coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native readback integration and missing catalogue acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 03:01:29 +02:00
parent ac8b04edc7
commit f0f67a55ce
2 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/USER-WP-0026-account-recovery.md
View file

@ -165,3 +165,7 @@ The local readback cache now binds each row set to tenant as well as session,
issuer and subject. A tenant switch within the same session therefore performs issuer and subject. A tenant switch within the same session therefore performs
a fresh read instead of displaying another tenant's unexpired allow. A focused a fresh read instead of displaying another tenant's unexpired allow. A focused
regression exercises an allow in tenant-a followed by a deny in tenant-b. regression exercises an allow in tenant-a followed by a deny in tenant-b.
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.

4
workplans/USER-WP-0028-user-journey-acceptance.md
View file

@ -101,3 +101,7 @@ net-kingdom's rollout reply, then the attended run with tegwick.
live from rapp-user-engine manifests/runtime.yaml, the apply home. The net-kingdom live from rapp-user-engine manifests/runtime.yaml, the apply home. The net-kingdom
file is migration input only. Public /security verified showing the file is migration input only. Public /security verified showing the
pink-account link. Next: the attended run with tegwick. pink-account link. Next: the attended run with tegwick.
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.