tegwick
c473f1971d
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
37 lines
931 B
Markdown
37 lines
931 B
Markdown
---
|
|
id: ADHOC-2026-08-23
|
|
type: workplan
|
|
title: "Inbound caller-auth and deployment documentation corrections"
|
|
domain: infotech
|
|
repo: flex-auth
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
---
|
|
|
|
## Classify rejected TokenReview credentials as unauthenticated
|
|
|
|
```task
|
|
id: ADHOC-2026-08-23-T01
|
|
status: done
|
|
priority: medium
|
|
```
|
|
|
|
Treat a successful TokenReview response that rejects a bearer token as an
|
|
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
|
|
HTTP, and response-decode failures. Regression coverage exercises the reviewer
|
|
and authenticator seam.
|
|
|
|
## Correct NetworkPolicy egress documentation
|
|
|
|
```task
|
|
id: ADHOC-2026-08-23-T02
|
|
status: done
|
|
priority: low
|
|
```
|
|
|
|
Document that caller-authenticated pins permit TCP 443 and 6443 without a
|
|
destination selector for Kubernetes TokenReview, while pins without caller
|
|
authentication retain deny-all egress.
|