Record deployed P06 policy and completed platform acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

docs/evidence/2026-09-13-p06-authentication-policy.md

@@ -13,6 +13,9 @@ factor replacement requires audited recovery, including from old AAL1 sessions.
 
 - Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
 - Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
+- Final platform completeness gate: 33 tests passed, zero skips, all P01–P08
+  marked implemented with no unresolved platform journeys. See the adjacent
+  P06 platform-complete JSON report.
 - Issuer policy/runtime regression tests passed; two policy rollout and one
   provider guard deployment tests passed.
 - Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
@@ -31,5 +34,46 @@ production account changes. Reproduce using key-cape
 
 ## Release
 
-Pending CI image publication and ordered live rollout. Do not infer deployment
-or complete platform journey acceptance from these test results.
+Completed 2026-09-14 Europe/Berlin (2026-09-13 UTC):
+
+- KeyCape source `e0b3c25`; CI acceptance run 64 and image run 65 passed.
+- Portal source `3bd1827`; image run 178 and journey run 179 passed. Routing-only
+  smoke run 177 was cancelled; it is not claimed as passed.
+- NetKingdom policy/guard tooling: `a549617`.
+- Portal image: `forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c`.
+- Issuer image: `forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5`.
+
+Portal guards rolled out first. Provider guard
+`keycape-onboarding-9465e5e0b98f7986` then rolled out to privacyIDEA and recovery.
+Provider policy readback confirms TOTP enrollment, pending-only deletion and
+active-factor changes through recovery; existing tokens were unchanged.
+Only the two reviewed client registrations were migrated with UID/resource-version
+CAS and unrelated Secret bytes preserved. Issuer replacement then activated
+persistent policy at `/var/lib/keycape-policy/policy.json` on the dedicated PVC.
+
+Read-only Job `p06-policy-readback-1c0eba21` verified both effective policies are
+`optional_after_enrollment`, revision 0, no administrative changes yet. The Job
+was removed. Portal health/readiness and issuer readiness return 200; both policy
+surfaces reject anonymous access with 403. The migration inspector reports no
+remaining change. Receipts are in the adjacent P06 rollout JSON.
+
+Positive policy changes/replay/rollback are tested in isolated stores and portal
+fixtures. No production account or real administrator policy override was used
+as a test. Actual invited-person and application sign-in acceptance remains in
+USER-WP-0028 / KEY-WP-0034 / VERGABE-WP-0019.
+
+## Operating policy and rollback
+
+Open Platform administration → Authentication policy and verify with fresh MFA.
+Select a reviewed client, policy and change reference; preview the impact and
+acknowledge it before applying. Cancel leaves policy unchanged. A stale review
+requires a new preview; an uncertain response should be checked in current state
+and history. Rollback is a new reviewed change to that client's previous policy.
+
+Preserve the policy PVC and receipts across issuer replacement; do not delete
+it during rollback. It uses this cluster's local-path storage, not multi-node HA.
+Before reverting to a pre-P06 portal or issuer, restore mandatory MFA for both
+clients in runtime policy and the baseline client registrations, verify it, then
+restore the previous image pins. Keep the provider active-factor guard and
+recovery service. Reverting the portal guards while optional login remains active
+would weaken administration. Previous exact image pins are in the rollout receipt.