Two things, both found by checking the wave file before pushing rather than
assuming it was current.
First: most done-when boxes were still open even where the work had been
verified, which would have told a reviewer that almost nothing was checked.
Ticked the ones genuinely verified, each with what verified it, and left eight
open that are not. One box was not merely unticked but WRONG - it asked that
`create-admin` create an admin with no password prompt, and T10.9 removed that
command outright; restated as what now has to be true.
Second: two of the open boxes were safety-relevant and cheap to close, so
ldap_auth_check now covers them (24/24):
a disabled local account is refused 403 even though its bind succeeds -
local is_active overrides the directory, which is how access to THIS app is
revoked without touching the domain account
the throttle stops CALLING the directory, not merely refusing. Proved by
spending the attempt budget on wrong passwords and then presenting the
CORRECT one: a 429 for a credential that would otherwise succeed is only
possible if the check runs before the directory is consulted. Also asserts
the budget is per-username, so throttling one account does not throttle
everyone.
That was the last untested safety-critical behaviour on the branch. It is the
thing standing between an unauthenticated caller and locking colleagues out of
Windows, and until now nothing exercised it.
Also recorded a deployment fact at the top of wave-10 where it cannot be missed:
LDAP_REQUIRED_GROUP is empty, and empty means no group gate - every account in
prime.local may sign in. The live sign-in that confirmed this branch works was
made without it, so it proved the bind, the certificate chain and provisioning,
but not the group check. That path has still never run against the real
directory.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Cody Schaefer
24fff382c8