coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed P06 policy and completed platform acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Account journey acceptance / journeys (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:10:24 +02:00
parent baf7467613
commit 8d525d959e
8 changed files with 280 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/USER-WP-0033-authentication-policy.md
View file

@ -4,11 +4,12 @@ type: workplan
title: "P06 scoped authentication policy and safe optional onboarding"
domain: communication
repo: user-engine
status: active
status: finished
owner: codex
topic_slug: communication
created: "2026-09-13"
updated: "2026-09-13"
updated: "2026-09-14"
state_hub_workstream_id: "d49778a4-faca-5712-8db3-1d15a7989aee"
---
Implements P06 under USER-WP-0030-T03 and KEY-WP-0035. Authorized by the
@ -21,6 +22,7 @@ for unrelated clients remains in its current configuration.
id: USER-WP-0033-T01
status: done
priority: high
state_hub_task_id: "193b737c-f9a0-5d30-8e70-efe7550df258"
```
AAL1 users can reach account/onboarding and authenticator setup. Administrative
@ -33,6 +35,7 @@ recent MFA. Explain step-up, unavailable setup and identity-switch recovery.
id: USER-WP-0033-T02
status: done
priority: high
state_hub_task_id: "4e635786-6a68-54a1-b1a1-b73c14fd417f"
```
Issuer-owned persistent policy state for the two reviewed browser clients only.
@ -46,8 +49,9 @@ credential. Changes affect subsequent authorization, not already issued tokens.
```task
id: USER-WP-0033-T03
status: progress
status: done
priority: high
state_hub_task_id: "006b3246-4f54-5989-9126-5ac0b95e226d"
```
Test no-factor/password-only, pending/cancel/confirmed enrollment, enrolled OTP,
@ -62,3 +66,10 @@ regressions and rollout tests pass. Installed-provider acceptance Job
`provider-p06-browser-46713f7e` passed native optional/old-session OTP plus five
browser checks. Fixed test endpoint and asynchronous TOTP/detail readiness.
Release and live readback remain in progress. See P06 evidence.
2026-09-14: P06 completed with CI-published portal and issuer images, provider
guard and scoped client migration. Both services are ready; persistent policy
readback confirms the two optional-after-enrollment clients. Evidence:
`docs/evidence/2026-09-13-p06-authentication-policy.md`. Residual customer sign-in,
user onboarding and workload propagation remain live in USER-WP-0028,
KEY-WP-0034 and VERGABE-WP-0019; this does not close those workplans.