Prepare pinned fresh authentication rollout and rollback with container proof

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae

deploy/FRESH-AUTH.md

@@ -0,0 +1,38 @@
+# Fresh review authentication rollout candidate
+
+INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
+Published immutable candidate:
+`forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
+
+`Containerfile.fresh-auth` inherits the exact running image and adds only
+`informed_decision/oidc.py`; all prior layers, non-root user, entrypoint,
+dependencies and schema remain unchanged. This excludes unadmitted intake
+changes. Review sign-in requests `prompt=login` and `max_age=0`, relying on
+KeyCape's KEY-WP-0033 upstream compatibility and freshness enforcement.
+Policy remains v7 with the existing 900-second action limit and native pins.
+
+Validation: 80 browser-authentication tests, installed fresh-login parameter
+check, base-layer prefix equality, and 11 container lifecycle checks pass.
+The container proof is fixture-only and predates registry publication; the
+published digest matches its tested image. Native browser acceptance is pending.
+
+Apply only after founder go-ahead under the attended-window rule in
+`the-custodian/docs/agent-environment-orientation.md` §4. Confirm current
+Deployment still uses the rollback image, unchanged resources, one replica
+and Recreate; check CPU headroom. Server dry-run the strategic image patch:
+
+```sh
+kubectl -n informed-decision patch deployment informed-decision --type=strategic --patch-file deploy/fresh-auth-image-patch.json --dry-run=server
+```
+
+After approval, apply the same patch without `--dry-run=server`, wait for the
+Deployment, verify public health/readiness, and verify the authorization
+redirect requests fresh login. The restart invalidates process-local browser
+sessions. The founder signs in again, completes password and OTP, opens p01
+and reviews its packet. Read-only observation must show a new signed MFA time
+and allowed exact p01 read. Only the founder may acknowledge and bind.
+
+Rollback uses the same command with `fresh-auth-image-rollback.json`; no new
+schema is introduced. If actual new MFA still emits old assurance, keep native
+acceptance blocked on KeyCape's INFD-IN-0005 correction. Do not extend the
+policy limit or substitute token mint time for authentication time.

deploy/fresh-auth-image-patch.json

@@ -0,0 +1,14 @@
+{
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [
+          {
+            "name": "informed-decision",
+            "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885"
+          }
+        ]
+      }
+    }
+  }
+}

deploy/fresh-auth-image-rollback.json

@@ -0,0 +1,14 @@
+{
+  "spec": {
+    "template": {
+      "spec": {
+        "containers": [
+          {
+            "name": "informed-decision",
+            "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:0557edffb0efccc2e283cb878bc3f85deacd8165b45eefde830c21f6f02710c8"
+          }
+        ]
+      }
+    }
+  }
+}

docs/evidence/2026-10-03-fresh-auth-container-proof.json

@@ -0,0 +1,30 @@
+{
+  "status": "passed",
+  "image_id": "sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885",
+  "repo_digests": [
+    "forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885"
+  ],
+  "checks_passed": 11,
+  "checks": [
+    "installed container entrypoint serves with projected configuration",
+    "non-root read-only runtime has no external network or published port",
+    "private config/database modes enforced; package installer absent",
+    "configured review refuses anonymous access and reports audit-unready status",
+    "a second writer cannot acquire the active evidence volume",
+    "synthetic uncertain intent and undelivered evidence remain explicit",
+    "consistent backup created while serving; overwrite refused",
+    "SIGTERM closes the serving writer without forced kill",
+    "restart preserves immutable content and unresolved submission without retry",
+    "separate restored volume preserves exact content and unresolved state",
+    "incomplete owner configuration exits before serving"
+  ],
+  "fixture_only": true,
+  "external_network": "none",
+  "content_snapshot_sha256": "6a090cbcd59f79355d8563ca64fea30e1cb2f0cad72145974a816042ddedad3a",
+  "native_identity_policy_audit_proven": false,
+  "published": false,
+  "deployed": false,
+  "factory_attempts": 0,
+  "paid_model_calls": 0,
+  "cleanup_complete": true
+}

workplans/INFD-WP-0006-fresh-review-authentication.md

@@ -42,7 +42,7 @@ id: INFD-WP-0006-T02
 status: wait
 priority: high
 needs_human: true
-blocking_reason: "Publish and prepare a pinned review image, obtain founder approval for the live rollout, then complete human password/OTP login and verify a new signed authentication time and p01 read allowance."
+blocking_reason: "Narrow pinned review image and rollback are published/prepared; obtain founder approval for the live rollout, then complete human password/OTP login and verify a new signed authentication time and p01 read allowance."
 ```
 
 Source tests are insufficient for native admission. Publish the exact tested
@@ -54,3 +54,10 @@ signed timestamp is new and exact p01 read is allowed. If genuine fresh MFA
 still reports the prior time, KeyCape must correct assurance issuance under
 INFD-IN-0005; if its upstream freshness check fails, KeyCape/Authelia own that
 dependency. Do not increase the 900-second action limit to mask either issue.
+
+Candidate published at
+`sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
+Installed fresh-login parameter check, base-layer equality check and all 11
+container lifecycle checks pass. Concrete rollout/rollback and acceptance
+requirements are in `deploy/FRESH-AUTH.md`; image-only strategic patches are
+prepared alongside it. Live deployment has not changed.