144 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
tegwick	7604d31776	ci: publish user-engine images from forge commits ... Add the fleet container-build workflow so latest main can be rolled out by digest instead of a workstation-built image.	2026-08-18 12:39:24 +02:00
tegwick	ecc4ab5755	Record upstream tenant contract corrections ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:57:07 +02:00
tegwick	47a58d5cc2	Report tenant grouping from the authority record ... tenant-engine has made grouping mutable through its own reclassification route, so a tenant created as tenant:small:acme can report grouping "large". The identifier's grouping segment is now historical and must not be parsed. TenantRecord dropped the field entirely, so the portal read discarded the one safe source of a tenant's classification and left an operator with nothing but the identifier to infer from — exactly the mistake the change creates. The record and adapter now carry grouping, the operator screen shows it with a note that the identifier segment is not the grouping, and the OpenAPI schema documents where to read it. Also corrects the UpdateTenant description, which still claimed grouping was immutable. It is mutable, but never as metadata, because it resolves a tenant's spend ceiling. No reclassification control is offered here: that route is not deployed yet and, per tenant-engine, wants its own permission rather than riding on rename. Full suite: 149 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:56:54 +02:00
custodian-sync	4e0f25acf2	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-18: - update .custodian-brief.md for user-engine	2026-08-18 10:55:22 +02:00
tegwick	260029e2f6	Record flex-auth fail-closed coverage ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:41 +02:00
tegwick	4622b64061	Authenticate flex-auth calls with a rotating caller token ... Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the audience-scoped projected ServiceAccount token from a file on every decision, so hourly rotation needs no restart, and runtime configuration now requires USER_ENGINE_FLEX_AUTH_TOKEN_FILE. A missing, empty, or unreadable token file fails closed as a denial without reaching flex-auth: OSError joins the caught set and an empty read raises. Coverage proves all three unusable-token cases deny before any request is made, and that neither the deny reason nor the decision repr carries the token value. Tenant-authority reads now identify user-engine as actor `user-engine` under the protected tenant.read action, keeping tenant ids opaque and URL-encoded. Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:31 +02:00
custodian-sync	6f6bbf5e4a	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-18: - update .custodian-brief.md for user-engine	2026-08-18 07:29:36 +02:00
tegwick	58f5f6d9c3	Refresh work record index ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 02:05:29 +02:00
custodian-sync	0c6d02b7a9	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-16: - update .custodian-brief.md for user-engine	2026-08-16 01:28:36 +02:00
tegwick	667ea694c2	Delegate tenant lifecycle to the tenant authority ... TEN-WP-0005 landed the authoritative metadata update and reversible retirement contract, so USER-WP-0021-T01's deferred tenant operations are now implementable without user-engine inventing lifecycle semantics. TenantManagementPort gains read, update, retire, and reactivate. The HTTP adapter echoes the record version as an If-Match ETag (never `*`), sends an Idempotency-Key plus actor/reason/correlation_id, and surfaces Idempotent-Replay. Authority failures map to redacted domain errors carrying only the contract's stable error_code; its detail text never crosses the boundary. Platform operators get the matching API routes and a CSRF-protected browser screen that reads the record before mutating it and hides the metadata form for a retired tenant. Portal OpenAPI moves to 0.3.0 with TenantRecord, UpdateTenant, and TenantLifecycleChange. Full suite: 145 tests, 3 external-provider skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 01:28:02 +02:00
tegwick	db8769cc8c	Authorize me reads as self service	2026-08-14 18:25:56 +02:00
tegwick	5e37e9c012	Authorize self identity links by stored ownership	2026-08-14 16:16:59 +02:00
tegwick	10ee042c41	Mark linked identity context as self	2026-08-14 15:46:17 +02:00
tegwick	d4a13275d0	Release readiness probe database transactions	2026-08-14 14:22:35 +02:00
tegwick	14b8121c71	Align registration verification request contract	2026-08-14 11:25:43 +02:00
tegwick	0b6a57dc6c	Keep failed outbox events retryable	2026-08-14 00:34:09 +02:00
tegwick	a0f39f58bd	Separate event and mail delivery credentials	2026-08-13 14:56:24 +02:00
tegwick	9480463b24	Refresh work record index	2026-08-10 20:01:12 +02:00
tegwick	dc2f831c66	Record idempotent registration image	2026-08-10 19:54:53 +02:00
tegwick	d6873b84ae	Make registration start idempotent	2026-08-10 19:53:39 +02:00
tegwick	e0399cf235	Refresh work record index	2026-08-10 19:36:02 +02:00
custodian-sync	21e2b50ed1	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0022-T05: wait → progress	2026-08-10 19:30:48 +02:00
custodian-sync	4870adcdc5	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0021-T01: wait → progress	2026-08-10 19:30:47 +02:00
tegwick	a94db46de0	Record registration cancellation images	2026-08-10 19:30:25 +02:00
tegwick	d5a5fed69a	Add public registration cancellation	2026-08-10 19:27:41 +02:00
tegwick	8170373148	Refresh work record index	2026-08-10 18:47:03 +02:00
tegwick	a8f190b7b7	Prove registration collision safety	2026-08-10 18:37:41 +02:00
tegwick	b80de5a1f4	Rate limit public registration writes	2026-08-10 17:52:53 +02:00
tegwick	cccca324c1	Record registration rollout gate	2026-08-10 17:02:54 +02:00
custodian-sync	d3b3266c62	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - update .custodian-brief.md for user-engine	2026-08-10 16:00:31 +02:00
custodian-sync	73f9b29e73	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-10: - USER-WP-0022-T01: progress → wait	2026-08-10 16:00:28 +02:00
tegwick	0669fa7a85	Add public registration browser journey	2026-08-10 15:59:50 +02:00
tegwick	c12bc604a8	Make public registration provisioning resumable	2026-08-10 11:32:08 +02:00
tegwick	c36a09bded	Implement verified public registration flow	2026-08-10 11:26:18 +02:00
custodian-sync	b7a57a50a4	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - USER-WP-0022-T02: progress → wait	2026-08-09 22:27:35 +02:00
custodian-sync	b7378b7623	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - USER-WP-0022-T01: progress → wait	2026-08-09 22:27:34 +02:00
custodian-sync	1f25052d02	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - update .custodian-brief.md for user-engine	2026-08-09 21:57:53 +02:00
tegwick	6962ad63b4	Route invitation recipients only to mail delivery	2026-08-09 21:25:20 +02:00
custodian-sync	bf03b3e82a	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - update .custodian-brief.md for user-engine	2026-08-09 20:50:40 +02:00
tegwick	fafa4d708a	Record tenant and authorization rollout	2026-08-09 02:23:11 +02:00
custodian-sync	3bb73b013e	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-09: - update .custodian-brief.md for user-engine	2026-08-09 02:02:03 +02:00
tegwick	292e7e0e3e	Add production authorization and delivery adapters	2026-08-09 01:53:30 +02:00
tegwick	c0da589dbe	Connect platform tenant creation to tenant-engine	2026-08-09 01:34:36 +02:00
tegwick	6589294ae7	Record expanded portal production rollout	2026-08-08 23:21:47 +02:00
tegwick	8229c6dd33	Expand portal onboarding and administration	2026-08-08 23:09:23 +02:00
custodian-sync	3d334479e9	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-08: - update .custodian-brief.md for user-engine	2026-08-08 22:02:10 +02:00
tegwick	8adc409d9a	Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) ... Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's preliminary governing license, per target-revenue's workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full specialist legal review is deferred until out of beta (target-revenue SCOPE.md §1). No Phase is yet declared for this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-30 01:12:41 +02:00
tegwick	6d64ec2ccf	Close portal MVP and preserve expansion backlog	2026-07-30 00:52:50 +02:00
custodian-sync	5be206420c	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-07-30: - update .custodian-brief.md for user-engine	2026-07-30 00:51:17 +02:00
tegwick	09bd9bb397	Close portal operability task	2026-07-30 00:40:45 +02:00