Enrich administrative profiles from SGU

docs/architecture.md

@@ -25,8 +25,12 @@ returns the NTLM challenge without waiting for the slow application pages. A
 `401` or `403` rejects the credential; an allowed `2xx` or `3xx` proves that IIS
 accepted it. The broker then makes a separately bounded, best-effort GET to the
 administrative incident overview for `AD`, the student information page for
-`AL`, or the portal menu for `DO`. A profile timeout does not invalidate an
-already authenticated credential. NTLM may still require its normal
+`AL`, or the portal menu for `DO`. After the incident page confirms an `AD`
+employee number, two additional GETs in the same in-memory session read the
+structured name from `datos/personales.aspx` and the address from
+`datos/ubicacion.aspx`. A supplemental failure preserves fields already
+collected, and a profile timeout does not invalidate an already authenticated
+credential. NTLM may still require its normal
 challenge/response round trips on the connection. Transient portal cookies are
 kept only in an in-memory per-request container and are never persisted or
 returned to the client.
@@ -54,8 +58,9 @@ When the authenticated HTML exposes recognized stable IDs, the broker also
 updates the applicable `displayName`, `givenName`, `sn`, `mail`, `title`,
 `department`, `employeeType`, `employeeID`, `streetAddress`, `l`, `st`, and
 `postalCode` attributes. Administrative and student numbers must match the six
-numeric digits of the requested identity before any scraped metadata is
-trusted. Student faculty/department is deliberately left unset because the
+numeric digits of the requested identity before any role-specific metadata is
+trusted. Administrative personal and location pages are accepted only after
+that incident-page match. Student faculty/department is deliberately left unset because the
 verified page does not expose it. Missing metadata does not clear existing AD
 values and never changes the password outcome.