[jeremi]

What changed and why

The optional eSignet profile ran the Java eSignet authenticator 0.2.0 against the NIA Relay. eSignet is now built and deployed elsewhere as the 2.0 Go line with a native authenticator, so this profile no longer shows how eSignet is used. The portal keeps only its mock login.

Removed

• The local and Coolify eSignet compose profiles, the four eSignet images and their release-candidate builds.
• The portal OIDC code and its settings. PORTAL_AUTH_PROVIDER is gone too, because only the eSignet code read it; the portal login is now always the mock persona login.
• The nia-esignet Mint client: its generated key, its hosted provisioning input, its Bruno request and its public key in the published Relay workload JWKS.
• The authenticator pins, the eSignet just recipes and smoke scripts, and the Visitor Center eSignet status entry.

Kept

• The NIA Relay project and its esignet-userinfo lookup. The Relay is one of the five Relays in the base and hosted topologies and is a governed, compiled package; renaming the lookup needs relay-check, which this change did not run. Nothing calls the lookup now, and the README and docs say so.

Tests

• New portal/src/routes/auth/auth.test.ts covers the mock login, the persona hint and the fallback for an unknown persona.
• The topology, image pin, secrets, hosted manifest and provisioning tests now assert the mock-only shape, including that no eSignet compose file, PORTAL_ESIGNET_* or PORTAL_AUTH_* setting remains.

Checks run

All passed before and after unless noted:

• ruff, check-fiction.sh, check-config-secrets.py, check-image-pins.py, hosted-image-manifest.py inventory, check-runtime-topology.py, check-registry-stack-release-pin.py, check-signer-public-keys.py.
• just metadata-publish-check and metadata-lint.py, including after the JWKS change.
• check-hosted-compose.sh, check-coolify-compose.sh, and the static docker compose config step of just compose.
• Portal: pnpm check (0 errors), pnpm test (144 tests), pnpm build, and Playwright e2e 8 of 8 (run after the change only).
• Home: pnpm check (0 errors), pnpm test (62 tests).
• Generator and scenario-runner tests.
• The root unittest list from the justfile: 239 tests, with one failure that is already on main: test_smoke_programme_acceptance fails on ResourceWarning text from the generator on stderr.

Not run: relay-check and evidence-check (they need Docker and relayctl; the unit tests covering build-cells.py pass), the home live e2e against a full stack (it now expects 17 status entries, all up), the release-candidate workflow and the image builds.

After merge

A hosted environment that still sets PORTAL_AUTH_PROVIDER or PORTAL_ESIGNET_* now ignores them; those variables, the old eSignet images and the eSignet secrets can be removed from it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T17:39:25.038795Z	bd408d6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.