[thecaticorn01]

Add admin/adm to create and hide a local administrator without running enrollment suppression. Reject normal mode before target access, and return from dry-run before resolving or mounting the Data volume. FileVault integration remains an attempt through the existing helper and must be verified after reboot.

Validation: the Recovery guard fails on the original head; the strengthened dry-run regression fails before the early return and passes after it in both entrypoints. make ci exits 0 with 113/113 tests and no skips. The integrated argument/daemon/diagnostic matrix also passes 13/13 under GNU Bash 3.2. Real account creation, hiding, FileVault, and Recovery hardware were not exercised.

Final diff: 239 added lines across 6 files.

[vercel]

@thecaticorn01 is attempting to deploy a commit to the MDA Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

The job was not started because the account is locked due to a billing issue.

[thecaticorn01]

Full disclosure: the PR title and summary were AI-generated using Google Gemini. However, all code modifications were written solely by me (@thecaticorn01) without any AI involvement.

[mateussiqueira]

The original head let cmd_admin resolve a target and reach the administrator-creation flow even when is_recovery returned false. I reproduced this in both entrypoints with inert stubs, then added commit 1aa394a to reject normal mode before target access.

The regression fails on the original head and passes after the fix. The dry-run control also passes for both entrypoints; the focused admin/logging suite passes 7/7. The final PR is 236 changed lines across 7 files, within the house limit. These tests do not validate real account creation, hiding, or FileVault on macOS.

make lint remains blocked by the pre-existing findings in #26, and the full suite is not approved. Keep this PR unmerged until the mandatory local gates pass.

[mateussiqueira]

Reviewed the final 239-line/6-file diff, account-flow composition, Recovery guard, dry-run ordering, and documentation limits. The dry-run regression now enters through cmd_admin and proves the resolver is never called. make ci passes 113/113 without skips; the integrated GNU Bash 3.2 matrix passes 13/13. The suite does not certify actual account creation, hiding, or FileVault on a Mac.