coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified enrollment assurance release and automate provider contract tests
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m13s
Details
Authentication acceptance / provider-contract (push) Successful in 28s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 17:03:44 +02:00
parent 113f3a6296
commit ecca6cb4ba
3 changed files with 66 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/KEY-WP-0035-optional-mfa.md
View file

@ -81,7 +81,7 @@ Consumer source 632b1f1 deployed and Ready 1/1; CI, four provider HTTP checks an
```task
id: KEY-WP-0035-T05
status: progress
status: done
priority: high
```
@ -91,4 +91,12 @@ factors. Distinguish pending enrollment from completed enrollment and require
TOTP/HOTP serial/type evidence before AAL2. Cover pending/confirmed/cancelled,
existing-factor plus pending enrollment, missing/unknown state, incomplete pages,
password passthrough and static-password token rejection. All Go suites pass
locally; publish and verify the guarded issuer replacement before completion.
locally; source 113f3a6 was published, CI acceptance/build passed, and the guarded issuer replacement is live. See docs/enrollment-assurance-release-2026-09-13.md.
Provider recovery testing additionally proved that withdrawing reader policy
returns HTTP 200 with an empty list. Added and deployed a same-realm disabled,
unassigned visibility probe before no-factor decisions, with missing visibility
failing closed. Native scope proof passed. Isolated installed-provider tests
passed possession confirmation/cancellation, permission withdrawal/recovery and
provider-issued JWT expiry; these are now included in CI. T02/T03 remain the
actual optional-client and self-service browser activation gates.