coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified one-application catalogue exception and remaining acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 04:13:08 +02:00
parent 5d80644efa
commit cd8909154c
13 changed files with 446 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

33
workplans/USER-WP-0026-account-recovery.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: codex
topic_slug: user-engine
created: "2026-09-12"
updated: "2026-10-09"
updated: "2026-10-11"
state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
---
@ -62,8 +62,8 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
```task
id: USER-WP-0026-T03
status: wait
blocked_on: message-from:rapp-user-engine
blocking_reason: "FLEX-WP-0035-T04 delivered the admitted readback pin on 2026-10-10. Needs rapp-user-engine readback URL, separate projected caller token and exact-pin egress, an image containing the readback client, and native consumer allow/deny/unavailable acceptance against the live pin."
blocked_on: message-from:access-engine
blocking_reason: "Actual one-app catalogue and admitted runtime readback verified 2026-10-11. Remains owner-supported scoped grant/revocation contract, actual signed-in human account projection and ordinary authenticated catalogue-management admission before customer production; SERVICE/synthetic checks do not satisfy those gates."
priority: high
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
```
@ -169,3 +169,30 @@ regression exercises an allow in tenant-a followed by a deny in tenant-b.
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.
2026-10-11 native R1 catalogue milestone (02:10Z): the founder accepted
infd-20261011-user-catalogue-bootstrap-r1, approval
b859698b-5d08-4da5-9599-4760c6a799f1. Root's exact approved standalone dry-run
and apply committed Application informed-decision and its OIDC
informed-decision-approver / protected-system informed-decision binding.
Independent READ ONLY verification proves 2 rows, 1 digest-bound consumed ledger,
3 truthfully maintenance SERVICE-attributed audits including genuine ordinary
PDP deny and no maintenance PDP allow ID, and 1 attributed registered event.
Fresh Access registry and native KeyCape known-client/wrong-redirect check bind
the actual three-way catalogue. The installed account reader joins real rows
and renders the maintenance SERVICE denied; native labelled policy fixtures
pass allow/deny/expiry/unavailable/tenant-cache checks. Evidence:
`docs/evidence/2026-10-11-one-app-catalogue-native-acceptance/README.md`.
The missing local catalogue record and consumer runtime-wiring blockers are
resolved for this one application. This task stays wait: owner-supported scoped
grant/revocation semantics and actual signed-in human account projection are
not established by SERVICE or synthetic policy checks. Ordinary authenticated
catalogue-management admission must be implemented and verified before customer
production; retain this follow-up on existing USER-WP-0026-T03 and its reuse in
USER-WP-0028-T02, linked to the single Custodian close-down exception row. No
duplicate intake or leftover only in prose is created. Never infer entitlement
from catalogue/membership facts. Real OTP/browser journey acceptance remains
separate. At verification the original event was unclaimed/undelivered with no
consumer receipt; maintenance authority grants no targeted delivery/replay.

31
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: codex
topic_slug: communication
created: "2026-09-13"
updated: "2026-10-03"
updated: "2026-10-11"
state_hub_workstream_id: "145df9d5-a7e9-5d20-8280-9d3ea069838b"
---
@ -33,7 +33,7 @@ U01–U04/U10–U13: preserve safe profile input on validation failure; confirm
id: USER-WP-0028-T02
status: wait
depends_on: [USER-WP-0026-T03]
blocking_reason: "Blocked on the provider-owned catalogue/admission and scoped grant/revocation contract from USER-WP-0026-T03."
blocking_reason: "Actual one-app catalogue/readback verified under native R1 exception. Reuses USER-WP-0026-T03 for supported scoped grant/revocation, signed-in human account projection and ordinary authenticated management restoration; no complete U09/T05 claim from SERVICE/synthetic evidence."
priority: high
state_hub_task_id: "5d1bf977-034d-5448-b4fb-5a8b630af6ba"
```
@ -105,3 +105,30 @@ pink-account link. Next: the attended run with tegwick.
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.
2026-10-11 native R1 catalogue milestone (02:10Z): the founder accepted
infd-20261011-user-catalogue-bootstrap-r1, approval
b859698b-5d08-4da5-9599-4760c6a799f1. Root's exact approved standalone dry-run
and apply committed Application informed-decision and its OIDC
informed-decision-approver / protected-system informed-decision binding.
Independent READ ONLY verification proves 2 rows, 1 digest-bound consumed ledger,
3 truthfully maintenance SERVICE-attributed audits including genuine ordinary
PDP deny and no maintenance PDP allow ID, and 1 attributed registered event.
Fresh Access registry and native KeyCape known-client/wrong-redirect check bind
the actual three-way catalogue. The installed account reader joins real rows
and renders the maintenance SERVICE denied; native labelled policy fixtures
pass allow/deny/expiry/unavailable/tenant-cache checks. Evidence:
`docs/evidence/2026-10-11-one-app-catalogue-native-acceptance/README.md`.
The missing local catalogue record and consumer runtime-wiring blockers are
resolved for this one application. This task stays wait: owner-supported scoped
grant/revocation semantics and actual signed-in human account projection are
not established by SERVICE or synthetic policy checks. Ordinary authenticated
catalogue-management admission must be implemented and verified before customer
production; retain this follow-up on existing USER-WP-0026-T03 and its reuse in
USER-WP-0028-T02, linked to the single Custodian close-down exception row. No
duplicate intake or leftover only in prose is created. Never infer entitlement
from catalogue/membership facts. Real OTP/browser journey acceptance remains
separate. At verification the original event was unclaimed/undelivered with no
consumer receipt; maintenance authority grants no targeted delivery/replay.