{
  "feature_id": "F-006",
  "agent": "leader",
  "stage": "close",
  "verdict": "APPROVED",
  "title": "Users: profile, addresses, RBAC",
  "gates": {
    "review": "APPROVED",
    "security": "APPROVED",
    "qa": "APPROVED"
  },
  "verification": {
    "lint": "clean",
    "boundaries": "52 files OK",
    "typecheck": "clean",
    "build": "clean",
    "unit_tests": "52 passed, 22 skipped",
    "integration_tests": "22 passed (PostgreSQL 16)",
    "verify_sh": "green"
  },
  "deliverables": [
    "migrations/003_identity_roles.js, migrations/004_users.js",
    "src/shared/auth.ts (Role, CurrentUser, Authenticate, requireRole, requireOwnerOrAdmin)",
    "src/modules/users/ (domain, application, infrastructure, api)",
    "identity: session-authenticator + role in model/responses",
    "app/build-app.ts: cookie plugin at root, Authenticate injection into users",
    "tests: shared/tests/auth.test.ts, app/tests/users.itest.ts, migrations.itest.ts updated"
  ],
  "known_followups": [
    "GET /users lists only users with a profile row; an admin user-listing endpoint may need an identity-owned port later",
    "Role promotion is out-of-band DB operation until an admin API exists"
  ]
}