docs(identity): record that the welcome mail is proven, so 6f is unblocked - #405
Merged
Conversation
…ocked Section 1.4 still said 6f cannot retire Authelia until the fallback alert has stopped firing for a real member join. That happened on 2026-08-21: a member new to authentik joined through Wizarr, the state file recorded welcome_sent_via authentik, 61 seconds from redemption to mail, no fallback and no alert. Left as it was, the next person reads a blocker that no longer exists and either waits for something that already happened or goes looking for evidence that is three documents away. Also names what the two failed attempts cost, because that is the part worth carrying: the endpoint the mail obviously wants needs a permission that also lets the holder take over the operator account, and the LDAP sync cannot be triggered by any scoped token at all. The remaining condition for 6f is the week of quiet 6e, which is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Section 1.4 still carried a blocker that was cleared today.
What it said
What happened
2026-08-21: a member new to authentik joined through Wizarr.
State file:
welcome_sent_via: authentik. 61 seconds from redemption to mail, no fallback, no alert.Left alone, the next person reads a blocker that no longer exists and either waits for something that already happened or goes hunting for the evidence across three documents.
Why the wording matters beyond the status flip
The two failed attempts before it are the part worth carrying forward, so the paragraph names them rather than just declaring success:
recovery_email) needs a permission that also lets its holder take over the operator accountBoth were shipped as "verified" first, and both survived because they were proven against an account that already existed in authentik. Only a genuinely new member exercises the sync path. That is now stated in
identity/README.mdas a constraint on how this gets tested, not just as history.What is actually left before 6f
The week of quiet 6e, unchanged, plus the
6f-preWizarr sweep added in #403. Neither is affected by this.Gates
check-doc-links.sh, pre-commit incl. gitleaks. Documentation only.