Track fresh review authentication compatibility residual

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

intakes/intakes.md

@@ -274,3 +274,34 @@ description: >-
   finding: docs/finding-r3-linkage-conflict.md.
 state_hub_intake_id: "01a08b30-b7e7-70a6-9139-2eac8c1f6611"
 ```
+
+
+## INFD-IN-0005 — Reliable fresh authentication for timed reviews
+
+```yaml
+id: INFD-IN-0005
+kind: intake
+title: Reliable fresh authentication for timed reviews
+status: open
+origin: residual
+origin_ref: SECRETS-WP-0010
+priority: high
+owner: informed-decision
+repo: informed-decision
+lane: blue
+tags: [cross-repo, authentication]
+created: '2026-09-16'
+updated: '2026-09-16'
+description: >-
+  Coordinate with key-cape and the Authelia deployment owner to validate an
+  upgrade supporting prompt=login/max_age, including changed ID-token claims,
+  existing clients and rollback. Authelia 4.38 rejected even fresh sign-in in
+  native logs; the review parameter change was rolled back (cbea539). Retain
+  the 900-second review MFA requirement. Verify KeyCape preserves the original
+  timestamp for reused authentication and records a new timestamp only after
+  actual reauthentication; completeAuthorization currently copies a prior
+  session timestamp even after MFA. Provide an actionable freshness error and
+  prove the full browser path, not just redirect parameter forwarding.
+  T03's three human approvals and key check subsequently completed; this is
+  ongoing authentication reliability work, not an outstanding T03 execution.
+```