coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin final P04 release and native ownership-lock evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 21:30:50 +02:00
parent c298cd900e
commit 99618488e0
1 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/evidence/2026-09-13-p04-recovery.md
View file

@ -11,7 +11,7 @@ Recovery disables one selected factor and preserves password, directory identity
tenant access and other factors. Provider audit persists before mutation; stale
state, changed ownership and conflicting references are rejected. PostgreSQL
advisory locking serializes recovery requests; row locking protects the selected
factor and a final fingerprint protects readback. Retries reconcile completion.
factor and its ownership records and a final fingerprint protects readback. Retries reconcile completion.
Check recovery result by support reference if the page or response was lost;
the original administrator can obtain a fresh confirmation for an interrupted
operation. A completed receipt is rechecked against current provider state.
@ -34,10 +34,10 @@ before AAL2. Recovery does not automatically relax application MFA policy.
## Release and verification
- Portal source: 11dfaf5 (including 58e07dd).
- Portal image: forgejo.coulomb.social/coulomb/user-engine@sha256:86112f2f0bb6388344d0260a3611da2a19c609b8f08bd79858d51e1a271e5fa6.
- Provider service source: key-cape d15f4dd (including cb51584).
- Immutable service code: mfa/factor-recovery-626517ff9acb0ef7.
- Portal source: c298cd9 (including 11dfaf5 and 58e07dd).
- Portal image: forgejo.coulomb.social/coulomb/user-engine@sha256:c71c6653132611de0c5f1209ca641ecefcde0df49a824930c6365a9fdecd3235.
- Provider service source: key-cape 63b3070 (including d15f4dd and cb51584).
- Immutable service code: mfa/factor-recovery-79e2964c112f3688.
- Provider image: ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473.
- net-kingdom deployment procedure: sso-mfa/k8s/privacyidea/deploy-factor-recovery.py;
possession policy: enable-factor-confirmation.py. Cluster and deployment UID
@ -46,12 +46,14 @@ before AAL2. Recovery does not automatically relax application MFA policy.
- 15 recovery core/service tests passed, including lost-confirmation reconciliation.
- 19 isolated Chromium checks passed, including P04 role denial, scope/proof
confirmation, completion receipt and replacement instructions.
- Installed-provider Job provider-p04-contract-02 passed signed administrator
- Installed-provider Job provider-p04-contract-03 passed signed administrator
recovery, wrong role/audience, stale MFA, unsigned requests, unknown-user
isolation, tampered confirmation, durable audit, retry, reference readback,
isolation, multi-owner factor refusal, tampered confirmation, durable audit, retry, reference readback,
replacement possession and authentication. Its databases, identities, JWT
signing key and OTP seeds were disposable fixtures, not production accounts.
- Exact source CI passed: KeyCape run60; portal runs161/162/163.
- Exact source CI passed: KeyCape run61; portal runs166/167/168.
- Native PostgreSQL advisory and token/ownership locking queries passed against
a nonexistent token ID and were rolled back; no factor rows were changed.
- Both deployments completed rollout. Live portal health/readiness returned 200;
anonymous recovery page returned 403 with sign-in recovery navigation. Native
portal-to-provider health returned 200; missing/invalid authentication returned
@ -61,3 +63,7 @@ No real user's authenticator was disabled for testing. Production authenticated
recovery was not exercised against a real account; positive mutation and browser
acceptance used disposable fixtures. P05 service operations and P06 broader
policy/self-service work remain USER-WP-0030-T03; P04 is removed from that gap.
Shared factors (one serial assigned to multiple identities) are explicitly refused
before mutation, with a clear ownership-resolution message. This preserves the
bounded single-identity recovery contract.