coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Request fresh KeyCape login for timed reviews with narrow image candidate

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
tegwick 2026-10-03 20:33:34 +02:00
parent 219d83ad1b
commit 2d2161bc64
7 changed files with 83 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/browser-authentication.md
View file

@ -57,6 +57,15 @@ MFA `at` is preserved as authentication time. A successful login does not assert
that MFA meets an action-specific freshness policy; the policy integration must
use these facts for the action. No local approval verdict is inferred.
Review sign-in requests `prompt=login` and `max_age=0` from KeyCape. Its
`KEY-WP-0033` implementation translates those parameters for Authelia 4.38 and
enforces the exact requested freshness against verified upstream authentication
time. It also refuses to reuse the existing KeyCape assurance for that login.
The earlier rollback predated this owner fix. Review policy still independently
requires signed MFA within 900 seconds; neither login nor token mint time
replaces authentication time. Portal sign-in does not refresh an existing review
session: start review sign-in again after authenticating elsewhere.
Sessions last at most fifteen minutes and never outlive either token. They are
bounded to 1,024 entries, protected by a process lock, rotated on sign-in and
deleted on sign-out/expiry. Restart requires reauthentication. This is a

2
docs/evidence/2026-10-03-provisioning-window-review-refusal.json
View file

@ -9,7 +9,7 @@
"mfa_age_at_request_seconds": 4781,
"maximum_mfa_age_seconds": 900,
"identity_and_memo_pins_match": true,
"fresh_password_and_otp_on_latest_attempt": "awaiting operator confirmation",
"fresh_password_and_otp_on_latest_attempt": "Founder reports logout through users.coulomb.social followed by password and OTP login in the same browser; review request still carries the old signed time.",
"dependency": "INFD-IN-0005",
"next_step": "Complete KeyCape /account/logout and upstream browser sign-out, then fresh password/OTP login. If the signed authentication time remains old after real OTP, KeyCape owns the correction and completed-browser proof.",
"policy_relaxed": false,