Record live account-clarity checks and remaining role journey acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

docs/evidence/2026-09-13-account-clarity.md

@@ -0,0 +1,53 @@
+# Account clarity rollout — 2026-09-13
+
+Source: user-engine a9ff77d21db5316d49d8d54519a490ca21951bc7.
+CI: user-engine image workflow run 133, success; CI smoke run 132, both jobs success.
+Image: `forgejo.coulomb.social/coulomb/user-engine@sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f`.
+Runtime package pin: rapp-user-engine 367bb1b.
+
+Applied an image-only JSON patch after checking cluster UID, deployment UID,
+resource version, predecessor digest and absent MFA management URL. The deployment
+rolled out successfully, Ready 1/1. Kept the existing Recreate strategy and resource
+requests; process-local portal sessions are invalidated on restart. No provider
+credential, OTP policy, enrollment setting, database or tenant membership changed.
+Unrelated hostname edits in the runtime package were preserved unstaged.
+
+## Validation
+
+- `PYTHONDONTWRITEBYTECODE=1 make test` in user-engine: 188 tests, 3 optional skips;
+  layer conformance passed. Includes synthetic authenticated member/operator,
+  expired/anonymous session controls, browser denial, API JSON, OTP handoff URL
+  validation and untrusted recovery-parameter tests.
+- `PYTHONDONTWRITEBYTECODE=1 make check` in rapp-user-engine: 4 packaging tests passed.
+- `git diff --check` passed in both repositories.
+- Eight live HTTP assertions passed: anonymous home, recovery, logged-out and
+  security controls/no-store; unavailable OTP setup without parameter spoofing;
+  HTML browser denial; unchanged JSON API denial; readiness.
+- Twelve isolated Chromium assertions passed: public recovery, Sign in without
+  portal logout, reachable identity switching, unavailable OTP setup, OTP-help
+  return route, security page fitting a 390px viewport, HTML denial recovery,
+  expired issuer callback stripping query parameters, shared sign-out confirmation,
+  real browser POST through Authelia to portal, appropriate post-sign-out control,
+  and truthful portal-session wording.
+
+No header overrides, reused personal browser profile, actual account credentials,
+or OTP values were used. Anonymous browser checks do not prove authenticated
+identity switching or provider enrollment. Script copies are in the session's
+/tmp/account-clarity directory; durable acceptance cases are under tests/.
+
+## Open acceptance
+
+The provider factor-read credential remains rejected and its approved custody and
+renewal contract is unpublished. `USER_ENGINE_MFA_MANAGEMENT_URL` remains unset.
+The public help page does not claim OTP is off or enabled. Complete KEY-WP-0035
+and USER-WP-0027-T04 before enabling the provider handoff or optional live policy.
+
+The 29 role-based journeys and their remaining implementation/acceptance gaps
+are in ../account-journeys.md. USER-WP-0027 stays active for T04–T06; authoritative
+workload discovery remains USER-WP-0026-T03. VERGABE-WP-0019 real-user acceptance
+remains open.
+
+Rollback: CAS image-only replacement with the predecessor
+`sha256:8621032bacc3da5a4c8c96775422263d4b0cf775744126aa50c002b0a678ec5b`,
+then reconcile both runtime manifest and Makefile pins. This reverts the UI and
+restarts portal sessions; no database migration accompanied this release.

workplans/USER-WP-0027-account-journey-clarity.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: communication
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "455300ca-ec1e-569e-a584-a8dcda2595cf"
 ---
 
 ## Establish role-based success, failure and recovery acceptance
@@ -17,6 +18,7 @@ updated: "2026-09-13"
 id: USER-WP-0027-T01
 status: done
 priority: high
+state_hub_task_id: "7f184a7c-2b93-5e6a-a15c-6fd8f3e9ff33"
 ```
 
 Defined 29 journeys in docs/account-journeys.md: 13 user, 8 tenant administrator,
@@ -30,6 +32,7 @@ are implemented. Includes OTP state contract and cross-role/isolation checks.
 id: USER-WP-0027-T02
 status: done
 priority: high
+state_hub_task_id: "897988e5-32a5-55e0-a49f-92d0e39971b6"
 ```
 
 Signed-out/expired sessions show Sign in; verified sessions show identity and
@@ -45,20 +48,24 @@ layer conformance passed. `git diff --check` passed.
 
 ```task
 id: USER-WP-0027-T03
-status: progress
+status: done
 priority: high
+state_hub_task_id: "90284878-ace3-5b90-96ed-845bc69f6e61"
 ```
 
 Publish reviewed source, pin the CI image in rapp-user-engine, deploy with CAS,
 verify readiness, signed-out browser controls, and recovery/security navigation.
 Keep live OTP handoff disabled until T04 dependencies are met.
 
+Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f, runtime pin commit 367bb1b. Deployment Ready 1/1. Eight live HTTP checks and twelve isolated Chromium checks passed; see docs/evidence/2026-09-13-account-clarity.md. No authenticated OTP acceptance is inferred.
+
 ## Complete provider OTP activation and recovery path
 
 ```task
 id: USER-WP-0027-T04
 status: wait
 priority: high
+state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b"
 ```
 
 Depends on KEY-WP-0035-T02/T03 and NK-WP-0033 custody handoff. Current owner route
@@ -74,6 +81,7 @@ assurance claims, redirect return parameters or manual step completion.
 id: USER-WP-0027-T05
 status: todo
 priority: high
+state_hub_task_id: "92906113-e28b-58d3-95a7-779e815d1ced"
 ```
 
 Implement remaining T02–T08/P02/P04/P07/P08 browser gaps from docs/account-journeys.md:
@@ -88,6 +96,7 @@ are starting points, not browser acceptance. Split into owner workplans as neede
 id: USER-WP-0027-T06
 status: todo
 priority: high
+state_hub_task_id: "550886ca-f916-5637-9639-b4134b0da939"
 ```
 
 Execute success/failure/recovery matrix with synthetic user, tenant admin,