# Journey result: Tenant SSO config (SAML/OIDC + claim mapping)

- **Walked**: 2026-05-29 by Claude (Opus 4.8) against commit `bf12b0f7d8`
- **Verdict**: **pass (operator SSO view) / out-of-scope (IdP config)** —
  `/operator/sso` renders the connections view.
- **Walker**:
  `/tmp/claude-oshun-lt-2-walkthrough/walk.mjs tenant-sso-config-saml-oidc-claim-mapping`

## Observations

- `/operator/sso` → 200 (authed); active/pending colour coding, IdP metadata
  URL, last-sync timestamp (Oxbow SAML/active + Redbird OIDC/pending) — rebuilt
  goal `9ba3d0823d`; prior 404 **fixed**.
- 0 page errors, 0 persistent failures.

## Out of scope

- Configuring a real SAML/OIDC connection + claim mapping (IdP round-trip) is a
  tenant-admin app concern + external IdP dependency; the operator SSO status
  view in this shell is verified.

## Durability addendum — 2026-07-20

- **Source commit**: `257b390ac439866669a9952bde1c2be57d7f4975`
- **Verdict**: **pass (tenant SSO configuration durability and recovery)**
- The detached best-effort snapshot write was replaced by a serialized
  candidate/save/publish queue. Create, import, update, and delete now
  acknowledge only after the primary snapshot commits; a failed write returns
  stable `503`, preserves the prior live state, and emits no success audit
  event.
- Production boot now requires and hydrates the durable snapshot before serving
  traffic. Restore rejects malformed, duplicate, over-limit, and noncanonical
  schema-v1 state; bounded legacy state migrates to the canonical schema.
- Store, route, and connection-probe tests passed 47/47. Real PostgreSQL
  restart/migration/CRUD proof passed 1/1. The eight cases in
  `tenant-sso-crud-bff.spec.ts` passed over real HTTP against an isolated
  current-source BFF, fresh migrated PostgreSQL database, and durable Redis.
- The zero-backlog BFF type ratchet, ESLint, direct esbuild package build, and
  emitted production-artifact startup/health/shutdown smoke gate passed.

This addendum verifies local SAML/OIDC configuration import and probes, not a
live external identity-provider round trip. It does not add SAML member login,
IdP-initiated login, distributed compare-and-swap across BFF replicas, or a
tenant auth-policy editor. The separate OIDC callback journey and its existing
tests remain the authority for signed-token member login.