From 75750c0036f6fabb87d6e1b14eec52d06b452858 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 13 Sep 2026 10:13:42 +0200 Subject: [PATCH] Record live account-clarity checks and remaining role journey acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- docs/evidence/2026-09-13-account-clarity.md | 53 +++++++++++++++++++ .../USER-WP-0027-account-journey-clarity.md | 11 +++- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 docs/evidence/2026-09-13-account-clarity.md diff --git a/docs/evidence/2026-09-13-account-clarity.md b/docs/evidence/2026-09-13-account-clarity.md new file mode 100644 index 0000000..c76e17a --- /dev/null +++ b/docs/evidence/2026-09-13-account-clarity.md @@ -0,0 +1,53 @@ +# Account clarity rollout — 2026-09-13 + +Source: user-engine a9ff77d21db5316d49d8d54519a490ca21951bc7. +CI: user-engine image workflow run 133, success; CI smoke run 132, both jobs success. +Image: `forgejo.coulomb.social/coulomb/user-engine@sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f`. +Runtime package pin: rapp-user-engine 367bb1b. + +Applied an image-only JSON patch after checking cluster UID, deployment UID, +resource version, predecessor digest and absent MFA management URL. The deployment +rolled out successfully, Ready 1/1. Kept the existing Recreate strategy and resource +requests; process-local portal sessions are invalidated on restart. No provider +credential, OTP policy, enrollment setting, database or tenant membership changed. +Unrelated hostname edits in the runtime package were preserved unstaged. + +## Validation + +- `PYTHONDONTWRITEBYTECODE=1 make test` in user-engine: 188 tests, 3 optional skips; + layer conformance passed. Includes synthetic authenticated member/operator, + expired/anonymous session controls, browser denial, API JSON, OTP handoff URL + validation and untrusted recovery-parameter tests. +- `PYTHONDONTWRITEBYTECODE=1 make check` in rapp-user-engine: 4 packaging tests passed. +- `git diff --check` passed in both repositories. +- Eight live HTTP assertions passed: anonymous home, recovery, logged-out and + security controls/no-store; unavailable OTP setup without parameter spoofing; + HTML browser denial; unchanged JSON API denial; readiness. +- Twelve isolated Chromium assertions passed: public recovery, Sign in without + portal logout, reachable identity switching, unavailable OTP setup, OTP-help + return route, security page fitting a 390px viewport, HTML denial recovery, + expired issuer callback stripping query parameters, shared sign-out confirmation, + real browser POST through Authelia to portal, appropriate post-sign-out control, + and truthful portal-session wording. + +No header overrides, reused personal browser profile, actual account credentials, +or OTP values were used. Anonymous browser checks do not prove authenticated +identity switching or provider enrollment. Script copies are in the session's +/tmp/account-clarity directory; durable acceptance cases are under tests/. + +## Open acceptance + +The provider factor-read credential remains rejected and its approved custody and +renewal contract is unpublished. `USER_ENGINE_MFA_MANAGEMENT_URL` remains unset. +The public help page does not claim OTP is off or enabled. Complete KEY-WP-0035 +and USER-WP-0027-T04 before enabling the provider handoff or optional live policy. + +The 29 role-based journeys and their remaining implementation/acceptance gaps +are in ../account-journeys.md. USER-WP-0027 stays active for T04–T06; authoritative +workload discovery remains USER-WP-0026-T03. VERGABE-WP-0019 real-user acceptance +remains open. + +Rollback: CAS image-only replacement with the predecessor +`sha256:8621032bacc3da5a4c8c96775422263d4b0cf775744126aa50c002b0a678ec5b`, +then reconcile both runtime manifest and Makefile pins. This reverts the UI and +restarts portal sessions; no database migration accompanied this release. diff --git a/workplans/USER-WP-0027-account-journey-clarity.md b/workplans/USER-WP-0027-account-journey-clarity.md index dd77576..442ca96 100644 --- a/workplans/USER-WP-0027-account-journey-clarity.md +++ b/workplans/USER-WP-0027-account-journey-clarity.md @@ -9,6 +9,7 @@ owner: codex topic_slug: communication created: "2026-09-13" updated: "2026-09-13" +state_hub_workstream_id: "455300ca-ec1e-569e-a584-a8dcda2595cf" --- ## Establish role-based success, failure and recovery acceptance @@ -17,6 +18,7 @@ updated: "2026-09-13" id: USER-WP-0027-T01 status: done priority: high +state_hub_task_id: "7f184a7c-2b93-5e6a-a15c-6fd8f3e9ff33" ``` Defined 29 journeys in docs/account-journeys.md: 13 user, 8 tenant administrator, @@ -30,6 +32,7 @@ are implemented. Includes OTP state contract and cross-role/isolation checks. id: USER-WP-0027-T02 status: done priority: high +state_hub_task_id: "897988e5-32a5-55e0-a49f-92d0e39971b6" ``` Signed-out/expired sessions show Sign in; verified sessions show identity and @@ -45,20 +48,24 @@ layer conformance passed. `git diff --check` passed. ```task id: USER-WP-0027-T03 -status: progress +status: done priority: high +state_hub_task_id: "90284878-ace3-5b90-96ed-845bc69f6e61" ``` Publish reviewed source, pin the CI image in rapp-user-engine, deploy with CAS, verify readiness, signed-out browser controls, and recovery/security navigation. Keep live OTP handoff disabled until T04 dependencies are met. +Deployed source a9ff77d, image sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f, runtime pin commit 367bb1b. Deployment Ready 1/1. Eight live HTTP checks and twelve isolated Chromium checks passed; see docs/evidence/2026-09-13-account-clarity.md. No authenticated OTP acceptance is inferred. + ## Complete provider OTP activation and recovery path ```task id: USER-WP-0027-T04 status: wait priority: high +state_hub_task_id: "9657abcb-690e-5323-8ff3-58253298ce7b" ``` Depends on KEY-WP-0035-T02/T03 and NK-WP-0033 custody handoff. Current owner route @@ -74,6 +81,7 @@ assurance claims, redirect return parameters or manual step completion. id: USER-WP-0027-T05 status: todo priority: high +state_hub_task_id: "92906113-e28b-58d3-95a7-779e815d1ced" ``` Implement remaining T02–T08/P02/P04/P07/P08 browser gaps from docs/account-journeys.md: @@ -88,6 +96,7 @@ are starting points, not browser acceptance. Split into owner workplans as neede id: USER-WP-0027-T06 status: todo priority: high +state_hub_task_id: "550886ca-f916-5637-9639-b4134b0da939" ``` Execute success/failure/recovery matrix with synthetic user, tenant admin,