Real Accountly/Kill Bill validation, dedicated billing tenants and guided lost-key replacement. Live payment and hardware-custody limits remain explicit.
Round 7 follow-up focused on Accountly, as requested, and device-bound key-loss recovery. A real deployed Accountly/Kill Bill contract passed locally. The wallet now guides replacement and issuer reissuance while refusing old-holder presentation. Half-point gains reflect the completed recovery UX and additional provider-contract evidence; they do not imply private-key reconstruction, hosted staging or payment settlement validation.
Scores are engineering judgments against the same 30/25/20/15/10 rubric. They are not percentages of bug-free code or a security certification. Historical scores are preserved.
Category
Maximum
TrustWeave
SaaS
Security
30
29
29
Correctness
25
24
24.5
Architecture
20
19
19
Testing
15
15
14
Experience
10
10
9.5
Remaining deductions
trustweave
Security -1: browser custody lacks hardware/user-presence signing and remains exposed to trusted-bundle compromise.
Correctness -1: issuer/disclosure profiles and hosted provider behavior remain limited or unvalidated.
Architecture -1: provider maturity and legacy storage boundaries remain uneven.
Experience: the remaining half-point is restored for the verified, explicit replacement-identity/reissuance flow. Lost key reconstruction and hardware signing remain security/product-profile limits, not claimed capabilities.
Testing receives full local-validation credit for the full JVM suite, lint, database/HTTP contracts and production browser regressions. This does not certify optional hosted providers; those limitations remain in correctness/architecture.
trustweave-saas
Security -1: SDK pin is repaired locally, but publication, exact-pair remote Linux CI and staging failure-boundary evidence remain outstanding.
Correctness -0.5: application/tenant/subscriber/payment-metadata contracts passed against real Accountly/Kill Bill; PSP setup, paid subscriptions, settlement and production service-account authentication remain unvalidated.
Architecture -1: release coupling and hosted recovery/alert integration remain outstanding.
Testing -1: two live-contract skips and no exact-pair remote Linux/staging evidence.
Experience -0.5: admins can inspect and page through recovery events without database/payload access; live provider redelivery still requires manual operations, and supported credential formats remain limited.
Validation evidence
Area
Result
Scope and limits
Wallet unit tests
37 passed
Four new lost-key regressions plus earlier custody, restore and import tests.
Production wallet
Build/TypeScript passed; 11 Chromium tests passed
New lost-key UI flow, preserved records and replacement identity; prior camera/CSP/import/export tests remain green.
Deployed Accountly contract
1 deployed test passed; 13 tests passed in its combined run
Local Accountly and real Kill Bill; two new applications across initial failed attempt and final run were cleaned up. No payment requests. See provider-environment.json.
Accountly regression suite
94 reported: 91 passed, 3 opt-in skipped; no failures/errors
The deployed test skipped here was separately run successfully. The original PSP-stand-in pair remains skipped. These counts overlap the combined run; do not add them.
Prior evidence
SDK broad JVM/lint and SaaS frontend evidence retained
No new full-server coverage gate, full SDK suite or SaaS frontend rerun. Targeted backend runs exclude the whole-server coverage threshold.
Deployment limitations
Explicit shared-tenant migration may be required
Do not bypass Accountly migration refusal. Hosted staging, service credentials, paid-tier catalog/PSP operation and production key custody remain open.
Results distinguish local database/HTTP fixtures from hosted-service validation. Optional tests that did not run remain reported as skips. Timing excludes fixture setup.
Lost-key replacement preserves credentials and requires issuer reissuance
A specifically missing device key enables an explicitly confirmed replacement identity. Existing credentials are retained and labelled for reissuance. Healthy keys, malformed identity data and storage errors do not trigger automatic rotation. The page explains issuer contact, identity checking and revocation/reissuance steps. Presentation rejects old-holder credentials.
Evidence: 37 wallet unit tests and 11 production Chromium tests passed. New checks cover old-record retention, rejection of old-holder presentation, new-holder issuance/presentation, healthy-key refusal, failed metadata commit, competing replacement attempts and the real recovery UI.
Limit: This creates a new identity; it does not reconstruct the missing private key, recover encrypted claims, or revoke old credentials. Issuers must independently verify and reissue. An interrupted metadata commit may leave an unused IndexedDB key; old identity and credential data remain intact.
Added and executed an opt-in contract against the running local Accountly service using real Keycloak authentication and real Kill Bill. It creates a temporary application, provisions a dedicated tenant twice safely, provisions a subscriber, reads plans/payment metadata, verifies the cardholder-data guard and deletes the application.
Evidence: The deployed-provider test passed in a 13-test run with client/catalog regressions. The broader Accountly suite also passed: 94 tests reported, 91 passed and three opt-in skips. The deployed-provider test is among those skips in the separate environment-free run but was executed successfully with credentials in the dedicated run.
Limit: Local deployed services, not hosted staging. The run uses an owner JWT, not production service-token acquisition. No PSP configuration, card collection, paid subscription or payment occurs. Kill Bill can retain closed account/tenant metadata after Accountly application cleanup.
The initial real-provider attempt exposed fallback to the shared Kill Bill tenant. SaaS now checks/provisions a dedicated application tenant before reconciling plans. A conflict is accepted only if a fresh status read confirms a dedicated tenant; a shared-tenant migration refusal stops catalog writes.
Evidence: Actual dedicated-tenant provisioning and repeat-call safety passed. Unit regressions cover already-dedicated status, provisioning, refusing shared responses, and preventing catalog writes after a migration conflict.
Limit: Existing applications with linked shared-tenant subscribers need an explicit migration. Configure the dedicated catalog, PSP and notifications before paid tiers. The initial subscriber request exceeded 20 seconds; the passing retry is not a latency SLA.
Issuer-assisted replacement now has a tested workflow. Missing private keys cannot be reconstructed; hardware/user-presence signing and most non-Accountly provider profiles remain unassessed.
Evidence: 37 wallet unit and 11 browser tests passed in Round 7. No hardware or external cloud validation is claimed.
Limit: A complete product/profile definition and supported provider matrix are needed before these deductions can be closed.
Real local Accountly/Kill Bill application, tenant, subscriber and payment-metadata behavior is now verified. External PSP setup/collection, settlement, service-account authentication, hosted alerts and the supported legacy Stripe cutover still require validation.
Evidence: Dedicated deployed contract passed. Original two Accountly tests requiring the PSP stand-in remain unexecuted in this pass.
Limit: The supported Accountly cutover/legacy Stripe workflow needs to be defined and exercised before claiming completeness.
docs/round-7-operations.md covers the deployed Accountly contract, cleanup boundaries, shared-tenant migration and lost-key replacement. Staging environment and release-branch details were requested during this pass and remain prerequisites for external release checks.