Record personal account blocker and reviewed live release proposal
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
This commit is contained in:
parent
219128bc01
commit
57afafaced
10 changed files with 315 additions and 15 deletions
9
SCOPE.md
9
SCOPE.md
|
|
@ -61,8 +61,13 @@ The host strategy is rebuild on `app.coulomb.social` with Bubble on apex until
|
|||
an explicit cutover. Historical identity/app-shell evidence is in
|
||||
[identity smoke](docs/identity/smoke.md). Public registration was evidenced on
|
||||
2026-08-14. **CSOC-IN-0004 remains open** for PageOps deployment, migration,
|
||||
persistent CONTENT_ROOT and live smoke. No fresh live deployment verification
|
||||
was performed in this review. All six original numbered workplans are finished;
|
||||
persistent CONTENT_ROOT and live smoke. Read-only checks on 2026-10-06 confirm
|
||||
an old 7fcd0cf Helm workload (revision 9), 1/1 healthy, without content persistence.
|
||||
Personal sign-in is broken: the user reports unknown client_id, and guarded
|
||||
inspection confirms the public coulomb-social OIDC client is absent. The latest
|
||||
88-test app image and persistent chart upgrade are prepared, not deployed;
|
||||
[release assessment](docs/release/personal-account-2026-10-06.md) documents the
|
||||
exact pending repair/upgrade and user acceptance. All six original numbered workplans are finished;
|
||||
their residual intakes remain the source of unfinished work.
|
||||
|
||||
## Ownership boundaries
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@
|
|||
| task | CSOC-WP-0007-T02 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
|
||||
| task | CSOC-WP-0007-T03 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
|
||||
| task | CSOC-WP-0007-T04 | done | — | workplans/CSOC-WP-0007-safe-transfer-readiness.md |
|
||||
| task | CSOC-WP-0008-T01 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T01 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T02 | todo | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T03 | wait | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T04 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
|
|
@ -63,6 +63,7 @@
|
|||
| task | CSOC-WP-0008-T08 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T09 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T10 | done | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0008-T11 | progress | — | workplans/CSOC-WP-0008-production-transfer-acceptance.md |
|
||||
| task | CSOC-WP-0009-T01 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |
|
||||
| task | CSOC-WP-0009-T02 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |
|
||||
| task | CSOC-WP-0009-T03 | done | — | workplans/CSOC-WP-0009-usecase-regression-infrastructure.md |
|
||||
|
|
|
|||
|
|
@ -51,13 +51,16 @@ See `.env.example`. Summary:
|
|||
|
||||
### Platform OIDC (KeyCape)
|
||||
|
||||
Client is registered on railiance01 KeyCape. Re-apply if redirect URIs change:
|
||||
Historical client registration has drifted: guarded inspection on 2026-10-06
|
||||
finds it absent. Inspect through the safe owner wrapper (read-only default):
|
||||
|
||||
```bash
|
||||
./scripts/register-keycape-client.sh
|
||||
```
|
||||
|
||||
Then:
|
||||
Live repair requires exact founder approval; see docs/release/personal-account-2026-10-06.md.
|
||||
|
||||
App configuration:
|
||||
|
||||
```bash
|
||||
export OIDC_ENABLED=true
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
|
|||
| client_type | **public** (no client secret; PKCE only) |
|
||||
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` · `http://localhost:8008/auth/callback/` |
|
||||
| redirect_uri (public app) | `https://app.coulomb.social/auth/callback/` (**live** host while Bubble keeps apex) |
|
||||
| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (registered; cutover deferred) |
|
||||
| redirect_uri (apex future) | `https://coulomb.social/auth/callback/` (historical descriptor; cutover deferred) |
|
||||
| scopes | `openid profile email groups` |
|
||||
| grant | authorization_code |
|
||||
| wildcard redirects | **forbidden** |
|
||||
|
|
@ -21,10 +21,10 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
|
|||
| Environment | Issuer mode | Registered |
|
||||
|-------------|-------------|------------|
|
||||
| local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
|
||||
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **yes** (2026-08-09) |
|
||||
| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 |
|
||||
| key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
|
||||
|
||||
### Live verification (2026-08-09)
|
||||
### Historical verification (2026-08-09)
|
||||
|
||||
- Registered via `scripts/register-keycape-client.sh` →
|
||||
`net-kingdom/sso-mfa/k8s/keycape/register-coulomb-social.sh` (patches
|
||||
|
|
@ -43,8 +43,21 @@ export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|||
make run
|
||||
```
|
||||
|
||||
Re-register after redirect URI changes:
|
||||
Inspect current registration (read-only default):
|
||||
|
||||
```bash
|
||||
./scripts/register-keycape-client.sh
|
||||
```
|
||||
|
||||
### Current repair — 2026-10-06
|
||||
|
||||
User tegwick reports invalid_profile_usage / unknown client_id. Guarded live
|
||||
inspection confirms the missing client; server dry-run passes. The wrapper now
|
||||
uses NetKingdom's byte-preserving CAS helper and executes Kubernetes operations
|
||||
on railiance01 through SSH, suppressing Secret output/errors. It refuses differing
|
||||
registrations. Explicit `dry-run` / `apply` modes require the fresh inspection's
|
||||
`--expected-uid` and `--expected-resource-version`. Apply and issuer restart need
|
||||
founder approval; the wrapper never restarts the issuer automatically.
|
||||
|
||||
See [release review](../release/personal-account-2026-10-06.md) and
|
||||
[ordinary-session assurance close-down](../security-close-down-checklist.md).
|
||||
|
|
|
|||
116
docs/release/personal-account-2026-10-06.md
Normal file
116
docs/release/personal-account-2026-10-06.md
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
# Personal Coulomb account release — 2026-10-06
|
||||
|
||||
CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
|
||||
No live mutation has been performed. Prepared code, image and review branch are
|
||||
ready; the personal account is not yet usable through this app.
|
||||
|
||||
## What is running
|
||||
|
||||
There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9,
|
||||
image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old
|
||||
August shell; it has no content PVC and lacks the latest tested workspace flows.
|
||||
The user-selected tegwick Member already exists in tenant:coulomb, bound to
|
||||
issuer https://kc.coulomb.social and directory subject
|
||||
uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required.
|
||||
One demo space has no membership grants; a stored Member alone grants no access.
|
||||
|
||||
The user's actual login returns invalid_profile_usage / unknown client_id.
|
||||
Guarded read-only inspection confirms the coulomb-social client is absent from
|
||||
KeyCape. Discovery health and stored identity did not establish working login.
|
||||
|
||||
## Exact proposed change
|
||||
|
||||
1. Restore NetKingdom's historical public coulomb-social client. Authorization
|
||||
code + PKCE; scopes openid/profile/email/groups; exact callbacks:
|
||||
http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/,
|
||||
https://app.coulomb.social/auth/callback/ and
|
||||
https://coulomb.social/auth/callback/. No wildcards or client secret.
|
||||
Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains
|
||||
available), as recorded in docs/security-close-down-checklist.md.
|
||||
2. Restart only sso/keycape to load that registration. This shared issuer restart
|
||||
can interrupt in-flight sign-ins. Issued tokens remain valid. No other client
|
||||
registrations or credentials are changed.
|
||||
3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily
|
||||
Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that
|
||||
establishes an existing DB recovery point, not paired application recovery.
|
||||
4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic.
|
||||
Source image ac7bac1852c9 is published and pinned to immutable digest
|
||||
sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
|
||||
Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content;
|
||||
CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app
|
||||
interruption; no rolling surge. Existing PostgreSQL and env Secret references
|
||||
remain. Entrypoint runs Django migrations; Helm rollback does not undo them.
|
||||
|
||||
Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before
|
||||
execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.
|
||||
|
||||
## Verification completed
|
||||
|
||||
- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy,
|
||||
rich HTML/plain text payloads, reader-write denial and outsider privacy.
|
||||
- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal
|
||||
checks pass; owner helper preserves unrelated config bytes and other Secret data.
|
||||
- Live safe inspect and server dry-run through SSH pass, with no Secret values or
|
||||
raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3,
|
||||
resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
|
||||
- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes,
|
||||
with ClipboardItem code. Static assets are collected into the release image.
|
||||
- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount,
|
||||
CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas,
|
||||
RollingUpdate and content-root mismatch.
|
||||
|
||||
## Execution and recovery after approval
|
||||
|
||||
Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01,
|
||||
activation=APPROVED. Freeze the reviewed owner branch before moving its changes
|
||||
into main; re-render and repeat diff/dry-run if the live state has changed.
|
||||
|
||||
Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh
|
||||
--expected-uid/--expected-resource-version; apply with the same receipt. The
|
||||
wrapper executes Kubernetes operations on railiance01 through SSH and suppresses
|
||||
Secret output/errors. It does not restart anything. Only after readback succeeds,
|
||||
restart sso/keycape from the node and wait for rollout readiness. Check discovery
|
||||
and authorization handoff; ask the user to complete their own interactive login.
|
||||
If issuer readiness fails, stop: never replay a stale Secret or reset other
|
||||
clients. Any inverse repair needs fresh revision checks and owner review.
|
||||
|
||||
Before the app upgrade, create a scoped CNPG Backup in databases with
|
||||
spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status.
|
||||
Use a timestamped csoc-preupgrade name and record non-secret completion metadata.
|
||||
Copy the reviewed chart/production values to a private node staging directory.
|
||||
From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade
|
||||
coulomb-social in namespace coulomb-social with the reviewed values, --atomic,
|
||||
--wait and a bounded timeout. No env Secret reconstruction or legacy registration
|
||||
apply script. Verify readiness, image digest, static asset, mounted content write
|
||||
ownership and database migrations before exposing productive content.
|
||||
|
||||
Application rollout failure: Helm atomic rollback returns to the previous release
|
||||
(revision 9 baseline). Retain the content PVC; never delete it for a retry.
|
||||
Investigate migrations separately; restore the private pre-upgrade DB backup only
|
||||
through the owning PostgreSQL lane and a separately confirmed destructive restore.
|
||||
|
||||
## User milestone and remaining acceptance
|
||||
|
||||
The immediate milestone is: tegwick signs in at app.coulomb.social and can use a
|
||||
personal private workspace on the new infrastructure. Then demonstrate the first
|
||||
ReichelAg journey: retain the original full protocol, duplicate it for the next
|
||||
call, edit agenda/protocol by hand, and copy rich/plain content for manual email.
|
||||
|
||||
Successful rollout does not finish WP0008. Prove content restart durability and
|
||||
paired DB/content restore (T02); privately reconcile the real nominated latest
|
||||
ReichelAg protocol (T03); complete user review and actual email-client paste
|
||||
(T09). Sharing/export/delete and content fidelity remain tracked tasks. No
|
||||
Bubble exit/apex cutover or real-data import is included in this live approval.
|
||||
|
||||
## Review artifacts
|
||||
|
||||
Application source is committed to coulomb-social main. Deployment changes are on
|
||||
railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
|
||||
https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
|
||||
|
||||
Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
|
||||
certificate access. No secrets were fetched into chat, logs, Git or State Hub.
|
||||
Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61;
|
||||
portal-client-rollout.py SHA256
|
||||
158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f.
|
||||
Changes to the owner helper require fresh review/dry-run before live execution.
|
||||
17
docs/security-close-down-checklist.md
Normal file
17
docs/security-close-down-checklist.md
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
# Coulomb sign-in close-down record
|
||||
|
||||
2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
|
||||
and coulomb-social (product assurance). Proposed repair, not yet activated.
|
||||
|
||||
The historical public authorization-code/PKCE client descriptor has
|
||||
`mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
|
||||
Restoration would retain that historical policy, with no changes to other clients.
|
||||
Before production approval, the owners must decide and verify whether ordinary
|
||||
personal sessions may remain AAL1, which actions require step-up, and that PKCE,
|
||||
exact callbacks and tenant checks are enforced by the running issuer/application.
|
||||
Do not treat successful discovery, synthetic tests or a registered Member as
|
||||
proof of interactive authentication. The live restoration requires founder go.
|
||||
|
||||
Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
|
||||
CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
|
||||
preparing this descriptor. No issuer policy has been loosened in this session.
|
||||
116
history/20261006T144400Z-personal-account-release-assessment.md
Normal file
116
history/20261006T144400Z-personal-account-release-assessment.md
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
# Personal Coulomb account release — 2026-10-06
|
||||
|
||||
CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
|
||||
No live mutation has been performed. Prepared code, image and review branch are
|
||||
ready; the personal account is not yet usable through this app.
|
||||
|
||||
## What is running
|
||||
|
||||
There is a replacement workload on railiance01 (92.205.62.239): Helm revision 9,
|
||||
image 7fcd0cf, 1/1 available. Landing and /healthz return 200. This is the old
|
||||
August shell; it has no content PVC and lacks the latest tested workspace flows.
|
||||
The user-selected tegwick Member already exists in tenant:coulomb, bound to
|
||||
issuer https://kc.coulomb.social and directory subject
|
||||
uid=tegwick,ou=people,dc=netkingdom,dc=local. No password or new identity is required.
|
||||
One demo space has no membership grants; a stored Member alone grants no access.
|
||||
|
||||
The user's actual login returns invalid_profile_usage / unknown client_id.
|
||||
Guarded read-only inspection confirms the coulomb-social client is absent from
|
||||
KeyCape. Discovery health and stored identity did not establish working login.
|
||||
|
||||
## Exact proposed change
|
||||
|
||||
1. Restore NetKingdom's historical public coulomb-social client. Authorization
|
||||
code + PKCE; scopes openid/profile/email/groups; exact callbacks:
|
||||
http://127.0.0.1:8008/auth/callback/, http://localhost:8008/auth/callback/,
|
||||
https://app.coulomb.social/auth/callback/ and
|
||||
https://coulomb.social/auth/callback/. No wildcards or client secret.
|
||||
Preserve historical mfaRequired=false (ordinary AAL1; explicit AAL2 remains
|
||||
available), as recorded in docs/security-close-down-checklist.md.
|
||||
2. Restart only sso/keycape to load that registration. This shared issuer restart
|
||||
can interrupt in-flight sign-ins. Issued tokens remain valid. No other client
|
||||
registrations or credentials are changed.
|
||||
3. Complete a fresh apps-pg barmanObjectStore Backup before app migration. A daily
|
||||
Backup apps-pg-daily-20261006021500 was completed at 02:15:19 UTC today; that
|
||||
establishes an existing DB recovery point, not paired application recovery.
|
||||
4. Upgrade only the coulomb-social Helm release using chart 0.2.0 and --atomic.
|
||||
Source image ac7bac1852c9 is published and pinned to immutable digest
|
||||
sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
|
||||
Add retained 2Gi local-path RWO coulomb-social-content PVC at /app/var/content;
|
||||
CONTENT_ROOT matches. One replica, Recreate, fsGroup/runAsUser 10001. Brief app
|
||||
interruption; no rolling surge. Existing PostgreSQL and env Secret references
|
||||
remain. Entrypoint runs Django migrations; Helm rollback does not undo them.
|
||||
|
||||
Node requests observed 3455m/4000m CPU (86%); host disk free 123G. Refresh before
|
||||
execution. Coulomb-social is Helm-managed and not among current ArgoCD apps.
|
||||
|
||||
## Verification completed
|
||||
|
||||
- make check: 88 tests passed, including Chromium ReichelAg duplicate/edit/copy,
|
||||
rich HTML/plain text payloads, reader-write denial and outsider privacy.
|
||||
- Guarded repair: synthetic insertion/idempotence and differing/duplicate refusal
|
||||
checks pass; owner helper preserves unrelated config bytes and other Secret data.
|
||||
- Live safe inspect and server dry-run through SSH pass, with no Secret values or
|
||||
raw errors emitted. Observed UID 2e94519d-1550-41c7-9701-2efe47fe1fd3,
|
||||
resourceVersion 67716615. Refresh both before apply; CAS refuses stale receipts.
|
||||
- Production container serves /static/spaces/copy-content.js HTTP 200, 2909 bytes,
|
||||
with ClipboardItem code. Static assets are collected into the release image.
|
||||
- Helm lint/server dry-run pass; diff shows image/digest, content volume/mount,
|
||||
CONTENT_ROOT, Recreate and chart label change. Chart rejects multiple replicas,
|
||||
RollingUpdate and content-root mismatch.
|
||||
|
||||
## Execution and recovery after approval
|
||||
|
||||
Record the founder's exact go as ADMINISTER @ realm:kubernetes/railiance01,
|
||||
activation=APPROVED. Freeze the reviewed owner branch before moving its changes
|
||||
into main; re-render and repeat diff/dry-run if the live state has changed.
|
||||
|
||||
Run scripts/register-keycape-client.sh inspect, then dry-run with its fresh
|
||||
--expected-uid/--expected-resource-version; apply with the same receipt. The
|
||||
wrapper executes Kubernetes operations on railiance01 through SSH and suppresses
|
||||
Secret output/errors. It does not restart anything. Only after readback succeeds,
|
||||
restart sso/keycape from the node and wait for rollout readiness. Check discovery
|
||||
and authorization handoff; ask the user to complete their own interactive login.
|
||||
If issuer readiness fails, stop: never replay a stale Secret or reset other
|
||||
clients. Any inverse repair needs fresh revision checks and owner review.
|
||||
|
||||
Before the app upgrade, create a scoped CNPG Backup in databases with
|
||||
spec.cluster.name=apps-pg and method=barmanObjectStore; wait for completed status.
|
||||
Use a timestamped csoc-preupgrade name and record non-secret completion metadata.
|
||||
Copy the reviewed chart/production values to a private node staging directory.
|
||||
From SSH on railiance01 with KUBECONFIG=/etc/rancher/k3s/k3s.yaml, run Helm upgrade
|
||||
coulomb-social in namespace coulomb-social with the reviewed values, --atomic,
|
||||
--wait and a bounded timeout. No env Secret reconstruction or legacy registration
|
||||
apply script. Verify readiness, image digest, static asset, mounted content write
|
||||
ownership and database migrations before exposing productive content.
|
||||
|
||||
Application rollout failure: Helm atomic rollback returns to the previous release
|
||||
(revision 9 baseline). Retain the content PVC; never delete it for a retry.
|
||||
Investigate migrations separately; restore the private pre-upgrade DB backup only
|
||||
through the owning PostgreSQL lane and a separately confirmed destructive restore.
|
||||
|
||||
## User milestone and remaining acceptance
|
||||
|
||||
The immediate milestone is: tegwick signs in at app.coulomb.social and can use a
|
||||
personal private workspace on the new infrastructure. Then demonstrate the first
|
||||
ReichelAg journey: retain the original full protocol, duplicate it for the next
|
||||
call, edit agenda/protocol by hand, and copy rich/plain content for manual email.
|
||||
|
||||
Successful rollout does not finish WP0008. Prove content restart durability and
|
||||
paired DB/content restore (T02); privately reconcile the real nominated latest
|
||||
ReichelAg protocol (T03); complete user review and actual email-client paste
|
||||
(T09). Sharing/export/delete and content fidelity remain tracked tasks. No
|
||||
Bubble exit/apex cutover or real-data import is included in this live approval.
|
||||
|
||||
## Review artifacts
|
||||
|
||||
Application source is committed to coulomb-social main. Deployment changes are on
|
||||
railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
|
||||
https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
|
||||
|
||||
Credential owner routing: key-cape-oidc-login; SSH access uses existing routed
|
||||
certificate access. No secrets were fetched into chat, logs, Git or State Hub.
|
||||
Owner helper source reviewed: net-kingdom 8f368679cdda1df699d52ad496bed77c59064f61;
|
||||
portal-client-rollout.py SHA256
|
||||
158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f.
|
||||
Changes to the owner helper require fresh review/dry-run before live execution.
|
||||
|
|
@ -5,7 +5,10 @@ Inspection is read-only. Apply requires exact founder approval and a fresh
|
|||
UID/resource-version receipt. Secret values stay inside the owner helper.
|
||||
"""
|
||||
import importlib.util
|
||||
import json
|
||||
import os
|
||||
import shlex
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
from types import SimpleNamespace
|
||||
|
||||
|
|
@ -31,6 +34,22 @@ def configure(owner_root):
|
|||
return original(secret)
|
||||
|
||||
rollout.replacement = replacement
|
||||
|
||||
def kubectl(arguments, payload=None):
|
||||
# Estate production changes execute on the node, never through a
|
||||
# workstation context. Capture both streams: kubectl errors may include
|
||||
# a Secret; only the owner's fixed reason code may leave this function.
|
||||
result = subprocess.run(
|
||||
["ssh", "railiance01", shlex.join([
|
||||
"kubectl", "--request-timeout=20s", *arguments,
|
||||
])],
|
||||
input=None if payload is None else json.dumps(payload),
|
||||
text=True, capture_output=True, timeout=40,
|
||||
)
|
||||
rollout.require(result.returncode == 0, "kubernetes_operation_failed")
|
||||
return json.loads(result.stdout)
|
||||
|
||||
rollout.kubectl = kubectl
|
||||
return rollout
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,14 +1,17 @@
|
|||
"""Synthetic owner-lane checks; run with python3 scripts/test_keycape_client_repair.py."""
|
||||
import base64
|
||||
import importlib.util
|
||||
import json
|
||||
from pathlib import Path
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
import yaml
|
||||
|
||||
from importlib.machinery import SourceFileLoader
|
||||
|
||||
adapter = SourceFileLoader("csoc_repair", str(Path(__file__).with_name("keycape-client-repair.py"))).load_module()
|
||||
spec = importlib.util.spec_from_file_location(
|
||||
"csoc_repair", Path(__file__).with_name("keycape-client-repair.py"),
|
||||
)
|
||||
adapter = importlib.util.module_from_spec(spec)
|
||||
spec.loader.exec_module(adapter)
|
||||
|
||||
|
||||
class RepairTests(unittest.TestCase):
|
||||
|
|
@ -18,7 +21,8 @@ class RepairTests(unittest.TestCase):
|
|||
def fixture(self, clients):
|
||||
raw = ("# keep comment\nauthelia:\n issuer: https://auth.example.invalid\n"
|
||||
" clientSecret: synthetic-marker\nclients:\n" +
|
||||
yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) + "tokenLifetime: 15m\n")
|
||||
yaml.safe_dump(json.loads(json.dumps(clients)), sort_keys=False) +
|
||||
"tokenLifetime: 15m\n")
|
||||
return {"data": {"config.yaml": base64.b64encode(raw.encode()).decode(),
|
||||
"key.pem": "synthetic-key"}}, raw
|
||||
|
||||
|
|
|
|||
|
|
@ -289,8 +289,9 @@ No deployment or credential change was made by these read-only checks.
|
|||
|
||||
```task
|
||||
id: CSOC-WP-0008-T11
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "3a6bdbfb-975e-5c3e-b34f-6eeede402521"
|
||||
```
|
||||
|
||||
Restore the historical NetKingdom public coulomb-social authorization-code/PKCE
|
||||
|
|
@ -304,3 +305,8 @@ this task done on an HTTP redirect or discovery-only check.
|
|||
|
||||
Knowledge receipt: emergent-security 0.2.6 identity, verified-files,
|
||||
orientation-only; digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02.
|
||||
|
||||
Prepared review: docs/release/personal-account-2026-10-06.md.
|
||||
Pending exact live decision: 8bbce691-a787-4140-9cd4-df06e8635a27.
|
||||
Published image and owning chart prep complete; live approval and user acceptance
|
||||
remain pending. No productive data transferred.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue