tegwick
61dc76739f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
75 lines
3 KiB
Markdown
75 lines
3 KiB
Markdown
---
|
|
id: USER-WP-0026
|
|
type: workplan
|
|
title: "Account recovery and visible identity and access"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: active
|
|
owner: codex
|
|
topic_slug: user-engine
|
|
created: "2026-09-12"
|
|
updated: "2026-09-12"
|
|
state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
|
|
---
|
|
|
|
The operator reports a dead-end authentication error after using an account
|
|
outside the product tenant. Recent issuer telemetry indicates token exchange
|
|
failure; tenant rejection and provider failure must not be conflated.
|
|
|
|
## Implement and validate recovery
|
|
|
|
```task
|
|
id: USER-WP-0026-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "86324ec8-cf2f-5e9e-bb60-670c4d792828"
|
|
```
|
|
|
|
Route failed browser login to the public account recovery surface without codes,
|
|
state or unverified identity. Show verified portal identity, tenant memberships,
|
|
and recorded workload memberships; preserve operator/customer separation.
|
|
Provide CSRF-protected portal logout and confirmed shared provider sign-out with
|
|
fixed owner-configured return locations. No automatic reauthentication loops,
|
|
MFA downgrade, global JWT revocation claim or inferred workload entitlements.
|
|
|
|
## Publish and verify the recovery flow
|
|
|
|
```task
|
|
id: USER-WP-0026-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "ad5b0a77-d8ec-5e07-9a9e-2fa231a6f792"
|
|
```
|
|
|
|
Publish immutable images, update canonical runtime pins, verify anonymous
|
|
recovery and sign-out confirmation live, and record actual account switching
|
|
only after browser evidence. Existing application sessions may outlive provider
|
|
logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.
|
|
|
|
Source verification: 182 tests passed with three optional integration skips; layer conformance passed. Immutable publication and live checks are in progress.
|
|
|
|
## Discover workload access from authoritative application records
|
|
|
|
```task
|
|
id: USER-WP-0026-T03
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
|
|
```
|
|
|
|
The requested cross-application allow list is not represented by the current
|
|
User Engine membership store. Establish a provider-owned workload catalogue and
|
|
read current application access decisions for the signed-in identity. Link only
|
|
registered HTTPS workload entry points. Distinguish allow, deny and unavailable;
|
|
never turn a tenant membership, platform role, application registration or a
|
|
missing access record into an inferred grant. Current UI displays recorded
|
|
workload memberships only; no complete fleet entitlement inventory is claimed.
|
|
|
|
### Live recovery rollout — 2026-09-12
|
|
|
|
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
|
|
(Helm revision 3). All three are Ready. Six provider checks, eleven product
|
|
checks and six fresh anonymous Chromium checks pass, including actual provider
|
|
logout POST and return to the portal without test overrides. Real-user identity
|
|
switching is still awaiting operator evidence; no authenticated/MFA acceptance
|
|
is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
|