[servicememeai]

Deployment slice for Hub's one-shot administrator roster

Linked to Hub #64 and the Hub startup sync PR in that Issue. No component-wide startup rebuild/periodic worker.

• scripts/scripts_14.0/start.py: run one cf_sync_provider_admins management command after ordinary Seafile/Seahub startup. It is not an AppConfig.ready or Gunicorn worker hook.
• scripts/scripts_cf14.0/cloudfile_admin_startup.py: process call bounded to 30 seconds, source call separately bounded, failure logs FAILED while returning normally so an unavailable enterprise Directory does not fail the file platform.
• CF_PROVIDER_ADMIN_STARTUP_SYNC_ENABLED defaults false in generic Compose and settings; optional Provider callable can be configured. Etech example reuses existing machine Directory connection.
• Standalone CE & existing Etech behavior unchanged until operator explicitly enables. No forced runtime migrations or new tables.
• Focused subprocess tests for one call/nonroot/success/timeout. No image build from this PR. Draft, requires matching Hub+EAP code SHAs before a consolidated DEV acceptance.

Admin changes while running take effect on next startup/manual invocation, not per request. Existing SSO/Session expiry governs sessions. Outage retains existing CE admin roles, operator checks failure log and can manually rerun.

[servicememeai]

2026-10-24 GitHub-only continuation:

• Hub /scripts/gc.sh haiwen/seafile-docker#71 head c9ef6a896ea595e0724ac8fa8c352de52226bbc1: early validation of explicit managed-account scope before CE identity preparation, rejecting malformed/duplicate/reserved entries. New mocked SQL control-flow regression covers grant, second-run idempotence, scoped revocation and transaction rollback. GitHub quick static check success (Actions 40077061997).
• Docker feat(startup): run bounded provider admin sync once after CloudFile starts #38 head eb157992b94f36450377d9048c9db0481a4083fd: do not report APPLIED merely because child process exited zero; require an explicit CF_ADMIN_SYNC APPLIED receipt, test SKIPPED/missing receipt and Etech sample admin with sync disabled by default. GitHub static success (Actions 40077190987).
• EAP docs: register native directory-share permission qualification #28 head 7102b6820300a40a7b882abc2c3786a860f80c97 unchanged; no GitHub Actions checks available for Java tests.
• Internal acceptance document updated in eap-cloudfile PR fix(build): unify full dev builds and immutable receipts #26 (merged as de375bc).
• Verified the Seafile-supported seahub.sh python-env python3 seahub/manage.py invocation; no unnecessary Docker command rewrite.
• All 3 feature PRs remain Draft. GitHub unit/mock tests are not a substitute for live CE/MariaDB transactions, EAP trusted roster, Authentik/SSO and real Docker startup validation. No deploy, no admin changes, feature stays disabled.