Use-case regression gate / usecase-regressions (push) Has been cancelled

Details

Prepare persistent personal app release and guarded OIDC repair

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

2026-10-06 15:14:38 +02:00

1.9 KiB

Raw Blame History

user-engine application binding

Field	Value
application id	`coulomb-social` (`USER_ENGINE_APPLICATION_ID`)
display name	coulomb.social
tenant (v1)	`tenant:coulomb` (KeyCape default; Binky friendly slug later)
identity link	`(issuer, sub)` via user-engine `GET /api/v1/me` auto-provision
local row	`members.Member` (no passwords)
live base URL	`https://users.92-205-62-239.nip.io` (cluster ingress)

Runtime

Mode	When	Behavior
stub	`USER_ENGINE_BASE_URL` or `USER_ENGINE_PROXY_SECRET` empty	Deterministic `user_id` from sha256(iss\|sub)
http	both set	Trusted-proxy `GET /api/v1/me` with IAM-shaped claims envelope

Trusted proxy envelope

user-engine accepts claims only when:

X-User-Engine-Proxy-Secret: <secret from user-engine-runtime>
X-Verified-Oidc-Claims: {"iss","sub","tenant","principal_type","aud",...}

aud must include the portal audience user-engine-portal (deployed expectation) plus coulomb-social. Trust is the proxy secret; claims were verified by KeyCape OIDC at the app edge.

Governed credential configuration

Live HTTP mode already uses mounted runtime credential references. Do not extract the proxy secret with kubectl/jsonpath or print it into shell/chat. For a new credential need, run warden route find "user-engine trusted proxy credential" --json and follow the owning OpenBao/platform lane. Interactive personal login belongs to KeyCape/NetKingdom; it does not require retrieving this server credential.

Profile attributes (shell only)

display name (OIDC name / user-engine user.display_name)
email (optional)

Bubble content fields are not part of this binding.

Live probe (2026-08-09)

GET /api/v1/me with probe claims returned user_id usr_… and actor.tenant=tenant:coulomb (HTTP 200).

1.9 KiB Raw Blame History