Record completed P06 session and live policy evidence

memory/working/2026-09-14-p06-session.md

@@ -0,0 +1,33 @@
+# P06 resumed and deployed
+
+Resumed the interrupted September 12–13 session at its last request, “Do P06
+please.” Completed platform authentication policy under USER-WP-0033,
+USER-WP-0030-T03 and KEY-WP-0035. The workload-sizing workplan CUST-WP-0071 was
+unrelated to the interruption and was not started.
+
+Fixed provider acceptance fixture races (TOTP selection and token-detail
+readiness) and its incorrect OTP submission endpoint. Native installed-provider
+acceptance and five provider browser checks pass. Portal browser: 30 checks.
+Final P01–P08 completeness: 33 tests, zero skips, no unresolved platform journeys.
+Full Go/provider CI and portal CI passed; the interrupted run had also passed
+232 database-backed portal tests.
+
+Published source: key-cape e0b3c25; user-engine 3bd1827; net-kingdom a549617.
+Release/evidence commits: user-engine 8d525d9; key-cape e17b3f4;
+net-kingdom bea425c; rapp-user-engine 909d8c6.
+
+Ordered rollout completed: portal MFA guards, provider enrollment guard and
+pending-only self-service cancellation, then optional-after-enrollment policy
+for user-engine-portal and vergabe-demo-company. Other client configuration
+bytes were preserved. Policy PVC readback confirms both modes at revision 0.
+Health/readiness succeeds; anonymous policy requests return 403.
+
+Evidence and exact before/after image digests:
+`/home/worsch/user-engine/docs/evidence/2026-09-13-p06-authentication-policy.md`
+and adjacent rollout/completeness JSON. State Hub decision:
+f4f11a4b-bd71-4673-971e-1048fa075cba.
+
+Actual invited-user/application sign-in remains in existing USER-WP-0028,
+KEY-WP-0034 and VERGABE-WP-0019. These were not closed. Pre-existing hostname
+edits and other unrelated working-tree changes in sibling repos were preserved.
+Do not rerun source-publication or rollout scripts from /tmp indiscriminately.