Confirm p01 human acceptance and finish sitting and fresh login workplans
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
This commit is contained in:
parent
4c4c6dc4d6
commit
cf73346233
7 changed files with 201 additions and 17 deletions
|
|
@ -8,12 +8,12 @@
|
|||
|
||||
| Kind | ID | Status | Lane | Source |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| workplan | INFD-WP-ADHOC-2026-10-03 | blocked | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | INFD-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
|
||||
| workplan | INFD-WP-0003 | finished | — | workplans/INFD-WP-0003-my-decisions-overview.md |
|
||||
| workplan | INFD-WP-0005 | blocked | — | workplans/INFD-WP-0005-frictionless-decision-intake.md |
|
||||
| workplan | INFD-WP-0006 | blocked | — | workplans/INFD-WP-0006-fresh-review-authentication.md |
|
||||
| workplan | INFD-WP-0006 | finished | — | workplans/INFD-WP-0006-fresh-review-authentication.md |
|
||||
| task | INFD-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | INFD-WP-ADHOC-2026-10-03-T02 | wait | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | INFD-WP-ADHOC-2026-10-03-T02 | done | — | workplans/ADHOC-2026-10-03.md |
|
||||
| task | INFD-WP-0003-T01 | done | — | workplans/INFD-WP-0003-my-decisions-overview.md |
|
||||
| task | INFD-WP-0003-T02 | done | — | workplans/INFD-WP-0003-my-decisions-overview.md |
|
||||
| task | INFD-WP-0003-T03 | done | — | workplans/INFD-WP-0003-my-decisions-overview.md |
|
||||
|
|
@ -29,7 +29,7 @@
|
|||
| task | INFD-WP-0005-T09 | done | — | workplans/INFD-WP-0005-frictionless-decision-intake.md |
|
||||
| task | INFD-WP-0005-T10 | wait | — | workplans/INFD-WP-0005-frictionless-decision-intake.md |
|
||||
| task | INFD-WP-0006-T01 | done | — | workplans/INFD-WP-0006-fresh-review-authentication.md |
|
||||
| task | INFD-WP-0006-T02 | wait | — | workplans/INFD-WP-0006-fresh-review-authentication.md |
|
||||
| task | INFD-WP-0006-T02 | done | — | workplans/INFD-WP-0006-fresh-review-authentication.md |
|
||||
| intake | INFD-IN-0001 | closed | blue | intakes/intakes.md |
|
||||
| intake | INFD-IN-0002 | closed | blue | intakes/intakes.md |
|
||||
| intake | INFD-IN-0003 | closed | blue | intakes/intakes.md |
|
||||
|
|
|
|||
|
|
@ -2,9 +2,13 @@
|
|||
|
||||
Deployed on founder instruction "please deploy", 2026-10-03 18:39 UTC.
|
||||
Deployment revision 17 Ready; public health/readiness and fresh-login redirect
|
||||
verified. Native human browser proof pending. Evidence:
|
||||
verified. Rollout evidence:
|
||||
`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
|
||||
Native proof completed at 18:45:15 UTC: founder accepted p01 with fresh signed
|
||||
MFA and confirmed native entry; all four audit events delivered. Receipt:
|
||||
`docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`.
|
||||
|
||||
INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
|
||||
Published immutable candidate:
|
||||
`forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@
|
|||
"kind": "informed-decision-sitting",
|
||||
"id": "infd-sitting-2026-10-03-provisioning-window",
|
||||
"review_group": "net-kingdom-admins",
|
||||
"principal": "pending-human-session",
|
||||
"status": "draft-unsigned",
|
||||
"principal": "uid=platform-root,ou=people,dc=netkingdom,dc=local",
|
||||
"status": "accepted",
|
||||
"hub_decision": "62aa95e4-3ccc-4867-8806-5e3db005b483",
|
||||
"batches": [
|
||||
"infd-batch-2026-10-03-provisioning-window"
|
||||
|
|
@ -11,5 +11,8 @@
|
|||
"memo_count": 1,
|
||||
"excluded_count": 4,
|
||||
"bind_path": "create approval (attended), Flex Auth exact-record admission, load store, human accept",
|
||||
"note": "Unsigned draft. Live bind substitutes pending-human-session with the authenticated key-cape subject."
|
||||
"note": "Human accepted the single admitted p01 memo. Four excluded lanes and broader provisioning decision D1 remain outside this acceptance; RPF-WP-0035-T06 still requires CCR-2026-0018 coordinated disablement.",
|
||||
"accepted_memo_count": 1,
|
||||
"receipt": "docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json",
|
||||
"approved_at": "2026-10-03T18:45:15+00:00"
|
||||
}
|
||||
|
|
|
|||
142
docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json
Normal file
142
docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json
Normal file
|
|
@ -0,0 +1,142 @@
|
|||
{
|
||||
"memo_id": "infd-20261003-p01",
|
||||
"memo_version": 1,
|
||||
"verb": "accept",
|
||||
"actor": {
|
||||
"kind": "person",
|
||||
"sub": "uid=platform-root,ou=people,dc=netkingdom,dc=local"
|
||||
},
|
||||
"presentation_id": "pres-bf1f39e0-a2f0-46d3-bca6-67135bea9bfc",
|
||||
"view_hash": "0f1976b52f13851509d99814d4cf6a8da2f042410ff84540c51484341c6a6bcc",
|
||||
"awareness_hash": "13092bccc782dc2db37b589f71ee135badeabd1b2d2f3ef9541f9020e15fac40",
|
||||
"acknowledgments": [
|
||||
{
|
||||
"highlight_id": "infd-20261003-p01-h1",
|
||||
"at": "2026-10-03T18:45:09.800683+00:00"
|
||||
}
|
||||
],
|
||||
"disposition_id": "disp-1839d9a6-57a8-4ab5-b695-1f5f3bed9ebb",
|
||||
"native_entry_receipt": {
|
||||
"source": "Approval Engine response preserved by confirmed submission",
|
||||
"approval_id": "706f4205-aaa7-44f6-be30-d0f57664d69c",
|
||||
"subject": "uid=platform-root,ou=people,dc=netkingdom,dc=local",
|
||||
"approved_at": "2026-10-03T18:45:15+00:00"
|
||||
},
|
||||
"approval_binding_digest": "sha256:c8a1a9c8fb22616e3aacfb877ba7974feb5eedaed491f856a6c90719c502ebe4",
|
||||
"submission_state": "confirmed",
|
||||
"policy_observations": [
|
||||
{
|
||||
"at": "2026-10-03T18:44:57.121507+00:00",
|
||||
"action": "read",
|
||||
"outcome": "allow",
|
||||
"assurance": {
|
||||
"at": 1791053091,
|
||||
"level": "aal2",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"mfa": true,
|
||||
"source": "key-cape"
|
||||
},
|
||||
"mfa_age_seconds": 6
|
||||
},
|
||||
{
|
||||
"at": "2026-10-03T18:45:09.789770+00:00",
|
||||
"action": "acknowledge",
|
||||
"outcome": "allow",
|
||||
"assurance": {
|
||||
"at": 1791053091,
|
||||
"level": "aal2",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"mfa": true,
|
||||
"source": "key-cape"
|
||||
},
|
||||
"mfa_age_seconds": 18
|
||||
},
|
||||
{
|
||||
"at": "2026-10-03T18:45:09.883802+00:00",
|
||||
"action": "read",
|
||||
"outcome": "allow",
|
||||
"assurance": {
|
||||
"at": 1791053091,
|
||||
"level": "aal2",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"mfa": true,
|
||||
"source": "key-cape"
|
||||
},
|
||||
"mfa_age_seconds": 18
|
||||
},
|
||||
{
|
||||
"at": "2026-10-03T18:45:15.458338+00:00",
|
||||
"action": "accept",
|
||||
"outcome": "allow",
|
||||
"assurance": {
|
||||
"at": 1791053091,
|
||||
"level": "aal2",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"mfa": true,
|
||||
"source": "key-cape"
|
||||
},
|
||||
"mfa_age_seconds": 24
|
||||
},
|
||||
{
|
||||
"at": "2026-10-03T18:45:15.621066+00:00",
|
||||
"action": "read",
|
||||
"outcome": "allow",
|
||||
"assurance": {
|
||||
"at": 1791053091,
|
||||
"level": "aal2",
|
||||
"methods": [
|
||||
"pwd",
|
||||
"otp"
|
||||
],
|
||||
"mfa": true,
|
||||
"source": "key-cape"
|
||||
},
|
||||
"mfa_age_seconds": 24
|
||||
}
|
||||
],
|
||||
"audit_deliveries": [
|
||||
{
|
||||
"id": "ev-b702f95f-d74c-4dbd-9bed-dd03cf624ac2",
|
||||
"class": "informed-decision.presentation",
|
||||
"at": "2026-10-03T18:44:57.000000+00:00",
|
||||
"delivery_state": "delivered",
|
||||
"receiver_reference": "audit:ev-b702f95f-d74c-4dbd-9bed-dd03cf624ac2"
|
||||
},
|
||||
{
|
||||
"id": "ev-869883f0-65e5-40d3-b0e4-149cb1331e56",
|
||||
"class": "informed-decision.presentation",
|
||||
"at": "2026-10-03T18:45:09.000000+00:00",
|
||||
"delivery_state": "delivered",
|
||||
"receiver_reference": "audit:ev-869883f0-65e5-40d3-b0e4-149cb1331e56"
|
||||
},
|
||||
{
|
||||
"id": "ev-32e4ab78-86c6-4759-ab34-8be3f0e72143",
|
||||
"class": "informed-decision.disposition",
|
||||
"at": "2026-10-03T18:45:15.000000+00:00",
|
||||
"delivery_state": "delivered",
|
||||
"receiver_reference": "audit:ev-32e4ab78-86c6-4759-ab34-8be3f0e72143"
|
||||
},
|
||||
{
|
||||
"id": "ev-f20e4679-96a0-49fa-a72f-cd7eec28169c",
|
||||
"class": "informed-decision.disposition",
|
||||
"at": "2026-10-03T18:45:15.000000+00:00",
|
||||
"delivery_state": "delivered",
|
||||
"receiver_reference": "audit:ev-f20e4679-96a0-49fa-a72f-cd7eec28169c"
|
||||
}
|
||||
],
|
||||
"verified_at": "2026-10-03T18:48:04.864046+00:00",
|
||||
"agent_performed_human_act": false,
|
||||
"scope": "Acceptance of CCR-2026-0019 scoped delivery proof only; does not close RPF-WP-0035-T06 or hub decision D1."
|
||||
}
|
||||
|
|
@ -291,7 +291,7 @@ repo: informed-decision
|
|||
lane: blue
|
||||
tags: [cross-repo, authentication]
|
||||
created: '2026-09-16'
|
||||
updated: '2026-09-27'
|
||||
updated: '2026-10-03'
|
||||
description: >-
|
||||
Coordinate with key-cape and the Authelia deployment owner to validate an
|
||||
upgrade supporting prompt=login/max_age, including changed ID-token claims,
|
||||
|
|
@ -329,6 +329,16 @@ description: >-
|
|||
actionable-freshness-error parts of the original ask remain open — keep
|
||||
this intake open for those, or split them into a fresh intake and close
|
||||
this one; operator's call.
|
||||
|
||||
2026-10-03: INFD-WP-0006 restores prompt=login/max_age=0 using the deployed
|
||||
KeyCape KEY-WP-0033 compatibility contract. Narrow image rollout completed;
|
||||
founder signed in, reviewed and accepted infd-20261003-p01. Signed MFA time
|
||||
18:44:51 UTC yielded allowed read/acknowledge/accept and confirmed native
|
||||
entry at 18:45:15 UTC, with four audit events delivered. Receipt:
|
||||
docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json.
|
||||
Fresh-login support and completed-browser proof are resolved. Keep this
|
||||
intake open only for an actionable freshness error and reauthentication UX;
|
||||
do not relax policy or infer freshness from token mint time.
|
||||
state_hub_intake_id: "01a0c14e-f965-788f-8efb-4424f1f1ad08"
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Provisioning-window sitting draft for hub decision D1"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: blocked
|
||||
status: finished
|
||||
owner: claude
|
||||
created: "2026-10-03"
|
||||
updated: "2026-10-03"
|
||||
|
|
@ -37,10 +37,9 @@ batch index. Unsigned; no approval created, nothing submitted.
|
|||
|
||||
```task
|
||||
id: INFD-WP-ADHOC-2026-10-03-T02
|
||||
status: wait
|
||||
needs_human: true
|
||||
status: done
|
||||
needs_human: false
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "p01 is loaded and fresh-login fix deployed; founder must sign in at decisions.coulomb.social/auth/start with password/OTP, open p01, acknowledge the required highlight and choose a disposition. If actual fresh MFA still emits old assurance, KeyCape owns correction under INFD-IN-0005."
|
||||
priority: high
|
||||
state_hub_task_id: "ffbc2e30-7a6a-5fb4-86c9-3db1e4a0bacf"
|
||||
```
|
||||
|
|
@ -136,3 +135,21 @@ at 18:39 UTC (INFD-WP-0006). Revision 17 is Ready; public login now requests
|
|||
fresh authentication from KeyCape. p01 and policy pins remain intact. Native
|
||||
read and the founder's disposition are still pending. See
|
||||
`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
|
||||
A6 completed by the founder at 18:45:15 UTC: p01 accepted, required highlight
|
||||
acknowledged, native Approval Engine entry receipt confirmed for the exact
|
||||
approval/subject/time. The fresh signed MFA timestamp was 18:44:51 UTC; read,
|
||||
acknowledge and accept were allowed within the unchanged 900-second limit.
|
||||
All four presentation/acknowledgment/disposition/result events have delivered
|
||||
Audit Core receiver references. Receipt:
|
||||
`docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`.
|
||||
`sitting.json` now records acceptance by the authenticated human.
|
||||
|
||||
Residual handoff: CCR-2026-0018 coordinated disablement remains in the existing
|
||||
live `RPF-WP-0035-T06` (KeyCape, Approval Engine and Platform owner confirmation).
|
||||
The broader provisioning window and four excluded lanes remain tracked by
|
||||
hub decision D1 `62aa95e4-3ccc-4867-8806-5e3db005b483` and their owner workplans.
|
||||
This acceptance neither closes T06 nor resolves D1. Fresh-login implementation
|
||||
and browser proof are completed in `INFD-WP-0006`; actionable freshness error
|
||||
UX remains the existing live intake `INFD-IN-0005`. No residual is hidden in
|
||||
this finished plan; no agent completed a human disposition.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Request fresh issuer authentication for timed decision reviews"
|
||||
domain: infotech
|
||||
repo: informed-decision
|
||||
status: blocked
|
||||
status: finished
|
||||
owner: codex
|
||||
created: "2026-10-03"
|
||||
updated: "2026-10-03"
|
||||
|
|
@ -41,10 +41,9 @@ browser proof remains T02.
|
|||
|
||||
```task
|
||||
id: INFD-WP-0006-T02
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
needs_human: true
|
||||
blocking_reason: "Fresh-login image deployed on founder approval; founder must complete review password/OTP login so we can verify a new signed authentication time and p01 read allowance."
|
||||
needs_human: false
|
||||
state_hub_task_id: "dfcc2723-42bd-5b8f-b1b8-e205dc506764"
|
||||
```
|
||||
|
||||
|
|
@ -75,3 +74,12 @@ with `prompt=login` and `max_age=0`. Read-only store verification confirms
|
|||
schema 2, retained p01 and v7 policy digest. All process-local sessions reset.
|
||||
Evidence: `docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.
|
||||
T02 remains wait solely for native human browser proof; no agent bound a memo.
|
||||
|
||||
Native proof completed 18:45:15 UTC: founder confirmed the review opened and
|
||||
accepted p01. Live policy observations show signed KeyCape MFA at 18:44:51 UTC,
|
||||
allowed exact p01 read/acknowledge/accept, and MFA age 24 seconds at accept.
|
||||
The exact native approval entry is confirmed and all four audit events delivered.
|
||||
Receipt: `docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`.
|
||||
T02 is done; no policy limit was relaxed. Existing intake `INFD-IN-0005` retains
|
||||
the independent actionable-freshness-error UX requirement, with this proof
|
||||
recorded there. No remaining implementation or native-proof task in this plan.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue