global.json above them, so whichever SDK is newest on the machine answers —
-	@# and the pin exists precisely so this target and CI apply the same EF version.
-	@#
-	@# Standards 05 § Database roles: ConnectionStrings:Migration must never appear
-	@# in API or worker runtime configuration. The role OWNS every table it creates,
-	@# and a runtime that is the owner is precisely the arrangement FORCE ROW LEVEL
-	@# SECURITY exists to defeat — every isolation test would then pass against
-	@# policies that constrain nothing. This target is where the credential lives.
-	@#
-	@# Every design-time factory reads only ConnectionStrings__Migration, never
-	@# the startup application's Default connection. Export to that confined
-	@# factory; do not duplicate the credential on the process command line.
-	@# Four things this recipe does that a naive version does not, each because the
-	@# naive version was measured doing the wrong thing:
-	@#
-	@# 1. `.env` is read one key at a time, NOT shell-sourced. A connection string
-	@#    contains semicolons, and `. ./.env` on an unquoted row parses them as
-	@#    statement separators: `ConnectionStrings__Migration` arrived as
-	@#    `Host=localhost`, and `Port`, `Database`, `Username`, `Password` leaked
-	@#    into the environment as bare variables. `tr -d '\r'` as well, because a
-	@#    CRLF row otherwise leaves the closing quote and the carriage return
-	@#    inside the credential.
-	@# 2. The role is compared EXACTLY. An unanchored `*Username=learnstack_migration*`
-	@#    accepted `learnstack_migration_readonly` and would have run migrations as
-	@#    it. Splitting on `;` and comparing the whole token has no neighbourhood.
-	@# 3. The error path prints a REDACTED string. An earlier version echoed the
-	@#    whole value, password included — in the one target whose entire purpose
-	@#    is keeping that credential in one place.
-	@# 4. The loop carries its own status. `-e` does not abort on a failure inside
-	@#    a for-loop body that is part of a compound list: both iterations ran
-	@#    after `false` and the recipe still exited 0, so a migration target
-	@#    reported success after every migration failed.
-	@# 5. The loop covers `LearnStack.Infrastructure` as well as the modules. The
-	@#    platform chain (outbox_messages, idempotency_keys) lives outside
-	@#    `src/Modules`, and a glob that only walked the modules left the two
-	@#    tables no module owns unmigrated on every documented path.
-	@# 6. Tenancy is named BEFORE the glob. From Phase 02a Packet 9 the chains are
-	@#    no longer independent: `audit_config` carries the schema's only
-	@#    cross-chain foreign key, to `tenants`, which the Tenancy chain creates.
-	@#    The glob expands alphabetically and `Modules/Audit` sorts first, so the
-	@#    naive order fails on a fresh database. `applied` is what keeps the named
-	@#    project from being visited twice when the glob reaches it — a second
-	@#    `database update` is a no-op, but a recipe that prints the same chain
-	@#    twice reads like a bug in the recipe.
-	@# 7. Build the startup graph once in Release, with restore for standalone use.
-	@#    Every EF invocation uses that fresh output; the demo launches the same API.
-	@#    Explicit failures also stop old Make versions without shell errexit.
-	@# 8. Save and unexport the migration credential before restore/build; only
-	@#    the no-build EF child receives it, through its process environment.
-	@migration_cs="$${ConnectionStrings__Migration:-}"; \
-	unset ConnectionStrings__Migration; \
-	migration_env="$${LEARNSTACK_COMPOSE_ENV_FILE:-.env}"; \
-	if [ -z "$$migration_cs" ] && [ -f "$$migration_env" ]; then \
-		migration_cs=$$(sed -n "s/^ConnectionStrings__Migration=//p" "$$migration_env" \
-			| tail -1 | tr -d "\r" | sed "s/^['\"]//; s/['\"]$$//"); \
-	fi; \
-	role=$$(printf '%s' "$$migration_cs" | awk -f scripts/connection-string.awk -v field=user); \
-	redacted=$$(printf '%s' "$$migration_cs" | awk -f scripts/connection-string.awk -v field=redacted); \
-	if [ -z "$$migration_cs" ]; then \
-		echo "ConnectionStrings__Migration is not set."; \
-		echo "It arrives with the four-role model in Phase 02a Packet 6: copy the"; \
-		echo "'four database roles' and 'four connection strings' blocks out of"; \
-		echo ".env.example into your .env and re-run. A .env written before that"; \
-		echo "packet has neither."; \
-		exit 1; \
-	fi; \
-	if [ "$$role" != "learnstack_migration" ]; then \
-		echo "ConnectionStrings__Migration names Username='$$role', not learnstack_migration:"; \
-		echo "  $$redacted"; \
-		echo "Migrations must run as the role that OWNS every table. Running them as"; \
-		echo "the runtime role is the arrangement FORCE ROW LEVEL SECURITY defeats."; \
-		echo "If the value looks truncated at the first ';', quote it in .env. A"; \
-		echo "URI-style DSN (postgres://...) is not a form Npgsql parses at all; the"; \
-		echo "expected shape is the key/value list in .env.example."; \
-		exit 1; \
-	fi; \
-	(cd backend && dotnet tool restore >/dev/null) || exit $$?; \
-	(cd backend && dotnet build src/LearnStack.Api --configuration Release --nologo) || exit $$?; \
-	found=0; \
-	failed=0; \
-	applied=" "; \
-	for proj in backend/src/Modules/Tenancy/LearnStack.Modules.Tenancy.Infrastructure \
-	            backend/src/LearnStack.Infrastructure \
-	            backend/src/Modules/*/LearnStack.Modules.*.Infrastructure; do \
-		test -d "$$proj/Persistence/Migrations" || continue; \
-		case "$$applied" in *" $$proj "*) continue;; esac; \
-		applied="$$applied$$proj "; \
-		found=1; \
-		echo "==> $$(basename $$proj)"; \
-		(cd backend && ConnectionStrings__Migration="$$migration_cs" dotnet ef database update \
-			--project "../$$proj" \
-			--startup-project src/LearnStack.Api \
-			--configuration Release --no-build) || failed=1; \
-	done; \
-	if [ "$$found" = "0" ]; then \
-		echo "No project carries Persistence/Migrations yet — the first lands with the Tenancy schema in Phase 02a Packet 6."; \
-	fi; \
-	exit "$$failed"
+	@# The Node owner selects one deployment source, validates the migration role,
+	@# and confines credentials to EF/authority children after fresh Release builds.
+	@# Keep dependency order explicit and cover future module chains with the glob.
+	@node scripts/migrate.mjs \
+		backend/src/Modules/Tenancy/LearnStack.Modules.Tenancy.Infrastructure \
+		backend/src/LearnStack.Infrastructure \
+		backend/src/Modules/Audit/LearnStack.Modules.Audit.Infrastructure \
+		backend/src/Modules/Identity/LearnStack.Modules.Identity.Infrastructure \
+		backend/src/Modules/*/LearnStack.Modules.*.Infrastructure
 
 .PHONY: sdk
 sdk: ## Regenerate @learnstack/sdk types from the committed v1 snapshot.