From 57afafaced9411d9ecddb4a140a62c7708eaf415 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 16:45:28 +0200 Subject: [PATCH] Record personal account blocker and reviewed live release proposal Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- SCOPE.md | 9 +- WORK-RECORDS.md | 3 +- docs/dev.md | 7 +- docs/identity/oidc-client.md | 21 +++- docs/release/personal-account-2026-10-06.md | 116 ++++++++++++++++++ docs/security-close-down-checklist.md | 17 +++ ...00Z-personal-account-release-assessment.md | 116 ++++++++++++++++++ scripts/keycape-client-repair.py | 19 +++ scripts/test_keycape_client_repair.py | 14 ++- ...-WP-0008-production-transfer-acceptance.md | 8 +- 10 files changed, 315 insertions(+), 15 deletions(-) create mode 100644 docs/release/personal-account-2026-10-06.md create mode 100644 docs/security-close-down-checklist.md create mode 100644 history/20261006T144400Z-personal-account-release-assessment.md diff --git a/SCOPE.md b/SCOPE.md index 50b7e3d..b4f4bf8 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -61,8 +61,13 @@ The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until an explicit cutover. Historical identity/app-shell evidence is in [identity smoke](docs/identity/smoke.md). Public registration was evidenced on 2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration, -persistent CONTENT_ROOT and live smoke. No fresh live deployment verification -was performed in this review. All six original numbered workplans are finished; +persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm +an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence. +Personal sign-in is broken: the user reports unknown client_id, and guarded +inspection confirms the public coulomb-social OIDC client is absent. The latest +88-test app image and persistent chart upgrade are prepared, not deployed; +[release assessment](docs/release/personal-account-2026-10-06.md) documents the +exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished; their residual intakes remain the source of unfinished work. ## Ownership boundaries diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index f1a6721..85b5d8d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -53,7 +53,7 @@ | task | CSOC-WP-0007-T02 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md | | task | CSOC-WP-0007-T03 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md | | task | CSOC-WP-0007-T04 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md | -| task | CSOC-WP-0008-T01 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | +| task | CSOC-WP-0008-T01 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0008-T02 | todo | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0008-T03 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0008-T04 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | @@ -63,6 +63,7 @@ | task | CSOC-WP-0008-T08 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0008-T09 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0008-T10 | done | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | +| task | CSOC-WP-0008-T11 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md | | task | CSOC-WP-0009-T01 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md | | task | CSOC-WP-0009-T02 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md | | task | CSOC-WP-0009-T03 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md | diff --git a/docs/dev.md b/docs/dev.md index 5041dee..eb70260 100644 --- a/docs/dev.md +++ b/docs/dev.md @@ -51,13 +51,16 @@ See `.env.example`. Summary: ### Platform OIDC (KeyCape) -Client is registered on railiance01 KeyCape. Re-apply if redirect URIs change: +Historical client registration has drifted: guarded inspection on 2026-10-06 +finds it absent. Inspect through the safe owner wrapper (read-only default): ```bash ./scripts/register-keycape-client.sh ``` -Then: +Live repair requires exact founder approval; see docs/release/personal-account-2026-10-06.md. + +App configuration: ```bash export OIDC_ENABLED=true diff --git a/docs/identity/oidc-client.md b/docs/identity/oidc-client.md index c3d05b0..841ccf6 100644 --- a/docs/identity/oidc-client.md +++ b/docs/identity/oidc-client.md @@ -11,7 +11,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers. | client_type | **public** (no client secret; PKCE only) | | redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` · `http://localhost:8008/auth/callback/` | | redirect_uri (public app) | `https://app.coulomb.social/auth/callback/` (**live** host while Bubble keeps apex) | -| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (registered; cutover deferred) | +| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (historical descriptor; cutover deferred) | | scopes | `openid profile email groups` | | grant | authorization_code | | wildcard redirects | **forbidden** | @@ -21,10 +21,10 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers. | Environment | Issuer mode | Registered | |-------------|-------------|------------| | local offline | dev claims (`OIDC_ENABLED=false`) | n/a | -| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **yes** (2026-08-09) | +| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 | | key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) | -### Live verification (2026-08-09) +### Historical verification (2026-08-09) - Registered via `scripts/register-keycape-client.sh` → `net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh` (patches @@ -43,8 +43,21 @@ export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/ make run ``` -Re-register after redirect URI changes: +Inspect current registration (read-only default): ```bash ./scripts/register-keycape-client.sh ``` + +### Current repair — 2026-10-06 + +User tegwick reports invalid_profile_usage / unknown client_id. Guarded live +inspection confirms the missing client; server dry-run passes. The wrapper now +uses NetKingdom's byte-preserving CAS helper and executes Kubernetes operations +on railiance01 through SSH, suppressing Secret output/errors. It refuses differing +registrations. Explicit `dry-run` / `apply` modes require the fresh inspection's +`--expected-uid` and `--expected-resource-version`. Apply and issuer restart need +founder approval; the wrapper never restarts the issuer automatically. + +See [release review](../release/personal-account-2026-10-06.md) and +[ordinary-session assurance close-down](../security-close-down-checklist.md). diff --git a/docs/release/personal-account-2026-10-06.md b/docs/release/personal-account-2026-10-06.md new file mode 100644 index 0000000..541e30d --- /dev/null +++ b/docs/release/personal-account-2026-10-06.md @@ -0,0 +1,116 @@ +# Personal Coulomb account release — 2026-10-06 + +CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`. +No live mutation has been performed. Prepared code, image and review branch are +ready; the personal account is not yet usable through this app. + +## What is running + +There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9, +image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old +August shell; it has no content PVC and lacks the latest tested workspace flows. +The user-selected tegwick Member already exists in tenant:coulomb, bound to +issuer https://kc.coulomb.social and directory subject +uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required. +One demo space has no membership grants; a stored Member alone grants no access. + +The user's actual login returns invalid_profile_usage / unknown client_id. +Guarded read-only inspection confirms the coulomb-social client is absent from +KeyCape. Discovery health and stored identity did not establish working login. + +## Exact proposed change + +1. Restore NetKingdom's historical public coulomb-social client. Authorization + code + PKCE; scopes openid/profile/email/groups; exact callbacks: + http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/, + https://app.coulomb.social/auth/callback/ and + https://coulomb.social/auth/callback/. No wildcards or client secret. + Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains + available), as recorded in docs/security-close-down-checklist.md. +2. Restart only sso/keycape to load that registration. This shared issuer restart + can interrupt in-flight sign-ins. Issued tokens remain valid. No other client + registrations or credentials are changed. +3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily + Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that + establishes an existing DB recovery point, not paired application recovery. +4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic. + Source image ac7bac1852c9 is published and pinned to immutable digest + sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. + Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content; + CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app + interruption; no rolling surge. Existing PostgreSQL and env Secret references + remain. Entrypoint runs Django migrations; Helm rollback does not undo them. + +Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before +execution. Coulomb-social is Helm-managed and not among current ArgoCD apps. + +## Verification completed + +- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy, + rich HTML/plain text payloads, reader-write denial and outsider privacy. +- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal + checks pass; owner helper preserves unrelated config bytes and other Secret data. +- Live safe inspect and server dry-run through SSH pass, with no Secret values or + raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3, + resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts. +- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes, + with ClipboardItem code. Static assets are collected into the release image. +- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount, + CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas, + RollingUpdate and content-root mismatch. + +## Execution and recovery after approval + +Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01, +activation=APPROVED. Freeze the reviewed owner branch before moving its changes +into main; re-render and repeat diff/dry-run if the live state has changed. + +Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh +--expected-uid/--expected-resource-version; apply with the same receipt. The +wrapper executes Kubernetes operations on railiance01 through SSH and suppresses +Secret output/errors. It does not restart anything. Only after readback succeeds, +restart sso/keycape from the node and wait for rollout readiness. Check discovery +and authorization handoff; ask the user to complete their own interactive login. +If issuer readiness fails, stop: never replay a stale Secret or reset other +clients. Any inverse repair needs fresh revision checks and owner review. + +Before the app upgrade, create a scoped CNPG Backup in databases with +spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status. +Use a timestamped csoc-preupgrade name and record non-secret completion metadata. +Copy the reviewed chart/production values to a private node staging directory. +From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade +coulomb-social in namespace coulomb-social with the reviewed values, --atomic, +--wait and a bounded timeout. No env Secret reconstruction or legacy registration +apply script. Verify readiness, image digest, static asset, mounted content write +ownership and database migrations before exposing productive content. + +Application rollout failure: Helm atomic rollback returns to the previous release +(revision 9 baseline). Retain the content PVC; never delete it for a retry. +Investigate migrations separately; restore the private pre-upgrade DB backup only +through the owning PostgreSQL lane and a separately confirmed destructive restore. + +## User milestone and remaining acceptance + +The immediate milestone is: tegwick signs in at app.coulomb.social and can use a +personal private workspace on the new infrastructure. Then demonstrate the first +ReichelAg journey: retain the original full protocol, duplicate it for the next +call, edit agenda/protocol by hand, and copy rich/plain content for manual email. + +Successful rollout does not finish WP0008. Prove content restart durability and +paired DB/content restore (T02); privately reconcile the real nominated latest +ReichelAg protocol (T03); complete user review and actual email-client paste +(T09). Sharing/export/delete and content fidelity remain tracked tasks. No +Bubble exit/apex cutover or real-data import is included in this live approval. + +## Review artifacts + +Application source is committed to coulomb-social main. Deployment changes are on +railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go: +https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app + +Credential owner routing: key-cape-oidc-login; SSH access uses existing routed +certificate access. No secrets were fetched into chat, logs, Git or State Hub. +Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61; +portal-client-rollout.py SHA256 +158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f. +Changes to the owner helper require fresh review/dry-run before live execution. diff --git a/docs/security-close-down-checklist.md b/docs/security-close-down-checklist.md new file mode 100644 index 0000000..e419e34 --- /dev/null +++ b/docs/security-close-down-checklist.md @@ -0,0 +1,17 @@ +# Coulomb sign-in close-down record + +2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication) +and coulomb-social (product assurance). Proposed repair, not yet activated. + +The historical public authorization-code/PKCE client descriptor has +`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported. +Restoration would retain that historical policy, with no changes to other clients. +Before production approval, the owners must decide and verify whether ordinary +personal sessions may remain AAL1, which actions require step-up, and that PKCE, +exact callbacks and tenant checks are enforced by the running issuer/application. +Do not treat successful discovery, synthetic tests or a registered Member as +proof of interactive authentication. The live restoration requires founder go. + +Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence; +CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by +preparing this descriptor. No issuer policy has been loosened in this session. diff --git a/history/20261006T144400Z-personal-account-release-assessment.md b/history/20261006T144400Z-personal-account-release-assessment.md new file mode 100644 index 0000000..541e30d --- /dev/null +++ b/history/20261006T144400Z-personal-account-release-assessment.md @@ -0,0 +1,116 @@ +# Personal Coulomb account release — 2026-10-06 + +CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`. +No live mutation has been performed. Prepared code, image and review branch are +ready; the personal account is not yet usable through this app. + +## What is running + +There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9, +image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old +August shell; it has no content PVC and lacks the latest tested workspace flows. +The user-selected tegwick Member already exists in tenant:coulomb, bound to +issuer https://kc.coulomb.social and directory subject +uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required. +One demo space has no membership grants; a stored Member alone grants no access. + +The user's actual login returns invalid_profile_usage / unknown client_id. +Guarded read-only inspection confirms the coulomb-social client is absent from +KeyCape. Discovery health and stored identity did not establish working login. + +## Exact proposed change + +1. Restore NetKingdom's historical public coulomb-social client. Authorization + code + PKCE; scopes openid/profile/email/groups; exact callbacks: + http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/, + https://app.coulomb.social/auth/callback/ and + https://coulomb.social/auth/callback/. No wildcards or client secret. + Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains + available), as recorded in docs/security-close-down-checklist.md. +2. Restart only sso/keycape to load that registration. This shared issuer restart + can interrupt in-flight sign-ins. Issued tokens remain valid. No other client + registrations or credentials are changed. +3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily + Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that + establishes an existing DB recovery point, not paired application recovery. +4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic. + Source image ac7bac1852c9 is published and pinned to immutable digest + sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58. + Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content; + CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app + interruption; no rolling surge. Existing PostgreSQL and env Secret references + remain. Entrypoint runs Django migrations; Helm rollback does not undo them. + +Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before +execution. Coulomb-social is Helm-managed and not among current ArgoCD apps. + +## Verification completed + +- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy, + rich HTML/plain text payloads, reader-write denial and outsider privacy. +- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal + checks pass; owner helper preserves unrelated config bytes and other Secret data. +- Live safe inspect and server dry-run through SSH pass, with no Secret values or + raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3, + resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts. +- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes, + with ClipboardItem code. Static assets are collected into the release image. +- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount, + CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas, + RollingUpdate and content-root mismatch. + +## Execution and recovery after approval + +Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01, +activation=APPROVED. Freeze the reviewed owner branch before moving its changes +into main; re-render and repeat diff/dry-run if the live state has changed. + +Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh +--expected-uid/--expected-resource-version; apply with the same receipt. The +wrapper executes Kubernetes operations on railiance01 through SSH and suppresses +Secret output/errors. It does not restart anything. Only after readback succeeds, +restart sso/keycape from the node and wait for rollout readiness. Check discovery +and authorization handoff; ask the user to complete their own interactive login. +If issuer readiness fails, stop: never replay a stale Secret or reset other +clients. Any inverse repair needs fresh revision checks and owner review. + +Before the app upgrade, create a scoped CNPG Backup in databases with +spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status. +Use a timestamped csoc-preupgrade name and record non-secret completion metadata. +Copy the reviewed chart/production values to a private node staging directory. +From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade +coulomb-social in namespace coulomb-social with the reviewed values, --atomic, +--wait and a bounded timeout. No env Secret reconstruction or legacy registration +apply script. Verify readiness, image digest, static asset, mounted content write +ownership and database migrations before exposing productive content. + +Application rollout failure: Helm atomic rollback returns to the previous release +(revision 9 baseline). Retain the content PVC; never delete it for a retry. +Investigate migrations separately; restore the private pre-upgrade DB backup only +through the owning PostgreSQL lane and a separately confirmed destructive restore. + +## User milestone and remaining acceptance + +The immediate milestone is: tegwick signs in at app.coulomb.social and can use a +personal private workspace on the new infrastructure. Then demonstrate the first +ReichelAg journey: retain the original full protocol, duplicate it for the next +call, edit agenda/protocol by hand, and copy rich/plain content for manual email. + +Successful rollout does not finish WP0008. Prove content restart durability and +paired DB/content restore (T02); privately reconcile the real nominated latest +ReichelAg protocol (T03); complete user review and actual email-client paste +(T09). Sharing/export/delete and content fidelity remain tracked tasks. No +Bubble exit/apex cutover or real-data import is included in this live approval. + +## Review artifacts + +Application source is committed to coulomb-social main. Deployment changes are on +railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go: +https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app + +Credential owner routing: key-cape-oidc-login; SSH access uses existing routed +certificate access. No secrets were fetched into chat, logs, Git or State Hub. +Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61; +portal-client-rollout.py SHA256 +158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f. +Changes to the owner helper require fresh review/dry-run before live execution. diff --git a/scripts/keycape-client-repair.py b/scripts/keycape-client-repair.py index ee87086..3f7d445 100644 --- a/scripts/keycape-client-repair.py +++ b/scripts/keycape-client-repair.py @@ -5,7 +5,10 @@ Inspection is read-only. Apply requires exact founder approval and a fresh UID/resource-version receipt. Secret values stay inside the owner helper. """ import importlib.util +import json import os +import shlex +import subprocess from pathlib import Path from types import SimpleNamespace @@ -31,6 +34,22 @@ def configure(owner_root): return original(secret) rollout.replacement = replacement + + def kubectl(arguments, payload=None): + # Estate production changes execute on the node, never through a + # workstation context. Capture both streams: kubectl errors may include + # a Secret; only the owner's fixed reason code may leave this function. + result = subprocess.run( + ["ssh", "railiance01", shlex.join([ + "kubectl", "--request-timeout=20s", *arguments, + ])], + input=None if payload is None else json.dumps(payload), + text=True, capture_output=True, timeout=40, + ) + rollout.require(result.returncode == 0, "kubernetes_operation_failed") + return json.loads(result.stdout) + + rollout.kubectl = kubectl return rollout diff --git a/scripts/test_keycape_client_repair.py b/scripts/test_keycape_client_repair.py index 5ce5eb8..a030028 100644 --- a/scripts/test_keycape_client_repair.py +++ b/scripts/test_keycape_client_repair.py @@ -1,14 +1,17 @@ """Synthetic owner-lane checks; run with python3 scripts/test_keycape_client_repair.py.""" import base64 +import importlib.util import json -from pathlib import Path import unittest +from pathlib import Path import yaml -from importlib.machinery import SourceFileLoader - -adapter = SourceFileLoader("csoc_repair", str(Path(__file__).with_name("keycape-client-repair.py"))).load_module() +spec = importlib.util.spec_from_file_location( + "csoc_repair", Path(__file__).with_name("keycape-client-repair.py"), +) +adapter = importlib.util.module_from_spec(spec) +spec.loader.exec_module(adapter) class RepairTests(unittest.TestCase): @@ -18,7 +21,8 @@ class RepairTests(unittest.TestCase): def fixture(self, clients): raw = ("# keep comment\nauthelia:\n issuer: https://auth.example.invalid\n" " clientSecret: synthetic-marker\nclients:\n" + - yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) + "tokenLifetime: 15m\n") + yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) + + "tokenLifetime: 15m\n") return {"data": {"config.yaml": base64.b64encode(raw.encode()).decode(), "key.pem": "synthetic-key"}}, raw diff --git a/workplans/CSOC-WP-0008-production-transfer-acceptance.md b/workplans/CSOC-WP-0008-production-transfer-acceptance.md index 8433513..a139e11 100644 --- a/workplans/CSOC-WP-0008-production-transfer-acceptance.md +++ b/workplans/CSOC-WP-0008-production-transfer-acceptance.md @@ -289,8 +289,9 @@ No deployment or credential change was made by these read-only checks. ```task id: CSOC-WP-0008-T11 -status: progress +status: wait priority: high +state_hub_task_id: "3a6bdbfb-975e-5c3e-b34f-6eeede402521" ``` Restore the historical NetKingdom public coulomb-social authorization-code/PKCE @@ -304,3 +305,8 @@ this task done on an HTTP redirect or discovery-only check. Knowledge receipt: emergent-security 0.2.6 identity, verified-files, orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02. + +Prepared review: docs/release/personal-account-2026-10-06.md. +Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27. +Published image and owning chart prep complete; live approval and user acceptance +remain pending. No productive data transferred.