user-engine/workplans/USER-WP-0030-platform-admin-journeys.md

---
id: USER-WP-0030
type: workplan
title: "Platform administration and operational recovery"
domain: communication
repo: user-engine
status: active
owner: codex
topic_slug: communication
created: "2026-09-13"
updated: "2026-09-13"
state_hub_workstream_id: "ab18c962-4ac4-5cf4-a8d9-edb773afbe8c"
---

Implements docs/account-journeys.md under USER-WP-0027. A passing local
suite is not evidence that an external provider flow works live.

## Expose scoped audit and delivery recovery

```task
id: USER-WP-0030-T01
status: done
priority: high
state_hub_task_id: "f51e3796-b649-586b-a228-c23f94804500"
```

P01/P03/P05/P08/T08: authorized browser views of safe audit metadata and delivery state, reference filtering, CSRF replay with readback, no raw payload/credential/error dumps.

## Make tenant lifecycle and bootstrap recoverable

```task
id: USER-WP-0030-T02
status: done
priority: high
state_hub_task_id: "09c2d30a-8230-5da2-b2d4-7a161259f557"
```

P02/P04/P07: preserve first-admin setup on retry without duplication, explicit tenant lifecycle confirmation, stale-version recovery and validation; verify cross-role isolation.

## Integrate provider policy and credential operations

```task
id: USER-WP-0030-T03
status: wait
priority: high
state_hub_task_id: "07510026-caee-54d7-998c-a8d2b2f17773"
```

P04–P06: owner-approved factor credential delivery/renewal and provider recovery/policy control. Depends on KEY-WP-0035/NK-WP-0033; no secret vending through portal or chat.


Validation: 210 database-enabled regression tests passed with no skips,
including independent-connection last-admin protection and nested bootstrap
rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
access integration remain explicitly open; no complete-journey claim is inferred.

## Finish platform support investigation and recovery clarity

```task
id: USER-WP-0030-T04
status: done
priority: high
state_hub_task_id: "09a571d9-e1f3-5289-a2c1-fe1c46d4e8ad"
```

Prioritize P04/P05/P08: exact support-reference search across authorized platform audit and delivery metadata, tenant narrowing before display limits, honest missing-evidence state, delivery readback links and actionable capability availability. Deny non-operators before recovery preview and explain tenant restoration versus provider factor/account-ownership recovery. Add regression and browser acceptance, publish and verify.

Provider gate rechecked: net-kingdom-privacyidea-admin-token remains non-resolvable. The owner playbook in ops-warden/wiki/playbooks/net-kingdom-sso-bind-credentials.md requires a concrete custody/renewal contract and approved attended action; it does not authorize reading live Secrets. P04 factor recovery/P05 credential operations/P06 effective policy remain T03 until that contract exists.

T04 release evidence: docs/evidence/2026-09-13-platform-admin-support.md. Source b8506ef, 216 regression tests (seven optional skips), 19 platform tests, 16 browser checks; CI and rollout verified. T03 stays waiting; P04/P05/P06 completeness is not claimed.

Provider consumer progress: KeyCape source 632b1f1 implements exclusive adminTokenFile renewal without issuer restart, fresh credential reads for both factor lookup and validation, no stale fallback, bounded/sanitized errors, request timeout and redirect refusal. OTP validation now requires successful provider status as well as a positive value. All Go suites pass; owner custody/issuance and live factor/policy acceptance remain T03. KEY-WP-0035-T04 tracks release evidence.