Skip to content

Platform Identity Current Consumer Refresh Validation — 2026-08-09

  • Status: STATIC VALIDATION PASS / CURRENT ENVIRONMENT EVIDENCE NOT RUN
  • Review ref: qa/master@40fb4020e2993347eb7cde9cb24ee9f6201cd806
  • Source refresh: PLATFORM_IDENTITY_CURRENT_CONSUMER_REFRESH_2026-08-09.md
  • Consumer matrix: PLATFORM_IDENTITY_CURRENT_CONSUMER_MATRIX_2026-08-09.md
  • Preflight: RBR-IDENTITY-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
  • Effects: static source and documentation review only

1. Validation Purpose

This document validates that:

  1. the previous Identity source authority remains current for the core source;
  2. current consumer drift is mapped without reclassifying it as a session-engine change;
  3. Provider Credential reveal/replacement is connected to current actor/subject/tenant semantics;
  4. the read-only package cannot authenticate, impersonate, change a password or expose a credential;
  5. no source observation is promoted to M3/M4 or an accepted target policy.

2. Baseline Relation

Previous Identity baseline:

3c084671c034f8f5136b02dce990ecff6c66d107

Current review ref:

40fb4020e2993347eb7cde9cb24ee9f6201cd806

Current is 72 commits ahead. The compare set does not include changes to the core Identity files listed below.

Source Current blob Validation
login.php bd73f23524e34e9daf85ecb0eb4fbe77a7afdfa4 unchanged from Identity baseline
config/session.php c2fb4d252bf910fe2507308a767a72398e919b37 unchanged
config/config.php b49bdf04441c2fe09ba1b53bd7cccc576f260d00 unchanged
app/platform/auth/account_post_helper.php 8baed69a47a058c13120973617f49980338a7409 unchanged
app/platform/audit/super_admin_post_helper.php 76c9bef4d77f4cc8856c3d2fa92998713968eab8 unchanged
admin-console.php 1fe62af36ff750cd3de358f7f05e00f0264af027 unchanged
app/platform/tenant/tenant_execution_context_adapter.php 0ffa6657aeabd117ddfc78c5bd2303ac022119bf unchanged
app/shared/api/runtime.php 54675d2f0c363fb68959a7d79b97ceb8686e4b25 unchanged

Result:

CORE IDENTITY SOURCE AUTHORITY REMAINS CURRENT
CURRENT CONSUMER ADDENDUM REQUIRED

3. Current Consumer Source Validation

3.1 Provider Credential routes

Current platform route blob:

app/platform/api_routes.php
191251c1f40bf56d2f4064e083a362de5ab8ccaa

Validated current facts:

  • reveal and replacement use POST;
  • both routes set redactRequestBody = true;
  • route moduleKey is null;
  • handler rechecks Admin Console access;
  • non-Super Admin is limited to getClientId();
  • credential key must be in the provider-secret allowlist;
  • reveal returns one value with no-store/no-cache headers;
  • replacement uses an expected revision when supplied;
  • no privileged reauthentication contract is present in the reviewed route;
  • no explicit impersonation prohibition is present in the reviewed route;
  • no dedicated managed credential removal route was found in the reviewed source.

Result: PASS.

3.2 Credential storage helper

Current tenant config helper owns:

allowlisted secret definition
encrypted SECRET.<KEY> storage
server-side decrypt for reveal
optimistic UPDATED_AT comparison
legacy plaintext companion retirement

The helper receives target clientId rather than a complete typed identity context. The refresh correctly classifies this as a target-contract gap, not a claim that current tenant isolation is absent.

Result: PASS.

3.3 Diagnostic redaction

Current logging blob:

app/shared/api/logging.php
f5a6f6dd6805b09d29f649c6b192061a594fd4a6

Validated current facts:

  • marked routes omit request body from log context;
  • sensitive key matching includes config and credential values;
  • diagnostic actor fields use original session data in current logger paths;
  • current request context may separately use effective scalar user/tenant.

The refresh does not claim complete Actor/Subject correlation without runtime log evidence.

Result: PASS.

4. Core Semantic Revalidation

Current statement Source support Result
login is username-only login.php query PASS
login regenerates session ID session_regenerate_id(true) PASS
session TTL is 20 hours config/session.php PASS
Secure cookie depends on HTTPS or forwarded proto session helper PASS
scalar user/tenant helpers can resolve impersonated target config/config.php PASS
physical Super Admin remains based on original session isSuperAdmin() contract PASS
impersonation start stores session object Super Admin helper PASS
impersonation start/end do not visibly regenerate ID current source sequence PASS
own-password change uses effective scalar user/tenant account helper PASS
password update does not revoke other sessions no revocation call in current path PASS
strict typed principal is route opt-in API runtime/route contract PASS

5. Layer Separation Validation

The refresh preserves these independent authorities:

credential verification
session issue/continuity
physical actor
effective subject
target tenant
impersonation delegation
action/record authorization
provider credential ownership
provider effect
request/business evidence

Examples:

credential reveal allowed
!= provider call allowed

physical Super Admin
!= effective target user

tenant-only impersonation
!= target-role acceptance

password row updated
!= every session revoked

request body redacted
!= complete identity audit

Result: PASS.

6. Preflight SQL Validation

The preflight contains 20 SQL templates.

Allowed forms:

SELECT
SHOW
information_schema read

No template contains:

INSERT
UPDATE
DELETE
REPLACE
ALTER
CREATE
DROP
TRUNCATE
SELECT ... FOR UPDATE
LOCK TABLES
GET_LOCK
RELEASE_LOCK
mutating CALL

Result: PASS.

6.1 Schema-first behavior

The package checks table, column, index and foreign-key inventory before data queries. Optional metadata columns must be confirmed before use.

Result: PASS.

6.2 Tenant and account scope

  • tenant queries require approved Client IDs;
  • account detail queries require controlled IDs/usernames;
  • Super Admin detail is limited to one approved ID;
  • broad user directories are prohibited;
  • foreign-tenant data is a stop condition.

Result: PASS.

6.3 Password safety

Queries return only hash classes/counts. They do not return password hashes.

Result: PASS.

6.4 Credential safety

Queries return logical key, configured boolean, storage-key class and revision metadata only. They do not return plaintext or ciphertext.

Result: PASS.

7. Browser / Host / Log Validation

The preflight defines 10 read-only observation groups:

3 host/session metadata groups
5 GET-only browser/API groups
2 request/correlation groups

Validated boundaries:

  • pre-established controlled sessions only;
  • no login for convenience;
  • no impersonation start/end;
  • no logout/reset;
  • no password or credential action;
  • no POST/PATCH/DELETE;
  • cookie values fully redacted;
  • session store payloads prohibited;
  • logs limited to safe metadata;
  • no provider/file effect.

Result: PASS.

8. Overclaim Review

The refresh does not claim:

  • a current security incident;
  • that duplicate usernames exist;
  • that credential reveal is currently misused;
  • that impersonation is unsafe in every context;
  • that a global denial or feature removal is safe;
  • that current session headers match source without evidence;
  • that a durable session store is absent in the environment;
  • that current logs can or cannot reconstruct actor and subject;
  • M3 or M4 readiness.

It classifies unknowns as evidence or policy questions.

Result: PASS.

9. Findings Validated

Finding Result
Core Identity implementation unchanged PASS
Current consumers expanded PASS
Credential reveal/replacement is a high-impact Identity consumer PASS
Current credential repository call lacks complete typed context PASS
Current source has no privileged reauth for reveal PASS
Current source has no explicit impersonation prohibition for reveal PASS
Current source has no managed removal route located PASS
Own-password behavior under impersonation remains an open policy PASS
Current session revocation behavior remains unproven PASS
Read-only evidence can be gathered without secret/session exposure PASS

10. Validation Result

core source comparison:
PASS

consumer mapping:
PASS

identity/effect separation:
PASS

preflight static safety:
PASS

current DB/session/browser/log evidence:
NOT RUN

consequential identity scenarios:
NOT RUN

M3 / M4:
NO CHANGE

---

Source: docs/reconstruction/PLATFORM_IDENTITY_CURRENT_SURFACE_VALIDATION_2026-08-09.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.