Define identity/account lifecycle audit semantics #3

New Issue

2026-07-10T11:01:17+02:00

zemion commented

2026-07-10 11:01:17 +02:00

Document and enforce the lifecycle semantics for identities and account links.

Acceptance criteria:

Identity active/inactive states and account-link source semantics are documented.
Primary-account changes define validation, audit events, and rollback expectations.
The module manifest exposes the relevant documentation topic.
Compatibility with multiple accounts per identity is covered in tests.

Document and enforce the lifecycle semantics for identities and account links. Acceptance criteria: - Identity active/inactive states and account-link source semantics are documented. - Primary-account changes define validation, audit events, and rollback expectations. - The module manifest exposes the relevant documentation topic. - Compatibility with multiple accounts per identity is covered in tests.

zemion added the area/governance codex/ready module/identity

labels 2026-07-29 14:15:10 +02:00

zemion commented

2026-08-19 23:21:40 +02:00

Implemented and verified in 43f0128.

This closes the lifecycle-semantics slice independently of the separate administration API/WebUI issue:

active identities appear in ordinary search; deactivated identities are excluded from default search but remain directly resolvable with explicit inactive state for Access/reconciliation;
deactivation is reversible and preserves every account link, source, and primary marker—it is not account suspension or erasure;
primary-account changes accept only an existing link belonging to the identity, atomically demote the former primary, retain all links, and preserve multi-account compatibility;
real activation/deactivation and primary changes record actor-bound audit events with old/new account and link-source provenance;
the lifecycle service deliberately does not commit, allowing callers to authorize and commit state plus audit together or roll both back. A focused test proves audit failure rolls the primary change back;
the module now contributes a static administrator lifecycle DocumentationTopic and the Identity model documents source semantics, no-op behavior, boundaries, and rollback expectations.

Verification passed: Ruff, 6 Identity tests, git diff --check, and the workspace manifest registry (68/68).

Implemented and verified in `43f0128`. This closes the lifecycle-semantics slice independently of the separate administration API/WebUI issue: - active identities appear in ordinary search; deactivated identities are excluded from default search but remain directly resolvable with explicit `inactive` state for Access/reconciliation; - deactivation is reversible and preserves every account link, source, and primary marker—it is not account suspension or erasure; - primary-account changes accept only an existing link belonging to the identity, atomically demote the former primary, retain all links, and preserve multi-account compatibility; - real activation/deactivation and primary changes record actor-bound audit events with old/new account and link-source provenance; - the lifecycle service deliberately does not commit, allowing callers to authorize and commit state plus audit together or roll both back. A focused test proves audit failure rolls the primary change back; - the module now contributes a static administrator lifecycle DocumentationTopic and the Identity model documents source semantics, no-op behavior, boundaries, and rollback expectations. Verification passed: Ruff, 6 Identity tests, `git diff --check`, and the workspace manifest registry (68/68).

zemion closed this issue

2026-08-19 23:21:40 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-identity#3