From f532324460843c11400ed525377029a5d416062b Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 13 Sep 2026 17:03:44 +0200 Subject: [PATCH] Record verified enrollment assurance release and automate provider contract tests Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- workplans/USER-WP-0030-platform-admin-journeys.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/workplans/USER-WP-0030-platform-admin-journeys.md b/workplans/USER-WP-0030-platform-admin-journeys.md index 926ada3..51ae9b1 100644 --- a/workplans/USER-WP-0030-platform-admin-journeys.md +++ b/workplans/USER-WP-0030-platform-admin-journeys.md @@ -80,3 +80,12 @@ offline tests pass and exact-commit CI is configured. This supersedes the earlie missing-owner gate for factor reads. T03 remains in progress for P04 audited factor/account recovery, P05 notification operations and remaining expiry drills, and P06 scoped policy/onboarding acceptance. Historical NK-WP-0033 is separate. + +2026-09-13 assurance follow-up: KeyCape 113f3a6 is released with confirmed-enrollment +state handling, TOTP/HOTP serial/type evidence required for AAL2, and an inert +realm-visibility probe before accepting no-factor responses. This closes three +policy failure modes found while implementing P06. Native probe and full Go +suites passed; installed-provider isolated tests verify enrollment/cancellation, +permission withdrawal/recovery and genuine JWT expiry. Evidence is +key-cape/docs/enrollment-assurance-release-2026-09-13.md. P04 audited lost-factor +recovery and P06 actual optional-client/self-service activation remain T03.