cb67b4318c
Finish USER-WP-0022; leave public registration fail-closed
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Has been cancelled
In-repo journey, recovery, and security matrix are complete (150 tests).
T03/T04 stay cancelled at coulomb-social and KeyCape. Production enablement
remains an operator flag plus governed verification and SMTP credentials.
2026-08-19 14:34:00 +02:00
108bb9a2de
Close USER-WP-0023 after live A2 enforce evidence
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
flex-auth-user-engine is enforce on sha256:138aa347. Probe from
user-engine-8569d7cb87-fp7px: 200 with the projected token, 401 without,
403 when representing tenant-engine. Record fsGroup 10001 so uid 10001
can read the projected caller token.
2026-08-19 14:24:33 +02:00
f762161d84
Adapt USER-WP-0021 and USER-WP-0023 to published policy-nexus contracts
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Build and Publish Container Image / build-and-push (push) Successful in 1m1s
IAM Profile v0.3 and Tenancy Posture v0.1 are now live on
policy.coulomb.social. Close the portal expansion workplan against those
documents, keep the flex-auth live A2 probe waiting, and forward optional
tenant_roles to flex-auth without authorizing from them locally.
2026-08-19 09:51:08 +02:00
e858115210
Record T03 readiness and the remaining upstream blocker
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Has been cancelled
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 12:53:14 +02:00
ecc4ab5755
Record upstream tenant contract corrections
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 10:57:07 +02:00
260029e2f6
Record flex-auth fail-closed coverage
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 10:53:41 +02:00
4622b64061
Authenticate flex-auth calls with a rotating caller token
...
Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the
audience-scoped projected ServiceAccount token from a file on every decision,
so hourly rotation needs no restart, and runtime configuration now requires
USER_ENGINE_FLEX_AUTH_TOKEN_FILE.
A missing, empty, or unreadable token file fails closed as a denial without
reaching flex-auth: OSError joins the caught set and an empty read raises.
Coverage proves all three unusable-token cases deny before any request is
made, and that neither the deny reason nor the decision repr carries the
token value.
Tenant-authority reads now identify user-engine as actor `user-engine` under
the protected tenant.read action, keeping tenant ids opaque and URL-encoded.
Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3
provider-gated skips.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 10:53:31 +02:00
667ea694c2
Delegate tenant lifecycle to the tenant authority
...
CI Smoke / container-smoke (push) Waiting to run
CI Smoke / host-smoke (push) Successful in 0s
TEN-WP-0005 landed the authoritative metadata update and reversible
retirement contract, so USER-WP-0021-T01's deferred tenant operations are
now implementable without user-engine inventing lifecycle semantics.
TenantManagementPort gains read, update, retire, and reactivate. The HTTP
adapter echoes the record version as an If-Match ETag (never `*`), sends an
Idempotency-Key plus actor/reason/correlation_id, and surfaces
Idempotent-Replay. Authority failures map to redacted domain errors carrying
only the contract's stable error_code; its detail text never crosses the
boundary.
Platform operators get the matching API routes and a CSRF-protected browser
screen that reads the record before mutating it and hides the metadata form
for a retired tenant. Portal OpenAPI moves to 0.3.0 with TenantRecord,
UpdateTenant, and TenantLifecycleChange.
Full suite: 145 tests, 3 external-provider skips.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-16 01:28:02 +02:00
0b6a57dc6c
Keep failed outbox events retryable
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-14 00:34:09 +02:00
a0f39f58bd
Separate event and mail delivery credentials
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-13 14:56:24 +02:00
dc2f831c66
Record idempotent registration image
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 19:54:53 +02:00
d6873b84ae
Make registration start idempotent
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 19:53:39 +02:00
custodian-sync
21e2b50ed1
chore(consistency): sync task status from DB [auto]
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Updated by fix-consistency on 2026-08-10:
- USER-WP-0022-T05: wait → progress
2026-08-10 19:30:48 +02:00
custodian-sync
4870adcdc5
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-08-10:
- USER-WP-0021-T01: wait → progress
2026-08-10 19:30:47 +02:00
a94db46de0
Record registration cancellation images
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 19:30:25 +02:00
d5a5fed69a
Add public registration cancellation
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 19:27:41 +02:00
a8f190b7b7
Prove registration collision safety
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 18:37:41 +02:00
b80de5a1f4
Rate limit public registration writes
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 17:52:53 +02:00
cccca324c1
Record registration rollout gate
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 17:02:54 +02:00
custodian-sync
73f9b29e73
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-08-10:
- USER-WP-0022-T01: progress → wait
2026-08-10 16:00:28 +02:00
0669fa7a85
Add public registration browser journey
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 15:59:50 +02:00
c12bc604a8
Make public registration provisioning resumable
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
2026-08-10 11:32:08 +02:00
c36a09bded
Implement verified public registration flow
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-10 11:26:18 +02:00
custodian-sync
b7a57a50a4
chore(consistency): sync task status from DB [auto]
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Updated by fix-consistency on 2026-08-09:
- USER-WP-0022-T02: progress → wait
2026-08-09 22:27:35 +02:00
custodian-sync
b7378b7623
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-08-09:
- USER-WP-0022-T01: progress → wait
2026-08-09 22:27:34 +02:00
fafa4d708a
Record tenant and authorization rollout
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-09 02:23:11 +02:00
6589294ae7
Record expanded portal production rollout
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
2026-08-08 23:21:47 +02:00
8229c6dd33
Expand portal onboarding and administration
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-08-08 23:09:23 +02:00
6d64ec2ccf
Close portal MVP and preserve expansion backlog
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-30 00:52:50 +02:00
09bd9bb397
Close portal operability task
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-30 00:40:45 +02:00
custodian-sync
dd2283412f
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-30:
- USER-WP-0020-T02: progress → done
2026-07-30 00:39:04 +02:00
0ffc5af591
Record registry and offsite backup completion
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-30 00:25:34 +02:00
f8df43a55e
Record portal operability evidence
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-30 00:00:24 +02:00
a336f594e7
Expose provider-neutral identity reconciliation
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-29 23:41:47 +02:00
de2c02dc6d
Record email login portal improvement
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-29 23:14:14 +02:00
37fff67b9f
Complete Binky portal acceptance
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-29 22:14:05 +02:00
0d1c7e133a
Record Binky MFA journey feedback
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-29 22:05:24 +02:00
53d38f2f1e
Record reusable password handoff
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-28 17:56:04 +02:00
bbe291dac3
Advance Binky portal acceptance
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-28 16:48:38 +02:00
custodian-sync
c3cbc39ec4
chore(consistency): sync task status from DB [auto]
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Updated by fix-consistency on 2026-07-28:
- USER-WP-0020-T07: progress → wait
2026-07-28 16:41:54 +02:00
5a4a908427
Record tenant administration UI evidence
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-28 01:32:25 +02:00
custodian-sync
3595eb891b
chore(consistency): sync task status from DB [auto]
...
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Updated by fix-consistency on 2026-07-28:
- USER-WP-0020-T06: progress → wait
2026-07-28 01:12:31 +02:00
3ccdcf7556
Record live provisioning conformance
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
2026-07-28 01:11:08 +02:00
custodian-sync
bbb3dacff0
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T05: wait → progress
2026-07-27 23:25:36 +02:00
custodian-sync
08a7523ba5
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T04: wait → progress
2026-07-27 23:25:36 +02:00
custodian-sync
2261dc3146
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T03: wait → progress
2026-07-27 23:25:36 +02:00
custodian-sync
1e20618a09
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T02: wait → progress
2026-07-27 23:25:36 +02:00
custodian-sync
26c5ee3f4c
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T05: progress → wait
2026-07-27 22:49:26 +02:00
custodian-sync
5b004dff97
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T04: progress → wait
2026-07-27 22:49:26 +02:00
custodian-sync
1b6a3e3c66
chore(consistency): sync task status from DB [auto]
...
Updated by fix-consistency on 2026-07-27:
- USER-WP-0020-T03: progress → wait
2026-07-27 22:49:26 +02:00
