Record verified platform-admin release and remaining provider acceptance
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
parent
9f254e969b
commit
70b565d9a2
4 changed files with 205 additions and 1 deletions
100
docs/evidence/2026-09-13-platform-admin-report.json
Normal file
100
docs/evidence/2026-09-13-platform-admin-report.json
Normal file
|
|
@ -0,0 +1,100 @@
|
|||
{
|
||||
"tests_run": 19,
|
||||
"test_success": true,
|
||||
"skipped": 0,
|
||||
"journeys": [
|
||||
{
|
||||
"id": "P01",
|
||||
"role": "platform_admin",
|
||||
"implementation": "implemented",
|
||||
"tests": [
|
||||
"test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership",
|
||||
"test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority"
|
||||
],
|
||||
"remaining": "",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P02",
|
||||
"role": "platform_admin",
|
||||
"implementation": "implemented",
|
||||
"tests": [
|
||||
"test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin",
|
||||
"test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin",
|
||||
"test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes"
|
||||
],
|
||||
"remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority.",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P03",
|
||||
"role": "platform_admin",
|
||||
"implementation": "implemented",
|
||||
"tests": [
|
||||
"test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant",
|
||||
"test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves"
|
||||
],
|
||||
"remaining": "",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P04",
|
||||
"role": "platform_admin",
|
||||
"implementation": "external-blocked",
|
||||
"tests": [
|
||||
"test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused",
|
||||
"test_platform_support.PlatformSupportJourneys.test_recovery_denied_before_preview_and_operator_sees_factor_boundary"
|
||||
],
|
||||
"remaining": "Tenant identity recovery is scoped; verified OTP/account-ownership recovery remains provider-owned.",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P05",
|
||||
"role": "platform_admin",
|
||||
"implementation": "external-blocked",
|
||||
"tests": [
|
||||
"test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
|
||||
"test_platform_support.PlatformSupportJourneys.test_service_capabilities_distinguish_configuration_from_health"
|
||||
],
|
||||
"remaining": "Local delivery record operations work; approved factor credential renewal and mail receipt remain external dependencies.",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P06",
|
||||
"role": "platform_admin",
|
||||
"implementation": "external-blocked",
|
||||
"tests": [
|
||||
"test_account_clarity.AccountClarityTests.test_provider_handoff_rejects_unsafe_configuration"
|
||||
],
|
||||
"remaining": "Boundary test only. KeyCape policy suite covers optional/required/step-up; live policy management and provider rollout remain KEY-WP-0035.",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P07",
|
||||
"role": "platform_admin",
|
||||
"implementation": "implemented",
|
||||
"tests": [
|
||||
"test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails",
|
||||
"test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority"
|
||||
],
|
||||
"remaining": "",
|
||||
"automated_result": "passed"
|
||||
},
|
||||
{
|
||||
"id": "P08",
|
||||
"role": "platform_admin",
|
||||
"implementation": "implemented",
|
||||
"tests": [
|
||||
"test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
|
||||
"test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload",
|
||||
"test_platform_support.PlatformSupportJourneys.test_operator_correlates_actions_and_delivery_without_raw_content",
|
||||
"test_platform_support.PlatformSupportJourneys.test_activity_denies_nonoperators_and_mutations",
|
||||
"test_platform_support.PlatformSupportJourneys.test_exact_filters_apply_before_display_limit_and_missing_is_explicit",
|
||||
"test_platform_support.PlatformSupportJourneys.test_filter_values_are_escaped_and_bounded"
|
||||
],
|
||||
"remaining": "",
|
||||
"automated_result": "passed"
|
||||
}
|
||||
],
|
||||
"complete": false
|
||||
}
|
||||
40
docs/evidence/2026-09-13-platform-admin-support.md
Normal file
40
docs/evidence/2026-09-13-platform-admin-support.md
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# Platform administrator support release — 2026-09-13
|
||||
|
||||
Source b8506ef2e336f15eb85b3fd66072ddc7ade341c4.
|
||||
Image `forgejo.coulomb.social/coulomb/user-engine@sha256:6c20229d5bc7bf7c89c10c0c3e8db66fbb76a71b3beec3adeed6b73ef140fb01`.
|
||||
CI smoke run 147, image run 148 and journey run 149 passed.
|
||||
|
||||
Implemented operator-only platform activity search by exact support reference
|
||||
and optional tenant, filtering before the 100-record display limit. Correlates
|
||||
safe audit metadata and current delivery state, with links to delivery readback.
|
||||
Missing evidence stays explicit. Raw payloads, free-text summaries and provider
|
||||
error contents are excluded. Service recovery distinguishes configured adapters
|
||||
from verified live health and provides assisted setup guidance.
|
||||
|
||||
Tenant restoration checks platform permission before confirmation, labels its
|
||||
scope clearly and explains that it cannot prove ownership or bypass/reset factors.
|
||||
No real user recovery, directory mutation or policy change was used in release
|
||||
verification.
|
||||
|
||||
Validation:
|
||||
- Full regression: 216 tests passed, seven opt-in PostgreSQL tests skipped;
|
||||
layer conformance passed. This change does not alter database behavior.
|
||||
- Platform role selection: 19 tests passed; JSON report retained alongside this file.
|
||||
- Isolated Chromium: 16 checks passed, including investigation form submission,
|
||||
no-match recovery, permission separation and factor-boundary confirmation.
|
||||
- Packaging: four checks passed; source diff check passed.
|
||||
- Platform completeness gate intentionally fails for P04/P05/P06; no complete
|
||||
provider acceptance is claimed.
|
||||
|
||||
Image-only rollout tests cluster UID, deployment UID/resourceVersion and predecessor
|
||||
image; canonical package pins retain unrelated hostname work. Rollback predecessor:
|
||||
`sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
|
||||
Recreate replaces the single portal pod and resets in-memory sessions.
|
||||
|
||||
Live result: portal Ready 1/1; eight existing public HTTP checks and the new
|
||||
anonymous platform-activity denial/recovery check passed after readiness.
|
||||
|
||||
P04 factor recovery, P05 credential renewal/provider health and P06 effective policy
|
||||
remain USER-WP-0030-T03, dependent on KEY-WP-0035/NK-WP-0033. The owner route was
|
||||
rechecked and remains non-resolvable. See docs/platform-admin-acceptance.md for
|
||||
operator steps and exact remaining custody/renewal contract. Workplan remains active.
|
||||
61
docs/platform-admin-acceptance.md
Normal file
61
docs/platform-admin-acceptance.md
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
# Platform administrator acceptance
|
||||
|
||||
Priority workplan: USER-WP-0030. Platform administration requires the platform
|
||||
operator role; membership in every tenant is not required. Ordinary tenant
|
||||
administrators cannot read cross-tenant platform support records.
|
||||
|
||||
| Journey | Implemented acceptance | Remaining integrated evidence |
|
||||
| --- | --- | --- |
|
||||
| P01 Platform entry | Role-aware navigation and tenant-independent console; member denial | Existing provider sign-in acceptance still applies |
|
||||
| P02 Tenant and first admin | Authority readback, local bootstrap rollback and retry without duplicate admin | Real first-admin sign-in depends on provider |
|
||||
| P03 Tenant inspection | Exact identifier, ambiguous-name handling and selected scope | No new implementation gap |
|
||||
| P04 Administrator recovery | Tenant account restoration, scoped directory readback, confirmation and operator-only preview | Identity proof and lost-factor recovery require provider recovery contract |
|
||||
| P05 Service operations | Capability availability, delivery failure/retry/readback, assisted setup guidance | Live factor credential renewal, provider health and actual mail receipt |
|
||||
| P06 Authentication policy | Existing KeyCape optional/mandatory/step-up source tests; no portal policy-write control | Verified factor lookup, owner-approved effective policy rollout and rollback |
|
||||
| P07 Tenant lifecycle | Authority version/confirmation, stale-state rejection and recovery | Application propagation must be verified at the application |
|
||||
| P08 Support investigation | Exact reference across audit/delivery records, tenant filter, safe metadata, unknown-evidence state and delivery drill-down | Provider actions require provider evidence; portal records alone cannot prove rollback |
|
||||
|
||||
## Investigate a support reference
|
||||
|
||||
Open Platform activity from the platform navigation. Paste the exact support
|
||||
reference and optionally the full tenant identifier. The view matches before
|
||||
limiting display to the newest 100 records. It shows recorded actor/action and
|
||||
current delivery state without raw payloads, free-text audit summaries, or provider
|
||||
errors. Follow Inspect delivery to its retry/readback page. No matching records
|
||||
means evidence is missing; it does not prove no action happened.
|
||||
|
||||
## Restore tenant access
|
||||
|
||||
Open the tenant's users page and choose Restore tenant account. Check the named
|
||||
person and tenant in the confirmation. Verify the request through the established
|
||||
support process. The operation restores that tenant account and prepares a missing
|
||||
directory login. It does not reset a password, remove an authenticator, clear a
|
||||
global suspension or prove account ownership. Use provider recovery for those
|
||||
cases. Cancel makes no change; failed provider readback must not become local
|
||||
success. Keep the support reference when escalating.
|
||||
|
||||
## Run acceptance
|
||||
|
||||
```sh
|
||||
make test
|
||||
make test-journeys JOURNEY_ARGS="--role platform_admin --report /tmp/platform-admin-report.json"
|
||||
make test-browser-journeys
|
||||
make test-journeys JOURNEY_ARGS="--role platform_admin --require-complete"
|
||||
```
|
||||
|
||||
The platform selection currently runs 19 tests; the full regression suite runs
|
||||
216 with seven opt-in PostgreSQL skips. The isolated Chromium suite runs 16
|
||||
checks. The final completeness command intentionally fails while P04/P05/P06
|
||||
retain external dependencies. The machine-readable matrix is
|
||||
`tests/journey-coverage.json`; passing portal tests is not live factor acceptance.
|
||||
|
||||
## Provider handoff needed
|
||||
|
||||
KEY-WP-0035/NK-WP-0033 and USER-WP-0030-T03 retain the provider gap. The registered
|
||||
`net-kingdom-privacyidea-admin-token` route was rechecked and remains
|
||||
non-resolvable: concrete custody path/fields, expiry/revocation and approved
|
||||
attended action are unpublished. A provider credential for attended resolver
|
||||
repair must not be assumed to be the correct ongoing realm-scoped factor-read
|
||||
credential. The owner must establish the consumer contract and verify its exact
|
||||
permissions and renewal before policy or recovery rollout. No secrets belong in
|
||||
this document, support references, chat or activity records.
|
||||
Loading…
Add table
Add a link
Reference in a new issue