coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record INFD-IN-0005 root cause and key-cape fix

Browse source 
platform-root's refused approval of infd-20260927-b01 reproduced this
intake's predicted failure exactly: key-cape was backdating a
just-completed MFA to a stale kc_login cookie, understating freshness
for flex-auth's 900s review window. Fixed upstream in key-cape
(ADHOC-2026-09-27, commit 911e9de). Left open pending live
confirmation and the remaining prompt=login/max_age work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
This commit is contained in:
tegwick 2026-09-27 19:03:36 +02:00
parent e415ec44c6
commit 37cc80561c
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
intakes/intakes.md
View file

@ -291,7 +291,7 @@ repo: informed-decision
lane: blue
tags: [cross-repo, authentication]
created: '2026-09-16'
updated: '2026-09-16'
updated: '2026-09-27'
description: >-
Coordinate with key-cape and the Authelia deployment owner to validate an
upgrade supporting prompt=login/max_age, including changed ID-token claims,
@ -304,6 +304,18 @@ description: >-
prove the full browser path, not just redirect parameter forwarding.
T03's three human approvals and key check subsequently completed; this is
ongoing authentication reliability work, not an outstanding T03 execution.
2026-09-27: reproduced live — platform-root's attempt to approve
infd-20260927-b01 got policy_denied from flex-auth's compact_sitting
policy despite a just-completed MFA sign-in, matching this intake's
predicted failure exactly. Root cause confirmed and fixed in key-cape
(`ADHOC-2026-09-27`, commit 911e9de): completeAuthorization was reusing an
existing kc_login cookie's IssuedAt even on the two call sites that had
just validated an MFA token in that same request, backdating freshness.
Regression test added; full key-cape suite green. The prompt=login/max_age
and actionable-freshness-error parts of this intake remain open — do not
close until platform-root confirms a live approval succeeds against the
fixed key-cape build.
state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08"
```