Story: Clean ores.iam to the component clean standard
Table of Contents
This page documents a story in Sprint 26. It captures the goal, current status, acceptance criteria, and the tasks that compose it.
1. Goal
ores.iam meets the Component Clean Standard: every item: All, Protocol and Entity pass, each item that does not apply is recorded with its reason, and ores.iam joins COMPONENTS_UNDER_TEST. Order 23 of 35 in the sprint 26 component clean-up, tier 3 (domain component).
2. Status
| Field | Value |
|---|---|
| State | DONE |
| Parent sprint | Sprint 26 |
| Now | Nothing. |
| Waiting on | Nothing. |
| Next | None. |
| Last touched | 2026-09-27 |
3. Acceptance
- Every checklist item that applies to a component of kind Entity passes, with its evidence recorded on the task.
- Every item that does not apply is recorded as not applicable, with the reason.
- Every generator defect found is fixed at its source, with a regression test.
- ores.iam is listed in
COMPONENTS_UNDER_TEST, andcheck_component_drift.py --allpasses.
4. Tasks
| Task | State | Start | End | Description |
|---|---|---|---|---|
| Bring ores.iam to the clean standard | DONE | 2026-09-26 | 2026-09-27 | Work ores.iam through the Component Clean Standard in order and record each item. |
| Fix the defects the ores.iam clean-up found | DONE | 2026-09-26 | 2026-09-27 | Task for: Clean ores.iam to the component clean standard |
| Fix the security defects the ores.iam clean-up recorded | DONE | 2026-09-27 | 2026-09-27 | Close the five recorded ores.iam security defects so the component's clean-standard registry entry rests on a true record: unguarded role assignment and account and login reads, credential fields on the wire, change-password ignoring the current password, the unguarded system-tenant delete, and unenforced tenant suspension. |
5. Notes
- Survey on 2026-09-23: 20 entity, junction or operation models; 392 C++ files outside tests, 297 of them generated (75%); 68 messaging headers, 11 of them hand-written.
- The reference component: the standard was written from its sprint 25 work, and it is the only component under test. Verify it against every item and record the result, so the standard is proved on the component it came from.
6. Decisions
- The component stays listed in
COMPONENTS_UNDER_TEST, with four accepted exceptions: P01, P04, S01 and V08, each recorded inACCEPTED_EXCEPTIONSwith its reason and the date it was accepted. Withdrawing the entry until they close would switch the gates off for a 429-file component, and every one of the four is recorded rather than omitted. The security defects the same review found are closed, not excepted, by #2256.
7. Out of scope
8. Result
Closed. The clean-up, the defects it recorded and the security defects the same review found are all closed.