Record and pin verified account journey release

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

docs/evidence/2026-09-13-journey-release.md

@@ -0,0 +1,66 @@
+# Account journey release — 2026-09-13
+
+Implemented and deployed user feedback/retry, tenant-scoped identity lifecycle,
+last-admin protection, administrator succession, confirmation/stale-state handling,
+actual login-name/onboarding/delivery guidance, scoped audit, platform delivery
+retry and atomic/retryable first-admin bootstrap.
+
+## Reproducible validation
+
+- `PYTHONDONTWRITEBYTECODE=1 make test`: 210 tests, seven opt-in PostgreSQL skips;
+  layer conformance passed.
+- Disposable PostgreSQL 16 on local loopback, tmpfs, no production records:
+  `USER_ENGINE_POSTGRES_TEST_DSN=postgresql://postgres@127.0.0.1:25432/postgres USER_ENGINE_POSTGRES_TEST_RESET=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src:tests uv run --no-project --with 'psycopg[binary]>=3.2,<4' python -m unittest discover -s tests`
+  passed all 210 with zero skips. Covers independent-connection concurrent
+  last-admin changes, advisory-lock cleanup, caller-transaction preservation and
+  nested bootstrap rollback. Disposable container stopped after validation.
+- `make test-journeys JOURNEY_ARGS="--report /tmp/user-engine-journeys.json"`:
+  41 tests passed. Durable report: `2026-09-13-journey-report.json`.
+- `make test-journeys JOURNEY_ARGS=--require-complete`: tests pass, command fails
+  intentionally because 15 of 29 journeys retain named gaps.
+- `make test-browser-journeys`: 13 isolated Chromium checks passed against the
+  synthetic loopback fixture (user, tenant admin, platform operator).
+- Identity provisioner regression: 20 tests passed.
+- rapp-user-engine `make check`: four packaging checks passed.
+- Portal CI commit 502a8e0: smoke run 141 and journey run 142 succeeded.
+  Provider CI commit 84f7635: smoke run 227 and journey run 228 succeeded.
+  CI uses pinned Python containers; browser and PostgreSQL acceptance were run
+  separately, not claimed as part of dependency-free CI.
+
+## Deployed artifacts
+
+Portal source 1127f852dde8b247bcc7a7f0caff805f25c5f37e, image CI run 138:
+`forgejo.coulomb.social/coulomb/user-engine@sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
+Provider source a0cc947bf65241ac93280d1d7c00d8fc8b7a7740, built from exact git archive:
+`forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6`.
+
+Provider deployed first, portal second. Image-only patches tested cluster UID,
+deployment UID/resource version and predecessor image. Both deployments Ready 1/1.
+Canonical provider manifests and portal package pins updated; unrelated hostname
+work preserved. In-pod provider inspection confirms tenant_access is present.
+Ten live HTTP checks passed (public account/recovery/security, readiness, API denial,
+and browser denial with recovery for platform operations and tenant activity).
+Twelve fresh live Chromium checks passed, including expired callback recovery,
+390px layout, shared sign-out confirmation/POST and final sign-in-only state.
+No real user's directory groups or factors were mutated for these checks.
+The Recreate portal rollout briefly returned 503 while replacing its single pod;
+checks passed after readiness. In-memory sessions and unused provider password
+setup grants are reset by restarts.
+
+Rollback images (retain all other deployment configuration):
+- Portal: `sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f`.
+- Provider: `sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6`.
+Rollback portal first if removing the new provider contract; rollback was not needed.
+
+## Live work retained
+
+This is not complete acceptance of all 29 journeys. USER-WP-0028-T02 and
+USER-WP-0026-T03 retain authoritative application catalogue/admission integration;
+current membership records cannot prove effective access. USER-WP-0028-T03 and
+USER-WP-0030-T03 depend on KEY-WP-0035/NK-WP-0033 factor credential custody and
+verified enrollment/cancel/replacement/recovery/policy behavior. MFA handoff stays
+unavailable; optional OTP enforcement has not been deployed. The coverage report
+also names mail delivery/receipt and real identity-switching acceptance gaps.
+USER-WP-0027-T06 remains open for complete integrated acceptance, including
+VERGABE-WP-0019. Local provider calls and local persistence are not one atomic
+transaction: desired-state retry/readback recovers an interruption between them.

docs/evidence/2026-09-13-journey-report.json

@@ -0,0 +1,323 @@
+{
+  "tests_run": 41,
+  "test_success": true,
+  "skipped": 0,
+  "journeys": [
+    {
+      "id": "U01",
+      "role": "user",
+      "implementation": "implemented",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_anonymous_and_expired_sessions_have_login_without_logout",
+        "test_account_clarity.AccountClarityTests.test_authenticated_roles_have_logout_without_login"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U02",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_web.PortalApplicationTests.test_expired_browser_session_and_provider_outage_fail_closed",
+        "test_account_recovery.AccountRecoveryTests.test_failed_callback_has_clean_recovery_and_no_loop"
+      ],
+      "remaining": "KEY-WP-0035: actual no-factor/enrolled login needs provider credential and policy rollout.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U03",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_web.PortalApplicationTests.test_browser_invitation_acceptance_and_onboarding_status",
+        "test_web.PortalApplicationTests.test_invitation_lifecycle_is_versioned_and_replay_safe"
+      ],
+      "remaining": "Live notification delivery and invited-person acceptance remain unverified.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U04",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry"
+      ],
+      "remaining": "Provider password reset is separately tested in net-kingdom; live email recovery remains unresolved.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U05",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
+      ],
+      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U06",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
+      ],
+      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U07",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
+      ],
+      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U08",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
+      ],
+      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U09",
+      "role": "user",
+      "implementation": "partial",
+      "tests": [
+        "test_account_recovery.AccountRecoveryTests.test_account_workload_list_is_scoped_to_current_user"
+      ],
+      "remaining": "USER-WP-0028-T02/USER-WP-0026-T03: authoritative application catalogue and access requests not implemented.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U10",
+      "role": "user",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_wrong_shared_identity_recovery_does_not_claim_a_known_session",
+        "test_portal_navigation.PortalNavigationTests.test_navigation_does_not_leak_between_operator_member_and_anonymous"
+      ],
+      "remaining": "Authenticated multi-identity/tenant switching must be verified against live issuer.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U11",
+      "role": "user",
+      "implementation": "implemented",
+      "tests": [
+        "test_account_recovery.AccountRecoveryTests.test_shared_logout_clears_portal_then_uses_provider_confirmation",
+        "test_portal_navigation.PortalNavigationTests.test_get_logout_only_confirms_and_bad_csrf_does_not_end_session",
+        "test_portal_navigation.PortalNavigationTests.test_expired_session_logout_clears_stale_cookie"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U12",
+      "role": "user",
+      "implementation": "implemented",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_browser_denial_is_recoverable_while_api_remains_json",
+        "test_account_recovery.AccountRecoveryTests.test_recovery_is_public_and_never_trusts_query_identity"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "U13",
+      "role": "user",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.UserJourneys.test_profile_validation_keeps_safe_input_and_retry_saves",
+        "test_web.PortalApplicationTests.test_browser_invitation_acceptance_and_onboarding_status"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T01",
+      "role": "tenant_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.TenantAdminJourneys.test_wrong_role_or_tenant_never_calls_provider",
+        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T02",
+      "role": "tenant_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_web.PortalApplicationTests.test_invitation_lifecycle_is_versioned_and_replay_safe",
+        "test_journey_roles.TenantAdminJourneys.test_invalid_role_cannot_create_partial_account",
+        "test_journey_roles.TenantAdminJourneys.test_invitation_delivery_reports_queue_failure_and_adapter_acceptance"
+      ],
+      "remaining": "Local invitation queue/failure/adapter-acceptance states are implemented. Actual receipt by the invited person remains live provider acceptance under U03.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T03",
+      "role": "tenant_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry",
+        "test_web.PortalApplicationTests.test_admin_form_requires_csrf_and_supports_two_step_provisioning"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T04",
+      "role": "tenant_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry",
+        "test_journey_roles.TenantAdminJourneys.test_provider_failure_retains_local_state_and_retry_recovers"
+      ],
+      "remaining": "Provider-owned lost-factor recovery still unverified; password setup assistance is supported.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T05",
+      "role": "tenant_admin",
+      "implementation": "partial",
+      "tests": [
+        "test_journey_roles.TenantAdminJourneys.test_invalid_role_cannot_create_partial_account"
+      ],
+      "remaining": "Tenant roles are managed; authoritative application-specific grant/revoke integration remains USER-WP-0028-T02.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T06",
+      "role": "tenant_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.TenantAdminJourneys.test_confirmation_cancel_tamper_and_stale_state",
+        "test_journey_roles.TenantAdminJourneys.test_tenant_removal_preserves_shared_identity_and_other_account",
+        "test_journey_roles.TenantAdminJourneys.test_provider_failure_retains_local_state_and_retry_recovers",
+        "test_journey_roles.TenantAdminJourneys.test_disabled_account_cannot_be_reactivated_by_password_setup"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T07",
+      "role": "tenant_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_web.PortalApplicationTests.test_admin_form_requires_csrf_and_supports_two_step_provisioning"
+      ],
+      "remaining": "Provider factor/password evidence remains explicitly unavailable; provider verification is tracked under U05-U08.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "T08",
+      "role": "tenant_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.TenantAdminJourneys.test_last_admin_protected_then_successor_allows_transition",
+        "test_journey_roles.TenantAdminJourneys.test_admin_succession_promote_then_demote_with_confirmation",
+        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload",
+        "test_journey_roles.TenantAdminJourneys.test_concurrent_admin_suspensions_keep_one_active_admin"
+      ],
+      "remaining": "Disposable PostgreSQL cross-connection/rollback suite also passed; run its separate opt-in suite for DB changes.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P01",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P02",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin",
+        "test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin",
+        "test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes"
+      ],
+      "remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P03",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P04",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused"
+      ],
+      "remaining": "Tenant identity recovery is scoped; verified OTP/account-ownership recovery remains provider-owned.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P05",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard"
+      ],
+      "remaining": "Local delivery record operations work; approved factor credential renewal and mail receipt remain external dependencies.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P06",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_provider_handoff_rejects_unsafe_configuration"
+      ],
+      "remaining": "Boundary test only. KeyCape policy suite covers optional/required/step-up; live policy management and provider rollout remain KEY-WP-0035.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P07",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails",
+        "test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P08",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
+        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    }
+  ],
+  "complete": false
+}

workplans/USER-WP-0027-account-journey-clarity.md

@@ -79,7 +79,7 @@ assurance claims, redirect return parameters or manual step completion.
 
 ```task
 id: USER-WP-0027-T05
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "92906113-e28b-58d3-95a7-779e815d1ced"
 ```
@@ -94,7 +94,7 @@ are starting points, not browser acceptance. Split into owner workplans as neede
 
 ```task
 id: USER-WP-0027-T06
-status: todo
+status: progress
 priority: high
 state_hub_task_id: "550886ca-f916-5637-9639-b4134b0da939"
 ```
@@ -109,3 +109,5 @@ Record live evidence and hand off any residuals as live work before closing.
 Implementation is split into USER-WP-0028 (user), USER-WP-0029 (tenant admin),
 USER-WP-0030 (platform admin), and USER-WP-0031 (automated acceptance). These
 are live workplans, not residuals parked only in the journey document.
+
+Implemented admin journeys and automated suites are deployed; see docs/evidence/2026-09-13-journey-release.md and its machine-readable report. Full acceptance remains incomplete for the named integration/provider gaps.

workplans/USER-WP-0028-user-journey-acceptance.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: communication
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "145df9d5-a7e9-5d20-8280-9d3ea069838b"
 ---
 
 Implements docs/account-journeys.md under USER-WP-0027. A passing local
@@ -20,6 +21,7 @@ suite is not evidence that an external provider flow works live.
 id: USER-WP-0028-T01
 status: done
 priority: high
+state_hub_task_id: "baa9938e-271b-5590-bdc0-5c844070144c"
 ```
 
 U01–U04/U10–U13: preserve safe profile input on validation failure; confirm saves, expose actual login name at password handoff, keep invitation/expired/session recovery reachable. Cover success, denial, provider interruption and retry.
@@ -30,6 +32,7 @@ U01–U04/U10–U13: preserve safe profile input on validation failure; confirm
 id: USER-WP-0028-T02
 status: todo
 priority: high
+state_hub_task_id: "5d1bf977-034d-5448-b4fb-5a8b630af6ba"
 ```
 
 U09 and T05: integrate a supported catalogue/admission source and scoped grants/revocation. Do not present static links or membership as effective authorization. Continues USER-WP-0026-T03; establish provider contract before deployment.
@@ -40,6 +43,7 @@ U09 and T05: integrate a supported catalogue/admission source and scoped grants/
 id: USER-WP-0028-T03
 status: wait
 priority: high
+state_hub_task_id: "40e46e52-31ac-5abd-8793-04c1b7b82df3"
 ```
 
 U05–U08: depends on KEY-WP-0035 and NK-WP-0033 credential custody. Verify enrollment/cancel/replace/lost-factor recovery and old-AAL1-session behavior before enabling live handoff. No stub acceptance.

workplans/USER-WP-0029-tenant-admin-journeys.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: communication
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "23963e14-255d-5935-b3d9-423e6f67f1d8"
 ---
 
 Implements docs/account-journeys.md under USER-WP-0027. A passing local
@@ -20,6 +21,7 @@ suite is not evidence that an external provider flow works live.
 id: USER-WP-0029-T01
 status: done
 priority: high
+state_hub_task_id: "c22c389c-0ee8-5f96-bd83-f584d29fce6e"
 ```
 
 T01/T03/T04/T06: reject non-admin and wrong-tenant user IDs before provisioning/recovery/lifecycle calls; bind invitation operations to route tenant; protect shared identities from global tenant-scoped mutation.
@@ -30,6 +32,7 @@ T01/T03/T04/T06: reject non-admin and wrong-tenant user IDs before provisioning/
 id: USER-WP-0029-T02
 status: done
 priority: high
+state_hub_task_id: "ce241cf7-b2fc-505c-a3e6-644ddb6689e9"
 ```
 
 T06/T08: preview target/scope/action, CSRF-bound confirmation, reject stale state and last-admin removal, provide cancel and recovery. Keep domain/API guards as well as UI checks. Document concurrency/external propagation limits.
@@ -40,6 +43,7 @@ T06/T08: preview target/scope/action, CSRF-bound confirmation, reject stale stat
 id: USER-WP-0029-T03
 status: done
 priority: high
+state_hub_task_id: "74664b6b-cc98-5332-a0d0-6a1a09a55556"
 ```
 
 T02/T03/T04/T07: show actual directory login separately from display name, account state, provider uncertainty, invitation delivery status and appropriate next steps; prevent duplicate rows from workload memberships.

workplans/USER-WP-0030-platform-admin-journeys.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: communication
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "ab18c962-4ac4-5cf4-a8d9-edb773afbe8c"
 ---
 
 Implements docs/account-journeys.md under USER-WP-0027. A passing local
@@ -20,6 +21,7 @@ suite is not evidence that an external provider flow works live.
 id: USER-WP-0030-T01
 status: done
 priority: high
+state_hub_task_id: "f51e3796-b649-586b-a228-c23f94804500"
 ```
 
 P01/P03/P05/P08/T08: authorized browser views of safe audit metadata and delivery state, reference filtering, CSRF replay with readback, no raw payload/credential/error dumps.
@@ -30,6 +32,7 @@ P01/P03/P05/P08/T08: authorized browser views of safe audit metadata and deliver
 id: USER-WP-0030-T02
 status: done
 priority: high
+state_hub_task_id: "09c2d30a-8230-5da2-b2d4-7a161259f557"
 ```
 
 P02/P04/P07: preserve first-admin setup on retry without duplication, explicit tenant lifecycle confirmation, stale-version recovery and validation; verify cross-role isolation.
@@ -40,6 +43,7 @@ P02/P04/P07: preserve first-admin setup on retry without duplication, explicit t
 id: USER-WP-0030-T03
 status: wait
 priority: high
+state_hub_task_id: "07510026-caee-54d7-998c-a8d2b2f17773"
 ```
 
 P04–P06: owner-approved factor credential delivery/renewal and provider recovery/policy control. Depends on KEY-WP-0035/NK-WP-0033; no secret vending through portal or chat.

workplans/USER-WP-0031-automated-journey-suites.md

@@ -4,11 +4,12 @@ type: workplan
 title: "Automated user and administrator journey suites"
 domain: communication
 repo: user-engine
-status: active
+status: finished
 owner: codex
 topic_slug: communication
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "3579f6bb-464e-506f-870c-e4e1b73c161c"
 ---
 
 Implements docs/account-journeys.md under USER-WP-0027. A passing local
@@ -20,6 +21,7 @@ suite is not evidence that an external provider flow works live.
 id: USER-WP-0031-T01
 status: done
 priority: high
+state_hub_task_id: "7243f931-32c8-585a-b9a4-decb6f35fd57"
 ```
 
 Run synthetic identities through actual WSGI routes and domain stores, with controlled provider failure/retry fixtures. Assert success, denial, unchanged state on failure, recovery and tenant isolation. Add make test-journeys and CI execution.
@@ -30,6 +32,7 @@ Run synthetic identities through actual WSGI routes and domain stores, with cont
 id: USER-WP-0031-T02
 status: done
 priority: high
+state_hub_task_id: "fd222e7c-00c9-525c-b09d-d5851277f011"
 ```
 
 Map every journey to real tests and explicit external acceptance blockers. Report missing live acceptance as incomplete, never a passing placeholder. Keep matrix/workplans synchronized.
@@ -38,8 +41,9 @@ Map every journey to real tests and explicit external acceptance blockers. Repor
 
 ```task
 id: USER-WP-0031-T03
-status: progress
+status: done
 priority: high
+state_hub_task_id: "3b04c187-a69d-5c30-b73d-ae36792d4d04"
 ```
 
 Run full unit/conformance suites and live read-only smoke, deploy digest-pinned reviewed source with CAS and rollback evidence. Retain provider-dependent journeys as live tasks until external acceptance passes.
@@ -49,3 +53,5 @@ Validation: 210 database-enabled regression tests passed with no skips,
 including independent-connection last-admin protection and nested bootstrap
 rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
 access integration remain explicitly open; no complete-journey claim is inferred.
+
+Release evidence: docs/evidence/2026-09-13-journey-release.md. Residual integration and live acceptance remain in USER-WP-0028-T02/T03, USER-WP-0030-T03 and USER-WP-0027-T06; these live records precede closure.