System Reconstruction Coverage Matrix — Identity And Access Wave¶
- Status:
CURRENT PLATFORM COVERAGE COMPANION - Original foundation baseline:
qa/master@3c084671c034f8f5136b02dce990ecff6c66d107 - Current Identity refresh ref:
qa/master@40fb4020e2993347eb7cde9cb24ee9f6201cd806 - Current Access refresh ref:
qa/master@2c0dd0bfadde7633337ec4357be1cbf9835c5c8b - Identity refresh:
PLATFORM_IDENTITY_CURRENT_CONSUMER_REFRESH_2026-08-09.md - Access refresh:
PLATFORM_AUTHORIZATION_CURRENT_SURFACE_REFRESH_2026-08-08.md - Identity evidence:
RBR-IDENTITY-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md - Access evidence:
RBR-ACCESS-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md - Platform index:
PLATFORM_FOUNDATION_RECONSTRUCTION_INDEX.md - Phase implementation:
USER HOLD - Important: coverage labels describe documentation and evidence gaps. They do not activate Runtime changes.
1. Coverage Vocabulary¶
COMPLETE INPUT
PARTIAL
MAPPED
MISSING
OPEN POLICY
RUNTIME EVIDENCE REQUIRED
NOT APPLICABLE
Dimensions:
PDT Product outcome
ROL Actors/roles/access
PRC Process/sequence
STA State/lifecycle
DAT Data/identity/fields
INT Query/command/error
EFF external/system effects
UIX UI/UX
OPS operations/recovery
WIK Wiki projection/publication
MIG migration/rollback/caller-zero
VER verification evidence
2. Coverage Summary¶
| Capability | PDT | ROL | PRC | STA | DAT | INT | EFF | UIX | OPS | WIK | MIG | VER | Primary remaining work |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Credential authentication | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | active username namespace, legacy-hash population, login failure/rehash evidence |
| PHP session lifecycle | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | PARTIAL | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | save handler, cookie headers, proxy trust, expiry and revocation semantics |
| Password change/reset | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | impersonation policy, current/other-session revocation and notification |
| User impersonation | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | reason/expiry/rotation, sensitive-action policy and durable actor/subject evidence |
| Tenant-only impersonation | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | support-only scope and explicit non-equivalence to target-role acceptance |
| Admin tenant override | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | route allowlist, authorization reference and current caller evidence |
| Provider Credential identity consumer | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | direct/impersonated policy, privileged reauth, actor/subject trace and safe metadata readback |
| CLI/service/integration identity | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | NOT APPLICABLE | PARTIAL | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | actual job/callback bindings, tenant provenance and credential-owner evidence |
| Menu/page access | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | current T_MENU/module-page/role rows and controlled-account GET evidence |
| API route access | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | module-only routes, numeric route roles and handler predicate parity |
| Semantic action authorization | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | PARTIAL | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | accepted action keys and current role bundles for named surfaces |
| Record authorization | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | PARTIAL | MAPPED | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | tenant/self/parent relations and foreign-record negative evidence |
| Record-state eligibility | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | MAPPED | COMPLETE INPUT | NOT APPLICABLE | PARTIAL | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | owning application state evidence; avoid generic duplication |
| Current Identity consumer matrix | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | RBR-IDENTITY-001, then separately authorized sensitive-action scenarios |
| Current operational action matrix | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | RBR-ACCESS-001 Client 1/selected Client 2 menu/page/API/control evidence |
| Identity/access diagnostics | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | redaction, actor/subject correlation, support role and controlled-account evidence |
| PHP↔Next.js identity/access coexistence | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | NOT APPLICABLE | COMPLETE INPUT | COMPLETE INPUT | PARTIAL | COMPLETE INPUT | RUNTIME EVIDENCE REQUIRED | one session and one access-decision authority, rollback and caller-zero |
3. Identity Detailed Gaps¶
| Area | Current documentation result | Missing acceptance/evidence |
|---|---|---|
| Login identity | username-only current lookup and bcrypt/legacy behavior documented; core source revalidated unchanged | active duplicate-user evidence, accepted realm policy and controlled login scenarios |
| Session cookie | current source settings documented | actual deployed headers, save handler, trusted proxy and browser behavior |
| Timeout/revocation | current 20-hour TTL documented | idle/absolute/privileged timeout, revocation store and measured behavior |
| Actor/subject | scalar and typed behavior plus current consumer matrix documented | request/log evidence proving both identities remain reconstructable |
| User impersonation | current start/end and typed interpretation documented | reason, expiry, session rotation, prohibited actions and durable audit |
| Tenant-only impersonation | subject-null semantics documented | accepted support action scope and field-role warning evidence |
| Password change/reset | current commands and non-implications documented | direct/impersonated policy, other-session invalidation and user notification |
| Provider Credential reveal/replacement | current routes, allowlist, tenant check and encrypted storage documented | privileged reauth/MFA policy, direct/user/tenant-only evidence and actor/subject audit |
| Credential removal | no current managed removal command located | accepted remove/rollback command and evidence contract |
| Service identity | typed explicit binding exists | active CLI/callback adoption, negative cases and credential-owner evidence |
| Next.js bridge | target patterns and prohibition documented | selected shared session authority and coexistence implementation contract |
4. Authorization Detailed Gaps¶
| Area | Current documentation result | Missing acceptance/evidence |
|---|---|---|
| Module | explicit/missing/error compatibility documented; reviewed module routes refreshed | current tenant assignment parity and selected strict cohort |
| Menu | route/query/role and virtual rows documented | current menu DB, duplicate-route and role-list evidence |
| Page | shell/page-local/direct/alias behavior documented; reviewed page list refreshed | normal-menu and direct-page controlled-account evidence |
| API v2 | dispatch order and current reviewed routes documented | current GET results and any unlisted consequential route |
| Legacy endpoint | TYPE/ACTION architecture documented | complete caller/action/role matrix and retirement candidates |
| Operational actions | Loader, Street Turn, Final Review, AR/QBO/BOL/Packing matrix documented | intended actor policy and expected denial evidence |
| Numeric compatibility | current Client 1/role branches identified | accepted replacement and selected Client 2 expectation |
| Role-name compatibility | Work Assignment manager helper documented | role rename/multi-role parity and target semantic bundle |
| Semantic action | target names proposed as documentation input | accepted keys, role bundles and publication owner |
| Record | current tenant/self/relation predicates mapped for named surfaces | controlled current/foreign record negative evidence |
| Super Admin | bypass/impersonation distinction documented | accepted privileged action categories and negative cases |
| UI parity | current controls and route owners mapped | actual visible/hidden/direct API scenario results |
| Diagnostics | current addenda and read-only packages defined | implemented source, redaction and support-role acceptance |
5. Required Document Packet¶
Foundation¶
docs/reconstruction/PLATFORM_FOUNDATION_RECONSTRUCTION_INDEX.md
docs/reconstruction/PLATFORM_IDENTITY_SESSION_IMPERSONATION_SOURCE_AUTHORITY.md
docs/reconstruction/PLATFORM_IDENTITY_SESSION_IMPERSONATION_REBUILD_PACKET.md
docs/reconstruction/PLATFORM_AUTHORIZATION_ACCESS_SOURCE_AUTHORITY.md
docs/reconstruction/PLATFORM_AUTHORIZATION_ACCESS_REBUILD_PACKET.md
docs/processes/PLATFORM_IDENTITY_SESSION_IMPERSONATION_POLICY_AND_SEQUENCE.md
docs/processes/PLATFORM_AUTHORIZATION_ACCESS_POLICY_AND_SEQUENCE.md
docs/runbooks/PLATFORM_IDENTITY_IMPERSONATION_ADMIN_SUPPORT_RUNBOOK.md
docs/runbooks/PLATFORM_ACCESS_DIAGNOSTICS_ADMIN_SUPPORT_RUNBOOK.md
docs/wiki/internal/PLATFORM_IDENTITY_ACCESS_WIKI_PROJECTION_PACKET.md
Current Identity consumer surface¶
docs/reconstruction/PLATFORM_IDENTITY_CURRENT_CONSUMER_REFRESH_2026-08-09.md
docs/processes/PLATFORM_IDENTITY_CURRENT_CONSUMER_MATRIX_2026-08-09.md
docs/operations/platform-identity/RBR-IDENTITY-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
docs/reconstruction/PLATFORM_IDENTITY_CURRENT_SURFACE_VALIDATION_2026-08-09.md
docs/runbooks/PLATFORM_IDENTITY_CURRENT_SOURCE_ADDENDUM.md
docs/wiki/internal/PLATFORM_IDENTITY_CURRENT_SOURCE_ADDENDUM.md
docs/reconstruction/HIGH_RISK_PACKET_SOURCE_DRIFT_IDENTITY_CORRECTION_2026-08-09.md
docs/operations/changes/2026-08-09-platform-identity-current-consumer-refresh-handover.md
Current Authorization action surface¶
docs/reconstruction/PLATFORM_AUTHORIZATION_CURRENT_SURFACE_REFRESH_2026-08-08.md
docs/processes/PLATFORM_AUTHORIZATION_CURRENT_ACTION_MATRIX_2026-08-08.md
docs/operations/platform-access/RBR-ACCESS-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
docs/reconstruction/PLATFORM_AUTHORIZATION_CURRENT_SURFACE_VALIDATION_2026-08-08.md
docs/runbooks/PLATFORM_ACCESS_DIAGNOSTICS_CURRENT_SURFACE_ADDENDUM.md
docs/wiki/internal/PLATFORM_ACCESS_CURRENT_SURFACE_WIKI_ADDENDUM.md
docs/operations/changes/2026-08-08-platform-authorization-current-surface-refresh-handover.md
6. Documentation Readiness Disposition¶
Identity/session core source:
CURRENT / STATICALLY REVALIDATED
Current Identity consumer surface:
SOURCE-RECONCILED INPUT
Authorization foundation:
DETAILED INPUT
Current reviewed action surface:
SOURCE-RECONCILED INPUT
Read-only Identity evidence package:
DEFINED / STATIC VALIDATION PASS
Read-only Access evidence package:
DEFINED / STATIC VALIDATION PASS
Policy decisions:
OPEN / PARTIAL
Current tenant/role/session/record evidence:
NOT RUN
Current Wiki content:
NOT READ
Implementation activation:
NO — PHASE HOLD
Migration readiness:
NOT M4
7. Stop Conditions¶
Do not begin a selected implementation wave while any of the following remains unresolved for that scope:
- actor/subject/tenant ambiguity;
- unknown authoritative session owner;
- missing rollback from PHP/Next.js coexistence;
- active username namespace ambiguity;
- unlisted direct/legacy caller;
- no Client 1 valid-action evidence;
- no selected Client 2 expected matrix;
- undefined privileged-action/reauth policy;
- undefined semantic action;
- undefined record tenant/relation predicate;
- page/UI numeric rule and API role-name rule are unreconciled;
- access policy duplicates business-state authority;
- unknown compatibility behavior would change live access;
- Wiki/admin procedure describes target behavior as current.
8. Next Documentation Wave¶
Deployment / Runtime identity and evidence-package refinement
That wave should update deployed source/config/schema/service identity and backup/restore evidence definitions without changing services or infrastructure.
---¶
Source:
docs/reconstruction/SYSTEM_RECONSTRUCTION_COVERAGE_MATRIX_IDENTITY_ACCESS_WAVE.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.