tegwick
2db3dc41e8
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029c-c003-7283-acc9-930b434e6cae
38 lines
2.2 KiB
Markdown
38 lines
2.2 KiB
Markdown
# Fresh review authentication rollout candidate
|
|
|
|
INFD-WP-0006. Source `50adfa0326f2366a2e9d9b5e39d50273e9589e7d`.
|
|
Published immutable candidate:
|
|
`forgejo.coulomb.social/coulomb/informed-decision@sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885`.
|
|
|
|
`Containerfile.fresh-auth` inherits the exact running image and adds only
|
|
`informed_decision/oidc.py`; all prior layers, non-root user, entrypoint,
|
|
dependencies and schema remain unchanged. This excludes unadmitted intake
|
|
changes. Review sign-in requests `prompt=login` and `max_age=0`, relying on
|
|
KeyCape's KEY-WP-0033 upstream compatibility and freshness enforcement.
|
|
Policy remains v7 with the existing 900-second action limit and native pins.
|
|
|
|
Validation: 80 browser-authentication tests, installed fresh-login parameter
|
|
check, base-layer prefix equality, and 11 container lifecycle checks pass.
|
|
The container proof is fixture-only and predates registry publication; the
|
|
published digest matches its tested image. Native browser acceptance is pending.
|
|
|
|
Apply only after founder go-ahead under the attended-window rule in
|
|
`the-custodian/docs/agent-environment-orientation.md` §4. Confirm current
|
|
Deployment still uses the rollback image, unchanged resources, one replica
|
|
and Recreate; check CPU headroom. Server dry-run the strategic image patch:
|
|
|
|
```sh
|
|
kubectl -n informed-decision patch deployment informed-decision --type=strategic --patch-file deploy/fresh-auth-image-patch.json --dry-run=server
|
|
```
|
|
|
|
After approval, apply the same patch without `--dry-run=server`, wait for the
|
|
Deployment, verify public health/readiness, and verify the authorization
|
|
redirect requests fresh login. The restart invalidates process-local browser
|
|
sessions. The founder signs in again, completes password and OTP, opens p01
|
|
and reviews its packet. Read-only observation must show a new signed MFA time
|
|
and allowed exact p01 read. Only the founder may acknowledge and bind.
|
|
|
|
Rollback uses the same command with `fresh-auth-image-rollback.json`; no new
|
|
schema is introduced. If actual new MFA still emits old assurance, keep native
|
|
acceptance blocked on KeyCape's INFD-IN-0005 correction. Do not extend the
|
|
policy limit or substitute token mint time for authentication time.
|