From 6fe39a9b6a5ddbfcd441d62a5c3a8d2afde0a436 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 13 Sep 2026 14:27:35 +0200 Subject: [PATCH] Record provider credential renewal release and remaining owner handoff Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- workplans/USER-WP-0030-platform-admin-journeys.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/workplans/USER-WP-0030-platform-admin-journeys.md b/workplans/USER-WP-0030-platform-admin-journeys.md index 48e83d3..f1d921e 100644 --- a/workplans/USER-WP-0030-platform-admin-journeys.md +++ b/workplans/USER-WP-0030-platform-admin-journeys.md @@ -68,3 +68,5 @@ Prioritize P04/P05/P08: exact support-reference search across authorized platfor Provider gate rechecked: net-kingdom-privacyidea-admin-token remains non-resolvable. The owner playbook in ops-warden/wiki/playbooks/net-kingdom-sso-bind-credentials.md requires a concrete custody/renewal contract and approved attended action; it does not authorize reading live Secrets. P04 factor recovery/P05 credential operations/P06 effective policy remain T03 until that contract exists. T04 release evidence: docs/evidence/2026-09-13-platform-admin-support.md. Source b8506ef, 216 regression tests (seven optional skips), 19 platform tests, 16 browser checks; CI and rollout verified. T03 stays waiting; P04/P05/P06 completeness is not claimed. + +Provider consumer progress: KeyCape source 632b1f1 implements exclusive adminTokenFile renewal without issuer restart, fresh credential reads for both factor lookup and validation, no stale fallback, bounded/sanitized errors, request timeout and redirect refusal. OTP validation now requires successful provider status as well as a positive value. All Go suites pass; owner custody/issuance and live factor/policy acceptance remain T03. KEY-WP-0035-T04 tracks release evidence.