coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified enrollment assurance release and automate provider contract tests
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m13s
Details
Authentication acceptance / provider-contract (push) Successful in 28s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 17:03:44 +02:00
parent 113f3a6296
commit ecca6cb4ba
3 changed files with 66 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

35
docs/enrollment-assurance-release-2026-09-13.md Normal file
View file

@ -0,0 +1,35 @@
# Enrollment and assurance release — 2026-09-13
Source 113f3a6 includes the confirmed-enrollment/AAL2 fix from 122a0d1 and the
reader-scope safeguard. Final image:
`forgejo.coulomb.social/coulomb/key-cape@sha256:75bdbe1cd8181949c9d2759506629f19bd5d62a7cf81293811affa76c6a43dd6`.
CI acceptance run 54 and image run 55 passed for 113f3a6; the full Go suite
passed locally. Tests cover pending/confirmed enrollment, cancellation state,
existing factors alongside pending enrollment, malformed/unknown states,
incomplete pagination, password passthrough and static-password token rejection,
missing scope proof, lost realm visibility, probe assignment and realm mismatch.
The installed privacyIDEA image was tested in an isolated Job with in-memory
SQLite, synthetic accounts, no production config/credentials, no service-account
token and no production data volumes. `provider-onboarding-contract-r7` passed:
password-only passthrough produces no OTP evidence; verification-pending TOTP
remains active; cancellation removes the pending token; explicit type=totp plus
OTP confirms enrollment; policy withdrawal gives a successful empty list;
restoration returns factor visibility; a genuinely provider-issued two-second
JWT expires and is rejected. The test source is retained under scripts and
wired into exact-commit CI with the tested provider image pinned by digest.
The production reader-scope probe KCFACTORSCOPE01 was generated provider-side,
verified disabled/unassigned in coulomb, and checked with the real dedicated
reader role. Native Job keycape-factor-scope-proof passed visibility, inert-state
and temporary-session revocation checks. Its key never leaves privacyIDEA.
KeyCape's readProbeSerial was set using Secret UID/resource-version CAS; exact
readback preserved every other config byte and Secret field. Image rollouts used
resource-version and expected-image guards. Canonical deployment pin is updated.
Mandatory and explicit AAL2 policies remain mandatory. No optional client policy
or production self-service enrollment policy was changed by this release. The
remaining T02/T03 work is actual self-service browser acceptance, scoped optional
client activation and privileged portal assurance. P04 audited lost-factor
recovery is still separate. Isolated provider tests do not claim those complete.