coulomb/coulomb-social
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
coulomb-social/docs/security-close-down-checklist.md
tegwick 1272c699b0
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 3m48s
Details
Record deployed personal app and remaining Authelia credential rejection 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
2026-10-06 17:02:16 +02:00

1.1 KiB
Raw Blame History

Coulomb sign-in close-down record

2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication) and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06.

The historical public authorization-code/PKCE client descriptor has mfaRequired: false: ordinary sessions are AAL1; explicit AAL2 remains supported. Restoration retained that historical policy, with no changes to other clients. Before production approval, the owners must decide and verify whether ordinary personal sessions may remain AAL1, which actions require step-up, and that PKCE, exact callbacks and tenant checks are enforced by the running issuer/application. Do not treat successful discovery, synthetic tests or a registered Member as proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending.

Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence; CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged.