From a8ced85258c99f7b43cf4e8d22523a30cc657329 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 14:48:39 +0200 Subject: [PATCH] =?UTF-8?q?Refresh=20final-assessment=20to=20the=20finishe?= =?UTF-8?q?d=20USER-WP-0001=E2=80=930023=20surface?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the in-memory/no-UI MVP note with what is actually shipped: portal, PostgreSQL, live flex-auth A2, and the remaining operator residuals. --- docs/final-assessment.md | 104 +++++++++++++++++++++++++++++++-------- 1 file changed, 84 insertions(+), 20 deletions(-) diff --git a/docs/final-assessment.md b/docs/final-assessment.md index ec52810..0eb667b 100644 --- a/docs/final-assessment.md +++ b/docs/final-assessment.md @@ -1,37 +1,101 @@ # Implementation Assessment +Date: 2026-08-19 +Related: `../SCOPE.md`, `../INTENT.md`, OpenAPI `0.3.0` + +Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no +active workplan. This file replaces the early-MVP assessment that still +described an in-memory, in-process core with no UI or platform adapters. + ## Implemented -- Headless service API for users, accounts, identity links, applications, +- Headless domain for users, accounts, identity links, applications, catalogs, profiles, projections, audit records, and outbox events. -- Tenant context enforcement, tenant account state, memberships, tenant - profile precedence, tenant diagnostics, and cross-tenant denial. +- Tenant context enforcement, memberships, tenant profile precedence, + redacted diagnostics, and cross-tenant denial. - Multi-application catalog ownership, namespace collision protection, semantic version checks, sensitivity downgrade prevention, app-filtered projections, and claims-enrichment projection caching. -- Scenario fixtures and conformance-style tests for positive and negative - standalone, tenant, multi-app, redaction, audit, event, and cache paths. +- Canon interface card, entity/relationship mappings, and explicit gap + records (`USER-WP-0007`). +- Hats, realms, services, assets, access profiles, and active access + context as user-domain facts. +- Invitations, prepared accounts, entitlement claims, and user-engine-owned + onboarding journeys. +- Public registration orchestration (start, verify, resume, cancel, + provider password-setup handoff) behind + `USER_ENGINE_PUBLIC_REGISTRATION`, fail-closed when credentials are + absent. +- Optional CSRF-protected portal over the same APIs: `/me`, `/onboarding`, + `/admin/{tenant}`, `/platform`, `/register`. +- Durable PostgreSQL store with migrations, plus in-memory fixtures for + standalone conformance. +- HTTP adapters for flex-auth (rotating caller token, live A2 on + `flex-auth-user-engine`), tenant-engine lifecycle, identity-provisioner, + registration verification, and split event/mail outbox delivery. +- OpenAPI portal contract `0.3.0` (`TenantRecord`, update/retire/reactivate). +- Scenario and security matrices. Full suite: 150 tests, three + provider-gated skips. + +Production image evidence includes +`sha256:c501aeb2…` (caller token) on Railiance. flex-auth-user-engine +enforce probe 2026-08-19: `200` with the projected token, `401` without, +`403` when representing `tenant-engine`. ## Boundary Verification -User-engine does not issue tokens, verify MFA, store credentials, act as the -policy decision point, own deployment, or provide a UI. It consumes verified -claims through an identity adapter, asks authorization through a port, emits -audit/outbox records, and exposes backend contracts for future UIs. +user-engine still does not issue tokens, verify MFA, store credentials, or +act as the policy decision point. It does not own tenant identifiers, +grouping reclassification, capability-role grants, runtime secrets, +platform audit storage, or transactional SMTP. + +It consumes verified IAM Profile v0.3 claims, asks flex-auth, calls +tenant-engine and identity-provisioner, and emits redacted audit/outbox +records. The in-repo portal is an optional surface, not a UI product; +password and MFA screens stay on the identity provider. ## Accepted Deviations -- The first persistence adapter is in-memory. It carries schema and migration - semantics but is not durable. -- The first API surface is in-process Python. HTTP/RPC transport adapters are - still future work. -- Metrics and cache diagnostics are local snapshots, not platform telemetry. +- Package version remains `0.1.0`. Schema and service contracts may still + evolve before `1.0.0`, with migrations and scenario updates. +- Access-review, policy, control, and exception are references or gaps, + not owned records (see `docs/canon-interface-card.yaml`). +- Application first-login profiles, unlink, and action step-up stay with + consuming apps and KeyCape (`USER-WP-0022` T03/T04 cancelled). +- `/metrics` is a bounded local snapshot (`user_engine_ready` plus record + counts), not platform telemetry. +- The user-engine boundary contract is accepted in net-kingdom and marked + `publish` in policy-nexus, but it is not yet on + `policy.coulomb.social`. + +## Residuals + +Operator-owned, not remaining product code: + +- Public registration and outbox mail stay fail-closed until governed + OpenBao verification/delivery tokens and the transactional SMTP lane + are installed. No placeholder credential. +- Live tenant-lifecycle probe from a user-engine pod (GET / PATCH / + retire / reactivate on a disposable tenant) is still owed. Contract + tests cannot see a digest pin rollback. +- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth + / tenant-engine. +- Pod `fsGroup: 10001` is required so uid 10001 can read the projected + flex-auth caller token; persisted in rapp-user-engine + `manifests/runtime.yaml` `e599b4f`. + +Demand-triggered, not started here: + +- Inbound federation, SCIM, or directory sync — new workplan only if a + tenant requires it; published path is IAM Profile v0.3 Keycloak + expanded mode. +- First-class access-review/governance records. +- A dedicated agent consumption product (projections already exist). +- Extracting a generic profile engine. ## Follow-Up Work -- Add a durable database adapter and migration tests. -- Add transport adapters with request/response contract tests. -- Add platform authorization, audit sink, secret provider, and outbox drain - adapters. -- Add release automation for SBOM, package build, static checks, and - deployment handoff. +The previous follow-ups are done: durable PostgreSQL, HTTP transport, +flex-auth, outbox drain, and a live Railiance deploy. Remaining work is +the residuals above, plus ordinary release hygiene (SBOM, static/security +scans) when the next image is published.