coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
user-engine/docs/final-assessment.md
tegwick a8ced85258
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Refresh final-assessment to the finished USER-WP-0001–0023 surface 
Replace the in-memory/no-UI MVP note with what is actually shipped:
portal, PostgreSQL, live flex-auth A2, and the remaining operator
residuals.
2026-08-19 14:48:39 +02:00

4.5 KiB
Raw Blame History

Implementation Assessment

Date: 2026-08-19 Related: ../SCOPE.md, ../INTENT.md, OpenAPI 0.3.0

Workplans USER-WP-0001 through USER-WP-0023 are finished. There is no active workplan. This file replaces the early-MVP assessment that still described an in-memory, in-process core with no UI or platform adapters.

Implemented

  • Headless domain for users, accounts, identity links, applications, catalogs, profiles, projections, audit records, and outbox events.
  • Tenant context enforcement, memberships, tenant profile precedence, redacted diagnostics, and cross-tenant denial.
  • Multi-application catalog ownership, namespace collision protection, semantic version checks, sensitivity downgrade prevention, app-filtered projections, and claims-enrichment projection caching.
  • Canon interface card, entity/relationship mappings, and explicit gap records (USER-WP-0007).
  • Hats, realms, services, assets, access profiles, and active access context as user-domain facts.
  • Invitations, prepared accounts, entitlement claims, and user-engine-owned onboarding journeys.
  • Public registration orchestration (start, verify, resume, cancel, provider password-setup handoff) behind USER_ENGINE_PUBLIC_REGISTRATION, fail-closed when credentials are absent.
  • Optional CSRF-protected portal over the same APIs: /me, /onboarding, /admin/{tenant}, /platform, /register.
  • Durable PostgreSQL store with migrations, plus in-memory fixtures for standalone conformance.
  • HTTP adapters for flex-auth (rotating caller token, live A2 on flex-auth-user-engine), tenant-engine lifecycle, identity-provisioner, registration verification, and split event/mail outbox delivery.
  • OpenAPI portal contract 0.3.0 (TenantRecord, update/retire/reactivate).
  • Scenario and security matrices. Full suite: 150 tests, three provider-gated skips.

Production image evidence includes sha256:c501aeb2… (caller token) on Railiance. flex-auth-user-engine enforce probe 2026-08-19: 200 with the projected token, 401 without, 403 when representing tenant-engine.

Boundary Verification

user-engine still does not issue tokens, verify MFA, store credentials, or act as the policy decision point. It does not own tenant identifiers, grouping reclassification, capability-role grants, runtime secrets, platform audit storage, or transactional SMTP.

It consumes verified IAM Profile v0.3 claims, asks flex-auth, calls tenant-engine and identity-provisioner, and emits redacted audit/outbox records. The in-repo portal is an optional surface, not a UI product; password and MFA screens stay on the identity provider.

Accepted Deviations

  • Package version remains 0.1.0. Schema and service contracts may still evolve before 1.0.0, with migrations and scenario updates.
  • Access-review, policy, control, and exception are references or gaps, not owned records (see docs/canon-interface-card.yaml).
  • Application first-login profiles, unlink, and action step-up stay with consuming apps and KeyCape (USER-WP-0022 T03/T04 cancelled).
  • /metrics is a bounded local snapshot (user_engine_ready plus record counts), not platform telemetry.
  • The user-engine boundary contract is accepted in net-kingdom and marked publish in policy-nexus, but it is not yet on policy.coulomb.social.

Residuals

Operator-owned, not remaining product code:

  • Public registration and outbox mail stay fail-closed until governed OpenBao verification/delivery tokens and the transactional SMTP lane are installed. No placeholder credential.
  • Live tenant-lifecycle probe from a user-engine pod (GET / PATCH / retire / reactivate on a disposable tenant) is still owed. Contract tests cannot see a digest pin rollback.
  • policy.enabled and tenant-engine caller enforce belong to flex-auth / tenant-engine.
  • Pod fsGroup: 10001 is required so uid 10001 can read the projected flex-auth caller token; persisted in rapp-user-engine manifests/runtime.yaml e599b4f.

Demand-triggered, not started here:

  • Inbound federation, SCIM, or directory sync — new workplan only if a tenant requires it; published path is IAM Profile v0.3 Keycloak expanded mode.
  • First-class access-review/governance records.
  • A dedicated agent consumption product (projections already exist).
  • Extracting a generic profile engine.

Follow-Up Work

The previous follow-ups are done: durable PostgreSQL, HTTP transport, flex-auth, outbox drain, and a live Railiance deploy. Remaining work is the residuals above, plus ordinary release hygiene (SBOM, static/security scans) when the next image is published.