docs: identity account-lifecycle contract (S2 contract 4) #1433

Merged

fred merged 4 commits from contract/identity-lifecycle into next 2026-08-27 00:13:50 +00:00

Conversation 1 Commits 4 Files Changed 1

+328

4 Commits

Author	SHA1	Message	Date
fred	339e147f77	style: prettier formatting in identity-lifecycle.md	2026-08-26 18:21:39 -05:00
fred	e595855adc	docs: identity lifecycle contract revision 3 ... Addresses the revision-2 re-review residuals and new findings: - emailVerified joins the canonical set; defined reset rule on email change - external-principal uniqueness moved to (issuer, subject) - 'usable login method' defined for unlink refusal - shipped delete affordances (web admin, mosaic CLI) must be removed or disabled with a defined visible state; deactivation exposed instead - admin-creation switch dropped in favor of plain admin authorization - verification matrix extended: IdP removal, forward-auth non-use, first-admin SSO, wizard-recorded JIT choice, step-up positive/expiry, issuer-aliasing witness, UI/CLI delete assertions, docs observable	2026-08-26 18:21:22 -05:00
fred	f507b2bc79	docs: identity lifecycle contract rev 2 — address independent review findings 1-9 ... - §3: durable fail-closed epoch + writer-level refusal + atomic transition (adapter must be transaction-bound or bootstrap writes users itself); first-admin SSO defined as the bootstrap writer, not JIT - §5: canonical account email split from per-principal provider claims; explicit email-change workflow only - §6: external principal keyed by issuer+subject, DB-unique, immutable provider->issuer binding; explicit link requires step-up reauth - §2/§4: JIT per-provider default off always, wizard-explicit enable; effective closed during epoch; allowlist requires verified email - §7.1: measurable deactivation (atomic-or-fail-closed ban+revocation, all transports, 30s/next-message socket bound, admin tokens) - §7.3: deletion gated here; hard-delete endpoint fails closed until a chartered deletion/retention contract ratifies (contract 7 is D14 custody) - §1.4: account creates no workspace membership/authority (SOT REQ-TEN-001) - §8: expanded verification matrix with bounded observables - factual fixes: 21 FK constraints across 19 tables; ci-postgres is the postgres service of the test step	2026-08-26 18:05:31 -05:00
fred	4d3de6c58c	docs: identity account-lifecycle contract (S2 contract 4, D10/Q1=O1; folds #1430 bootstrap invariant)	2026-08-26 17:49:24 -05:00