41 lines
2.3 KiB
Markdown
41 lines
2.3 KiB
Markdown
|
# Platform administrator support release — 2026-09-13
|
||
|
|
|
||
|
|
Source b8506ef2e336f15eb85b3fd66072ddc7ade341c4.
|
||
|
|
Image `forgejo.coulomb.social/coulomb/user-engine@sha256:6c20229d5bc7bf7c89c10c0c3e8db66fbb76a71b3beec3adeed6b73ef140fb01`.
|
||
|
|
CI smoke run 147, image run 148 and journey run 149 passed.
|
||
|
|
|
||
|
|
Implemented operator-only platform activity search by exact support reference
|
||
|
|
and optional tenant, filtering before the 100-record display limit. Correlates
|
||
|
|
safe audit metadata and current delivery state, with links to delivery readback.
|
||
|
|
Missing evidence stays explicit. Raw payloads, free-text summaries and provider
|
||
|
|
error contents are excluded. Service recovery distinguishes configured adapters
|
||
|
|
from verified live health and provides assisted setup guidance.
|
||
|
|
|
||
|
|
Tenant restoration checks platform permission before confirmation, labels its
|
||
|
|
scope clearly and explains that it cannot prove ownership or bypass/reset factors.
|
||
|
|
No real user recovery, directory mutation or policy change was used in release
|
||
|
|
verification.
|
||
|
|
|
||
|
|
Validation:
|
||
|
|
- Full regression: 216 tests passed, seven opt-in PostgreSQL tests skipped;
|
||
|
|
layer conformance passed. This change does not alter database behavior.
|
||
|
|
- Platform role selection: 19 tests passed; JSON report retained alongside this file.
|
||
|
|
- Isolated Chromium: 16 checks passed, including investigation form submission,
|
||
|
|
no-match recovery, permission separation and factor-boundary confirmation.
|
||
|
|
- Packaging: four checks passed; source diff check passed.
|
||
|
|
- Platform completeness gate intentionally fails for P04/P05/P06; no complete
|
||
|
|
provider acceptance is claimed.
|
||
|
|
|
||
|
|
Image-only rollout tests cluster UID, deployment UID/resourceVersion and predecessor
|
||
|
|
image; canonical package pins retain unrelated hostname work. Rollback predecessor:
|
||
|
|
`sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
|
||
|
|
Recreate replaces the single portal pod and resets in-memory sessions.
|
||
|
|
|
||
|
|
Live result: portal Ready 1/1; eight existing public HTTP checks and the new
|
||
|
|
anonymous platform-activity denial/recovery check passed after readiness.
|
||
|
|
|
||
|
|
P04 factor recovery, P05 credential renewal/provider health and P06 effective policy
|
||
|
|
remain USER-WP-0030-T03, dependent on KEY-WP-0035/NK-WP-0033. The owner route was
|
||
|
|
rechecked and remains non-resolvable. See docs/platform-admin-acceptance.md for
|
||
|
|
operator steps and exact remaining custody/renewal contract. Workplan remains active.
|