I1208 — Adding a provider is one file, removing one is one deletion, and both are executed rather than described
Document how a provider is added and how one is struck, and make the documentation executable: a test that adds a synthetic provider object and asserts it appears in the sign-in offer, in the capability read, in the generated documentation and in the Cockpit with no other edit, and a test that removes one of the two shipped objects and asserts every one of those surfaces loses it.
BLOCKED wave 6 · p1 · implementation profile · runs alone
Part of web-sign-in — The deployed surfaces know who is asking, and the identity providers are data.
Blocked. This issue cannot start until I1202, I1206 are done. The status is derived from that, not declared.
Objective
Document how a provider is added and how one is struck, and make the documentation executable: a test that adds a synthetic provider object and asserts it appears in the sign-in offer, in the capability read, in the generated documentation and in the Cockpit with no other edit, and a test that removes one of the two shipped objects and asserts every one of those surfaces loses it.
Why
The operator has said the first two providers may both be struck once the audience is known. That is the operation this milestone must make cheap, and the only proof it is cheap is a test that performs it.
Current state
Nothing is documented and nothing performs the lifecycle.
Desired state
The add and the remove are both proved by tests, and the documentation states the one-file operation because a test executes it.
Scope
- docs
- site
- apps/majordomus-cli/tests
- test/cases
- .ai/repo/rules/project
Out of scope
- A migration path for sessions issued by a provider that has been struck, beyond revoking them
Dependencies
- I1202BLOCKED One typed provider model reads the objects, and no code names a provider
- I1206BLOCKED What an anonymous reader may do is derived from the effect classification, not from a list
Acceptance criteria
- A synthetic provider dropped into the directory appears on every applicable surface with no source edit, proved by a test
- Removing a provider object removes it from every surface, and sessions pinned to that issuer are refused
- The documentation names the file to write and the file to delete, and cites the tests that execute both
- A rule states that a provider fact may not be stated outside its object, with a check CI executes
Validation
- bash test/run.sh
- cargo test --workspace --all-features
- majordomus generate --check
Evidence required
- add_proved
- remove_proved
- rule_enforced
Evidence
None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.
Risk
The removal half is the half that is skipped, and it is the half the operator asked for.
Timeline
- started
- —
- verified
- —
- completed
- —
Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.
Canonical record: .ai/repo/project/issues/I1208.yaml. Read it back with majordomus plan show I1208.