skillhub/openspec/changes/enterprise-identity-platform/tasks.md

1. Release boundary and architecture

• 1.1 Freeze Release 1 as unified identity core, minimal Organization boundary and dynamic OIDC only.
• 1.2 Explicitly exclude SAML, CAS, LDAP login, Identity Link, Account Merge, Directory/SCIM and Namespace entitlement automation.
• 1.3 Add an automated architecture check that keeps protocol types out of organization/directory/entitlement domain packages and prevents adapters from owning identity decisions.
• 1.4 Define the staged rollout and non-destructive rollback order.

2. Organization security boundary

• 2.1 Add Organization, verified domain, Membership and role-binding models with tenant-scoped uniqueness and optimistic locking.
• 2.2 Implement Organization and Membership lifecycle guards with authority-version increments only on effective state changes.
• 2.3 Separate platform Organization creation from tenant administration; verify platform roles do not bypass Organization membership.
• 2.4 Implement stable, bounded Organization/member/domain/role list and management APIs.
• 2.5 Record allowlisted, redacted audit events for Organization administration.
• 2.6 Add minimal Organization and member/domain administration pages without Namespace mapping or directory controls; member-only organizations are listed without a management-detail entry.

3. Unified identity and compatibility

• 3.1 Define versioned Adapter descriptors, interaction models, normalized assertions and standard failure taxonomy.
• 3.2 Implement the single identity decision module for binding, pre-provisioned subject, verified-email correlation, JIT and account/membership guards.
• 3.3 Persist External Identity V2 and pre-provisioned immutable subjects with concurrency-safe uniqueness.
• 3.4 Implement field-authority-aware profile resolution and block unverified email from trusted fields.
• 3.5 Persist enterprise session origin using a one-way session-key digest and Organization/Membership authority versions.
• 3.6 Recheck enterprise authority before Device Flow redemption and enterprise-resource access.
• 3.7 Route legacy public OAuth facts through the unified core decision gate while preserving LEGACY/SHADOW compatibility and legacy binding persistence.
• 3.8 Keep legacy public OAuth bindings authoritative in R1-A; fail closed on ACTIVE unified-core Denied/Conflict before active or pending legacy writes.

4. Login Connection and dynamic OIDC

• 4.1 Implement immutable Login Connection revisions, lifecycle rules, test-before-activate and runtime snapshot materialization.
• 4.2 Encrypt client secrets separately from typed configuration and expose only redacted secret summaries.
• 4.3 Implement secure OIDC discovery/JWKS retrieval with outbound target, redirect, timeout and body-size controls.
• 4.4 Implement one-time OIDC authorization transactions bound to state, nonce, PKCE, connection revision, browser and configured callback origin.
• 4.5 Validate token endpoint response and ID Token issuer, algorithm, signature, key, audience/azp, expiry, issued-at and nonce.
• 4.6 Implement enumeration-resistant login discovery plus anonymous start/callback endpoints using opaque public handles.
• 4.7 Make dynamic OIDC default-off and require both the global switch and Organization allowlist.
• 4.8 Add bounded anonymous rate limits and redact all query values and authentication secrets from logs/errors.
• 4.9 Implement Organization Login Connection management UI and API for create, revision, test, activate, suspend and disable.

5. Database and contract convergence

• 5.1 Place enterprise authentication migrations at V54–V60 after main's Skill Suites V49–V53 migrations.
• 5.2 Add migration guardrails for immutable released migrations, legacy backfill safety and required uniqueness constraints.
• 5.3 Run empty-database migration from V1 through V60 using the exact candidate image.
• 5.4 Run upgrade migration from a main/V53 database through V60 and verify public OAuth legacy bindings remain the runtime write authority; V60 V2 shadow backfill is only a consistency and rollback aid.
• 5.5 Regenerate checked-in OpenAPI types from the candidate source and prove no uncommitted generated diff remains.

6. Source verification

• 6.1 Pass strict OpenSpec validation for this three-capability release scope.
• 6.2 Pass enterprise architecture check and its negative self-test fixtures.
• 6.3 Pass targeted migration, connection, controller, association, session, logging and rate-limit tests.
• 6.4 Pass full backend test suite from a clean candidate worktree.
• 6.5 Pass Web typecheck, lint and unit tests.
• 6.6 Pass generated OpenAPI freshness and repository diff/secret scans.

7. Exact-SHA runtime acceptance

• 7.1 Freeze the candidate SHA and build backend/frontend images only from that SHA; record image digests.
• 7.2 Start a resource-bounded isolated OIDC reference lab with PostgreSQL and Redis and prove health/readiness.
• 7.3 Prove existing local/OAuth configuration, CLI Device Flow and API Token compatibility with enterprise OIDC disabled.
• 7.4 Prove discovery, redirect, IdP authentication, callback, first association, repeat login and logout in a real Windows browser.
• 7.5 Prove invalid state/nonce/signature/audience/issuer, callback replay, cross-Organization subject collision and unsafe return targets fail closed.
• 7.6 Prove member/Organization/connection suspension rejects stale enterprise access without waiting for session expiry.
• 7.7 Prove logs and generated reports contain no token, authorization code, state, nonce, client secret, cookie or test password.
• 7.8 Exercise allowlist removal, enterprise OIDC disable and identity-core LEGACY rollback in order.
• 7.9 Stop the lab and prove containers, temporary networks, volumes, credentials and browser artifacts are cleaned.
• 7.10 Produce one exact-SHA readiness report; only then request permission to push or create a PR.

8. Configuration-driven dedicated login page (local review)

• 8.1 Replace embedded login card with a dedicated responsive split-screen shell.
• 8.2 Advertise enterprise discovery using existing OIDC switches, allowlist and ACTIVE identity core.
• 8.3 Render only configured methods and mutually exclusive enterprise/account panels; preserve existing direct-password/bootstrap integration.
• 8.4 Test configuration combinations, catalog loading/error/empty states, validation, retained input and discovery request errors.
• 8.5 Pass targeted backend tests, frontend checks and OpenSpec/architecture validation.
• 8.6 Complete final Windows Chrome desktop/mobile interaction and visual review.
• 8.7 Obtain user acceptance and repeat exact-SHA release checks after committing the approved UI; no PR/push authorization is implied.
• 8.8 Rotate the authorized review lab credentials, certificates and disposable test data without touching other projects.
• 8.9 Replace accordion interaction with segmented entry switching and shared registration shell; retain existing registration validation/API.
• 8.10 Recheck laptop/short-screen/mobile layouts, fixed brand position, discovery redirect and full frontend regression for the revised interaction.
• 8.11 Compact login controls after user feedback and prove the right main does not overflow at ordinary/scaled desktop sizes; retain short-screen scrolling.
• 8.12 Preserve the login source and default successful authentication to homepage; test catalog-driven public providers independently of enterprise discovery. Real vendor authentication remains a separate credential-dependent acceptance check.

9. Public Provider Adapter follow-ups

• 9.1 Document provider protocol versus login context as a first-class architecture boundary: public provider login must not create Organization Membership, enterprise session origin, or Namespace permissions.
• 9.2 Route GitHub/GitLab public OAuth through the unified identity core decision gate while retaining legacy identity_binding persistence.
  • 9.2.1 Make ACTIVE public OAuth fail closed on unified-core Denied/Conflict before creating active or pending legacy bindings; LEGACY and SHADOW keep existing behavior.
  • 9.2.2 Optional follow-up: evaluate whether platform-scoped public OAuth should switch runtime write authority to V2 after R1-A is stable; do not block unified authentication rollout on this cutover.
• 9.3 Rework the Feishu PR as a public Provider Adapter first, with stable subject, verified email semantics, catalog rendering, real login validation, and no enterprise side effects.
• 9.4 Rework the DingTalk PR as a public Provider Adapter first; define a stable primary subject and explicit alias/migration policy before any merge.
• 9.5 Add a repeatable public-provider acceptance path using real vendor test credentials or an explicit reference service for each provider; mocked catalog buttons only prove presentation and navigation.
• 9.6 Add enterprise Feishu/DingTalk Login Connection adapters only after public-provider behavior is stable, reusing protocol code but adding Organization/LoginConnection context and enterprise session guards.