coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close recovery acceptance and reconcile blocked workplans
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
Account journey acceptance / journeys (push) Successful in 10s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e38e-e5bb-7b50-968d-a738a0294997
This commit is contained in:
tegwick 2026-09-27 17:54:47 +02:00
parent b73f553c18
commit eca7c54748
9 changed files with 162 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

24
tests/journey-coverage.json
View file

@ -20,7 +20,7 @@
"test_web.PortalApplicationTests.test_expired_browser_session_and_provider_outage_fail_closed",
"test_account_recovery.AccountRecoveryTests.test_failed_callback_has_clean_recovery_and_no_loop"
],
"remaining": "KEY-WP-0035: actual no-factor/enrolled login needs provider credential and policy rollout."
"remaining": "Fresh application login was confirmed on 2026-09-24 (KeyCape fresh-login/account-switch receipt). VERGABE-WP-0019-T06 still owns second-user, setup-to-welcome and company-workflow acceptance."
},
{
"id": "U03",
@ -48,7 +48,7 @@
"tests": [
"test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
],
"remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
"remaining": "KEY-WP-0035/RPF-WP-0040 credential and optional-policy rollout are complete; P04/P06 installed-provider fixtures cover enrollment, cancellation, recovery/replacement and old-session MFA. USER-WP-0028-T03 retains attended real-user OTP acceptance and verified portal setup handoff."
},
{
"id": "U06",
@ -57,7 +57,7 @@
"tests": [
"test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
],
"remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
"remaining": "KEY-WP-0035/RPF-WP-0040 credential and optional-policy rollout are complete; P04/P06 installed-provider fixtures cover enrollment, cancellation, recovery/replacement and old-session MFA. USER-WP-0028-T03 retains attended real-user OTP acceptance and verified portal setup handoff."
},
{
"id": "U07",
@ -66,7 +66,7 @@
"tests": [
"test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
],
"remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
"remaining": "KEY-WP-0035/RPF-WP-0040 credential and optional-policy rollout are complete; P04/P06 installed-provider fixtures cover enrollment, cancellation, recovery/replacement and old-session MFA. USER-WP-0028-T03 retains attended real-user OTP acceptance and verified portal setup handoff."
},
{
"id": "U08",
@ -75,12 +75,12 @@
"tests": [
"test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
],
"remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
"remaining": "KEY-WP-0035/RPF-WP-0040 credential and optional-policy rollout are complete; P04/P06 installed-provider fixtures cover enrollment, cancellation, recovery/replacement and old-session MFA. USER-WP-0028-T03 retains attended real-user OTP acceptance and verified portal setup handoff."
},
{
"id": "U09",
"role": "user",
"implementation": "partial",
"implementation": "external-blocked",
"tests": [
"test_account_recovery.AccountRecoveryTests.test_account_workload_list_is_scoped_to_current_user",
"test_account_awareness.AccountAwarenessTests.test_token_tenant_without_membership_is_active_and_not_allowed",
@ -88,17 +88,17 @@
"test_account_awareness.AccountAwarenessTests.test_recorded_workload_stays_allowed_and_unchecked",
"test_account_awareness.AccountAwarenessTests.test_exception_role_shows_every_tenant_the_sign_in_lists"
],
"remaining": "USER-WP-0036 shows login state, the active sign-in, and allowed memberships. USER-WP-0028-T02/USER-WP-0026-T03 still own authoritative allow, deny, and unavailable workload decisions."
"remaining": "USER-WP-0036 shows login state, the active sign-in, and allowed memberships. USER-WP-0028-T02/USER-WP-0026-T03 still own authoritative allow, deny, and unavailable workload decisions. Integration waits on an owner-supported workload catalogue/admission and scoped grant/revocation contract; membership is not effective authorization."
},
{
"id": "U10",
"role": "user",
"implementation": "external-blocked",
"implementation": "implemented",
"tests": [
"test_account_clarity.AccountClarityTests.test_wrong_shared_identity_recovery_does_not_claim_a_known_session",
"test_portal_navigation.PortalNavigationTests.test_navigation_does_not_leak_between_operator_member_and_anonymous"
],
"remaining": "Authenticated multi-identity/tenant switching must be verified against live issuer."
"remaining": "Account switching confirmed by the founder and fresh portal issuer sequences on 2026-09-24; see key-cape/docs/evidence/2026-09-24-fresh-login-and-account-switch.md and USER-WP-0026-T02. Application sessions may outlive provider logout; multi-user workload acceptance remains VERGABE-WP-0019-T06."
},
{
"id": "U11",
@ -170,16 +170,16 @@
"test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry",
"test_journey_roles.TenantAdminJourneys.test_provider_failure_retains_local_state_and_retry_recovers"
],
"remaining": "Provider-owned lost-factor recovery still unverified; password setup assistance is supported."
"remaining": "P04 recovery and provider status are implemented and deployed, with installed-provider fixture evidence. Real-person lost-factor recovery remains USER-WP-0028-T03; tenant administrators must use the authorized platform recovery path."
},
{
"id": "T05",
"role": "tenant_admin",
"implementation": "partial",
"implementation": "external-blocked",
"tests": [
"test_journey_roles.TenantAdminJourneys.test_invalid_role_cannot_create_partial_account"
],
"remaining": "Tenant roles are managed; authoritative application-specific grant/revoke integration remains USER-WP-0028-T02."
"remaining": "Tenant roles are managed; authoritative application-specific grant/revoke integration remains USER-WP-0028-T02. Integration waits on an owner-supported workload catalogue/admission and scoped grant/revocation contract; membership is not effective authorization."
},
{
"id": "T06",