Repository navigation
feat(identity): reconcile development realm and prove real issuance - #34
Merged
Merged
Conversation
Keep recurrence routing tied to its acknowledged recipient acquisition while the ordinary request coordinator commits the child and reciprocal receipt atomically. Preserve tenant scope, successful-production receipts and actual cleanup ownership without constructing feature work. ADR: 0047, 0040, 0057
Resolve uncertain child submission from the locked reciprocal receipt without inventing its original acknowledgement or another identity. Keep lifecycle skip and bounded deferral confined to the original live acquisition after positively completed application cleanup. ADR: 0047
Observe actual PostgreSQL effects independently of rollback so context, lease and stop races cannot pass through a masked late refusal. Keep the healthy counterpart and exact guard-removal proof alongside the restored source qualification. ADR: 0047
Keep old deployments from replacing current invocation hints after a manifest changes, including writes delayed before the live guard runs. Verify volatility alongside the existing bootstrap contract and prove upgrade, snapshot and lock behavior with actual stock transactions. ADR: 0047
Keep durable fan-out independent of stock timer delivery, native calls and locally retained recipient work. Preserve original cleanup and receipt ownership, observe all stored control quarantines, and budget the concrete application and privileged connection owners. ADR: 0047, 0059 Module: Kernel, Tenancy
Exercise actual stock registration while durable fan-out progresses and all sibling owners join. Separate guard-removal controls demonstrate single-flight and parent-source retention without cooldown masking. ADR: 0047, 0059
Exercise four actual application owners through natural lease expiry, independent child progress and late cleanup. Separate semantic controls pin the ceiling, retained-ID exclusion and cancellation ownership. Reconcile the published architecture method count with the existing Step 8 companion methods. ADR: 0047, 0059
Pin concrete construction and callback ownership to exact targets, callers and opcodes. Trusted framework cleanup signatures and planted foreign targets prevent name-only cleanup checks from passing blindly. ADR: 0047, 0059
Constrain the concrete retained owners, native recurrence entry points, memory-only tick closure and recipient exclusion/publication seams. Plant foreign identities, escaped resources, reordered acknowledgements and unauthorized work against the same nonempty production detector. Record source-specific qualification and its limits before the two full Step 8 review rounds. The nineteen packet obligations stay Registered. ADR: 0047, 0059
Keep schema-legal dates outside the CLR range from poisoning control quanta, and let an already stopped recurrence child decline late setup without inventing cleanup failure. Preserve duplicate setup refusals, actual locked-row quarantine, owned joins and source disposal. Cover all changed readers and the real parent-start race with PostgreSQL regressions, and reconcile the completed Step 7 catalogue pointer. ADR: 0047, 0059
Keep a stopped first parent start neutral while preserving duplicate refusal. Prove durable recurrence progress while the actual control generation stays held, including late native duplicate ticks. Record both full Step 8 reviews, verified corrections and source-bound qualification, then reconcile primary status carriers for Step 9. ADR: 0047, 0059
Keep accepted independent recurrence owners visible to existing guards while reducing repeated metadata work without losing mutation controls. Record full-suite failures and focused recovery; the CI budget and complete packet qualification remain open. ADR: 0040, 0046, 0047, 0059
Resolve exact callback and field-owner identities only after candidate selection, retaining the complete production inventory and every mutation phase. Compare the old and new lookup policies independently and record focused timing without claiming whole-workflow budget compliance. ADR: 0047
Keep independent mutation graphs in bounded collections without splitting clean, dirty and restored evaluations. Preserve all 249 declarations and 405 discovered cases; full packet and CI budget qualification remain open. ADR: 0047
Classify complete status populations against frozen local metadata so future and unsupported work cannot disappear behind an empty registry. Publish immutable aggregates only after actual read rollback and cleanup, using the existing serialized control owner and confined grants. Qualify cold runtime health, independent SQL/.NET hashes, stored history, real routing eligibility, reservation counts and failed refresh ownership. Keep Step 9 metrics, enforcement and complete packet qualification open. ADR: 0047
Expose existing running work and generation cleanup witnesses through immutable snapshots. Preserve confirmed monotonic zero separately from missing metadata heartbeat, without adding execution or release authority. Qualify the real PostgreSQL callback and facade collection immutability; record focused review and source-specific qualification boundaries. ADR: 0047, 0059
Bind the required observer to the concrete initialized runtime and project durable samples, native progress and finite component states without opening sources or granting execution authority in collection. Qualify the actual Meter callbacks and singleton wiring with listener, PostgreSQL and mutation controls; record corrected test premises and keep remaining stage instrumentation and packet review gates explicit. ADR: 0047, 0059
Keep stage measurements tied to actual executor settlement and durable acknowledgements so cleanup faults and unissued provider calls cannot invent a failed commit or uncertain external effect. Contain metric listener faults without changing completed work, and pin the memory-only observation boundary with actual-call and hidden-initializer controls. ADR: 0047, 0059, 0061
Keep named job spans on their existing actual owners before Start can invoke observers, and separate declared causal parents from fresh roots. Preserve W3C correlation without an exporter and attempt tenant restoration independently of Activity callback faults. Bind source and cleanup calls to their real receivers so tracing cannot hide an unowned Activity. ADR: 0032, 0047, 0059, 0061
Preserve physical acknowledgements through cleanup refusal and count only the original retry's locked confirmation. Keep renewal history separate from physical ACKs without reopening execution or ownership. Qualify actual retry owners and fixed-memory counter boundaries while recording the remaining Step 9 proof work explicitly. ADR: 0047, 0061
Exercise actual owner tasks and PostgreSQL commit uncertainty so retries, renewals and terminal audit observations cannot imply cleanup or renewed execution authority. Keep native handoff and grouped history limits explicit. ADR: 0047, 0059, 0061
Distinguish original committed fanout progress from a returned value or a later durable history, while preserving acknowledged work after cleanup refusal. Keep observation in fixed memory cells without expanding authority. ADR: 0047
Keep prior-handoff repair observations distinct from unmarked work and refuse to report a durable deferral when its current fence did not change. Qualify actual native/status cleanup without inferring hidden commit ACKs. ADR: 0047
Keep the first actual lease-loss cause after its execution leaves memory without mistaking stop, settled work or cleanup for expired authority. Guard the recorder as synchronous memory-only work and qualify real renewal and recovery ownership. ADR: 0047, 0059
Retain elapsed-stage provenance until actual invocation cleanup so returned wrapper waits cannot masquerade as settled work. Keep fixed memory-only process counters and pin their task and cleanup evidence with runtime controls and the existing architecture censuses. ADR: 0047, 0059
Guide feature authors through the delivered typed scheduler, explicit composition, external evidence and recurrence boundaries so later features preserve the accepted ownership and failure contracts. ADR: 0047, 0058, 0059, 0060, 0061
Compare disk-wide declarations and actual Program registries and served endpoints so missing composition, hidden modules and conditional routes cannot pass the infrastructure-only contract. Exercise dashboard and inherited-action controls and complete the sixth-attempt SQL policy pair. ADR: 0047, 0061
Observe real parameter, request and handler constructors under trusted job context and independent causal tracing. Keep the genuine business task held after cancellation and distinguish caller isolation from positive owned cleanup, with separate wrong-context and trace controls. ADR: 0047
Gate the existing backend job on its actual API publish and both offline material/replacement controls so passing test binaries cannot hide a missing distribution kit. Retain JSON receipts and the existing job identity, filters and deadline. ADR: 0047
Name existing substantive proofs after their canonical obligations without duplicating graphs or changing their bodies, data or traits. Keep full companion qualification and catalogue promotion separate from compiled discovery of the nineteen actual owners. ADR: 0047
Record both fresh review rounds for the isolated fixture typing fix and the final Proposed warm-realm correction. Preserve the approval hold and separate author checks, private feasibility and hosted qualification. ADR: 0064, 0067
Admin assignment endpoints return only ID and name. Read and bind the complete representation before checking protocol, while preserving all existing compatible allowance and mapper checks. Add independent graph, identity, readback and transport-cap counterexamples; 256 guarded Node cases and six workflow-gate controls pass. ADR: 0004, 0064
Require all identity-independent refusals before preparation, preserve readable prior definitions, and specify preparation diagnostics, write accounting and exact assignment-only DELETE authority. Retain shipped catalogue status with pending extensions. Correct raw provider anchors and distinguish actual console token effects from unproved POST/runtime behavior. Record conditional maintainer acceptance authority and the separate source-bound CI failure without guessing its cause. ADR: 0004, 0064, 0067
Add the existing settlement test file to the finite diagnostic source projection. Verify exact and near-match handling without exposing raw paths or errors. All 43 offline controls pass. This does not infer the lost CI assertion or alter runtime, deadlines or success witnesses. ADR: 0063
Record the first fresh review of the compatible-read correction and conditional decision revision. Reflow its one minor finding and clarify what the failed launcher envelope can and cannot establish. ADR: 0063, 0064, 0067
Accept ADR-0068 under the maintainer's conditional authority after both fresh revision reviews. Disclose the two bounded phase replacements and historical remedy follow-up; reconcile authority headers, architecture, guidance and index. Preserve shipped catalogue status/counts while the expanded obligations remain explicitly pending. Acceptance authorizes the three-step implementation, without claiming automatic-path proof. ADR: 0004, 0064, 0067, 0068
Bind complete historical scope, mapper and role representations before removing only three approved account-console assignments. Preserve the compatible path, keep DELETE authority opaque and requalify explicit partial-progress reruns without replay or a durable marker. Commit a credential-redacted historical fixture, fixed canonical baseline and independent real-provider reproduction. The ordinary production path performs sixteen writes, then zero after test-owned metadata setup. Automatic preparation and the remaining token/self-service proofs retain the next steps' gates. ADR: 0004, 0064, 0067, 0068
Persist uncertain-response and cancellation controls at all three DELETE positions. Verify the exact durable prefix, no replay, last-edge handoff to compatible preservation and explicit zero-write convergence. Record the first independent Step 1 review and its verified proof gap. Runtime behavior and mutation authority remain unchanged. ADR: 0068
Record both fresh review rounds, the persisted interruption correction and its independently verified convergence. Keep preparation, complete automatic-path evidence and final hosted qualification explicitly pending. Clarify that the Node census guards files and counts, not test semantics. ADR: 0068
Qualify independent prerequisites before the bounded metadata exception, then discard every provisional projection before admitting ordinary writes. Keep uncertain dispatched progress visible through failures and cleanup. Actual historical provider controls prove convergence and explicit recovery. ADR: 0068
Keep already observable identity and profile refusals ahead of metadata preparation. Preserve mapper refusal codes through stock qualification and retain dispatched metadata notices through the seed and demo entry owners. Actual provider regressions and clean counterpart controls bind these fixes. ADR: 0068
Bind the closed first-round findings and caller/mapper regressions to their committed fixes and independent checks without claiming final qualification. ADR: 0068
Record both fresh review rounds, verified correction coverage and remaining complete-path qualification without treating partial evidence as release proof. ADR: 0068
Qualify the approved warm upgrade with usable MFA, signed application reads and stored account changes. Retain source-bound entry evidence and measured case assignments while keeping incomplete public qualification explicit. ADR: 0004, 0064, 0067, 0068
Retain both historical demo outcomes and their distinct evidence limits, then record the two fresh independent review rounds before final hosted assignment qualification. No earlier failure is relabelled as success. ADR: 0063, 0068
Remove an unrelated unbounded informational lookup from the native ingress fixture while preserving real request settlement and all security checks. Exercise case-bound diagnostics through the pinned test adapter and retain failed qualification receipts without guessing their missing root cause. ADR: 0047, 0055, 0063, 0068
Retain independent source and actual adapter checks without treating historical green assignments as a waiver for the failed A3 receipt. ADR: 0063, 0068
Record the fresh second review and clarify the informational fetch bound without claiming a universal response-body deadline or waiving A3. ADR: 0063, 0068
Preserve the original held Outcome invariant without assigning later Finalize observations to it. Prove the distinction with a real locked Finalize commit, conservative renewal refusal and actual cleanup, and retain closed identity attribution across all failure boundaries. ADR: 0047, 0059
Await actual flights before positive ownership joins so an early assertion cannot retain unfinished work permanently. Preserve the first failure and qualify the cleanup path with a real held-COMMIT negative and bounded, case-bound cleanup observations. ADR: 0047, 0059
Record the verified cleanup correction, both fresh review rounds and the exact whitespace-only source binding. Keep current-head hosted qualification in the PR and preserve every earlier failed receipt. ADR: 0047, 0059, 0068
Keep the first actual recurrence test fault through independent cleanup and retain only case-bound finite diagnostics. Real adapter controls preserve the original assertion even when cleanup also fails; production behavior and all existing waits remain unchanged. ADR: 0047, 0059, 0063, 0068
Record independent ownership and export checks against actual adapter failure, cleanup, source and archive evidence while preserving the failed hosted run. ADR: 0047, 0059, 0063, 0068
Bind both fresh review rounds to actual failure preservation, positive cleanup and complete retained evidence, with hosted qualification and merge separate. ADR: 0047, 0059, 0063, 0068
Schedule the real renewal pacing callbacks around Outcome settlement, retain actual timer cleanup, and prove the unrelated Prepare-lock refusal against PostgreSQL. Preserve exact cases, deadlines and production policy. Retain the failed CI and partial-rerun evidence with bounded diagnostics. ADR: 0047, 0059, 0060, 0063
ADR: 0047, 0063
Create the actual normal deadline timer before the fixture publication hold. Preserve real durations, callback/factory ownership and exact case identities. Retain fresh clean and exclusion-control evidence, and explicitly refuse the ordering control's unconfirmed internal cleanup witness. ADR: 0047, 0059, 0060, 0063
ADR: 0047, 0063
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Deliver the P02b-6 tenant development realm, bounded shared seed/demo reconciliation and real Keycloak/API proofs. Four typed personas have stable protected actor/tenant identities, exact HTTPS callbacks, confidential code/S256 exchange and the configured 900-second issuance lifetime. ADR-0067 is Accepted; API acceptance and BFF session policy remain separate.
Existing account IDs, passwords, MFA, unrelated state, API service credentials and the Hub realm are preserved. The approved changes add the confidential web-client secret, four missing built-in account capabilities and the fixed account-console role mapper. Existing BFF full scope remains; its token can authorize provider owner self-service.
ADR-0068 is Accepted: The decision authorizes the bounded historical upgrade. Its first two correction steps completed both fresh independent review rounds after verified fixes. Qualified visibility preparation now checks readable facts and independent refusals before metadata, verifies the exact profile, then builds a fresh complete plan. Complete entry, credential/token/self-service and hosted qualification remain in Step 3. Review and merge remain separate.
Approach
make seedand both demo modes await the same target-qualified, locked, bounded reconciler. Ordinary writes require complete planning and independent readback; uncertain progress requires an explicit rerun.public-envno longer follows links or silently repairs permissions.Shard topology/counts, seven required contexts and execution ceilings are preserved. The PR includes advisory timing/source-provenance plan updates; the plan file is not claimed unchanged.
Tests
All four implementation steps and the recorded correction bundles completed their two independent review rounds. The latest complete code correction, isolated fixture typing fix, revised ADR-0068 and its first implementation step completed two fresh independent review rounds after verified corrections. ADR-0068 Steps 1–2 are complete locally; Step 3 is in progress.
TenantRealmIssuanceTests, not the integration population.Run 39668841753 passes all 27 jobs and seven contexts at
57772a2a. Historical full A/B qualification belongs toabd45611. Neither result qualifies a later source. Run 39687329554 at8e914a8bfinishes with 25/27 passing jobs: ordinary-10 fails one existing Outcome ACK/held-cleanup variant, and integration correctly rejects that producer. Its hash-bound receipt and lack of an original assertion are recorded. Three serial paired local invocations pass all six cases on identical backend source, without explaining or waiving the hosted failure; the finite source diagnostic is now included. No deadline or success witness is relaxed. Run 39694542640 at52c73e60fails two existing mapper-reason assertions and its integration aggregate. Both are reproduced on the real provider, corrected without weakening refusal, and the five unsafe variants pass their final zero-write/state assertions. Run 39699380813 is pending atf714a5af. None of these receipts qualifies the final source as green. Final reviewed changes require their own complete hosted assignment under ADR-0063; workflow evidence is always attempt-specific, with no borrowed sibling artifacts.Risk
The exact pre-P02b-6 export hides stored identity attributes and creates broader console scope assignments. Step 1 qualifies only the fixed stock graph and removes its three approved assignment edges; compatible custom graphs retain priority. The console is shared, so scope selection changes affect other console users as described in ADR-0068. Automatic preparation can leave metadata durable on later identity conflict; a fixed notice survives owner and entry cleanup/cancellation. Known readable conflicts refuse before preparation. The actual core upgrade proofs do not replace remaining complete entry, changed-password/MFA, token/self-service and hosted qualification.
Migration / Rollback
Private environment files must be owner-only regular single-link files and explicitly hold the retained BFF secret. The committed example is public development data; there is no automatic missing-key fallback or automatic secret rotation. Provider writes are not atomically rolled back, and reverting code does not reverse them. Follow the realm guide; never reset the provider database or overwrite actor identities to make convergence pass.
Related
BFF sessions, refresh/CSRF/logout and SDK bearer attachment remain P02b-7; application membership/permissions remain Phase 03. The correction record owns precise receipts, limits and finding dispositions.
ADR-0067 records development issuance; ADR-0064 retains the API acceptance boundary.
Prepared with Codex.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation