coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile public registration acceptance residuals

Browse source
This commit is contained in:
tegwick 2026-08-14 19:35:46 +02:00
parent b5a4af7bf0
commit 688215f831
4 changed files with 40 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

21
workplans/CSOC-WP-0003-self-registration-and-assurance.md
View file

@ -8,7 +8,7 @@ status: finished
owner: bernd
topic_slug: coulomb-social
created: "2026-08-09"
updated: "2026-08-12"
updated: "2026-08-14"
depends_on:
- CSOC-WP-0002
- NK-WP-0025
@ -22,10 +22,10 @@ state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
creation entry point and optional profile/action step-up.
**Finished 2026-08-12:** app-side work complete. Existing-user login on
**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account**
is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits
on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below.
**Finished 2026-08-12; acceptance reconciled 2026-08-14:** existing-user login
on **`app.coulomb.social`** is proven (tegwick, AAL1). Public Case B subsequently
completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a
repeat login retaining exactly one Member under NK-WP-0025.
## T01 - Preserve and prove first-login JIT profile creation
@ -80,16 +80,17 @@ state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) |
| B — brand-new public registration → OIDC → Member | **done 2026-08-14** (`NK-WP-0025`) |
Negatives checklist parked in `docs/identity/smoke.md`; execution residual
**CSOC-IN-0002**.
The negative checklist is reconciled in `docs/identity/smoke.md`. Redirect,
issuer+subject idempotency, and assurance checks passed; `CSOC-IN-0002` is
narrowed to direct callback-replay and email-only takeover regressions.
## Residuals (live records)
| Id | Role |
|----|------|
| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships |
| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) |
| `CSOC-IN-0001` | **closed** — Create account and Case B are live and evidenced |
| `CSOC-IN-0002` | **open, narrowed** — callback replay and email-only takeover regressions |
Source: `docs/intakes/csoc-residuals.md`.