{
  "schema_version": 1,
  "journeys": [
    {
      "id": "U01",
      "role": "user",
      "implementation": "implemented",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_anonymous_and_expired_sessions_have_login_without_logout",
        "test_account_clarity.AccountClarityTests.test_authenticated_roles_have_logout_without_login"
      ],
      "remaining": ""
    },
    {
      "id": "U02",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_web.PortalApplicationTests.test_expired_browser_session_and_provider_outage_fail_closed",
        "test_account_recovery.AccountRecoveryTests.test_failed_callback_has_clean_recovery_and_no_loop"
      ],
      "remaining": "KEY-WP-0035: actual no-factor/enrolled login needs provider credential and policy rollout."
    },
    {
      "id": "U03",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_web.PortalApplicationTests.test_browser_invitation_acceptance_and_onboarding_status",
        "test_web.PortalApplicationTests.test_invitation_lifecycle_is_versioned_and_replay_safe"
      ],
      "remaining": "Live notification delivery and invited-person acceptance remain unverified."
    },
    {
      "id": "U04",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry"
      ],
      "remaining": "Provider password reset is separately tested in net-kingdom; live email recovery remains unresolved."
    },
    {
      "id": "U05",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
      ],
      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
    },
    {
      "id": "U06",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
      ],
      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
    },
    {
      "id": "U07",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
      ],
      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
    },
    {
      "id": "U08",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_otp_help_is_available_without_portal_login_and_never_claims_activation"
      ],
      "remaining": "Portal boundary only. KEY-WP-0035 owns factor presence/AAL2 enforcement; live enrollment, cancel, replacement and lost-factor recovery await approved provider credential/contract."
    },
    {
      "id": "U09",
      "role": "user",
      "implementation": "partial",
      "tests": [
        "test_account_recovery.AccountRecoveryTests.test_account_workload_list_is_scoped_to_current_user"
      ],
      "remaining": "USER-WP-0028-T02/USER-WP-0026-T03: authoritative application catalogue and access requests not implemented."
    },
    {
      "id": "U10",
      "role": "user",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_wrong_shared_identity_recovery_does_not_claim_a_known_session",
        "test_portal_navigation.PortalNavigationTests.test_navigation_does_not_leak_between_operator_member_and_anonymous"
      ],
      "remaining": "Authenticated multi-identity/tenant switching must be verified against live issuer."
    },
    {
      "id": "U11",
      "role": "user",
      "implementation": "implemented",
      "tests": [
        "test_account_recovery.AccountRecoveryTests.test_shared_logout_clears_portal_then_uses_provider_confirmation",
        "test_portal_navigation.PortalNavigationTests.test_get_logout_only_confirms_and_bad_csrf_does_not_end_session",
        "test_portal_navigation.PortalNavigationTests.test_expired_session_logout_clears_stale_cookie"
      ],
      "remaining": ""
    },
    {
      "id": "U12",
      "role": "user",
      "implementation": "implemented",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_browser_denial_is_recoverable_while_api_remains_json",
        "test_account_recovery.AccountRecoveryTests.test_recovery_is_public_and_never_trusts_query_identity"
      ],
      "remaining": ""
    },
    {
      "id": "U13",
      "role": "user",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.UserJourneys.test_profile_validation_keeps_safe_input_and_retry_saves",
        "test_web.PortalApplicationTests.test_browser_invitation_acceptance_and_onboarding_status"
      ],
      "remaining": ""
    },
    {
      "id": "T01",
      "role": "tenant_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.TenantAdminJourneys.test_wrong_role_or_tenant_never_calls_provider",
        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload"
      ],
      "remaining": ""
    },
    {
      "id": "T02",
      "role": "tenant_admin",
      "implementation": "external-blocked",
      "tests": [
        "test_web.PortalApplicationTests.test_invitation_lifecycle_is_versioned_and_replay_safe",
        "test_journey_roles.TenantAdminJourneys.test_invalid_role_cannot_create_partial_account",
        "test_journey_roles.TenantAdminJourneys.test_invitation_delivery_reports_queue_failure_and_adapter_acceptance"
      ],
      "remaining": "Local invitation queue/failure/adapter-acceptance states are implemented. Actual receipt by the invited person remains live provider acceptance under U03."
    },
    {
      "id": "T03",
      "role": "tenant_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry",
        "test_web.PortalApplicationTests.test_admin_form_requires_csrf_and_supports_two_step_provisioning"
      ],
      "remaining": ""
    },
    {
      "id": "T04",
      "role": "tenant_admin",
      "implementation": "external-blocked",
      "tests": [
        "test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry",
        "test_journey_roles.TenantAdminJourneys.test_provider_failure_retains_local_state_and_retry_recovers"
      ],
      "remaining": "Provider-owned lost-factor recovery still unverified; password setup assistance is supported."
    },
    {
      "id": "T05",
      "role": "tenant_admin",
      "implementation": "partial",
      "tests": [
        "test_journey_roles.TenantAdminJourneys.test_invalid_role_cannot_create_partial_account"
      ],
      "remaining": "Tenant roles are managed; authoritative application-specific grant/revoke integration remains USER-WP-0028-T02."
    },
    {
      "id": "T06",
      "role": "tenant_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.TenantAdminJourneys.test_confirmation_cancel_tamper_and_stale_state",
        "test_journey_roles.TenantAdminJourneys.test_tenant_removal_preserves_shared_identity_and_other_account",
        "test_journey_roles.TenantAdminJourneys.test_provider_failure_retains_local_state_and_retry_recovers",
        "test_journey_roles.TenantAdminJourneys.test_disabled_account_cannot_be_reactivated_by_password_setup"
      ],
      "remaining": ""
    },
    {
      "id": "T07",
      "role": "tenant_admin",
      "implementation": "implemented",
      "tests": [
        "test_web.PortalApplicationTests.test_admin_form_requires_csrf_and_supports_two_step_provisioning"
      ],
      "remaining": "Provider factor/password evidence remains explicitly unavailable; provider verification is tracked under U05-U08."
    },
    {
      "id": "T08",
      "role": "tenant_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.TenantAdminJourneys.test_last_admin_protected_then_successor_allows_transition",
        "test_journey_roles.TenantAdminJourneys.test_admin_succession_promote_then_demote_with_confirmation",
        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload",
        "test_journey_roles.TenantAdminJourneys.test_concurrent_admin_suspensions_keep_one_active_admin"
      ],
      "remaining": "Disposable PostgreSQL cross-connection/rollback suite also passed; run its separate opt-in suite for DB changes."
    },
    {
      "id": "P01",
      "role": "platform_admin",
      "implementation": "implemented",
      "tests": [
        "test_portal_navigation.PortalNavigationTests.test_operator_can_reach_administration_without_personal_membership",
        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_user_navigation_preserves_authority"
      ],
      "remaining": ""
    },
    {
      "id": "P02",
      "role": "platform_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.PlatformAdminJourneys.test_bootstrap_retry_does_not_duplicate_first_admin",
        "test_web.PortalApplicationTests.test_platform_tenant_authority_denial_is_redacted_and_creates_no_admin",
        "test_journey_roles.PlatformAdminJourneys.test_partial_first_admin_setup_rolls_back_and_retry_finishes"
      ],
      "remaining": "Local bootstrap is atomic and retryable; tenant creation remains delegated to its authority."
    },
    {
      "id": "P03",
      "role": "platform_admin",
      "implementation": "implemented",
      "tests": [
        "test_portal_navigation.PortalNavigationTests.test_ambiguous_or_unknown_short_names_do_not_guess_a_tenant",
        "test_portal_navigation.PortalNavigationTests.test_existing_tenant_is_selectable_and_short_name_resolves"
      ],
      "remaining": ""
    },
    {
      "id": "P04",
      "role": "platform_admin",
      "implementation": "external-blocked",
      "tests": [
        "test_journey_roles.PlatformAdminJourneys.test_recovery_uses_tenant_access_and_keeps_global_identity_operations_unused"
      ],
      "remaining": "Tenant identity recovery is scoped; verified OTP/account-ownership recovery remains provider-owned."
    },
    {
      "id": "P05",
      "role": "platform_admin",
      "implementation": "external-blocked",
      "tests": [
        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard"
      ],
      "remaining": "Local delivery record operations work; approved factor credential renewal and mail receipt remain external dependencies."
    },
    {
      "id": "P06",
      "role": "platform_admin",
      "implementation": "external-blocked",
      "tests": [
        "test_account_clarity.AccountClarityTests.test_provider_handoff_rejects_unsafe_configuration"
      ],
      "remaining": "Boundary test only. KeyCape policy suite covers optional/required/step-up; live policy management and provider rollout remain KEY-WP-0035."
    },
    {
      "id": "P07",
      "role": "platform_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.PlatformAdminJourneys.test_tenant_retirement_requires_confirmation_and_stale_confirmation_fails",
        "test_web.PortalApplicationTests.test_platform_tenant_lifecycle_is_delegated_to_the_authority"
      ],
      "remaining": ""
    },
    {
      "id": "P08",
      "role": "platform_admin",
      "implementation": "implemented",
      "tests": [
        "test_journey_roles.PlatformAdminJourneys.test_delivery_denial_redaction_retry_and_completed_guard",
        "test_journey_roles.TenantAdminJourneys.test_audit_is_tenant_scoped_and_never_dumps_payload"
      ],
      "remaining": ""
    }
  ]
}