4c3c528644
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
1.1 KiB
1.1 KiB
| id | type | title | domain | repo | status | owner | topic_slug | planning_priority | planning_order | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| FLEX-WP-0018 | workplan | Inbound caller-auth and deployment documentation corrections | infotech | flex-auth | finished | codex | netkingdom | P2 | 118 | 2026-08-23 | 2026-08-23 | 8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f |
Classify rejected TokenReview credentials as unauthenticated
id: FLEX-WP-0018-T01
status: done
priority: medium
state_hub_task_id: "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b"
Treat a successful TokenReview response that rejects a bearer token as an authentication failure (HTTP 401), while retaining HTTP 503 for transport, HTTP, and response-decode failures. Regression coverage exercises the reviewer and authenticator seam.
Correct NetworkPolicy egress documentation
id: FLEX-WP-0018-T02
status: done
priority: low
state_hub_task_id: "5613aeb1-ad09-50e5-9933-ced39593dc54"
Document that caller-authenticated pins permit TCP 443 and 6443 without a destination selector for Kubernetes TokenReview, while pins without caller authentication retain deny-all egress.