25 commits

Author	SHA1	Message	Date
tegwick	3bd1827a7f	Implement scoped P06 authentication policy and guarded optional onboarding ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6	2026-09-14 00:00:07 +02:00
tegwick	ac0eb14b75	Implement P05 checked services and safe selected delivery recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 22:11:49 +02:00
tegwick	58e07dd4df	Connect P04 audited recovery to fresh-MFA platform browser flow ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 21:05:33 +02:00
tegwick	b8506ef2e3	Add platform support investigation and clarify bounded account recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 14:14:10 +02:00
tegwick	1127f852dd	Implement role-based account journeys with database and browser acceptance suites ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 12:20:02 +02:00
tegwick	a9ff77d21d	Clarify account session controls and add authenticator recovery guidance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 10:09:01 +02:00
tegwick	e54b6ee970	Add account recovery, visible access records and shared sign-out handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 10:34:44 +02:00
tegwick	d177d47975	fix: select existing tenants by name in the operator portal ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:51:57 +02:00
tegwick	655dce7165	fix: expose operator navigation and protected portal logout ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-12 00:37:17 +02:00
tegwick	47a58d5cc2	Report tenant grouping from the authority record ... tenant-engine has made grouping mutable through its own reclassification route, so a tenant created as tenant:small:acme can report grouping "large". The identifier's grouping segment is now historical and must not be parsed. TenantRecord dropped the field entirely, so the portal read discarded the one safe source of a tenant's classification and left an operator with nothing but the identifier to infer from — exactly the mistake the change creates. The record and adapter now carry grouping, the operator screen shows it with a note that the identifier segment is not the grouping, and the OpenAPI schema documents where to read it. Also corrects the UpdateTenant description, which still claimed grouping was immutable. It is mutable, but never as metadata, because it resolves a tenant's spend ceiling. No reclassification control is offered here: that route is not deployed yet and, per tenant-engine, wants its own permission rather than riding on rename. Full suite: 149 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:56:54 +02:00
tegwick	667ea694c2	Delegate tenant lifecycle to the tenant authority ... TEN-WP-0005 landed the authoritative metadata update and reversible retirement contract, so USER-WP-0021-T01's deferred tenant operations are now implementable without user-engine inventing lifecycle semantics. TenantManagementPort gains read, update, retire, and reactivate. The HTTP adapter echoes the record version as an If-Match ETag (never `*`), sends an Idempotency-Key plus actor/reason/correlation_id, and surfaces Idempotent-Replay. Authority failures map to redacted domain errors carrying only the contract's stable error_code; its detail text never crosses the boundary. Platform operators get the matching API routes and a CSRF-protected browser screen that reads the record before mutating it and hides the metadata form for a retired tenant. Portal OpenAPI moves to 0.3.0 with TenantRecord, UpdateTenant, and TenantLifecycleChange. Full suite: 145 tests, 3 external-provider skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-16 01:28:02 +02:00
tegwick	d6873b84ae	Make registration start idempotent	2026-08-10 19:53:39 +02:00
tegwick	d5a5fed69a	Add public registration cancellation	2026-08-10 19:27:41 +02:00
tegwick	b80de5a1f4	Rate limit public registration writes	2026-08-10 17:52:53 +02:00
tegwick	0669fa7a85	Add public registration browser journey	2026-08-10 15:59:50 +02:00
tegwick	c12bc604a8	Make public registration provisioning resumable	2026-08-10 11:32:08 +02:00
tegwick	c36a09bded	Implement verified public registration flow	2026-08-10 11:26:18 +02:00
tegwick	8229c6dd33	Expand portal onboarding and administration	2026-08-08 23:09:23 +02:00
tegwick	2bcda7f26f	Expose protected operability metrics	2026-07-29 23:52:06 +02:00
tegwick	746bf21715	Allow renewing password setup links	2026-07-28 17:33:12 +02:00
tegwick	4efce34821	Present single-use password setup handoff	2026-07-28 17:30:17 +02:00
tegwick	e23674d343	Add CSRF-safe tenant identity administration	2026-07-28 01:22:55 +02:00
tegwick	e7e8709ca8	Add reusable identity provisioning adapter	2026-07-28 00:57:04 +02:00
tegwick	67ad2af640	Add KeyCape PKCE browser sessions	2026-07-28 00:06:21 +02:00
tegwick	0980d1fd41	Implement user-engine portal foundation	2026-07-27 22:47:39 +02:00