# P06 authentication policy acceptance

Scoped to `vergabe-demo-company` and `user-engine-portal`. The issuer owns
persistent policy, revision-bound previews, acknowledged apply, durable receipts
and reviewed rollback. Explicit application AAL2 remains authoritative. Portal
administration requires MFA; policy and factor recovery require recent MFA.

Optional means password-only until a confirmed active authenticator exists.
Provider lookup failures deny login. Pending setup can be cancelled; active
factor replacement requires audited recovery, including from old AAL1 sessions.

## Verification

- Previous interrupted run: full Go suite and 232 database-backed portal tests passed.
- Resumed run: all 30 portal Chromium checks and five portal policy tests passed.
- Final platform completeness gate: 33 tests passed, zero skips, all P01–P08
  marked implemented with no unresolved platform journeys. See the adjacent
  P06 platform-complete JSON report.
- Issuer policy/runtime regression tests passed; two policy rollout and one
  provider guard deployment tests passed.
- Installed privacyIDEA fixture `provider-p06-browser-46713f7e`: native adapter
  confirms no-factor/pending login, activation, old-session MFA, explicit AAL2
  and successful OTP sign-in. Five browser checks pass: correct identity,
  pending possession proof, cancellation, confirmed activation and denied
  replacement with a visible recovery route.
- Provider image: `ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473`.

Fixture repairs submit OTP to `/authorize/callback`, wait for asynchronous TOTP
selection, and wait for loaded pending state and an enabled Delete button.
The fixture uses disposable databases and synthetic identities, with no
production account changes. Reproduce using key-cape
`scripts/provider_browser_acceptance.py` and user-engine
`scripts/browser_journeys.py`.

## Release

Completed 2026-09-14 Europe/Berlin (2026-09-13 UTC):

- KeyCape source `e0b3c25`; CI acceptance run 64 and image run 65 passed.
- Portal source `3bd1827`; image run 178 and journey run 179 passed. Routing-only
  smoke run 177 was cancelled; it is not claimed as passed.
- NetKingdom policy/guard tooling: `a549617`.
- Portal image: `forgejo.coulomb.social/coulomb/user-engine@sha256:de39ed717b69ce61c66fe0b12f9fdbe63abbee0ea0cbad9614c2dae6c2c5116c`.
- Issuer image: `forgejo.coulomb.social/coulomb/key-cape@sha256:db2c5a13a47839049349e881c8d19bc39f720ee69d8518f9f2eba2b1f98af9d5`.

Portal guards rolled out first. Provider guard
`keycape-onboarding-9465e5e0b98f7986` then rolled out to privacyIDEA and recovery.
Provider policy readback confirms TOTP enrollment, pending-only deletion and
active-factor changes through recovery; existing tokens were unchanged.
Only the two reviewed client registrations were migrated with UID/resource-version
CAS and unrelated Secret bytes preserved. Issuer replacement then activated
persistent policy at `/var/lib/keycape-policy/policy.json` on the dedicated PVC.

Read-only Job `p06-policy-readback-1c0eba21` verified both effective policies are
`optional_after_enrollment`, revision 0, no administrative changes yet. The Job
was removed. Portal health/readiness and issuer readiness return 200; both policy
surfaces reject anonymous access with 403. The migration inspector reports no
remaining change. Receipts are in the adjacent P06 rollout JSON.

Positive policy changes/replay/rollback are tested in isolated stores and portal
fixtures. No production account or real administrator policy override was used
as a test. Actual invited-person and application sign-in acceptance remains in
USER-WP-0028 / KEY-WP-0034 / VERGABE-WP-0019.

## Operating policy and rollback

Open Platform administration → Authentication policy and verify with fresh MFA.
Select a reviewed client, policy and change reference; preview the impact and
acknowledge it before applying. Cancel leaves policy unchanged. A stale review
requires a new preview; an uncertain response should be checked in current state
and history. Rollback is a new reviewed change to that client's previous policy.

Preserve the policy PVC and receipts across issuer replacement; do not delete
it during rollback. It uses this cluster's local-path storage, not multi-node HA.
Before reverting to a pre-P06 portal or issuer, restore mandatory MFA for both
clients in runtime policy and the baseline client registrations, verify it, then
restore the previous image pins. Keep the provider active-factor guard and
recovery service. Reverting the portal guards while optional login remains active
would weaken administration. Previous exact image pins are in the rollout receipt.