100 commits

Author	SHA1	Message	Date
tegwick	1127f852dd	Implement role-based account journeys with database and browser acceptance suites ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 12:20:02 +02:00
tegwick	75750c0036	Record live account-clarity checks and remaining role journey acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 10:13:42 +02:00
tegwick	a9ff77d21d	Clarify account session controls and add authenticator recovery guidance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 10:09:01 +02:00
tegwick	61dc76739f	Record generated State Hub recovery task bindings ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 17:10:41 +02:00
tegwick	90d809a486	Record recovery rollout and authoritative access catalogue follow-up ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 10:50:35 +02:00
tegwick	e54b6ee970	Add account recovery, visible access records and shared sign-out handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 10:34:44 +02:00
tegwick	7330c25d80	docs: record native onboarding and completed operator navigation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 01:08:32 +02:00
tegwick	d177d47975	fix: select existing tenants by name in the operator portal ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:51:57 +02:00
tegwick	655dce7165	fix: expose operator navigation and protected portal logout ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:37:17 +02:00
tegwick	b9ae48b00c	Point identity and evidence mappings to current canon owners ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b	2026-09-06 01:39:09 +02:00
tegwick	4349758608	Implement USER-WP-0024 security layer conformance ... Declare Engine/PIP machine-readably, publish a total fail-closed PEP stance map, stop minting local decision ids on engine-unavailable DENY, bind allows to a 30s request lifetime, confine the local authorization double, classify evidence and emit a denial/revocation heartbeat, and prove access-control facts remain claims. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb	2026-08-29 12:53:16 +02:00
repo-manager	c7b6148a70	chore(registrar): assign State Hub identifiers ... Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb	2026-08-29 12:10:32 +02:00
tegwick	96430299b7	Declare Engine/PIP and open USER-WP-0024 for layer conformance ... Adopt security-layer-model v0.7 in INTENT.md in this repository's own voice, restate SCOPE.md from that declaration, and record the scope-versus-implementation assessment. USER-IN-0001 is answered; runtime follow-through is USER-WP-0024. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb	2026-08-29 11:56:06 +02:00
codex	a87a794cc9	fix(workplans): adopt ADR-007 derived identifiers for unregistered records ... These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 20:26:33 +02:00
tegwick	cb67b4318c	Finish USER-WP-0022; leave public registration fail-closed ... In-repo journey, recovery, and security matrix are complete (150 tests). T03/T04 stay cancelled at coulomb-social and KeyCape. Production enablement remains an operator flag plus governed verification and SMTP credentials.	2026-08-19 14:34:00 +02:00
tegwick	108bb9a2de	Close USER-WP-0023 after live A2 enforce evidence ... flex-auth-user-engine is enforce on sha256:138aa347. Probe from user-engine-8569d7cb87-fp7px: 200 with the projected token, 401 without, 403 when representing tenant-engine. Record fsGroup 10001 so uid 10001 can read the projected caller token.	2026-08-19 14:24:33 +02:00
tegwick	f762161d84	Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts ... IAM Profile v0.3 and Tenancy Posture v0.1 are now live on policy.coulomb.social. Close the portal expansion workplan against those documents, keep the flex-auth live A2 probe waiting, and forward optional tenant_roles to flex-auth without authorizing from them locally.	2026-08-19 09:51:08 +02:00
tegwick	e858115210	Record T03 readiness and the remaining upstream blocker ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 12:53:14 +02:00
tegwick	ecc4ab5755	Record upstream tenant contract corrections ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:57:07 +02:00
tegwick	260029e2f6	Record flex-auth fail-closed coverage ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:41 +02:00
tegwick	4622b64061	Authenticate flex-auth calls with a rotating caller token ... Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the audience-scoped projected ServiceAccount token from a file on every decision, so hourly rotation needs no restart, and runtime configuration now requires USER_ENGINE_FLEX_AUTH_TOKEN_FILE. A missing, empty, or unreadable token file fails closed as a denial without reaching flex-auth: OSError joins the caught set and an empty read raises. Coverage proves all three unusable-token cases deny before any request is made, and that neither the deny reason nor the decision repr carries the token value. Tenant-authority reads now identify user-engine as actor `user-engine` under the protected tenant.read action, keeping tenant ids opaque and URL-encoded. Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:31 +02:00
tegwick	667ea694c2	Delegate tenant lifecycle to the tenant authority ... TEN-WP-0005 landed the authoritative metadata update and reversible retirement contract, so USER-WP-0021-T01's deferred tenant operations are now implementable without user-engine inventing lifecycle semantics. TenantManagementPort gains read, update, retire, and reactivate. The HTTP adapter echoes the record version as an If-Match ETag (never `*`), sends an Idempotency-Key plus actor/reason/correlation_id, and surfaces Idempotent-Replay. Authority failures map to redacted domain errors carrying only the contract's stable error_code; its detail text never crosses the boundary. Platform operators get the matching API routes and a CSRF-protected browser screen that reads the record before mutating it and hides the metadata form for a retired tenant. Portal OpenAPI moves to 0.3.0 with TenantRecord, UpdateTenant, and TenantLifecycleChange. Full suite: 145 tests, 3 external-provider skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 01:28:02 +02:00
tegwick	0b6a57dc6c	Keep failed outbox events retryable	2026-08-14 00:34:09 +02:00
tegwick	a0f39f58bd	Separate event and mail delivery credentials	2026-08-13 14:56:24 +02:00
tegwick	dc2f831c66	Record idempotent registration image	2026-08-10 19:54:53 +02:00
tegwick	d6873b84ae	Make registration start idempotent	2026-08-10 19:53:39 +02:00
custodian-sync	21e2b50ed1	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0022-T05: wait → progress	2026-08-10 19:30:48 +02:00
custodian-sync	4870adcdc5	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0021-T01: wait → progress	2026-08-10 19:30:47 +02:00
tegwick	a94db46de0	Record registration cancellation images	2026-08-10 19:30:25 +02:00
tegwick	d5a5fed69a	Add public registration cancellation	2026-08-10 19:27:41 +02:00
tegwick	a8f190b7b7	Prove registration collision safety	2026-08-10 18:37:41 +02:00
tegwick	b80de5a1f4	Rate limit public registration writes	2026-08-10 17:52:53 +02:00
tegwick	cccca324c1	Record registration rollout gate	2026-08-10 17:02:54 +02:00
custodian-sync	73f9b29e73	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0022-T01: progress → wait	2026-08-10 16:00:28 +02:00
tegwick	0669fa7a85	Add public registration browser journey	2026-08-10 15:59:50 +02:00
tegwick	c12bc604a8	Make public registration provisioning resumable	2026-08-10 11:32:08 +02:00
tegwick	c36a09bded	Implement verified public registration flow	2026-08-10 11:26:18 +02:00
custodian-sync	b7a57a50a4	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - USER-WP-0022-T02: progress → wait	2026-08-09 22:27:35 +02:00
custodian-sync	b7378b7623	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - USER-WP-0022-T01: progress → wait	2026-08-09 22:27:34 +02:00
tegwick	fafa4d708a	Record tenant and authorization rollout	2026-08-09 02:23:11 +02:00
tegwick	6589294ae7	Record expanded portal production rollout	2026-08-08 23:21:47 +02:00
tegwick	8229c6dd33	Expand portal onboarding and administration	2026-08-08 23:09:23 +02:00
tegwick	6d64ec2ccf	Close portal MVP and preserve expansion backlog	2026-07-30 00:52:50 +02:00
tegwick	09bd9bb397	Close portal operability task	2026-07-30 00:40:45 +02:00
custodian-sync	dd2283412f	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-07-30: - USER-WP-0020-T02: progress → done	2026-07-30 00:39:04 +02:00
tegwick	0ffc5af591	Record registry and offsite backup completion	2026-07-30 00:25:34 +02:00
tegwick	f8df43a55e	Record portal operability evidence	2026-07-30 00:00:24 +02:00
tegwick	a336f594e7	Expose provider-neutral identity reconciliation	2026-07-29 23:41:47 +02:00
tegwick	de2c02dc6d	Record email login portal improvement	2026-07-29 23:14:14 +02:00
tegwick	37fff67b9f	Complete Binky portal acceptance	2026-07-29 22:14:05 +02:00