diff --git a/docs/evidence/2026-09-13-platform-admin-report.json b/docs/evidence/2026-09-13-platform-admin-report.json new file mode 100644 index 0000000..aa101db --- /dev/null +++ b/docs/evidence/2026-09-13-platform-admin-report.json @@ -0,0 +1,100 @@ +{ + "tests_run": 19, + "test_success": true, + "skipped": 0, + "journeys": [ + { + "id": "P01", + "role": "platform_admin", + "implementation": "implemented", + "tests": [ + "test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership", + "test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority" + ], + "remaining": "", + "automated_result": "passed" + }, + { + "id": "P02", + "role": "platform_admin", + "implementation": "implemented", + "tests": [ + "test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin", + "test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin", + "test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes" + ], + "remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority.", + "automated_result": "passed" + }, + { + "id": "P03", + "role": "platform_admin", + "implementation": "implemented", + "tests": [ + "test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant", + "test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves" + ], + "remaining": "", + "automated_result": "passed" + }, + { + "id": "P04", + "role": "platform_admin", + "implementation": "external-blocked", + "tests": [ + "test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused", + "test_platform_support.PlatformSupportJourneys.test_recovery_denied_before_preview_and_operator_sees_factor_boundary" + ], + "remaining": "Tenant identity recovery is scoped; verified OTP/account-ownership recovery remains provider-owned.", + "automated_result": "passed" + }, + { + "id": "P05", + "role": "platform_admin", + "implementation": "external-blocked", + "tests": [ + "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard", + "test_platform_support.PlatformSupportJourneys.test_service_capabilities_distinguish_configuration_from_health" + ], + "remaining": "Local delivery record operations work; approved factor credential renewal and mail receipt remain external dependencies.", + "automated_result": "passed" + }, + { + "id": "P06", + "role": "platform_admin", + "implementation": "external-blocked", + "tests": [ + "test_account_clarity.AccountClarityTests.test_provider_handoff_rejects_unsafe_configuration" + ], + "remaining": "Boundary test only. KeyCape policy suite covers optional/required/step-up; live policy management and provider rollout remain KEY-WP-0035.", + "automated_result": "passed" + }, + { + "id": "P07", + "role": "platform_admin", + "implementation": "implemented", + "tests": [ + "test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails", + "test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority" + ], + "remaining": "", + "automated_result": "passed" + }, + { + "id": "P08", + "role": "platform_admin", + "implementation": "implemented", + "tests": [ + "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard", + "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload", + "test_platform_support.PlatformSupportJourneys.test_operator_correlates_actions_and_delivery_without_raw_content", + "test_platform_support.PlatformSupportJourneys.test_activity_denies_nonoperators_and_mutations", + "test_platform_support.PlatformSupportJourneys.test_exact_filters_apply_before_display_limit_and_missing_is_explicit", + "test_platform_support.PlatformSupportJourneys.test_filter_values_are_escaped_and_bounded" + ], + "remaining": "", + "automated_result": "passed" + } + ], + "complete": false +} diff --git a/docs/evidence/2026-09-13-platform-admin-support.md b/docs/evidence/2026-09-13-platform-admin-support.md new file mode 100644 index 0000000..7cb842d --- /dev/null +++ b/docs/evidence/2026-09-13-platform-admin-support.md @@ -0,0 +1,40 @@ +# Platform administrator support release — 2026-09-13 + +Source b8506ef2e336f15eb85b3fd66072ddc7ade341c4. +Image `forgejo.coulomb.social/coulomb/user-engine@sha256:6c20229d5bc7bf7c89c10c0c3e8db66fbb76a71b3beec3adeed6b73ef140fb01`. +CI smoke run 147, image run 148 and journey run 149 passed. + +Implemented operator-only platform activity search by exact support reference +and optional tenant, filtering before the 100-record display limit. Correlates +safe audit metadata and current delivery state, with links to delivery readback. +Missing evidence stays explicit. Raw payloads, free-text summaries and provider +error contents are excluded. Service recovery distinguishes configured adapters +from verified live health and provides assisted setup guidance. + +Tenant restoration checks platform permission before confirmation, labels its +scope clearly and explains that it cannot prove ownership or bypass/reset factors. +No real user recovery, directory mutation or policy change was used in release +verification. + +Validation: +- Full regression: 216 tests passed, seven opt-in PostgreSQL tests skipped; + layer conformance passed. This change does not alter database behavior. +- Platform role selection: 19 tests passed; JSON report retained alongside this file. +- Isolated Chromium: 16 checks passed, including investigation form submission, + no-match recovery, permission separation and factor-boundary confirmation. +- Packaging: four checks passed; source diff check passed. +- Platform completeness gate intentionally fails for P04/P05/P06; no complete + provider acceptance is claimed. + +Image-only rollout tests cluster UID, deployment UID/resourceVersion and predecessor +image; canonical package pins retain unrelated hostname work. Rollback predecessor: +`sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`. +Recreate replaces the single portal pod and resets in-memory sessions. + +Live result: portal Ready 1/1; eight existing public HTTP checks and the new +anonymous platform-activity denial/recovery check passed after readiness. + +P04 factor recovery, P05 credential renewal/provider health and P06 effective policy +remain USER-WP-0030-T03, dependent on KEY-WP-0035/NK-WP-0033. The owner route was +rechecked and remains non-resolvable. See docs/platform-admin-acceptance.md for +operator steps and exact remaining custody/renewal contract. Workplan remains active. diff --git a/docs/platform-admin-acceptance.md b/docs/platform-admin-acceptance.md new file mode 100644 index 0000000..c8706c1 --- /dev/null +++ b/docs/platform-admin-acceptance.md @@ -0,0 +1,61 @@ +# Platform administrator acceptance + +Priority workplan: USER-WP-0030. Platform administration requires the platform +operator role; membership in every tenant is not required. Ordinary tenant +administrators cannot read cross-tenant platform support records. + +| Journey | Implemented acceptance | Remaining integrated evidence | +| --- | --- | --- | +| P01 Platform entry | Role-aware navigation and tenant-independent console; member denial | Existing provider sign-in acceptance still applies | +| P02 Tenant and first admin | Authority readback, local bootstrap rollback and retry without duplicate admin | Real first-admin sign-in depends on provider | +| P03 Tenant inspection | Exact identifier, ambiguous-name handling and selected scope | No new implementation gap | +| P04 Administrator recovery | Tenant account restoration, scoped directory readback, confirmation and operator-only preview | Identity proof and lost-factor recovery require provider recovery contract | +| P05 Service operations | Capability availability, delivery failure/retry/readback, assisted setup guidance | Live factor credential renewal, provider health and actual mail receipt | +| P06 Authentication policy | Existing KeyCape optional/mandatory/step-up source tests; no portal policy-write control | Verified factor lookup, owner-approved effective policy rollout and rollback | +| P07 Tenant lifecycle | Authority version/confirmation, stale-state rejection and recovery | Application propagation must be verified at the application | +| P08 Support investigation | Exact reference across audit/delivery records, tenant filter, safe metadata, unknown-evidence state and delivery drill-down | Provider actions require provider evidence; portal records alone cannot prove rollback | + +## Investigate a support reference + +Open Platform activity from the platform navigation. Paste the exact support +reference and optionally the full tenant identifier. The view matches before +limiting display to the newest 100 records. It shows recorded actor/action and +current delivery state without raw payloads, free-text audit summaries, or provider +errors. Follow Inspect delivery to its retry/readback page. No matching records +means evidence is missing; it does not prove no action happened. + +## Restore tenant access + +Open the tenant's users page and choose Restore tenant account. Check the named +person and tenant in the confirmation. Verify the request through the established +support process. The operation restores that tenant account and prepares a missing +directory login. It does not reset a password, remove an authenticator, clear a +global suspension or prove account ownership. Use provider recovery for those +cases. Cancel makes no change; failed provider readback must not become local +success. Keep the support reference when escalating. + +## Run acceptance + +```sh +make test +make test-journeys JOURNEY_ARGS="--role platform_admin --report /tmp/platform-admin-report.json" +make test-browser-journeys +make test-journeys JOURNEY_ARGS="--role platform_admin --require-complete" +``` + +The platform selection currently runs 19 tests; the full regression suite runs +216 with seven opt-in PostgreSQL skips. The isolated Chromium suite runs 16 +checks. The final completeness command intentionally fails while P04/P05/P06 +retain external dependencies. The machine-readable matrix is +`tests/journey-coverage.json`; passing portal tests is not live factor acceptance. + +## Provider handoff needed + +KEY-WP-0035/NK-WP-0033 and USER-WP-0030-T03 retain the provider gap. The registered +`net-kingdom-privacyidea-admin-token` route was rechecked and remains +non-resolvable: concrete custody path/fields, expiry/revocation and approved +attended action are unpublished. A provider credential for attended resolver +repair must not be assumed to be the correct ongoing realm-scoped factor-read +credential. The owner must establish the consumer contract and verify its exact +permissions and renewal before policy or recovery rollout. No secrets belong in +this document, support references, chat or activity records. diff --git a/workplans/USER-WP-0030-platform-admin-journeys.md b/workplans/USER-WP-0030-platform-admin-journeys.md index 2939ab3..48e83d3 100644 --- a/workplans/USER-WP-0030-platform-admin-journeys.md +++ b/workplans/USER-WP-0030-platform-admin-journeys.md @@ -58,10 +58,13 @@ access integration remain explicitly open; no complete-journey claim is inferred ```task id: USER-WP-0030-T04 -status: progress +status: done priority: high +state_hub_task_id: "09a571d9-e1f3-5289-a2c1-fe1c46d4e8ad" ``` Prioritize P04/P05/P08: exact support-reference search across authorized platform audit and delivery metadata, tenant narrowing before display limits, honest missing-evidence state, delivery readback links and actionable capability availability. Deny non-operators before recovery preview and explain tenant restoration versus provider factor/account-ownership recovery. Add regression and browser acceptance, publish and verify. Provider gate rechecked: net-kingdom-privacyidea-admin-token remains non-resolvable. The owner playbook in ops-warden/wiki/playbooks/net-kingdom-sso-bind-credentials.md requires a concrete custody/renewal contract and approved attended action; it does not authorize reading live Secrets. P04 factor recovery/P05 credential operations/P06 effective policy remain T03 until that contract exists. + +T04 release evidence: docs/evidence/2026-09-13-platform-admin-support.md. Source b8506ef, 216 regression tests (seven optional skips), 19 platform tests, 16 browser checks; CI and rollout verified. T03 stays waiting; P04/P05/P06 completeness is not claimed.