[servicememeai]

Deployment slice for Hub's one-shot administrator roster

Linked to Hub #64 and the Hub startup sync PR in that Issue. No component-wide startup rebuild/periodic worker.

• scripts/scripts_14.0/start.py: run one cf_sync_provider_admins management command after ordinary Seafile/Seahub startup. It is not an AppConfig.ready or Gunicorn worker hook.
• scripts/scripts_cf14.0/cloudfile_admin_startup.py: process call bounded to 30 seconds, source call separately bounded, failure logs FAILED while returning normally so an unavailable enterprise Directory does not fail the file platform.
• CF_PROVIDER_ADMIN_STARTUP_SYNC_ENABLED defaults false in generic Compose and settings; optional Provider callable can be configured. Etech example reuses existing machine Directory connection.
• Standalone CE & existing Etech behavior unchanged until operator explicitly enables. No forced runtime migrations or new tables.
• Focused subprocess tests for one call/nonroot/success/timeout. No image build from this PR. Draft, requires matching Hub+EAP code SHAs before a consolidated DEV acceptance.

Admin changes while running take effect on next startup/manual invocation, not per request. Existing SSO/Session expiry governs sessions. Outage retains existing CE admin roles, operator checks failure log and can manually rerun.

[servicememeai]

2026-10-24 GitHub-only continuation:

• Hub /scripts/gc.sh haiwen/seafile-docker#71 head c9ef6a896ea595e0724ac8fa8c352de52226bbc1: early validation of explicit managed-account scope before CE identity preparation, rejecting malformed/duplicate/reserved entries. New mocked SQL control-flow regression covers grant, second-run idempotence, scoped revocation and transaction rollback. GitHub quick static check success (Actions 40077061997).
• Docker feat(startup): run bounded provider admin sync once after CloudFile starts #38 head eb157992b94f36450377d9048c9db0481a4083fd: do not report APPLIED merely because child process exited zero; require an explicit CF_ADMIN_SYNC APPLIED receipt, test SKIPPED/missing receipt and Etech sample admin with sync disabled by default. GitHub static success (Actions 40077190987).
• EAP docs: register native directory-share permission qualification #28 head 7102b6820300a40a7b882abc2c3786a860f80c97 unchanged; no GitHub Actions checks available for Java tests.
• Internal acceptance document updated in eap-cloudfile PR fix(build): unify full dev builds and immutable receipts #26 (merged as de375bc).
• Verified the Seafile-supported seahub.sh python-env python3 seahub/manage.py invocation; no unnecessary Docker command rewrite.
• All 3 feature PRs remain Draft. GitHub unit/mock tests are not a substitute for live CE/MariaDB transactions, EAP trusted roster, Authentik/SSO and real Docker startup validation. No deploy, no admin changes, feature stays disabled.

[opendev9]

2026-10-25 合并说明（Etech 兼容默认）

Hub 侧配套实现已合并：cloudfile-hub#71（0cf9ea3a）。本 PR 是启动钩子，复核兼容性：

• CF_PROVIDER_ADMIN_STARTUP_SYNC_ENABLED=false 是通用默认；未显式启用时 standalone CE 与现有 Etech 部署行为完全不变。
• Etech 示例配置复用现有 machine Directory 连接（.env.etech-sso.example），不新增凭证/协议；CF_PROVIDER_ADMIN_EXPECTED_ACCOUNT 仅作健康断言（Etech 示例 admin），不是替代提权手段。
• Provider 不可用/超时只记录 FAILED，不阻塞 Seafile 启动；必须有显式 APPLIED receipt 才报告成功。
• 管理员变更在下次启动/手动执行生效（已文档化），不引入每请求远程核验或后台轮询。

dev 同步完成（head 4b78373b，含 docker dev #43 等），dev.yml static CI PASS，定向 6 项 hook 测试通过。合并。

说明：真实 Etech/EAP roster 与 CE/MariaDB 的 DEV 联验仍是部署启用前检查项，本合并只交付默认关闭的增量能力。