key-cape/docs/enrollment-assurance-release-2026-09-13.md

Enrollment and assurance release — 2026-09-13

Source 113f3a6 includes the confirmed-enrollment/AAL2 fix from 122a0d1 and the reader-scope safeguard. Final image: forgejo.coulomb.social/coulomb/key-cape@sha256:75bdbe1cd8181949c9d2759506629f19bd5d62a7cf81293811affa76c6a43dd6.

CI acceptance run 54 and image run 55 passed for 113f3a6; the full Go suite passed locally. Tests cover pending/confirmed enrollment, cancellation state, existing factors alongside pending enrollment, malformed/unknown states, incomplete pagination, password passthrough and static-password token rejection, missing scope proof, lost realm visibility, probe assignment and realm mismatch.

The installed privacyIDEA image was tested in an isolated Job with in-memory SQLite, synthetic accounts, no production config/credentials, no service-account token and no production data volumes. provider-onboarding-contract-r7 passed: password-only passthrough produces no OTP evidence; verification-pending TOTP remains active; cancellation removes the pending token; explicit type=totp plus OTP confirms enrollment; policy withdrawal gives a successful empty list; restoration returns factor visibility; a genuinely provider-issued two-second JWT expires and is rejected. The test source is retained under scripts and wired into exact-commit CI with the tested provider image pinned by digest.

The production reader-scope probe KCFACTORSCOPE01 was generated provider-side, verified disabled/unassigned in coulomb, and checked with the real dedicated reader role. Native Job keycape-factor-scope-proof passed visibility, inert-state and temporary-session revocation checks. Its key never leaves privacyIDEA. KeyCape's readProbeSerial was set using Secret UID/resource-version CAS; exact readback preserved every other config byte and Secret field. Image rollouts used resource-version and expected-image guards. Canonical deployment pin is updated.

Mandatory and explicit AAL2 policies remain mandatory. No optional client policy or production self-service enrollment policy was changed by this release. The remaining T02/T03 work is actual self-service browser acceptance, scoped optional client activation and privileged portal assurance. P04 audited lost-factor recovery is still separate. Isolated provider tests do not claim those complete.

Final CI evidence: run 56 succeeded for ecca6cb, including both the full Go suite and the isolated provider contract job. The final deployment is Ready 1/1; health, readiness, discovery and JWKS endpoints each returned HTTP 200. Workplan synchronization completed with zero failures; the generated T05 task binding is retained in its source record.