coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record why the live overview is refused: MFA age 1744 s against 900 (INFD-WP-0004-T01)

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 359683@bnt-lap001
Assistant-Session: eebdc939-7a9b-4e50-9d39-c8437e8a14ec
This commit is contained in:
tegwick 2026-09-21 22:48:25 +02:00
parent f47805bece
commit b105f93b80
3 changed files with 24 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/evidence/2026-09-21-overview-read-refusal.json Normal file
View file

@ -0,0 +1,16 @@
{
"task": "INFD-WP-0004-T01",
"observed_by": "operator, read-only query of live policy_observations",
"checks": "4 latest read checks at 2026-09-21T20:37:40Z (memo:infd-20260914-d02, d03, d04, memo:infd-20260921-b01), all policy_denied",
"subject_attributes_match_policy": {
"groups_contains_net_kingdom_admins": true,
"tenant_source": "directory-asserted",
"principal_type_source": "authentication-derived",
"level": "aal2",
"methods": ["pwd", "otp"]
},
"auth_age_at_check_seconds": 1744,
"policy_maximum_age_seconds": 900,
"finding": "The only failing condition is MFA freshness. The operator reported a fresh sign-in, but the assurance timestamp KeyCape supplied was about 29 minutes old at check time. This is consistent with INFD-IN-0005 (a reused session, or a prior timestamp carried forward). There is no identity or group regression. The three SECRETS-WP-0010-T03 memos are additionally outside the served compact-sitting v2 package.",
"consequence": "A browsing overview cannot rely on the binding-grade read bar. Pursue the list action (INFD-IN-0008) and continue INFD-IN-0005 separately for binding."
}

4
docs/flex-auth-request-list-action.md
View file

@ -28,7 +28,9 @@ consequences:
previous session's timestamp even after an actual MFA (`INFD-IN-0005`). previous session's timestamp even after an actual MFA (`INFD-IN-0005`).
Authelia 4.38 cannot be made to force reauthentication (`cbea539`). So a Authelia 4.38 cannot be made to force reauthentication (`cbea539`). So a
browsing session usually cannot meet a bar designed for binding. browsing session usually cannot meet a bar designed for binding.
Confirming this against the live policy observations is pending. Confirmed on 2026-09-21: all four latest checks matched every identity
condition except age, which was 1744 seconds against 900
(`docs/evidence/2026-09-21-overview-read-refusal.json`).
2. **The three `SECRETS-WP-0010-T03-*` memos are out of scope for good.** They 2. **The three `SECRETS-WP-0010-T03-*` memos are out of scope for good.** They
were admitted under `informed-decision.t03-review`. The served sitting were admitted under `informed-decision.t03-review`. The served sitting
package does not name them, so their own reviewer cannot see their outcome. package does not name them, so their own reviewer cannot see their outcome.

6
workplans/INFD-WP-0004-comfortable-decision-review.md
View file

@ -41,7 +41,7 @@ split *seeing your decisions* from *reviewing one for binding*:
```task ```task
id: INFD-WP-0004-T01 id: INFD-WP-0004-T01
status: wait status: done
priority: high priority: high
state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8" state_hub_task_id: "513e91cf-6063-5a39-9f4d-af3976bb29a8"
``` ```
@ -53,6 +53,10 @@ If a group, level or method differs from the rule, that is a separate identity
regression and needs fixing regardless of `list`. Record the finding under regression and needs fixing regardless of `list`. Record the finding under
`docs/evidence/`. `docs/evidence/`.
**Finding (2026-09-21):** only freshness fails. `auth_age_at_check_s` was
1744 against 900, and groups, sources, level and methods all match. See
`docs/evidence/2026-09-21-overview-read-refusal.json`.
## Request the `list` policy from flex-auth ## Request the `list` policy from flex-auth
```task ```task