coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
informed-decision/deploy/FRESH-AUTH.md
tegwick 2db3dc41e8 Prepare pinned fresh authentication rollout and rollback with container proof 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
2026-10-03 20:36:00 +02:00

2.2 KiB
Raw Blame History

Fresh review authentication rollout candidate

INFD-WP-0006. Source 50adfa0326f2366a2e9d9b5e39d50273e9589e7d. Published immutable candidate: forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885.

Containerfile.fresh-auth inherits the exact running image and adds only informed_decision/oidc.py; all prior layers, non-root user, entrypoint, dependencies and schema remain unchanged. This excludes unadmitted intake changes. Review sign-in requests prompt=login and max_age=0, relying on KeyCape's KEY-WP-0033 upstream compatibility and freshness enforcement. Policy remains v7 with the existing 900-second action limit and native pins.

Validation: 80 browser-authentication tests, installed fresh-login parameter check, base-layer prefix equality, and 11 container lifecycle checks pass. The container proof is fixture-only and predates registry publication; the published digest matches its tested image. Native browser acceptance is pending.

Apply only after founder go-ahead under the attended-window rule in the-custodian/docs/agent-environment-orientation.md §4. Confirm current Deployment still uses the rollback image, unchanged resources, one replica and Recreate; check CPU headroom. Server dry-run the strategic image patch:

kubectl -n informed-decision patch deployment informed-decision --type=strategic --patch-file deploy/fresh-auth-image-patch.json --dry-run=server

After approval, apply the same patch without --dry-run=server, wait for the Deployment, verify public health/readiness, and verify the authorization redirect requests fresh login. The restart invalidates process-local browser sessions. The founder signs in again, completes password and OTP, opens p01 and reviews its packet. Read-only observation must show a new signed MFA time and allowed exact p01 read. Only the founder may acknowledge and bind.

Rollback uses the same command with fresh-auth-image-rollback.json; no new schema is introduced. If actual new MFA still emits old assurance, keep native acceptance blocked on KeyCape's INFD-IN-0005 correction. Do not extend the policy limit or substitute token mint time for authentication time.