user-engine/docs/evidence/2026-09-13-journey-release.md

Account journey release — 2026-09-13

Implemented and deployed user feedback/retry, tenant-scoped identity lifecycle, last-admin protection, administrator succession, confirmation/stale-state handling, actual login-name/onboarding/delivery guidance, scoped audit, platform delivery retry and atomic/retryable first-admin bootstrap.

Reproducible validation

• PYTHONDONTWRITEBYTECODE=1 make test: 210 tests, seven opt-in PostgreSQL skips; layer conformance passed.
• Disposable PostgreSQL 16 on local loopback, tmpfs, no production records: USER_ENGINE_POSTGRES_TEST_DSN=postgresql://postgres@127.0.0.1:25432/postgres USER_ENGINE_POSTGRES_TEST_RESET=1 PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=src:tests uv run --no-project --with 'psycopg[binary]>=3.2,<4' python -m unittest discover -s tests passed all 210 with zero skips. Covers independent-connection concurrent last-admin changes, advisory-lock cleanup, caller-transaction preservation and nested bootstrap rollback. Disposable container stopped after validation.
• make test-journeys JOURNEY_ARGS="--report /tmp/user-engine-journeys.json": 41 tests passed. Durable report: 2026-09-13-journey-report.json.
• make test-journeys JOURNEY_ARGS=--require-complete: tests pass, command fails intentionally because 15 of 29 journeys retain named gaps.
• make test-browser-journeys: 13 isolated Chromium checks passed against the synthetic loopback fixture (user, tenant admin, platform operator).
• Identity provisioner regression: 20 tests passed.
• rapp-user-engine make check: four packaging checks passed.
• Portal CI commit 502a8e0: smoke run 141 and journey run 142 succeeded. Provider CI commit 84f7635: smoke run 227 and journey run 228 succeeded. CI uses pinned Python containers; browser and PostgreSQL acceptance were run separately, not claimed as part of dependency-free CI.

Deployed artifacts

Portal source 1127f852dd, image CI run 138: forgejo.coulomb.social/coulomb/user-engine@sha256:b3df548acd23860c2bca3af123ea542d07784ff21340ea2cb0a406e6e7d9c29d. Provider source a0cc947bf65241ac93280d1d7c00d8fc8b7a7740, built from exact git archive: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:698620e25cabccd746c10c332030e436428d184baab0f8270936494d285216a6.

Provider deployed first, portal second. Image-only patches tested cluster UID, deployment UID/resource version and predecessor image. Both deployments Ready 1/1. Canonical provider manifests and portal package pins updated; unrelated hostname work preserved. In-pod provider inspection confirms tenant_access is present. Ten live HTTP checks passed (public account/recovery/security, readiness, API denial, and browser denial with recovery for platform operations and tenant activity). Twelve fresh live Chromium checks passed, including expired callback recovery, 390px layout, shared sign-out confirmation/POST and final sign-in-only state. No real user's directory groups or factors were mutated for these checks. The Recreate portal rollout briefly returned 503 while replacing its single pod; checks passed after readiness. In-memory sessions and unused provider password setup grants are reset by restarts.

Rollback images (retain all other deployment configuration):

• Portal: sha256:558e489f0b6e0b7160ab0d370560a66497e12488b95531bbccca122b46331a6f.
• Provider: sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6. Rollback portal first if removing the new provider contract; rollback was not needed.

Live work retained

This is not complete acceptance of all 29 journeys. USER-WP-0028-T02 and USER-WP-0026-T03 retain authoritative application catalogue/admission integration; current membership records cannot prove effective access. USER-WP-0028-T03 and USER-WP-0030-T03 depend on KEY-WP-0035/NK-WP-0033 factor credential custody and verified enrollment/cancel/replacement/recovery/policy behavior. MFA handoff stays unavailable; optional OTP enforcement has not been deployed. The coverage report also names mail delivery/receipt and real identity-switching acceptance gaps. USER-WP-0027-T06 remains open for complete integrated acceptance, including VERGABE-WP-0019. Local provider calls and local persistence are not one atomic transaction: desired-state retry/readback recovers an interruption between them.