tegwick
ecca6cb4ba
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
2.3 KiB
Enrollment and assurance release — 2026-09-13
Source 113f3a6 includes the confirmed-enrollment/AAL2 fix from 122a0d1 and the
reader-scope safeguard. Final image:
forgejo.coulomb.social/coulomb/key-cape@sha256:75bdbe1cd8181949c9d2759506629f19bd5d62a7cf81293811affa76c6a43dd6.
CI acceptance run 54 and image run 55 passed for 113f3a6; the full Go suite
passed locally. Tests cover pending/confirmed enrollment, cancellation state,
existing factors alongside pending enrollment, malformed/unknown states,
incomplete pagination, password passthrough and static-password token rejection,
missing scope proof, lost realm visibility, probe assignment and realm mismatch.
The installed privacyIDEA image was tested in an isolated Job with in-memory
SQLite, synthetic accounts, no production config/credentials, no service-account
token and no production data volumes. provider-onboarding-contract-r7 passed:
password-only passthrough produces no OTP evidence; verification-pending TOTP
remains active; cancellation removes the pending token; explicit type=totp plus
OTP confirms enrollment; policy withdrawal gives a successful empty list;
restoration returns factor visibility; a genuinely provider-issued two-second
JWT expires and is rejected. The test source is retained under scripts and
wired into exact-commit CI with the tested provider image pinned by digest.
The production reader-scope probe KCFACTORSCOPE01 was generated provider-side, verified disabled/unassigned in coulomb, and checked with the real dedicated reader role. Native Job keycape-factor-scope-proof passed visibility, inert-state and temporary-session revocation checks. Its key never leaves privacyIDEA. KeyCape's readProbeSerial was set using Secret UID/resource-version CAS; exact readback preserved every other config byte and Secret field. Image rollouts used resource-version and expected-image guards. Canonical deployment pin is updated.
Mandatory and explicit AAL2 policies remain mandatory. No optional client policy or production self-service enrollment policy was changed by this release. The remaining T02/T03 work is actual self-service browser acceptance, scoped optional client activation and privileged portal assurance. P04 audited lost-factor recovery is still separate. Isolated provider tests do not claim those complete.