[Feature] Add identity-assurance and device-key administration UI #2

New Issue

2026-08-02T04:12:42+02:00

zemion commented

2026-08-02 04:12:42 +02:00

Context

Identity Trust exposes assurance evidence, device-key lifecycle, epoch rotation, and key-access decisions as headless APIs. Security officers and users need bounded views for these operations; GovOPlaN #26 identified the missing surface.

Acceptance criteria

Show assurance state and evidence provenance subject to Policy and Access.
Let users/admins list and revoke authorized device keys without exposing private material.
Surface epoch rotation and key-access decisions only to the appropriate authority with explicit consequences.
Preserve capability-first use by Encryption and other modules.
Cover stale revisions, inaccessible subjects, compromised/revoked devices, and optional-module permutations.
Update security/user documentation and endpoint-surface declarations.

## Context Identity Trust exposes assurance evidence, device-key lifecycle, epoch rotation, and key-access decisions as headless APIs. Security officers and users need bounded views for these operations; GovOPlaN #26 identified the missing surface. ## Acceptance criteria - Show assurance state and evidence provenance subject to Policy and Access. - Let users/admins list and revoke authorized device keys without exposing private material. - Surface epoch rotation and key-access decisions only to the appropriate authority with explicit consequences. - Preserve capability-first use by Encryption and other modules. - Cover stale revisions, inaccessible subjects, compromised/revoked devices, and optional-module permutations. - Update security/user documentation and endpoint-surface declarations.

zemion added the module/identity area/security

area/webui labels 2026-08-02 04:12:42 +02:00

zemion commented

2026-08-03 20:41:08 +02:00

Closure audit (2026-08-03)

The device-key list/register/revoke, epoch rotation, key-access decision, and assurance evidence/check APIs are implemented with backend coverage. This issue is not yet closable because the module has no WebUI package or user/admin surface; assurance evidence is currently command/check oriented rather than a browsable provenance projection.

Shortest closure path:

Add bounded assurance-evidence/status projections where needed.
Scaffold user device-key and security-officer administration sections.
Add revoke, epoch rotation, key-access decision, stale/revoked-device, forbidden-subject, optional-module, docs, and declaration coverage.

This should precede Encryption #4 because Encryption recovery explanations consume this trust boundary.

## Closure audit (2026-08-03) The device-key list/register/revoke, epoch rotation, key-access decision, and assurance evidence/check APIs are implemented with backend coverage. This issue is **not yet closable** because the module has no WebUI package or user/admin surface; assurance evidence is currently command/check oriented rather than a browsable provenance projection. Shortest closure path: 1. Add bounded assurance-evidence/status projections where needed. 2. Scaffold user device-key and security-officer administration sections. 3. Add revoke, epoch rotation, key-access decision, stale/revoked-device, forbidden-subject, optional-module, docs, and declaration coverage. This should precede Encryption #4 because Encryption recovery explanations consume this trust boundary.

zemion commented

2026-08-04 01:14:00 +02:00

Codex State: done

Summary

Added permission-aware identity-trust administration for device status, revocation, and epoch rotation, including read-only states.

Changed Files

commit 9640ec2

Verification

5 focused Python tests and Identity Trust WebUI test passed; all-module startup smoke passed.

## Codex State: done ### Summary - Added permission-aware identity-trust administration for device status, revocation, and epoch rotation, including read-only states. ### Changed Files - `commit 9640ec2` ### Verification - `5 focused Python tests and Identity Trust WebUI test passed; all-module startup smoke passed.`

zemion closed this issue

2026-08-04 01:14:01 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-identity-trust#2