tegwick
502a2d5c56
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
41 lines
2.7 KiB
Markdown
41 lines
2.7 KiB
Markdown
# Enrollment and assurance release — 2026-09-13
|
|
|
|
Source 113f3a6 includes the confirmed-enrollment/AAL2 fix from 122a0d1 and the
|
|
reader-scope safeguard. Final image:
|
|
`forgejo.coulomb.social/coulomb/key-cape@sha256:75bdbe1cd8181949c9d2759506629f19bd5d62a7cf81293811affa76c6a43dd6`.
|
|
|
|
CI acceptance run 54 and image run 55 passed for 113f3a6; the full Go suite
|
|
passed locally. Tests cover pending/confirmed enrollment, cancellation state,
|
|
existing factors alongside pending enrollment, malformed/unknown states,
|
|
incomplete pagination, password passthrough and static-password token rejection,
|
|
missing scope proof, lost realm visibility, probe assignment and realm mismatch.
|
|
|
|
The installed privacyIDEA image was tested in an isolated Job with in-memory
|
|
SQLite, synthetic accounts, no production config/credentials, no service-account
|
|
token and no production data volumes. `provider-onboarding-contract-r7` passed:
|
|
password-only passthrough produces no OTP evidence; verification-pending TOTP
|
|
remains active; cancellation removes the pending token; explicit type=totp plus
|
|
OTP confirms enrollment; policy withdrawal gives a successful empty list;
|
|
restoration returns factor visibility; a genuinely provider-issued two-second
|
|
JWT expires and is rejected. The test source is retained under scripts and
|
|
wired into exact-commit CI with the tested provider image pinned by digest.
|
|
|
|
The production reader-scope probe KCFACTORSCOPE01 was generated provider-side,
|
|
verified disabled/unassigned in coulomb, and checked with the real dedicated
|
|
reader role. Native Job keycape-factor-scope-proof passed visibility, inert-state
|
|
and temporary-session revocation checks. Its key never leaves privacyIDEA.
|
|
KeyCape's readProbeSerial was set using Secret UID/resource-version CAS; exact
|
|
readback preserved every other config byte and Secret field. Image rollouts used
|
|
resource-version and expected-image guards. Canonical deployment pin is updated.
|
|
|
|
Mandatory and explicit AAL2 policies remain mandatory. No optional client policy
|
|
or production self-service enrollment policy was changed by this release. The
|
|
remaining T02/T03 work is actual self-service browser acceptance, scoped optional
|
|
client activation and privileged portal assurance. P04 audited lost-factor
|
|
recovery is still separate. Isolated provider tests do not claim those complete.
|
|
|
|
Final CI evidence: [run 56](https://forgejo.coulomb.social/coulomb/key-cape/actions/runs/56)
|
|
succeeded for ecca6cb, including both the full Go suite and the isolated provider
|
|
contract job. The final deployment is Ready 1/1; health, readiness, discovery and
|
|
JWKS endpoints each returned HTTP 200. Workplan synchronization completed with
|
|
zero failures; the generated T05 task binding is retained in its source record.
|