From 1272c699b027a2dce89e4766c19199ceed94d1bf Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 17:02:16 +0200 Subject: [PATCH] Record deployed personal app and remaining Authelia credential rejection Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- SCOPE.md | 17 +++--- docs/dev.md | 4 +- docs/identity/oidc-client.md | 10 +++- docs/release/personal-account-2026-10-06.md | 10 ++-- .../personal-account-deployed-2026-10-06.md | 59 +++++++++++++++++++ docs/security-close-down-checklist.md | 8 +-- ...145931Z-personal-app-deployment-receipt.md | 59 +++++++++++++++++++ ...-WP-0008-production-transfer-acceptance.md | 33 +++++++++++ 8 files changed, 182 insertions(+), 18 deletions(-) create mode 100644 docs/release/personal-account-deployed-2026-10-06.md create mode 100644 history/20261006T145931Z-personal-app-deployment-receipt.md diff --git a/SCOPE.md b/SCOPE.md index b4f4bf8..b5ea7da 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -61,13 +61,16 @@ The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until an explicit cutover. Historical identity/app-shell evidence is in [identity smoke](docs/identity/smoke.md). Public registration was evidenced on 2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration, -persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm -an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence. -Personal sign-in is broken: the user reports unknown client_id, and guarded -inspection confirms the public coulomb-social OIDC client is absent. The latest -88-test app image and persistent chart upgrade are prepared, not deployed; -[release assessment](docs/release/personal-account-2026-10-06.md) documents the -exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished; +live product acceptance. On 2026-10-06, founder-approved Helm revision 10 deployed +the tested app (source ac7bac1852c9, chart 0.2.0, digest pinned) with a retained +2Gi CONTENT_ROOT PVC and one writer/Recreate. OIDC client registration was restored +and KeyCape restarted; authorization now hands off to Authelia. Public health, +clipboard asset delivery, zero pending migrations and content restart durability +passed. Interactive tegwick sign-in remains blocked: Authelia rejects the attempted +credentials although a read-only directory check confirms the account exists. +Real-use-case acceptance remains pending; +[deployment receipt](docs/release/personal-account-deployed-2026-10-06.md) records +exact evidence and gaps. All six original numbered workplans are finished; their residual intakes remain the source of unfinished work. ## Ownership boundaries diff --git a/docs/dev.md b/docs/dev.md index eb70260..79f514e 100644 --- a/docs/dev.md +++ b/docs/dev.md @@ -51,8 +51,8 @@ See `.env.example`. Summary: ### Platform OIDC (KeyCape) -Historical client registration has drifted: guarded inspection on 2026-10-06 -finds it absent. Inspect through the safe owner wrapper (read-only default): +The missing historical client registration was restored with founder approval +on 2026-10-06. Inspect through the safe owner wrapper (read-only default): ```bash ./scripts/register-keycape-client.sh diff --git a/docs/identity/oidc-client.md b/docs/identity/oidc-client.md index 841ccf6..71f352b 100644 --- a/docs/identity/oidc-client.md +++ b/docs/identity/oidc-client.md @@ -21,7 +21,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers. | Environment | Issuer mode | Registered | |-------------|-------------|------------| | local offline | dev claims (`OIDC_ENABLED=false`) | n/a | -| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 | +| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **restored** (founder-approved guarded repair 2026-10-06; interactive acceptance pending) | | key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) | ### Historical verification (2026-08-09) @@ -61,3 +61,11 @@ founder approval; the wrapper never restarts the issuer automatically. See [release review](../release/personal-account-2026-10-06.md) and [ordinary-session assurance close-down](../security-close-down-checklist.md). + +### Deployed repair — 2026-10-06 + +Founder approved the exact repair. Guarded CAS/readback succeeded; KeyCape +restart completed. Discovery returns 200 and authorization hands off to Authelia +with 302, without the missing-client error. The upgraded app emits the correct +client ID, callback and S256 PKCE challenge. Interactive tegwick login remains +pending the user's confirmation. See docs/release/personal-account-deployed-2026-10-06.md. diff --git a/docs/release/personal-account-2026-10-06.md b/docs/release/personal-account-2026-10-06.md index 541e30d..583bd97 100644 --- a/docs/release/personal-account-2026-10-06.md +++ b/docs/release/personal-account-2026-10-06.md @@ -1,8 +1,10 @@ # Personal Coulomb account release — 2026-10-06 -CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`. -No live mutation has been performed. Prepared code, image and review branch are -ready; the personal account is not yet usable through this app. +CSOC-WP-0008 · RAPPS-WP-0015 · founder-approved decision `8bbce691-a787-4140-9cd4-df06e8635a27`. +The founder approved this proposal and it was deployed as Helm revision 10. +See [deployment receipt](personal-account-deployed-2026-10-06.md). Interactive +tegwick sign-in remains pending user confirmation. The sections below preserve +the reviewed pre-change state and execution proposal. ## What is running @@ -105,7 +107,7 @@ Bubble exit/apex cutover or real-data import is included in this live approval. ## Review artifacts Application source is committed to coulomb-social main. Deployment changes are on -railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go: +railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), approved, merged into main and deployed: https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app Credential owner routing: key-cape-oidc-login; SSH access uses existing routed diff --git a/docs/release/personal-account-deployed-2026-10-06.md b/docs/release/personal-account-deployed-2026-10-06.md new file mode 100644 index 0000000..517c1c5 --- /dev/null +++ b/docs/release/personal-account-deployed-2026-10-06.md @@ -0,0 +1,59 @@ +# Personal app deployment receipt — 2026-10-06 + +Founder explicitly approved: “Go on and deploy the interruption is not a problem.” +Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. +Decision 8bbce691-a787-4140-9cd4-df06e8635a27 records that human answer. + +## Executed and verified + +- Correct node: railiance01 / 92.205.62.239. Preflight CPU requests 3455m/4000m, + disk free 123G. Reviewed owner helper hash unchanged; dry-runs/diffs refreshed. +- Restored only historical public coulomb-social OIDC registration through guarded + SSH/CAS owner lane. Secret UID retained; resourceVersion 67716615 → 71471711. + Byte-preserving validation/readback confirmed unrelated config and Secret data + unchanged. No Secret values or raw errors emitted. Restarted sso/keycape; + rollout succeeded. Discovery 200; public /authorize probe 302 to Authelia, + without unknown client_id. This is a handoff check, not a completed user login. +- Fresh Backup databases/csoc-preupgrade-20261006145351 for apps-pg, + method barmanObjectStore: completed, start 2026-10-06T14:54:22Z, + stop 2026-10-06T14:54:31Z. Completed before app upgrade began. +- Approved owner chart merged/pushed to railiance-apps main at 3f5a909. + Helm upgrade executed from railiance01 with --atomic/--wait/5m timeout. + Release coulomb-social revision 10 is deployed, chart 0.2.0, source ac7bac1852c9, + digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. +- Retained local-path PVC coulomb-social-content is Bound, 2Gi/RWO; mounted at + /app/var/content with CONTENT_ROOT matching. One replica/Recreate. App UID/GID + 10001; volume group 10001; write check passed. A dedicated synthetic marker + survived a fresh pod restart and was removed afterward. No real content touched. +- App 1/1 available after upgrade and restart. Zero pending Django migrations; + existing tegwick Member retained (count one for tenant:coulomb and live issuer). +- Public /healthz and landing: 200. Clipboard JS: 200, 2909 bytes, ClipboardItem + present. /auth/login/: 302 to correct issuer/client/callback and PKCE S256. + Anonymous /app/: 302, preserving authentication boundary. + +## Remaining acceptance + +The user has been asked to complete interactive tegwick sign-in. It is not yet +confirmed. CSOC-WP-0008-T11 remains waiting for that result; T01 continues live +product smoke/visual and permission acceptance. A DB backup plus persistent +volume is not paired DB/content restore proof: T02 remains open. Real ReichelAg +protocol reconciliation/import and manual mail-client paste remain T03/T09. +No Bubble/apex cutover, real-data import, password change, broad grant or private +protocol export was performed. RAPPS-WP-0015 remains active pending T04. + +## User sign-in result — 2026-10-06 + +The user reaches auth.coulomb.social but tegwick is rejected as wrong username +or password. Read-only directory query through the existing provisioner confirms +tegwick is present. Live Authelia username attribute is uid; its lookup supports +uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- +credentials failure, without backend connection error or regulation-ban evidence +in that entry. This does not establish why the entered credential is rejected. + +The app and client restoration are deployed, but personal sign-in is not accepted. +CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a +successful fresh sign-in. The user was asked whether the same password works on +another service. No password was requested/read/exported or reset. Authelia's +current notifier is filesystem rather than SMTP: do not promise emailed recovery +or expose reset tokens from notification files. Any credential reset must use +the owning attended recovery/setup lane under a separate exact approved change. diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md index e419e34..33e431c 100644 --- a/docs/security-close-down-checklist.md +++ b/docs/security-close-down-checklist.md @@ -1,17 +1,17 @@ # Coulomb sign-in close-down record 2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication) -and coulomb-social (product assurance). Proposed repair, not yet activated. +and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06. The historical public authorization-code/PKCE client descriptor has `mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported. -Restoration would retain that historical policy, with no changes to other clients. +Restoration retained that historical policy, with no changes to other clients. Before production approval, the owners must decide and verify whether ordinary personal sessions may remain AAL1, which actions require step-up, and that PKCE, exact callbacks and tenant checks are enforced by the running issuer/application. Do not treat successful discovery, synthetic tests or a registered Member as -proof of interactive authentication. The live restoration requires founder go. +proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending. Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence; CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by -preparing this descriptor. No issuer policy has been loosened in this session. +preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged. diff --git a/history/20261006T145931Z-personal-app-deployment-receipt.md b/history/20261006T145931Z-personal-app-deployment-receipt.md new file mode 100644 index 0000000..517c1c5 --- /dev/null +++ b/history/20261006T145931Z-personal-app-deployment-receipt.md @@ -0,0 +1,59 @@ +# Personal app deployment receipt — 2026-10-06 + +Founder explicitly approved: “Go on and deploy the interruption is not a problem.” +Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. +Decision 8bbce691-a787-4140-9cd4-df06e8635a27 records that human answer. + +## Executed and verified + +- Correct node: railiance01 / 92.205.62.239. Preflight CPU requests 3455m/4000m, + disk free 123G. Reviewed owner helper hash unchanged; dry-runs/diffs refreshed. +- Restored only historical public coulomb-social OIDC registration through guarded + SSH/CAS owner lane. Secret UID retained; resourceVersion 67716615 → 71471711. + Byte-preserving validation/readback confirmed unrelated config and Secret data + unchanged. No Secret values or raw errors emitted. Restarted sso/keycape; + rollout succeeded. Discovery 200; public /authorize probe 302 to Authelia, + without unknown client_id. This is a handoff check, not a completed user login. +- Fresh Backup databases/csoc-preupgrade-20261006145351 for apps-pg, + method barmanObjectStore: completed, start 2026-10-06T14:54:22Z, + stop 2026-10-06T14:54:31Z. Completed before app upgrade began. +- Approved owner chart merged/pushed to railiance-apps main at 3f5a909. + Helm upgrade executed from railiance01 with --atomic/--wait/5m timeout. + Release coulomb-social revision 10 is deployed, chart 0.2.0, source ac7bac1852c9, + digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. +- Retained local-path PVC coulomb-social-content is Bound, 2Gi/RWO; mounted at + /app/var/content with CONTENT_ROOT matching. One replica/Recreate. App UID/GID + 10001; volume group 10001; write check passed. A dedicated synthetic marker + survived a fresh pod restart and was removed afterward. No real content touched. +- App 1/1 available after upgrade and restart. Zero pending Django migrations; + existing tegwick Member retained (count one for tenant:coulomb and live issuer). +- Public /healthz and landing: 200. Clipboard JS: 200, 2909 bytes, ClipboardItem + present. /auth/login/: 302 to correct issuer/client/callback and PKCE S256. + Anonymous /app/: 302, preserving authentication boundary. + +## Remaining acceptance + +The user has been asked to complete interactive tegwick sign-in. It is not yet +confirmed. CSOC-WP-0008-T11 remains waiting for that result; T01 continues live +product smoke/visual and permission acceptance. A DB backup plus persistent +volume is not paired DB/content restore proof: T02 remains open. Real ReichelAg +protocol reconciliation/import and manual mail-client paste remain T03/T09. +No Bubble/apex cutover, real-data import, password change, broad grant or private +protocol export was performed. RAPPS-WP-0015 remains active pending T04. + +## User sign-in result — 2026-10-06 + +The user reaches auth.coulomb.social but tegwick is rejected as wrong username +or password. Read-only directory query through the existing provisioner confirms +tegwick is present. Live Authelia username attribute is uid; its lookup supports +uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- +credentials failure, without backend connection error or regulation-ban evidence +in that entry. This does not establish why the entered credential is rejected. + +The app and client restoration are deployed, but personal sign-in is not accepted. +CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a +successful fresh sign-in. The user was asked whether the same password works on +another service. No password was requested/read/exported or reset. Authelia's +current notifier is filesystem rather than SMTP: do not promise emailed recovery +or expose reset tokens from notification files. Any credential reset must use +the owning attended recovery/setup lane under a separate exact approved change. diff --git a/workplans/CSOC-WP-0008-production-transfer-acceptance.md b/workplans/CSOC-WP-0008-production-transfer-acceptance.md index a139e11..54b4e3a 100644 --- a/workplans/CSOC-WP-0008-production-transfer-acceptance.md +++ b/workplans/CSOC-WP-0008-production-transfer-acceptance.md @@ -310,3 +310,36 @@ Prepared review: docs/release/personal-account-2026-10-06.md. Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27. Published image and owning chart prep complete; live approval and user acceptance remain pending. No productive data transferred. + +## Deployment execution — 2026-10-06 + +Founder approved exact live changes (decision 8bbce691-a787-4140-9cd4-df06e8635a27). +T11 registration restored through guarded CAS; shared KeyCape restart succeeded; +authorization now hands off to Authelia. Interactive tegwick login confirmation +still pending, so T11 remains wait. T01 app upgrade succeeded as Helm revision10, +chart0.2.0/digest-pinned source ac7bac1852c9; retained2Gi content PVC bound, +UID/GID10001 writable, zero pending migrations. Public health/clipboard/login +handoff and dedicated synthetic-marker restart durability passed. Fresh apps-pg +backup csoc-preupgrade-20261006145351 completed before migration. + +Receipt: docs/release/personal-account-deployed-2026-10-06.md. T01 stays progress +for live product/Visual/permission acceptance; T02 paired restore, T03 real cohort +and T09 user/email walkthrough remain open. No real-data import or apex cutover. +RAPPS-WP-0015 T03 deployment completes; T04 user acceptance remains open. + +## User sign-in result — 2026-10-06 + +The user reaches auth.coulomb.social but tegwick is rejected as wrong username +or password. Read-only directory query through the existing provisioner confirms +tegwick is present. Live Authelia username attribute is uid; its lookup supports +uid or mail. Contained recent-log inspection records a tegwick LDAP invalid- +credentials failure, without backend connection error or regulation-ban evidence +in that entry. This does not establish why the entered credential is rejected. + +The app and client restoration are deployed, but personal sign-in is not accepted. +CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a +successful fresh sign-in. The user was asked whether the same password works on +another service. No password was requested/read/exported or reset. Authelia's +current notifier is filesystem rather than SMTP: do not promise emailed recovery +or expose reset tokens from notification files. Any credential reset must use +the owning attended recovery/setup lane under a separate exact approved change.