Record verified platform-admin release and remaining provider acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

docs/evidence/2026-09-13-platform-admin-report.json

@@ -0,0 +1,100 @@
+{
+  "tests_run": 19,
+  "test_success": true,
+  "skipped": 0,
+  "journeys": [
+    {
+      "id": "P01",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P02",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin",
+        "test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin",
+        "test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes"
+      ],
+      "remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P03",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P04",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused",
+        "test_platform_support.PlatformSupportJourneys.test_recovery_denied_before_preview_and_operator_sees_factor_boundary"
+      ],
+      "remaining": "Tenant identity recovery is scoped; verified OTP/account-ownership recovery remains provider-owned.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P05",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
+        "test_platform_support.PlatformSupportJourneys.test_service_capabilities_distinguish_configuration_from_health"
+      ],
+      "remaining": "Local delivery record operations work; approved factor credential renewal and mail receipt remain external dependencies.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P06",
+      "role": "platform_admin",
+      "implementation": "external-blocked",
+      "tests": [
+        "test_account_clarity.AccountClarityTests.test_provider_handoff_rejects_unsafe_configuration"
+      ],
+      "remaining": "Boundary test only. KeyCape policy suite covers optional/required/step-up; live policy management and provider rollout remain KEY-WP-0035.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P07",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails",
+        "test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P08",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
+        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload",
+        "test_platform_support.PlatformSupportJourneys.test_operator_correlates_actions_and_delivery_without_raw_content",
+        "test_platform_support.PlatformSupportJourneys.test_activity_denies_nonoperators_and_mutations",
+        "test_platform_support.PlatformSupportJourneys.test_exact_filters_apply_before_display_limit_and_missing_is_explicit",
+        "test_platform_support.PlatformSupportJourneys.test_filter_values_are_escaped_and_bounded"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    }
+  ],
+  "complete": false
+}

docs/evidence/2026-09-13-platform-admin-support.md

@@ -0,0 +1,40 @@
+# Platform administrator support release — 2026-09-13
+
+Source b8506ef2e336f15eb85b3fd66072ddc7ade341c4.
+Image `forgejo.coulomb.social/coulomb/user-engine@sha256:6c20229d5bc7bf7c89c10c0c3e8db66fbb76a71b3beec3adeed6b73ef140fb01`.
+CI smoke run 147, image run 148 and journey run 149 passed.
+
+Implemented operator-only platform activity search by exact support reference
+and optional tenant, filtering before the 100-record display limit. Correlates
+safe audit metadata and current delivery state, with links to delivery readback.
+Missing evidence stays explicit. Raw payloads, free-text summaries and provider
+error contents are excluded. Service recovery distinguishes configured adapters
+from verified live health and provides assisted setup guidance.
+
+Tenant restoration checks platform permission before confirmation, labels its
+scope clearly and explains that it cannot prove ownership or bypass/reset factors.
+No real user recovery, directory mutation or policy change was used in release
+verification.
+
+Validation:
+- Full regression: 216 tests passed, seven opt-in PostgreSQL tests skipped;
+  layer conformance passed. This change does not alter database behavior.
+- Platform role selection: 19 tests passed; JSON report retained alongside this file.
+- Isolated Chromium: 16 checks passed, including investigation form submission,
+  no-match recovery, permission separation and factor-boundary confirmation.
+- Packaging: four checks passed; source diff check passed.
+- Platform completeness gate intentionally fails for P04/P05/P06; no complete
+  provider acceptance is claimed.
+
+Image-only rollout tests cluster UID, deployment UID/resourceVersion and predecessor
+image; canonical package pins retain unrelated hostname work. Rollback predecessor:
+`sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d`.
+Recreate replaces the single portal pod and resets in-memory sessions.
+
+Live result: portal Ready 1/1; eight existing public HTTP checks and the new
+anonymous platform-activity denial/recovery check passed after readiness.
+
+P04 factor recovery, P05 credential renewal/provider health and P06 effective policy
+remain USER-WP-0030-T03, dependent on KEY-WP-0035/NK-WP-0033. The owner route was
+rechecked and remains non-resolvable. See docs/platform-admin-acceptance.md for
+operator steps and exact remaining custody/renewal contract. Workplan remains active.