Record deployed P06 policy and completed platform acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-13-p06-authentication-policy.md

@@ -13,6 +13,9 @@ factor replacement requires audited recovery, including from old AAL1 sessions.
 
 - Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
 - Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
+- Final platform completeness gate: 33 tests passed, zero skips, all P01–P08
+  marked implemented with no unresolved platform journeys. See the adjacent
+  P06 platform-complete JSON report.
 - Issuer policy/runtime regression tests passed; two policy rollout and one
   provider guard deployment tests passed.
 - Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
@@ -31,5 +34,46 @@ production account changes. Reproduce using key-cape
 
 ## Release
 
-Pending CI image publication and ordered live rollout. Do not infer deployment
-or complete platform journey acceptance from these test results.
+Completed 2026-09-14 Europe/Berlin (2026-09-13 UTC):
+
+- KeyCape source `e0b3c25`; CI acceptance run 64 and image run 65 passed.
+- Portal source `3bd1827`; image run 178 and journey run 179 passed. Routing-only
+  smoke run 177 was cancelled; it is not claimed as passed.
+- NetKingdom policy/guard tooling: `a549617`.
+- Portal image: `forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c`.
+- Issuer image: `forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5`.
+
+Portal guards rolled out first. Provider guard
+`keycape-onboarding-9465e5e0b98f7986` then rolled out to privacyIDEA and recovery.
+Provider policy readback confirms TOTP enrollment, pending-only deletion and
+active-factor changes through recovery; existing tokens were unchanged.
+Only the two reviewed client registrations were migrated with UID/resource-version
+CAS and unrelated Secret bytes preserved. Issuer replacement then activated
+persistent policy at `/var/lib/keycape-policy/policy.json` on the dedicated PVC.
+
+Read-only Job `p06-policy-readback-1c0eba21` verified both effective policies are
+`optional_after_enrollment`, revision 0, no administrative changes yet. The Job
+was removed. Portal health/readiness and issuer readiness return 200; both policy
+surfaces reject anonymous access with 403. The migration inspector reports no
+remaining change. Receipts are in the adjacent P06 rollout JSON.
+
+Positive policy changes/replay/rollback are tested in isolated stores and portal
+fixtures. No production account or real administrator policy override was used
+as a test. Actual invited-person and application sign-in acceptance remains in
+USER-WP-0028 / KEY-WP-0034 / VERGABE-WP-0019.
+
+## Operating policy and rollback
+
+Open Platform administration → Authentication policy and verify with fresh MFA.
+Select a reviewed client, policy and change reference; preview the impact and
+acknowledge it before applying. Cancel leaves policy unchanged. A stale review
+requires a new preview; an uncertain response should be checked in current state
+and history. Rollback is a new reviewed change to that client's previous policy.
+
+Preserve the policy PVC and receipts across issuer replacement; do not delete
+it during rollback. It uses this cluster's local-path storage, not multi-node HA.
+Before reverting to a pre-P06 portal or issuer, restore mandatory MFA for both
+clients in runtime policy and the baseline client registrations, verify it, then
+restore the previous image pins. Keep the provider active-factor guard and
+recovery service. Reverting the portal guards while optional login remains active
+would weaken administration. Previous exact image pins are in the rollout receipt.

docs/evidence/2026-09-13-p06-platform-complete.json

@@ -0,0 +1,114 @@
+{
+  "tests_run": 33,
+  "test_success": true,
+  "skipped": 0,
+  "journeys": [
+    {
+      "id": "P01",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P02",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin",
+        "test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin",
+        "test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes"
+      ],
+      "remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority.",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P03",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant",
+        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P04",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused",
+        "test_platform_support.PlatformSupportJourneys.test_recovery_denied_before_preview_and_operator_sees_factor_boundary",
+        "test_factor_recovery_journey.FactorRecoveryJourney.test_role_csrf_and_freshness_denied_before_provider",
+        "test_factor_recovery_journey.FactorRecoveryJourney.test_preview_cancel_apply_retry_and_secret_not_rendered",
+        "test_factor_recovery_journey.FactorRecoveryJourney.test_stepup_requests_fresh_mfa_and_binds_return"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P05",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
+        "test_platform_support.PlatformSupportJourneys.test_service_capabilities_distinguish_configuration_from_health",
+        "test_service_operations.ServiceOperations.test_one_confirmed_delivery_and_completed_retry_guard",
+        "test_service_operations.ServiceOperations.test_role_csrf_and_stale_confirmation_cannot_submit",
+        "test_service_operations.ServiceOperations.test_failure_releases_claim_and_retry_is_available",
+        "test_service_operations.ServiceOperations.test_crashed_claim_reconciles_under_event_guard",
+        "test_service_operations.ServiceOperations.test_missing_mail_lane_never_marks_an_invitation_accepted",
+        "test_service_operations.ServiceOperations.test_status_is_checked_bounded_and_never_claims_receipt",
+        "test_service_operations.ServiceOperations.test_selected_mail_evidence_is_safe_and_read_only"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P06",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_authentication_policy.AuthenticationPolicyJourney.test_aal1_account_access_does_not_grant_administration",
+        "test_authentication_policy.AuthenticationPolicyJourney.test_role_csrf_and_stale_mfa_deny_before_policy_service",
+        "test_authentication_policy.AuthenticationPolicyJourney.test_review_explains_lockout_scope_rollback_and_receipts",
+        "test_authentication_policy.AuthenticationPolicyJourney.test_outage_is_redacted_and_current_status_is_retryable",
+        "test_authentication_policy.AuthenticationPolicyJourney.test_policy_stepup_binds_only_supported_return_path"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P07",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails",
+        "test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    },
+    {
+      "id": "P08",
+      "role": "platform_admin",
+      "implementation": "implemented",
+      "tests": [
+        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
+        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload",
+        "test_platform_support.PlatformSupportJourneys.test_operator_correlates_actions_and_delivery_without_raw_content",
+        "test_platform_support.PlatformSupportJourneys.test_activity_denies_nonoperators_and_mutations",
+        "test_platform_support.PlatformSupportJourneys.test_exact_filters_apply_before_display_limit_and_missing_is_explicit",
+        "test_platform_support.PlatformSupportJourneys.test_filter_values_are_escaped_and_bounded"
+      ],
+      "remaining": "",
+      "automated_result": "passed"
+    }
+  ],
+  "complete": true
+}

docs/evidence/2026-09-13-p06-rollout.json

@@ -0,0 +1,74 @@
+{
+  "portal": {
+    "namespace": "user-engine",
+    "deployment": "user-engine",
+    "uid": "e1c4274a-4b6d-4ea2-b619-e09630b745b0",
+    "before_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:8c55d285123c70c453752e19fa1b0ed179cb7fe060e854040fa1c559748a1ebf",
+    "after_image": "forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c",
+    "phase": "portal"
+  },
+  "issuer": {
+    "namespace": "sso",
+    "deployment": "keycape",
+    "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
+    "before_image": "forgejo.coulomb.social/coulomb/key-cape@sha256:d3c358ec793b59d519ea6b1dbe4172449745a57504474399984de6cd8703024d",
+    "after_image": "forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5",
+    "phase": "issuer"
+  },
+  "migration": {
+    "clients": [
+      "user-engine-portal",
+      "vergabe-demo-company"
+    ],
+    "before": {
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3",
+      "resource_version": "60841607"
+    },
+    "change_needed": true,
+    "other_clients_unchanged": true,
+    "secret_values_emitted": false,
+    "mode": "apply",
+    "after": {
+      "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3",
+      "resource_version": "60979095"
+    }
+  },
+  "persistent_policy": {
+    "modes": {
+      "user-engine-portal": "optional_after_enrollment",
+      "vergabe-demo-company": "optional_after_enrollment"
+    },
+    "revision": 0,
+    "history_count": 0,
+    "read_only": true,
+    "job": "p06-policy-readback-1c0eba21"
+  },
+  "http": [
+    {
+      "host": "users.coulomb.social",
+      "path": "/healthz",
+      "http_status": 200
+    },
+    {
+      "host": "users.coulomb.social",
+      "path": "/readyz",
+      "http_status": 200
+    },
+    {
+      "host": "users.coulomb.social",
+      "path": "/platform/authentication-policy",
+      "http_status": 403
+    },
+    {
+      "host": "kc.coulomb.social",
+      "path": "/readyz",
+      "http_status": 200
+    },
+    {
+      "host": "kc.coulomb.social",
+      "path": "/platform/authentication-policy",
+      "http_status": 403
+    }
+  ],
+  "decision_id": "f4f11a4b-bd71-4673-971e-1048fa075cba"
+}