docs: migrate SSO provider runbook

2026-08-10 17:01:40 -05:00
parent 571a3d54b5
commit 7425edb80f
8 changed files with 211 additions and 128 deletions
@@ -22,6 +22,7 @@
 - [x] Select the P8-003 performance report as the first low-risk migration slice.
 - [x] Archive the contradicted TUI PRD/task pair with unchanged content and an explicit archive index.
 - [x] Create and promote the verified user quickstart from the empty root placeholder.
+- [x] Rewrite and promote the SSO administrator runbook from current auth/web source evidence.

 ## Initial findings

@@ -39,6 +40,7 @@
 - `docs/PERFORMANCE.md` had no live source/test dependency or internal links; it moved unchanged to `docs/reports/qa/p8-003-performance-optimization.md`. The admin index and current sitemap now classify it as historical evidence, not an operator runbook.
 - `PRD-TUI_Improvements.md` and `TASKS-TUI_Improvements.md` had no live source/test dependencies beyond their internal relative link; both moved unchanged to `docs/archive/tui/`, and `docs/archive/README.md` labels them historical.
 - The empty `docs/QUICKSTART.md` placeholder was replaced by `docs/USER-GUIDE/getting-started/quickstart.md`, based on verified installer, wizard, CLI, and runtime-safety behavior. The page explicitly excludes held PostgreSQL/source-checkout routes.
+- The SSO guide now documents Authentik/WorkOS/Keycloak discovery, OIDC callbacks, Keycloak SAML fallback, partial-config failures, and the absence of frontend feature flags. The root guide and stale `.env.example` flags were removed.

 ## Method

@@ -74,3 +76,4 @@
 | P8-003 migration            | PASS — destination is byte-identical, live references were updated, formatting and navigation checks pass, and only the scoped migration files are pending commit |
 | TUI archive migration       | PASS — both pages are byte-identical, internal links and archive navigation resolve, formatting passes, and only the scoped archive files are pending commit      |
 | Quickstart migration        | PASS — current page content is source-checked, held routes are labeled, navigation resolves, root placeholder is removed, and formatting passes                   |
+| SSO migration               | PASS — auth/gateway/web SSO tests pass (15+2+2), source claims and navigation resolve, obsolete env flags are removed, and the root guide is retired              |