user-engine/docs/platform-admin-acceptance.md

Platform administrator acceptance

Priority workplan: USER-WP-0030. Platform administration requires the platform operator role; membership in every tenant is not required. Ordinary tenant administrators cannot read cross-tenant platform support records.

Journey	Implemented acceptance	Remaining integrated evidence
P01 Platform entry	Role-aware navigation and tenant-independent console; member denial	Existing provider sign-in acceptance still applies
P02 Tenant and first admin	Authority readback, local bootstrap rollback and retry without duplicate admin	Real first-admin sign-in depends on provider
P03 Tenant inspection	Exact identifier, ambiguous-name handling and selected scope	No new implementation gap
P04 Administrator recovery	Tenant restoration and recent-MFA lost-factor preview, proof attestation, signed scope confirmation, audited disable/readback/retry and replacement enrollment	Implemented and deployed; evidence: evidence/2026-09-13-p04-recovery.md
P05 Service operations	Capability availability, delivery failure/retry/readback, assisted setup guidance	Live factor credential renewal, provider health and actual mail receipt
P06 Authentication policy	Existing KeyCape optional/mandatory/step-up source tests; no portal policy-write control	Verified factor lookup, owner-approved effective policy rollout and rollback
P07 Tenant lifecycle	Authority version/confirmation, stale-state rejection and recovery	Application propagation must be verified at the application
P08 Support investigation	Exact reference across audit/delivery records, tenant filter, safe metadata, unknown-evidence state and delivery drill-down	Provider actions require provider evidence; portal records alone cannot prove rollback

Investigate a support reference

Open Platform activity from the platform navigation. Paste the exact support reference and optionally the full tenant identifier. The view matches before limiting display to the newest 100 records. It shows recorded actor/action and current delivery state without raw payloads, free-text audit summaries, or provider errors. Follow Inspect delivery to its retry/readback page. No matching records means evidence is missing; it does not prove no action happened.

Restore tenant access

Open the tenant's users page and choose Restore tenant account. Check the named person and tenant in the confirmation. Verify the request through the established support process. The operation restores that tenant account and prepares a missing directory login. It does not reset a password, remove an authenticator, clear a global suspension or prove account ownership. Use provider recovery for those cases. Cancel makes no change; failed provider readback must not become local success. Keep the support reference when escalating.

Run acceptance

make test
make test-journeys JOURNEY_ARGS="--role platform_admin --report /tmp/platform-admin-report.json"
make test-browser-journeys
make test-journeys JOURNEY_ARGS="--role platform_admin --require-complete"

The platform selection includes the P04 recovery tests; the full regression suite runs 219 tests (all pass when disposable PostgreSQL is enabled). The isolated Chromium suite runs 19 checks. The final completeness command intentionally fails while P05/P06 retain external dependencies. The machine-readable matrix is tests/journey-coverage.json; passing portal tests is not live factor acceptance.

Historical provider handoff (superseded for P04)

KEY-WP-0035/NK-WP-0033 and USER-WP-0030-T03 retain the provider gap. The registered net-kingdom-privacyidea-admin-token route was rechecked and remains non-resolvable: concrete custody path/fields, expiry/revocation and approved attended action are unpublished. A provider credential for attended resolver repair must not be assumed to be the correct ongoing realm-scoped factor-read credential. The owner must establish the consumer contract and verify its exact permissions and renewal before policy or recovery rollout. No secrets belong in this document, support references, chat or activity records.

P04 recovery now uses the signed platform session and private provider service. Use Authenticator recovery for exact-login preview and support-reference readback. No provider credential or OpenBao login is requested from the operator. See evidence/2026-09-13-p04-recovery.md for the implemented boundary and acceptance.