67 lines
4.3 KiB
Markdown
67 lines
4.3 KiB
Markdown
|
# Account journey release — 2026-09-13
|
||
|
|
|
||
|
|
Implemented and deployed user feedback/retry, tenant-scoped identity lifecycle,
|
||
|
|
last-admin protection, administrator succession, confirmation/stale-state handling,
|
||
|
|
actual login-name/onboarding/delivery guidance, scoped audit, platform delivery
|
||
|
|
retry and atomic/retryable first-admin bootstrap.
|
||
|
|
|
||
|
|
## Reproducible validation
|
||
|
|
|
||
|
|
- `PYTHONDONTWRITEBYTECODE=1 make test`: 210 tests, seven opt-in PostgreSQL skips;
|
||
|
|
layer conformance passed.
|
||
|
|
- Disposable PostgreSQL 16 on local loopback, tmpfs, no production records:
|
||
|
|
`USER_ENGINE_POSTGRES_TEST_DSN=postgresql://postgres@127.0.0.1:25432/postgres USER_ENGINE_POSTGRES_TEST_RESET=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src:tests uv run --no-project --with 'psycopg[binary]>=3.2,<4' python -m unittest discover -s tests`
|
||
|
|
passed all 210 with zero skips. Covers independent-connection concurrent
|
||
|
|
last-admin changes, advisory-lock cleanup, caller-transaction preservation and
|
||
|
|
nested bootstrap rollback. Disposable container stopped after validation.
|
||
|
|
- `make test-journeys JOURNEY_ARGS="--report /tmp/user-engine-journeys.json"`:
|
||
|
|
41 tests passed. Durable report: `2026-09-13-journey-report.json`.
|
||
|
|
- `make test-journeys JOURNEY_ARGS=--require-complete`: tests pass, command fails
|
||
|
|
intentionally because 15 of 29 journeys retain named gaps.
|
||
|
|
- `make test-browser-journeys`: 13 isolated Chromium checks passed against the
|
||
|
|
synthetic loopback fixture (user, tenant admin, platform operator).
|
||
|
|
- Identity provisioner regression: 20 tests passed.
|
||
|
|
- rapp-user-engine `make check`: four packaging checks passed.
|
||
|
|
- Portal CI commit 502a8e0: smoke run 141 and journey run 142 succeeded.
|
||
|
|
Provider CI commit 84f7635: smoke run 227 and journey run 228 succeeded.
|
||
|
|
CI uses pinned Python containers; browser and PostgreSQL acceptance were run
|
||
|
|
separately, not claimed as part of dependency-free CI.
|
||
|
|
|
||
|
|
## Deployed artifacts
|
||
|
|
|
||
|
|
Portal source 1127f852dde8b247bcc7a7f0caff805f25c5f37e, image CI run 138:
|
||
|
|
`forgejo.coulomb.social/coulomb/user-engine@sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
|
||
|
|
Provider source a0cc947bf65241ac93280d1d7c00d8fc8b7a7740, built from exact git archive:
|
||
|
|
`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6`.
|
||
|
|
|
||
|
|
Provider deployed first, portal second. Image-only patches tested cluster UID,
|
||
|
|
deployment UID/resource version and predecessor image. Both deployments Ready 1/1.
|
||
|
|
Canonical provider manifests and portal package pins updated; unrelated hostname
|
||
|
|
work preserved. In-pod provider inspection confirms tenant_access is present.
|
||
|
|
Ten live HTTP checks passed (public account/recovery/security, readiness, API denial,
|
||
|
|
and browser denial with recovery for platform operations and tenant activity).
|
||
|
|
Twelve fresh live Chromium checks passed, including expired callback recovery,
|
||
|
|
390px layout, shared sign-out confirmation/POST and final sign-in-only state.
|
||
|
|
No real user's directory groups or factors were mutated for these checks.
|
||
|
|
The Recreate portal rollout briefly returned 503 while replacing its single pod;
|
||
|
|
checks passed after readiness. In-memory sessions and unused provider password
|
||
|
|
setup grants are reset by restarts.
|
||
|
|
|
||
|
|
Rollback images (retain all other deployment configuration):
|
||
|
|
- Portal: `sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f`.
|
||
|
|
- Provider: `sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6`.
|
||
|
|
Rollback portal first if removing the new provider contract; rollback was not needed.
|
||
|
|
|
||
|
|
## Live work retained
|
||
|
|
|
||
|
|
This is not complete acceptance of all 29 journeys. USER-WP-0028-T02 and
|
||
|
|
USER-WP-0026-T03 retain authoritative application catalogue/admission integration;
|
||
|
|
current membership records cannot prove effective access. USER-WP-0028-T03 and
|
||
|
|
USER-WP-0030-T03 depend on KEY-WP-0035/NK-WP-0033 factor credential custody and
|
||
|
|
verified enrollment/cancel/replacement/recovery/policy behavior. MFA handoff stays
|
||
|
|
unavailable; optional OTP enforcement has not been deployed. The coverage report
|
||
|
|
also names mail delivery/receipt and real identity-switching acceptance gaps.
|
||
|
|
USER-WP-0027-T06 remains open for complete integrated acceptance, including
|
||
|
|
VERGABE-WP-0019. Local provider calls and local persistence are not one atomic
|
||
|
|
transaction: desired-state retry/readback recovers an interruption between them.
|