Permora 1.0 — six-area production acceptance (current evidence)

Updated: 23 October 2026. Status: OPEN; NOT production approved.
A green test suite or a signed DRAFT candidate does not prove full
Microsoft AD compatibility, production HA, legal compliance, or an independent
penetration test. The authoritative, versioned matrix is
docs/release-checklist.md.

1. Keycloak FGAP and LDAP/AD

• Real Keycloak 26.8.1 FGAP delegated client/user/group + foreign/realm denial on scoped service credentials.
• Real certificate-validated OpenLDAP/LDAPS imported and non-imported user modes, pagination, nested group membership, dynamic member add/remove and negative permission matrix (CI #39117753117).
• Document unsupported direct individual-role writes for non-imported READ_ONLY LDAP, with expected rejection; group mapping/inheritance tested.
• Actual Microsoft Active Directory userAccountControl, MSAD-specific mapper, nested/cross-domain groups, Kerberos/SPNEGO/forest-trust scenarios in an authorized representative AD test domain.
• Production-specific FGAP rights/list-visibility and blast-radius audit; group manage is broader than map-roles-only; no global realm-admin.

2. Real multi-worker failures and load

• Two separate worker processes + actual Keycloak/PostgreSQL, four apps and 32 expirations, injected Keycloak HTTP 503, committed DELETE with lost response, killed responsible worker, surviving worker recovers; read-back and no duplicate effective remote writes (CI #39117753047).
• PostgreSQL row-lock/concurrent-app regression, idempotency, bounded cursor-based queue fairness and incident counters.
• Load/soak and multi-host/multi-zone tests at the real workload, failover under DB/Keycloak partitions, measured revocation p95/p99, approved SLOs/SLAs and operator handover.

3. Production TLS, secrets and HA

• Explicit trusted reverse-proxy IPs, HTTPS-required in Production; encrypted Data Protection key ring, cross-provider session sharing, wrapping-certificate rotation in tests; file-mounted per-process database/IdP credentials; restricted single-host pilot compose.
• Actual production-like TLS termination and ingress certificate renewal with denied spoofed forwarded headers, verified multi-host deployment, shared RWX/key custody, PostgreSQL/Keycloak HA, external secret-manager automatic rotation, documented and observed failover.

4. Disaster recovery

• Isolated PostgreSQL/Keycloak dump-restore, signing-key identity, no unintended regrant following revoked access; encrypted BFF key-ring backup/restore and previous-certificate decryption in separate tests.
• Coordinated multi-system DR with real Keycloak + Portal + Data Protection and secrets, PITR/rollback, no stale IAM regrants, measured and approved RPO/RTO with runbook under a representative environment.

5. SBOM, licenses, signing

• Actual API/Worker/Provisioner image CycloneDX/SPDX, frontend production closure, license declaration/notice evidence, normalized dependency graph, source/executable digests.
• Exact SHA-bound GitHub OIDC/Sigstore attestation and signed draft-only development candidate #39117753278.
• Release signing workflow now requires exact-source successful core, system, worker and accessibility acceptance (PR docs(release): accurate six-area readiness and require WCAG gate before draft signing #38).
• Human/legal review of unknown/conditional third-party and OS package licenses, current vulnerability advisories/VEX, maintenance and patch policy; no unreviewed risks in a production release.
• Fresh Grype vulnerability scan blocks fixable High/Critical on actual candidate inventories: merged PR #43, independently rerun on the 20 Oct PR #54 source. Production-specific vulnerability disposition and license review remain open.

6. Accessibility, security, privacy

• Automated axe-core WCAG A/AA tests for 54 UI states/viewports (desktop, mobile, 320px), keyboard/reflow cases (CI #39117753107).
• Real OIDC LoA2/TOTP positive MFA and negative weak-auth session / CSRF checks (CI #39011230492).
• Data inventory, pseudonymous-only new immutable audit metadata, raw request/decision rationale retained solely in managed business records; opt-in bound and conservative cleanup of stale unreferenced directory snapshots.
• Full WCAG 2.2 AA manual keyboard/screenreader usability, German/English coverage, real end-to-end business journey evaluation by independent reviewer.
• External WORM/SIEM audit integrity, lawful personal-data retention/rights processing including backups, DPIA decision where required and independent privacy/legal signoff.
• Independent penetration test under written authorization, findings remediation and retest, documented threat acceptance and signed security/operations/central IAM release decision.

Strict 1.0 completion definition

The release owner must record: exact immutable source SHA, tests and direct URLs,
supported Keycloak/.NET/Angular/PostgreSQL versions, real representative deployment,
RPO/RTO and latency observations, current vulnerability findings, third-party license
approvals, privacy/DSAR/WORM outcome, independent pen-test report, risk owner and
explicit release signoff. Unsupported environments must be excluded, not declared
complete. Never merge failing PRs solely to show a complete roadmap.

Until every production-applicable gate is evidenced, this issue stays open.

18 Oct 2026 additional verified integrations

• 96-revocation load/worker test (isolated): PR #42, real stress workflow #39119622674. Two actual worker processes, 8 apps × 12 identities, simulated Keycloak outages/lost reply, worker termination and recovery; does not constitute production SLO or multi-zone HA approval.
• Built-artifact vulnerability gate: PR #43, all six PR checks passed. Pinned Grype scanner on actual API/worker/provisioner image plus frontend SBOMs; fixable High/Critical block signed draft candidates. Unfixed/unknown advisories and licenses remain human release gates.
• Signed-candidate trigger completeness: PR #45, all five required PR workflows passed. Scanner installer and vulnerability-policy changes now invalidate previous candidate freshness and trigger exact-SHA checking on main.
• Actual FGAP group privilege breadth characterized: PR #44, test run #39119853859. The same scoped Groups.manage token could rename a group, proving it is not mapping-only; revert verified in CI. Security blocker tracked in #46.
• Default-deny group-mapping mitigation: PR #47 merged after all six PR workflows succeeded; new group grants require an explicit per-realm central IAM opt-in, revocations remain allowed. Upstream Groups.manage overbreadth still requires independent approval.

Production release remains BLOCKED on Microsoft AD-specific behavior and organization-specific FGAP review; representative TLS/multi-host failover and secret rotation; coordinated DR/RPO/RTO; legal license review and unresolved vulnerabilities; independent WCAG/screenreader, GDPR/DPIA, WORM/SIEM and penetration-test acceptance. This checklist does not imply that automated tests substitute independent approvals.

20 Oct 2026 engineering checkpoint — no production authorization

• Fail-closed directory identity handling: PR #54 merged as 5017624d57aecb65758553a8d017a02d6636be4c. Reject duplicate same-realm local principal IDs for new grants; do not guess a Keycloak remote write target on ambiguous revocations; flag duplicate, invalid-kind/ID, stale and disabled/protected assigned identities in reconciliation. 198/198 xUnit tests passed on PR head e99ec1660113c6ab19894aa277d35a8abaad89f1 (CI run #39397708574); isolated Keycloak/LDAP, OIDC, workers, accessibility and built-artifact vulnerability checks also succeeded on that PR commit. Real AD integration and deployment-specific revocation behavior are not proven.
• Public documentation: English and German README/architecture refresh in merged PR #53, after all 13 applicable checks passed.
• Security tracking corrected: issue #46 reopened because Keycloak Groups.manage scope breadth remains unresolved. The API/worker exact-group allowlist does not restrict upstream token rights.
• Post-merge source-bound CI and signed draft confirmed at 5017624d57aecb65758553a8d017a02d6636be4c: all six main workflows passed; artifact integrity #39398135494 completed successfully and created draft tag candidate-5017624d57ae-run39398135494 containing 25 assets. This is not a published release or operator security acceptance.

The release remains blocked on representative Microsoft AD tests, production-specific FGAP privilege audit, multi-host TLS/HA/secret rotation, coordinated disaster recovery with RPO/RTO, independent accessibility/security/privacy reviews, and accountable vulnerability and license decisions.

20 Oct 2026 FGAP group scope expansion

• PR #55 merged at efa98973869a45f36b547cc3330b2e3eb1a07e7a after 13/13 PR checks passed. Actual Keycloak 26.8.1 same-delegated-token Admin REST contract tested allowed-group metadata rename (excess privilege exists) and denied foreign group rename/delete, denied user membership edits, and denied foreign role maps with read-back. Operator matrix and caveats. This does not close R03/R06, #46, or deployment-specific LDAP/AD, network, rotation and audit gates.

20 Oct 2026 — P4 missing-directory-grants fail closed

• PR #56 merged at 6f0e700843fc6ffc0f563cdb392c6949e743629a after all 14 applicable PR checks succeeded (draft signing correctly skipped on PR). 206/206 xUnit passed and real isolated PostgreSQL, Keycloak/LDAPS, OIDC, worker failure/recovery, accessibility and artifact vulnerability checks succeeded on PR head 35fc473822d654e6318e49489605e0cc6d1be898.
• Before GrantAccess or UpdateRole, existing assignments must resolve uniquely to current in-realm directory records and pass freshness/eligibility/group-membership checks. Missing or duplicated old identities now block a new grant, rather than silently suppressing an existing group in SoD evaluation. RevokeAccess remains plan-able; remote execution still requires an unambiguous Keycloak target.
• Post-merge SHA 6f0e700843fc6ffc0f563cdb392c6949e743629a passed all six applicable main workflows (core #39401674436, system #39401674476, worker #39401674570, accessibility #39401674455, documentation #39401674419, artifact integrity #39401674554). The signed, exact-source draft-only candidate candidate-6f0e700843fc-run39401674554 exists with 25 assets. It is not a published release, operational safety approval or AD certification.
• Validate these P4 controls with representative LDAP/MSAD real external membership-loss and restoration scenarios; document/measure incident response and reconciliation, not just xUnit outcomes.

1.0 remains incomplete. Same-token FGAP Groups.manage privilege excess, Microsoft AD integration, production-like TLS/HA, coordinated DR and independent privacy/security/Accessibility acceptance are not resolved by this engineering regression.

20 October 2026 — release gate reopened and new engineering evidence

The issue was found closed even though the six operator/independent acceptance areas above explicitly remained incomplete. It was reopened to prevent a false 1.0 completion claim. This does not undo successful engineering work.

PR #60 adds a real imported-LDAPS → Keycloak → PostgreSQL → Permora.Worker group SoD remediation test, independently passed in the 7/7 PR workflow suite and merged as e3bfcf6ca6b2. This narrows R07/P4 only. The separate unverified combinations remain in #58.

OPEN release obligations unchanged: actual Microsoft AD-specific federation; central IAM signoff on Groups.manage / #46 and real token/network scopes; multi-host TLS/HA/rotation; coordinated full DR with measured RPO/RTO; legally reviewed license/vulnerability decisions; independent WCAG, GDPR/DPIA, WORM/SIEM and penetration testing. Signed engineering draft candidates and an isolated CI latency are not an approved operational release.

PR #63 — governance, tooling security and final main acceptance

PR #63 merged into main at d993bf1dc4fdcbf875d6515f1ee8f06f1c3867bb. All seven workflows passed on exact PR head 0033f7aad7b720bc5177f39fe541decdb2cf9ad8; all six triggered main workflows passed again on the merge commit.

• Core CI: 287/287 xUnit, 0 skips, real PostgreSQL/HTTP scope and restore; 41 frontend logic cases and 46 fixture-backed desktop/mobile browser cases; genuine Keycloak OTP/MFA and shared BFF session/logout. Complete production/development npm audit: zero findings at run time.
• Accessibility: 66 automated axe/reflow cases; not independent/manual WCAG approval.
• System federation and worker/recovery passed. The final PR bounded load passed with two actual workers, 96 revocations plus scheduled review revocations; no production SLO is inferred.
• Artifact integrity: actual API/worker/provisioner images, SBOM/vulnerability gate, exact-source/digest signature verification passed. candidate-d993bf1dc4fd-run39866023451 is a draft prerelease with 25 assets, not a production release.
• Implemented application-scoped governance counts and paginated in-portal reminders, current-mandate rechecks, overdue/expiry/directory/group-SoD cues and >200-review regression. No external notification delivery or complete SoD attestation is claimed.
• Remediated Vite development-tool advisories with a documented, tested scoped 8.3.3 override; included development dependencies in npm CI auditing. Worker/core/persistence/central .NET edits now trigger bounded load. Browser CI handles GitHub's actual priority APT mirror list while preserving signature keys, suites and security fallback; 25 Python cases passed locally.

Still OPEN: optional external notification channels; complete SoD/directory scenarios and #58; DE/EN UI localization and remaining product work in the roadmap; #46's upstream group privilege/risk acceptance; representative Microsoft AD, multi-host TLS/HA/rotation and coordinated DR/RPO/RTO; independent security/accessibility/privacy and legal license/vulnerability acceptance. This checkpoint does not close this release issue or authorize production.

23 October 2026 — PR #64 merged, joined engineering acceptance complete

PR #64 merged into main as b7f5a30fe39c553e014d0d7152a1a5ddcbdd1648 (tree 666e1e46746b3ba7a9d180c7153dbeaaad953c67). All seven final PR workflows succeeded on adf3f18206fd029df22f5cea3cd9f5af207f795d; all six triggered main workflows independently succeeded on the merge SHA.

• Main core CI #39935210241: 296/296 xUnit, zero skips, real PostgreSQL/HTTP scope/CSRF and isolated restore; Angular/logic/browser, same-token Keycloak FGAP and genuine OIDC/MFA BFF checks passed.
• Main joined federation #39935210213: 115 assertions, actual OpenLDAP/LDAPS + Keycloak 26.8.1 + PostgreSQL 18 + SDK 10.0.402, compiled worker and Portal API, both imported/non-imported READ_ONLY modes. Real LDAP visibility loss with configured probes, duplicate source page, injected ambiguous persisted identity (Conflict/blocked audit, no guessed target), actual owner HTTP retry, Keycloak 503, committed DELETE/reply loss/worker termination and postcondition recovery all passed. 2 imported / 3 non-imported effective revokes, zero remote grants, unrelated rights preserved and no regrant after membership loss/rejoin/final restart. Isolated SoD observations 3.36s / 4.42s, not production SLOs. Engineering issue #58 is now closed.
• Main worker/recovery #39935210195 and final PR bounded-load #39934616765 passed, including 96 revocations plus scheduled review revocations in the bounded load fixture. Load is PR/manual-triggered, not a separate main load run.
• Main accessibility #39935210288 and public docs #39935210206 passed. Automated accessibility is not independent manual WCAG approval.
• Main artifact integrity #39935210407: actual API/worker/provisioner image builds, inventories and fresh remediable High/Critical vulnerability gate passed; OIDC attestation and source/workflow/digest verification succeeded. candidate-b7f5a30fe39c-run39935210407 exists as a draft prerelease with 25 assets, exact target SHA above. It is not a published production release.
• Added optional operator-configured DirectoryProbeUserIds: required point read and unique search presence before refreshing a membership snapshot; failed visibility preserves prior timestamps. Without configured probes, previous behavior remains. An accessible/cached probe does not prove full source/group visibility or globally pause mutations. Configuration and limits.
• Corrected both test fault proxies to preserve bounded chunked JSON role-list DELETE bodies; missing payload could otherwise broaden a test DELETE to all client-role mappings. The new regression and live readback preserve unrelated mappings. Repaired the runpy diagnostic entrypoint. 35 Python tests passed locally, including 10 proxy/entrypoint tests also run in system CI. Full local SDK 10.0.402 Release build passed with no warnings/errors; 281/281 non-PostgreSQL xUnit passed locally.
• Documentation, roadmap, threat model, source-trigger coverage and the joined acceptance contract updated. Manual diff review is recorded; formal Codex Security scan runtime was unavailable, and no independent security review or production signoff is claimed.

Still OPEN: #46 upstream Groups.manage overbreadth and actual deployed central IAM/network/rotation/audit acceptance; representative Microsoft AD; multi-host TLS/HA, real failover/rotation and approved SLOs; coordinated full-system DR/PITR/RPO/RTO; independent manual WCAG, privacy/GDPR/DPIA/WORM/SIEM and penetration testing; accountable license/vulnerability decisions and signed release approval. Remaining product scope such as full DE/EN UI, optional external notification channels and complete SoD/reporting remains visible in the roadmap. Those obligations are not replaced by closing the isolated #58 fixture.

This release issue remains OPEN; production remains unapproved.