tegwick
a9ff77d21d
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
3.4 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated |
|---|---|---|---|---|---|---|---|---|---|
| USER-WP-0027 | workplan | Clear account state and complete user, tenant-admin and platform-admin journeys | communication | user-engine | active | codex | communication | 2026-09-13 | 2026-09-13 |
Establish role-based success, failure and recovery acceptance
id: USER-WP-0027-T01
status: done
priority: high
Defined 29 journeys in docs/account-journeys.md: 13 user, 8 tenant administrator, 8 platform administrator. Each has success, failure/recovery and current support status. The document is the browser acceptance contract, not proof all journeys are implemented. Includes OTP state contract and cross-role/isolation checks.
Make account controls and browser recovery reflect verified state
id: USER-WP-0027-T02
status: done
priority: high
Signed-out/expired sessions show Sign in; verified sessions show identity and
Log out. Logout uses existing scope confirmation; wrong shared-identity recovery
stays accessible without implying a portal session. Signed-in registration routes
to account. Browser errors retain status and gain safe recovery navigation; APIs
remain JSON. Public /security explains OTP setup/recovery without claiming factor
state or activation. Fixed HTTPS provider handoff is configurable but disabled by
default pending provider verification. make test: 188 tests, 3 optional skips;
layer conformance passed. git diff --check passed.
Publish and verify the portal UI cleanup
id: USER-WP-0027-T03
status: progress
priority: high
Publish reviewed source, pin the CI image in rapp-user-engine, deploy with CAS, verify readiness, signed-out browser controls, and recovery/security navigation. Keep live OTP handoff disabled until T04 dependencies are met.
Complete provider OTP activation and recovery path
id: USER-WP-0027-T04
status: wait
priority: high
Depends on KEY-WP-0035-T02/T03 and NK-WP-0033 custody handoff. Current owner route net-kingdom-privacyidea-admin-token remains non-resolvable. Restore scoped factor lookup and verify possession-confirmed enrollment, cancellation, replacement, recovery and fresh login; resolve privileged portal policy. Only then configure USER_ENGINE_MFA_MANAGEMENT_URL and accept U05–U08/P04–P06. Do not fake a status from assurance claims, redirect return parameters or manual step completion.
Close tenant and platform administrator usability gaps
id: USER-WP-0027-T05
status: todo
priority: high
Implement remaining T02–T08/P02/P04/P07/P08 browser gaps from docs/account-journeys.md: clear login-name versus display-name and lifecycle states, delivery confirmation, consolidated onboarding diagnosis, scoped lifecycle confirmation/readback, admin succession guard review and safe audit/support recovery. Existing headless routes are starting points, not browser acceptance. Split into owner workplans as needed.
Validate all journeys across roles and applications
id: USER-WP-0027-T06
status: todo
priority: high
Execute success/failure/recovery matrix with synthetic user, tenant admin, platform operator, expired and wrong-tenant identities. Include invitation/mail, actual OTP, shared sign-out, keyboard/mobile, form preservation, and authoritative application access (USER-WP-0026-T03). Preserve VERGABE-WP-0019 real-user acceptance. Record live evidence and hand off any residuals as live work before closing.