coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix missing live Informed Decision browser registration

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 02:54:53 +02:00
parent 6fb35d953b
commit 65c83dedbf
2 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/keycape-client-registration.md
View file

@ -3,8 +3,8 @@
**Workplan task:** `INFD-WP-0001-T07` **Workplan task:** `INFD-WP-0001-T07`
**For:** `key-cape` (`KEY-WP-0013-T02`, `KEY-WP-0013-T05`) **For:** `key-cape` (`KEY-WP-0013-T02`, `KEY-WP-0013-T05`)
**Status:** **submitted 2026-09-10** (`INFD-WP-0001-T07` done). The **Status:** **submitted 2026-09-10** (`INFD-WP-0001-T07` done). The
origin is live. Registration rollout and a native human token accepted by origin is live. Registration rollout completed on 2026-09-14; a native human token accepted by
Approval Engine remain T08; the browser login implementation is described in Approval Engine remains T08; the browser login implementation is described in
[browser-authentication.md](browser-authentication.md). [browser-authentication.md](browser-authentication.md).
**Rulings:** `GH-DEC-2026-012`, `GH-DEC-2026-013` **Rulings:** `GH-DEC-2026-012`, `GH-DEC-2026-013`
**Contracts cited:** `key-cape/docs/approval-engine-auth-contract.md`, **Contracts cited:** `key-cape/docs/approval-engine-auth-contract.md`,
@ -196,3 +196,19 @@ exact scopes, tenant provenance and MFA facts before assigning the
`authentication-derived` route. The generic provenance guard continues refusing `authentication-derived` route. The generic provenance guard continues refusing
registration-only assertions. This is a checked source contract, not a claim registration-only assertions. This is a checked source contract, not a claim
that the current deployed issuer or a native human login has been verified here. that the current deployed issuer or a native human login has been verified here.
### Live browser registration correction — 2026-09-14
The user's login exposed `invalid_profile_usage: unknown client_id`: the public
`informed-decision-approver` registration existed in the source example but was
absent from live KeyCape. Applied exactly the existing admitted registration,
with UID/resourceVersion guards and byte-preserving insertion; unrelated clients,
configuration, signing key and pinned image were preserved. KeyCape is ready.
The actual review-site `/auth/start` now redirects through KeyCape to
`auth.coulomb.social`. Wrong redirect, consume scope and absent PKCE are refused.
Receipt: key-cape/docs/evidence/2026-09-14-informed-decision-browser-registration.json.
Repeatable contained helper: key-cape/tools/register-informed-decision.py
(default preflight; --apply mutates only a missing exact registration).
Human callback/MFA/token proof and T03 approval entries remain pending. The
previous ready check established service health, not browser login acceptance.

16
workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md
View file

@ -809,3 +809,19 @@ verify and exec using scoped attended authority, and capture native denial,
revocation, workload health and key-check evidence. No OpenRouter credential has revocation, workload health and key-check evidence. No OpenRouter credential has
been read and no inference or spend was performed. T03 remains waiting; this been read and no inference or spend was performed. T03 remains waiting; this
entry supersedes earlier statements that requester or group admission is missing. entry supersedes earlier statements that requester or group admission is missing.
### Live browser registration correction — 2026-09-14
The user's login exposed `invalid_profile_usage: unknown client_id`: the public
`informed-decision-approver` registration existed in the source example but was
absent from live KeyCape. Applied exactly the existing admitted registration,
with UID/resourceVersion guards and byte-preserving insertion; unrelated clients,
configuration, signing key and pinned image were preserved. KeyCape is ready.
The actual review-site `/auth/start` now redirects through KeyCape to
`auth.coulomb.social`. Wrong redirect, consume scope and absent PKCE are refused.
Receipt: key-cape/docs/evidence/2026-09-14-informed-decision-browser-registration.json.
Repeatable contained helper: key-cape/tools/register-informed-decision.py
(default preflight; --apply mutates only a missing exact registration).
Human callback/MFA/token proof and T03 approval entries remain pending. The
previous ready check established service health, not browser login acceptance.