Record deployed personal app and remaining Authelia credential rejection
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
This commit is contained in:
parent
b8253c4e3b
commit
1272c699b0
8 changed files with 182 additions and 18 deletions
17
SCOPE.md
17
SCOPE.md
|
|
@ -61,13 +61,16 @@ The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until
|
|||
an explicit cutover. Historical identity/app-shell evidence is in
|
||||
[identity smoke](docs/identity/smoke.md). Public registration was evidenced on
|
||||
2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration,
|
||||
persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm
|
||||
an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence.
|
||||
Personal sign-in is broken: the user reports unknown client_id, and guarded
|
||||
inspection confirms the public coulomb-social OIDC client is absent. The latest
|
||||
88-test app image and persistent chart upgrade are prepared, not deployed;
|
||||
[release assessment](docs/release/personal-account-2026-10-06.md) documents the
|
||||
exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished;
|
||||
live product acceptance. On 2026-10-06, founder-approved Helm revision 10 deployed
|
||||
the tested app (source ac7bac1852c9, chart 0.2.0, digest pinned) with a retained
|
||||
2Gi CONTENT_ROOT PVC and one writer/Recreate. OIDC client registration was restored
|
||||
and KeyCape restarted; authorization now hands off to Authelia. Public health,
|
||||
clipboard asset delivery, zero pending migrations and content restart durability
|
||||
passed. Interactive tegwick sign-in remains blocked: Authelia rejects the attempted
|
||||
credentials although a read-only directory check confirms the account exists.
|
||||
Real-use-case acceptance remains pending;
|
||||
[deployment receipt](docs/release/personal-account-deployed-2026-10-06.md) records
|
||||
exact evidence and gaps. All six original numbered workplans are finished;
|
||||
their residual intakes remain the source of unfinished work.
|
||||
|
||||
## Ownership boundaries
|
||||
|
|
|
|||
|
|
@ -51,8 +51,8 @@ See `.env.example`. Summary:
|
|||
|
||||
### Platform OIDC (KeyCape)
|
||||
|
||||
Historical client registration has drifted: guarded inspection on 2026-10-06
|
||||
finds it absent. Inspect through the safe owner wrapper (read-only default):
|
||||
The missing historical client registration was restored with founder approval
|
||||
on 2026-10-06. Inspect through the safe owner wrapper (read-only default):
|
||||
|
||||
```bash
|
||||
./scripts/register-keycape-client.sh
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
|
|||
| Environment | Issuer mode | Registered |
|
||||
|-------------|-------------|------------|
|
||||
| local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
|
||||
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 |
|
||||
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **restored** (founder-approved guarded repair 2026-10-06; interactive acceptance pending) |
|
||||
| key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
|
||||
|
||||
### Historical verification (2026-08-09)
|
||||
|
|
@ -61,3 +61,11 @@ founder approval; the wrapper never restarts the issuer automatically.
|
|||
|
||||
See [release review](../release/personal-account-2026-10-06.md) and
|
||||
[ordinary-session assurance close-down](../security-close-down-checklist.md).
|
||||
|
||||
### Deployed repair — 2026-10-06
|
||||
|
||||
Founder approved the exact repair. Guarded CAS/readback succeeded; KeyCape
|
||||
restart completed. Discovery returns 200 and authorization hands off to Authelia
|
||||
with 302, without the missing-client error. The upgraded app emits the correct
|
||||
client ID, callback and S256 PKCE challenge. Interactive tegwick login remains
|
||||
pending the user's confirmation. See docs/release/personal-account-deployed-2026-10-06.md.
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
# Personal Coulomb account release — 2026-10-06
|
||||
|
||||
CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
|
||||
No live mutation has been performed. Prepared code, image and review branch are
|
||||
ready; the personal account is not yet usable through this app.
|
||||
CSOC-WP-0008 · RAPPS-WP-0015 · founder-approved decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
|
||||
The founder approved this proposal and it was deployed as Helm revision 10.
|
||||
See [deployment receipt](personal-account-deployed-2026-10-06.md). Interactive
|
||||
tegwick sign-in remains pending user confirmation. The sections below preserve
|
||||
the reviewed pre-change state and execution proposal.
|
||||
|
||||
## What is running
|
||||
|
||||
|
|
@ -105,7 +107,7 @@ Bubble exit/apex cutover or real-data import is included in this live approval.
|
|||
## Review artifacts
|
||||
|
||||
Application source is committed to coulomb-social main. Deployment changes are on
|
||||
railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
|
||||
railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), approved, merged into main and deployed:
|
||||
https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
|
||||
|
||||
Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
|
||||
|
|
|
|||
59
docs/release/personal-account-deployed-2026-10-06.md
Normal file
59
docs/release/personal-account-deployed-2026-10-06.md
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# Personal app deployment receipt — 2026-10-06
|
||||
|
||||
Founder explicitly approved: “Go on and deploy the interruption is not a problem.”
|
||||
Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
Decision 8bbce691-a787-4140-9cd4-df06e8635a27 records that human answer.
|
||||
|
||||
## Executed and verified
|
||||
|
||||
- Correct node: railiance01 / 92.205.62.239. Preflight CPU requests 3455m/4000m,
|
||||
disk free 123G. Reviewed owner helper hash unchanged; dry-runs/diffs refreshed.
|
||||
- Restored only historical public coulomb-social OIDC registration through guarded
|
||||
SSH/CAS owner lane. Secret UID retained; resourceVersion 67716615 → 71471711.
|
||||
Byte-preserving validation/readback confirmed unrelated config and Secret data
|
||||
unchanged. No Secret values or raw errors emitted. Restarted sso/keycape;
|
||||
rollout succeeded. Discovery 200; public /authorize probe 302 to Authelia,
|
||||
without unknown client_id. This is a handoff check, not a completed user login.
|
||||
- Fresh Backup databases/csoc-preupgrade-20261006145351 for apps-pg,
|
||||
method barmanObjectStore: completed, start 2026-10-06T14:54:22Z,
|
||||
stop 2026-10-06T14:54:31Z. Completed before app upgrade began.
|
||||
- Approved owner chart merged/pushed to railiance-apps main at 3f5a909.
|
||||
Helm upgrade executed from railiance01 with --atomic/--wait/5m timeout.
|
||||
Release coulomb-social revision 10 is deployed, chart 0.2.0, source ac7bac1852c9,
|
||||
digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
|
||||
- Retained local-path PVC coulomb-social-content is Bound, 2Gi/RWO; mounted at
|
||||
/app/var/content with CONTENT_ROOT matching. One replica/Recreate. App UID/GID
|
||||
10001; volume group 10001; write check passed. A dedicated synthetic marker
|
||||
survived a fresh pod restart and was removed afterward. No real content touched.
|
||||
- App 1/1 available after upgrade and restart. Zero pending Django migrations;
|
||||
existing tegwick Member retained (count one for tenant:coulomb and live issuer).
|
||||
- Public /healthz and landing: 200. Clipboard JS: 200, 2909 bytes, ClipboardItem
|
||||
present. /auth/login/: 302 to correct issuer/client/callback and PKCE S256.
|
||||
Anonymous /app/: 302, preserving authentication boundary.
|
||||
|
||||
## Remaining acceptance
|
||||
|
||||
The user has been asked to complete interactive tegwick sign-in. It is not yet
|
||||
confirmed. CSOC-WP-0008-T11 remains waiting for that result; T01 continues live
|
||||
product smoke/visual and permission acceptance. A DB backup plus persistent
|
||||
volume is not paired DB/content restore proof: T02 remains open. Real ReichelAg
|
||||
protocol reconciliation/import and manual mail-client paste remain T03/T09.
|
||||
No Bubble/apex cutover, real-data import, password change, broad grant or private
|
||||
protocol export was performed. RAPPS-WP-0015 remains active pending T04.
|
||||
|
||||
## User sign-in result — 2026-10-06
|
||||
|
||||
The user reaches auth.coulomb.social but tegwick is rejected as wrong username
|
||||
or password. Read-only directory query through the existing provisioner confirms
|
||||
tegwick is present. Live Authelia username attribute is uid; its lookup supports
|
||||
uid or mail. Contained recent-log inspection records a tegwick LDAP invalid-
|
||||
credentials failure, without backend connection error or regulation-ban evidence
|
||||
in that entry. This does not establish why the entered credential is rejected.
|
||||
|
||||
The app and client restoration are deployed, but personal sign-in is not accepted.
|
||||
CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a
|
||||
successful fresh sign-in. The user was asked whether the same password works on
|
||||
another service. No password was requested/read/exported or reset. Authelia's
|
||||
current notifier is filesystem rather than SMTP: do not promise emailed recovery
|
||||
or expose reset tokens from notification files. Any credential reset must use
|
||||
the owning attended recovery/setup lane under a separate exact approved change.
|
||||
|
|
@ -1,17 +1,17 @@
|
|||
# Coulomb sign-in close-down record
|
||||
|
||||
2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
|
||||
and coulomb-social (product assurance). Proposed repair, not yet activated.
|
||||
and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06.
|
||||
|
||||
The historical public authorization-code/PKCE client descriptor has
|
||||
`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
|
||||
Restoration would retain that historical policy, with no changes to other clients.
|
||||
Restoration retained that historical policy, with no changes to other clients.
|
||||
Before production approval, the owners must decide and verify whether ordinary
|
||||
personal sessions may remain AAL1, which actions require step-up, and that PKCE,
|
||||
exact callbacks and tenant checks are enforced by the running issuer/application.
|
||||
Do not treat successful discovery, synthetic tests or a registered Member as
|
||||
proof of interactive authentication. The live restoration requires founder go.
|
||||
proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending.
|
||||
|
||||
Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
|
||||
CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
|
||||
preparing this descriptor. No issuer policy has been loosened in this session.
|
||||
preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged.
|
||||
|
|
|
|||
59
history/20261006T145931Z-personal-app-deployment-receipt.md
Normal file
59
history/20261006T145931Z-personal-app-deployment-receipt.md
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# Personal app deployment receipt — 2026-10-06
|
||||
|
||||
Founder explicitly approved: “Go on and deploy the interruption is not a problem.”
|
||||
Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
|
||||
Decision 8bbce691-a787-4140-9cd4-df06e8635a27 records that human answer.
|
||||
|
||||
## Executed and verified
|
||||
|
||||
- Correct node: railiance01 / 92.205.62.239. Preflight CPU requests 3455m/4000m,
|
||||
disk free 123G. Reviewed owner helper hash unchanged; dry-runs/diffs refreshed.
|
||||
- Restored only historical public coulomb-social OIDC registration through guarded
|
||||
SSH/CAS owner lane. Secret UID retained; resourceVersion 67716615 → 71471711.
|
||||
Byte-preserving validation/readback confirmed unrelated config and Secret data
|
||||
unchanged. No Secret values or raw errors emitted. Restarted sso/keycape;
|
||||
rollout succeeded. Discovery 200; public /authorize probe 302 to Authelia,
|
||||
without unknown client_id. This is a handoff check, not a completed user login.
|
||||
- Fresh Backup databases/csoc-preupgrade-20261006145351 for apps-pg,
|
||||
method barmanObjectStore: completed, start 2026-10-06T14:54:22Z,
|
||||
stop 2026-10-06T14:54:31Z. Completed before app upgrade began.
|
||||
- Approved owner chart merged/pushed to railiance-apps main at 3f5a909.
|
||||
Helm upgrade executed from railiance01 with --atomic/--wait/5m timeout.
|
||||
Release coulomb-social revision 10 is deployed, chart 0.2.0, source ac7bac1852c9,
|
||||
digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
|
||||
- Retained local-path PVC coulomb-social-content is Bound, 2Gi/RWO; mounted at
|
||||
/app/var/content with CONTENT_ROOT matching. One replica/Recreate. App UID/GID
|
||||
10001; volume group 10001; write check passed. A dedicated synthetic marker
|
||||
survived a fresh pod restart and was removed afterward. No real content touched.
|
||||
- App 1/1 available after upgrade and restart. Zero pending Django migrations;
|
||||
existing tegwick Member retained (count one for tenant:coulomb and live issuer).
|
||||
- Public /healthz and landing: 200. Clipboard JS: 200, 2909 bytes, ClipboardItem
|
||||
present. /auth/login/: 302 to correct issuer/client/callback and PKCE S256.
|
||||
Anonymous /app/: 302, preserving authentication boundary.
|
||||
|
||||
## Remaining acceptance
|
||||
|
||||
The user has been asked to complete interactive tegwick sign-in. It is not yet
|
||||
confirmed. CSOC-WP-0008-T11 remains waiting for that result; T01 continues live
|
||||
product smoke/visual and permission acceptance. A DB backup plus persistent
|
||||
volume is not paired DB/content restore proof: T02 remains open. Real ReichelAg
|
||||
protocol reconciliation/import and manual mail-client paste remain T03/T09.
|
||||
No Bubble/apex cutover, real-data import, password change, broad grant or private
|
||||
protocol export was performed. RAPPS-WP-0015 remains active pending T04.
|
||||
|
||||
## User sign-in result — 2026-10-06
|
||||
|
||||
The user reaches auth.coulomb.social but tegwick is rejected as wrong username
|
||||
or password. Read-only directory query through the existing provisioner confirms
|
||||
tegwick is present. Live Authelia username attribute is uid; its lookup supports
|
||||
uid or mail. Contained recent-log inspection records a tegwick LDAP invalid-
|
||||
credentials failure, without backend connection error or regulation-ban evidence
|
||||
in that entry. This does not establish why the entered credential is rejected.
|
||||
|
||||
The app and client restoration are deployed, but personal sign-in is not accepted.
|
||||
CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a
|
||||
successful fresh sign-in. The user was asked whether the same password works on
|
||||
another service. No password was requested/read/exported or reset. Authelia's
|
||||
current notifier is filesystem rather than SMTP: do not promise emailed recovery
|
||||
or expose reset tokens from notification files. Any credential reset must use
|
||||
the owning attended recovery/setup lane under a separate exact approved change.
|
||||
|
|
@ -310,3 +310,36 @@ Prepared review: docs/release/personal-account-2026-10-06.md.
|
|||
Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27.
|
||||
Published image and owning chart prep complete; live approval and user acceptance
|
||||
remain pending. No productive data transferred.
|
||||
|
||||
## Deployment execution — 2026-10-06
|
||||
|
||||
Founder approved exact live changes (decision 8bbce691-a787-4140-9cd4-df06e8635a27).
|
||||
T11 registration restored through guarded CAS; shared KeyCape restart succeeded;
|
||||
authorization now hands off to Authelia. Interactive tegwick login confirmation
|
||||
still pending, so T11 remains wait. T01 app upgrade succeeded as Helm revision10,
|
||||
chart0.2.0/digest-pinned source ac7bac1852c9; retained2Gi content PVC bound,
|
||||
UID/GID10001 writable, zero pending migrations. Public health/clipboard/login
|
||||
handoff and dedicated synthetic-marker restart durability passed. Fresh apps-pg
|
||||
backup csoc-preupgrade-20261006145351 completed before migration.
|
||||
|
||||
Receipt: docs/release/personal-account-deployed-2026-10-06.md. T01 stays progress
|
||||
for live product/Visual/permission acceptance; T02 paired restore, T03 real cohort
|
||||
and T09 user/email walkthrough remain open. No real-data import or apex cutover.
|
||||
RAPPS-WP-0015 T03 deployment completes; T04 user acceptance remains open.
|
||||
|
||||
## User sign-in result — 2026-10-06
|
||||
|
||||
The user reaches auth.coulomb.social but tegwick is rejected as wrong username
|
||||
or password. Read-only directory query through the existing provisioner confirms
|
||||
tegwick is present. Live Authelia username attribute is uid; its lookup supports
|
||||
uid or mail. Contained recent-log inspection records a tegwick LDAP invalid-
|
||||
credentials failure, without backend connection error or regulation-ban evidence
|
||||
in that entry. This does not establish why the entered credential is rejected.
|
||||
|
||||
The app and client restoration are deployed, but personal sign-in is not accepted.
|
||||
CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a
|
||||
successful fresh sign-in. The user was asked whether the same password works on
|
||||
another service. No password was requested/read/exported or reset. Authelia's
|
||||
current notifier is filesystem rather than SMTP: do not promise emailed recovery
|
||||
or expose reset tokens from notification files. Any credential reset must use
|
||||
the owning attended recovery/setup lane under a separate exact approved change.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue