From 836cc2a56d3699fe5d8632040f3c31118c2a9f70 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 16 Sep 2026 02:12:45 +0200 Subject: [PATCH] Track fresh review authentication compatibility residual Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- intakes/intakes.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/intakes/intakes.md b/intakes/intakes.md index f2433ba..f54e6ff 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -274,3 +274,34 @@ description: >- finding: docs/finding-r3-linkage-conflict.md. state_hub_intake_id: "01a08b30-b7e7-70a6-9139-2eac8c1f6611" ``` + + +## INFD-IN-0005 — Reliable fresh authentication for timed reviews + +```yaml +id: INFD-IN-0005 +kind: intake +title: Reliable fresh authentication for timed reviews +status: open +origin: residual +origin_ref: SECRETS-WP-0010 +priority: high +owner: informed-decision +repo: informed-decision +lane: blue +tags: [cross-repo, authentication] +created: '2026-09-16' +updated: '2026-09-16' +description: >- + Coordinate with key-cape and the Authelia deployment owner to validate an + upgrade supporting prompt=login/max_age, including changed ID-token claims, + existing clients and rollback. Authelia 4.38 rejected even fresh sign-in in + native logs; the review parameter change was rolled back (cbea539). Retain + the 900-second review MFA requirement. Verify KeyCape preserves the original + timestamp for reused authentication and records a new timestamp only after + actual reauthentication; completeAuthorization currently copies a prior + session timestamp even after MFA. Provide an actionable freshness error and + prove the full browser path, not just redirect parameter forwarding. + T03's three human approvals and key check subsequently completed; this is + ongoing authentication reliability work, not an outstanding T03 execution. +```