coulomb/coulomb-social
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed personal app and remaining Authelia credential rejection
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
This commit is contained in:
tegwick 2026-10-06 17:02:16 +02:00
parent b8253c4e3b
commit 1272c699b0
8 changed files with 182 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/security-close-down-checklist.md
View file

@ -1,17 +1,17 @@
# Coulomb sign-in close-down record
2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
and coulomb-social (product assurance). Proposed repair, not yet activated.
and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06.
The historical public authorization-code/PKCE client descriptor has
`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
Restoration would retain that historical policy, with no changes to other clients.
Restoration retained that historical policy, with no changes to other clients.
Before production approval, the owners must decide and verify whether ordinary
personal sessions may remain AAL1, which actions require step-up, and that PKCE,
exact callbacks and tenant checks are enforced by the running issuer/application.
Do not treat successful discovery, synthetic tests or a registered Member as
proof of interactive authentication. The live restoration requires founder go.
proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending.
Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
preparing this descriptor. No issuer policy has been loosened in this session.
preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged.