coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Track fresh review authentication compatibility residual

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-16 02:12:45 +02:00
parent cbea539d08
commit 836cc2a56d
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
intakes/intakes.md
View file

@ -274,3 +274,34 @@ description: >-
finding: docs/finding-r3-linkage-conflict.md.
state_hub_intake_id: "01a08b30-b7e7-70a6-9139-2eac8c1f6611"
```
## INFD-IN-0005 — Reliable fresh authentication for timed reviews
```yaml
id: INFD-IN-0005
kind: intake
title: Reliable fresh authentication for timed reviews
status: open
origin: residual
origin_ref: SECRETS-WP-0010
priority: high
owner: informed-decision
repo: informed-decision
lane: blue
tags: [cross-repo, authentication]
created: '2026-09-16'
updated: '2026-09-16'
description: >-
Coordinate with key-cape and the Authelia deployment owner to validate an
upgrade supporting prompt=login/max_age, including changed ID-token claims,
existing clients and rollback. Authelia 4.38 rejected even fresh sign-in in
native logs; the review parameter change was rolled back (cbea539). Retain
the 900-second review MFA requirement. Verify KeyCape preserves the original
timestamp for reused authentication and records a new timestamp only after
actual reauthentication; completeAuthorization currently copies a prior
session timestamp even after MFA. Provide an actionable freshness error and
prove the full browser path, not just redirect parameter forwarding.
T03's three human approvals and key check subsequently completed; this is
ongoing authentication reliability work, not an outstanding T03 execution.
```