coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified platform-admin release and remaining provider acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 14:17:12 +02:00
parent 9f254e969b
commit 70b565d9a2
4 changed files with 205 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

61
docs/platform-admin-acceptance.md Normal file
View file

@ -0,0 +1,61 @@
# Platform administrator acceptance
Priority workplan: USER-WP-0030. Platform administration requires the platform
operator role; membership in every tenant is not required. Ordinary tenant
administrators cannot read cross-tenant platform support records.
| Journey | Implemented acceptance | Remaining integrated evidence |
| --- | --- | --- |
| P01 Platform entry | Role-aware navigation and tenant-independent console; member denial | Existing provider sign-in acceptance still applies |
| P02 Tenant and first admin | Authority readback, local bootstrap rollback and retry without duplicate admin | Real first-admin sign-in depends on provider |
| P03 Tenant inspection | Exact identifier, ambiguous-name handling and selected scope | No new implementation gap |
| P04 Administrator recovery | Tenant account restoration, scoped directory readback, confirmation and operator-only preview | Identity proof and lost-factor recovery require provider recovery contract |
| P05 Service operations | Capability availability, delivery failure/retry/readback, assisted setup guidance | Live factor credential renewal, provider health and actual mail receipt |
| P06 Authentication policy | Existing KeyCape optional/mandatory/step-up source tests; no portal policy-write control | Verified factor lookup, owner-approved effective policy rollout and rollback |
| P07 Tenant lifecycle | Authority version/confirmation, stale-state rejection and recovery | Application propagation must be verified at the application |
| P08 Support investigation | Exact reference across audit/delivery records, tenant filter, safe metadata, unknown-evidence state and delivery drill-down | Provider actions require provider evidence; portal records alone cannot prove rollback |
## Investigate a support reference
Open Platform activity from the platform navigation. Paste the exact support
reference and optionally the full tenant identifier. The view matches before
limiting display to the newest 100 records. It shows recorded actor/action and
current delivery state without raw payloads, free-text audit summaries, or provider
errors. Follow Inspect delivery to its retry/readback page. No matching records
means evidence is missing; it does not prove no action happened.
## Restore tenant access
Open the tenant's users page and choose Restore tenant account. Check the named
person and tenant in the confirmation. Verify the request through the established
support process. The operation restores that tenant account and prepares a missing
directory login. It does not reset a password, remove an authenticator, clear a
global suspension or prove account ownership. Use provider recovery for those
cases. Cancel makes no change; failed provider readback must not become local
success. Keep the support reference when escalating.
## Run acceptance
```sh
make test
make test-journeys JOURNEY_ARGS="--role platform_admin --report /tmp/platform-admin-report.json"
make test-browser-journeys
make test-journeys JOURNEY_ARGS="--role platform_admin --require-complete"
```
The platform selection currently runs 19 tests; the full regression suite runs
216 with seven opt-in PostgreSQL skips. The isolated Chromium suite runs 16
checks. The final completeness command intentionally fails while P04/P05/P06
retain external dependencies. The machine-readable matrix is
`tests/journey-coverage.json`; passing portal tests is not live factor acceptance.
## Provider handoff needed
KEY-WP-0035/NK-WP-0033 and USER-WP-0030-T03 retain the provider gap. The registered
`net-kingdom-privacyidea-admin-token` route was rechecked and remains
non-resolvable: concrete custody path/fields, expiry/revocation and approved
attended action are unpublished. A provider credential for attended resolver
repair must not be assumed to be the correct ongoing realm-scoped factor-read
credential. The owner must establish the consumer contract and verify its exact
permissions and renewal before policy or recovery rollout. No secrets belong in
this document, support references, chat or activity records.