# Fresh review authentication rollout candidate

Deployed on founder instruction "please deploy", 2026-10-03 18:39 UTC.
Deployment revision 17 Ready; public health/readiness and fresh-login redirect
verified. Rollout evidence:
`docs/evidence/2026-10-03-fresh-auth-live-rollout.json`.

Native proof completed at 18:45:15 UTC: founder accepted p01 with fresh signed
MFA and confirmed native entry; all four audit events delivered. Receipt:
`docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json`.

INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
Published immutable candidate:
`forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.

`Containerfile.fresh-auth` inherits the exact running image and adds only
`informed_decision/oidc.py`; all prior layers, non-root user, entrypoint,
dependencies and schema remain unchanged. This excludes unadmitted intake
changes. Review sign-in requests `prompt=login` and `max_age=0`, relying on
KeyCape's KEY-WP-0033 upstream compatibility and freshness enforcement.
Policy remains v7 with the existing 900-second action limit and native pins.

Validation: 80 browser-authentication tests, installed fresh-login parameter
check, base-layer prefix equality, and 11 container lifecycle checks pass.
The container proof is fixture-only and predates registry publication; the
published digest matches its tested image. Native browser acceptance is pending.

Apply only after founder go-ahead under the attended-window rule in
`the-custodian/docs/agent-environment-orientation.md` §4. Confirm current
Deployment still uses the rollback image, unchanged resources, one replica
and Recreate; check CPU headroom. Server dry-run the strategic image patch:

```sh
kubectl -n informed-decision patch deployment informed-decision --type=strategic --patch-file deploy/fresh-auth-image-patch.json --dry-run=server
```

After approval, apply the same patch without `--dry-run=server`, wait for the
Deployment, verify public health/readiness, and verify the authorization
redirect requests fresh login. The restart invalidates process-local browser
sessions. The founder signs in again, completes password and OTP, opens p01
and reviews its packet. Read-only observation must show a new signed MFA time
and allowed exact p01 read. Only the founder may acknowledge and bind.

Rollback uses the same command with `fresh-auth-image-rollback.json`; no new
schema is introduced. If actual new MFA still emits old assurance, keep native
acceptance blocked on KeyCape's INFD-IN-0005 correction. Do not extend the
policy limit or substitute token mint time for authentication time.