64 commits

Author	SHA1	Message	Date
tegwick	3bd1827a7f	Implement scoped P06 authentication policy and guarded optional onboarding ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6	2026-09-14 00:00:07 +02:00
tegwick	38b041385e	Record verified P05 rollout and service recovery acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 22:31:16 +02:00
tegwick	ac0eb14b75	Implement P05 checked services and safe selected delivery recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 22:11:49 +02:00
tegwick	799d20548b	Record completed P04 recovery rollout and acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 21:19:13 +02:00
tegwick	58e07dd4df	Connect P04 audited recovery to fresh-MFA platform browser flow ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 21:05:33 +02:00
tegwick	b8506ef2e3	Add platform support investigation and clarify bounded account recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 14:14:10 +02:00
tegwick	1127f852dd	Implement role-based account journeys with database and browser acceptance suites ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 12:20:02 +02:00
tegwick	a9ff77d21d	Clarify account session controls and add authenticator recovery guidance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 10:09:01 +02:00
tegwick	e54b6ee970	Add account recovery, visible access records and shared sign-out handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 10:34:44 +02:00
tegwick	d177d47975	fix: select existing tenants by name in the operator portal ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:51:57 +02:00
tegwick	655dce7165	fix: expose operator navigation and protected portal logout ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:37:17 +02:00
tegwick	3c85e563ee	fix: preserve tenant creation metadata and report authority denial ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-11 20:52:47 +02:00
tegwick	4349758608	Implement USER-WP-0024 security layer conformance ... Declare Engine/PIP machine-readably, publish a total fail-closed PEP stance map, stop minting local decision ids on engine-unavailable DENY, bind allows to a 30s request lifetime, confine the local authorization double, classify evidence and emit a denial/revocation heartbeat, and prove access-control facts remain claims. Assistant: grok Assistant-Session: 01a04cea-f0d6-7ab3-9ffd-881eb6bea6cb	2026-08-29 12:53:16 +02:00
tegwick	f762161d84	Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts ... IAM Profile v0.3 and Tenancy Posture v0.1 are now live on policy.coulomb.social. Close the portal expansion workplan against those documents, keep the flex-auth live A2 probe waiting, and forward optional tenant_roles to flex-auth without authorizing from them locally.	2026-08-19 09:51:08 +02:00
tegwick	47a58d5cc2	Report tenant grouping from the authority record ... tenant-engine has made grouping mutable through its own reclassification route, so a tenant created as tenant:small:acme can report grouping "large". The identifier's grouping segment is now historical and must not be parsed. TenantRecord dropped the field entirely, so the portal read discarded the one safe source of a tenant's classification and left an operator with nothing but the identifier to infer from — exactly the mistake the change creates. The record and adapter now carry grouping, the operator screen shows it with a note that the identifier segment is not the grouping, and the OpenAPI schema documents where to read it. Also corrects the UpdateTenant description, which still claimed grouping was immutable. It is mutable, but never as metadata, because it resolves a tenant's spend ceiling. No reclassification control is offered here: that route is not deployed yet and, per tenant-engine, wants its own permission rather than riding on rename. Full suite: 149 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:56:54 +02:00
tegwick	4622b64061	Authenticate flex-auth calls with a rotating caller token ... Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the audience-scoped projected ServiceAccount token from a file on every decision, so hourly rotation needs no restart, and runtime configuration now requires USER_ENGINE_FLEX_AUTH_TOKEN_FILE. A missing, empty, or unreadable token file fails closed as a denial without reaching flex-auth: OSError joins the caught set and an empty read raises. Coverage proves all three unusable-token cases deny before any request is made, and that neither the deny reason nor the decision repr carries the token value. Tenant-authority reads now identify user-engine as actor `user-engine` under the protected tenant.read action, keeping tenant ids opaque and URL-encoded. Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:31 +02:00
tegwick	667ea694c2	Delegate tenant lifecycle to the tenant authority ... TEN-WP-0005 landed the authoritative metadata update and reversible retirement contract, so USER-WP-0021-T01's deferred tenant operations are now implementable without user-engine inventing lifecycle semantics. TenantManagementPort gains read, update, retire, and reactivate. The HTTP adapter echoes the record version as an If-Match ETag (never `*`), sends an Idempotency-Key plus actor/reason/correlation_id, and surfaces Idempotent-Replay. Authority failures map to redacted domain errors carrying only the contract's stable error_code; its detail text never crosses the boundary. Platform operators get the matching API routes and a CSRF-protected browser screen that reads the record before mutating it and hides the metadata form for a retired tenant. Portal OpenAPI moves to 0.3.0 with TenantRecord, UpdateTenant, and TenantLifecycleChange. Full suite: 145 tests, 3 external-provider skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 01:28:02 +02:00
tegwick	db8769cc8c	Authorize me reads as self service	2026-08-14 18:25:56 +02:00
tegwick	5e37e9c012	Authorize self identity links by stored ownership	2026-08-14 16:16:59 +02:00
tegwick	10ee042c41	Mark linked identity context as self	2026-08-14 15:46:17 +02:00
tegwick	d4a13275d0	Release readiness probe database transactions	2026-08-14 14:22:35 +02:00
tegwick	14b8121c71	Align registration verification request contract	2026-08-14 11:25:43 +02:00
tegwick	0b6a57dc6c	Keep failed outbox events retryable	2026-08-14 00:34:09 +02:00
tegwick	a0f39f58bd	Separate event and mail delivery credentials	2026-08-13 14:56:24 +02:00
tegwick	d6873b84ae	Make registration start idempotent	2026-08-10 19:53:39 +02:00
tegwick	d5a5fed69a	Add public registration cancellation	2026-08-10 19:27:41 +02:00
tegwick	a8f190b7b7	Prove registration collision safety	2026-08-10 18:37:41 +02:00
tegwick	b80de5a1f4	Rate limit public registration writes	2026-08-10 17:52:53 +02:00
tegwick	0669fa7a85	Add public registration browser journey	2026-08-10 15:59:50 +02:00
tegwick	c12bc604a8	Make public registration provisioning resumable	2026-08-10 11:32:08 +02:00
tegwick	c36a09bded	Implement verified public registration flow	2026-08-10 11:26:18 +02:00
tegwick	6962ad63b4	Route invitation recipients only to mail delivery	2026-08-09 21:25:20 +02:00
tegwick	292e7e0e3e	Add production authorization and delivery adapters	2026-08-09 01:53:30 +02:00
tegwick	c0da589dbe	Connect platform tenant creation to tenant-engine	2026-08-09 01:34:36 +02:00
tegwick	8229c6dd33	Expand portal onboarding and administration	2026-08-08 23:09:23 +02:00
tegwick	2bcda7f26f	Expose protected operability metrics	2026-07-29 23:52:06 +02:00
tegwick	a336f594e7	Expose provider-neutral identity reconciliation	2026-07-29 23:41:47 +02:00
tegwick	746bf21715	Allow renewing password setup links	2026-07-28 17:33:12 +02:00
tegwick	4efce34821	Present single-use password setup handoff	2026-07-28 17:30:17 +02:00
tegwick	0ef2ae515e	Normalize runtime secret transport whitespace	2026-07-28 15:22:43 +02:00
tegwick	e23674d343	Add CSRF-safe tenant identity administration	2026-07-28 01:22:55 +02:00
tegwick	b2f11856b8	Normalize mounted provisioning tokens	2026-07-28 01:04:05 +02:00
tegwick	e7e8709ca8	Add reusable identity provisioning adapter	2026-07-28 00:57:04 +02:00
tegwick	67ad2af640	Add KeyCape PKCE browser sessions	2026-07-28 00:06:21 +02:00
tegwick	0980d1fd41	Implement user-engine portal foundation	2026-07-27 22:47:39 +02:00
tegwick	a1692c62e3	test: add provider postgres conformance	2026-06-16 07:33:34 +02:00
tegwick	0d50ad294d	feat: add postgres user engine store	2026-06-16 07:14:37 +02:00
tegwick	6810d9a3aa	feat: add durable store record serialization	2026-06-16 03:43:55 +02:00
tegwick	886874d0f6	feat: add durable store conformance harness	2026-06-16 00:20:29 +02:00
tegwick	2ceecf6463	test: add registration security conformance	2026-06-15 23:59:45 +02:00