tegwick
a8ced85258
Replace the in-memory/no-UI MVP note with what is actually shipped: portal, PostgreSQL, live flex-auth A2, and the remaining operator residuals.
101 lines
4.5 KiB
Markdown
101 lines
4.5 KiB
Markdown
# Implementation Assessment
|
|
|
|
Date: 2026-08-19
|
|
Related: `../SCOPE.md`, `../INTENT.md`, OpenAPI `0.3.0`
|
|
|
|
Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no
|
|
active workplan. This file replaces the early-MVP assessment that still
|
|
described an in-memory, in-process core with no UI or platform adapters.
|
|
|
|
## Implemented
|
|
|
|
- Headless domain for users, accounts, identity links, applications,
|
|
catalogs, profiles, projections, audit records, and outbox events.
|
|
- Tenant context enforcement, memberships, tenant profile precedence,
|
|
redacted diagnostics, and cross-tenant denial.
|
|
- Multi-application catalog ownership, namespace collision protection,
|
|
semantic version checks, sensitivity downgrade prevention, app-filtered
|
|
projections, and claims-enrichment projection caching.
|
|
- Canon interface card, entity/relationship mappings, and explicit gap
|
|
records (`USER-WP-0007`).
|
|
- Hats, realms, services, assets, access profiles, and active access
|
|
context as user-domain facts.
|
|
- Invitations, prepared accounts, entitlement claims, and user-engine-owned
|
|
onboarding journeys.
|
|
- Public registration orchestration (start, verify, resume, cancel,
|
|
provider password-setup handoff) behind
|
|
`USER_ENGINE_PUBLIC_REGISTRATION`, fail-closed when credentials are
|
|
absent.
|
|
- Optional CSRF-protected portal over the same APIs: `/me`, `/onboarding`,
|
|
`/admin/{tenant}`, `/platform`, `/register`.
|
|
- Durable PostgreSQL store with migrations, plus in-memory fixtures for
|
|
standalone conformance.
|
|
- HTTP adapters for flex-auth (rotating caller token, live A2 on
|
|
`flex-auth-user-engine`), tenant-engine lifecycle, identity-provisioner,
|
|
registration verification, and split event/mail outbox delivery.
|
|
- OpenAPI portal contract `0.3.0` (`TenantRecord`, update/retire/reactivate).
|
|
- Scenario and security matrices. Full suite: 150 tests, three
|
|
provider-gated skips.
|
|
|
|
Production image evidence includes
|
|
`sha256:c501aeb2…` (caller token) on Railiance. flex-auth-user-engine
|
|
enforce probe 2026-08-19: `200` with the projected token, `401` without,
|
|
`403` when representing `tenant-engine`.
|
|
|
|
## Boundary Verification
|
|
|
|
user-engine still does not issue tokens, verify MFA, store credentials, or
|
|
act as the policy decision point. It does not own tenant identifiers,
|
|
grouping reclassification, capability-role grants, runtime secrets,
|
|
platform audit storage, or transactional SMTP.
|
|
|
|
It consumes verified IAM Profile v0.3 claims, asks flex-auth, calls
|
|
tenant-engine and identity-provisioner, and emits redacted audit/outbox
|
|
records. The in-repo portal is an optional surface, not a UI product;
|
|
password and MFA screens stay on the identity provider.
|
|
|
|
## Accepted Deviations
|
|
|
|
- Package version remains `0.1.0`. Schema and service contracts may still
|
|
evolve before `1.0.0`, with migrations and scenario updates.
|
|
- Access-review, policy, control, and exception are references or gaps,
|
|
not owned records (see `docs/canon-interface-card.yaml`).
|
|
- Application first-login profiles, unlink, and action step-up stay with
|
|
consuming apps and KeyCape (`USER-WP-0022` T03/T04 cancelled).
|
|
- `/metrics` is a bounded local snapshot (`user_engine_ready` plus record
|
|
counts), not platform telemetry.
|
|
- The user-engine boundary contract is accepted in net-kingdom and marked
|
|
`publish` in policy-nexus, but it is not yet on
|
|
`policy.coulomb.social`.
|
|
|
|
## Residuals
|
|
|
|
Operator-owned, not remaining product code:
|
|
|
|
- Public registration and outbox mail stay fail-closed until governed
|
|
OpenBao verification/delivery tokens and the transactional SMTP lane
|
|
are installed. No placeholder credential.
|
|
- Live tenant-lifecycle probe from a user-engine pod (GET / PATCH /
|
|
retire / reactivate on a disposable tenant) is still owed. Contract
|
|
tests cannot see a digest pin rollback.
|
|
- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth
|
|
/ tenant-engine.
|
|
- Pod `fsGroup: 10001` is required so uid 10001 can read the projected
|
|
flex-auth caller token; persisted in rapp-user-engine
|
|
`manifests/runtime.yaml` `e599b4f`.
|
|
|
|
Demand-triggered, not started here:
|
|
|
|
- Inbound federation, SCIM, or directory sync — new workplan only if a
|
|
tenant requires it; published path is IAM Profile v0.3 Keycloak
|
|
expanded mode.
|
|
- First-class access-review/governance records.
|
|
- A dedicated agent consumption product (projections already exist).
|
|
- Extracting a generic profile engine.
|
|
|
|
## Follow-Up Work
|
|
|
|
The previous follow-ups are done: durable PostgreSQL, HTTP transport,
|
|
flex-auth, outbox drain, and a live Railiance deploy. Remaining work is
|
|
the residuals above, plus ordinary release hygiene (SBOM, static/security
|
|
scans) when the next image is published.
|