informed-decision/workplans/INFD-WP-0006-fresh-review-authentication.md

id	type	title	domain	repo	status	owner	created	updated	related	state_hub_workstream_id
INFD-WP-0006	workplan	Request fresh issuer authentication for timed decision reviews	infotech	informed-decision	finished	codex	2026-10-03	2026-10-03	INFD-IN-0005 KEY-WP-0033 INFD-WP-ADHOC-2026-10-03	672505ec-cf29-5b5d-b133-f839b0f1499f

Request fresh authentication on review sign-in

id: INFD-WP-0006-T01
status: done
priority: high
state_hub_task_id: "047272eb-3360-5b33-aba3-4e58d3e9f5ec"

The founder reported signing out through users.coulomb.social and entering password and OTP again in the same browser, but p01 read still carried the 17:08:08 UTC authentication time. Portal and review sessions are independent. Review sign-in currently permits reused KeyCape assurance. Request prompt=login and max_age=0 via the existing state/nonce/PKCE flow, using KeyCape's completed KEY-WP-0033 compatibility implementation. Retain the signed authentication timestamp and every action policy freshness check. Update the existing browser authentication regression and document the owner contract. No new identity assertion or local authorization decision.

Implemented and validated: all 80 browser-authentication tests pass, including preservation of the issuer's original signed authentication time. The candidate uses Containerfile.fresh-auth to replace only oidc.py in the exact admitted image, excluding pending intake implementation and schema migration. Native browser proof remains T02.

Deploy and prove the fresh browser journey

id: INFD-WP-0006-T02
status: done
priority: high
needs_human: false
state_hub_task_id: "dfcc2723-42bd-5b8f-b1b8-e205dc506764"

Source tests are insufficient for native admission. Publish the exact tested source and prepare the existing deployment image update with previous image rollback; preserve runtime policy and memo pins. Live replacement needs the founder's go under the agent environment orientation attended-window rule. The founder alone completes password/OTP and any disposition. Verify the signed timestamp is new and exact p01 read is allowed. If genuine fresh MFA still reports the prior time, KeyCape must correct assurance issuance under INFD-IN-0005; if its upstream freshness check fails, KeyCape/Authelia own that dependency. Do not increase the 900-second action limit to mask either issue.

Candidate published at sha256:ccca0b377bb8ba6af52a37edc453b5b51c96e380840ec8243ffaab3ac2170885. Installed fresh-login parameter check, base-layer equality check and all 11 container lifecycle checks pass. Concrete rollout/rollback and acceptance requirements are in deploy/FRESH-AUTH.md; image-only strategic patches are prepared alongside it. Live deployment has not changed.

2026-10-03 18:39 UTC: founder instructed "please deploy". ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. Image-only patch deployed successfully as Deployment revision 17, one Ready replica, Recreate, unchanged 5m CPU/64Mi memory requests. Node preflight showed 3445m of 4000m CPU requested; no additional request introduced. Public health and readiness return 200; public sign-in redirects to the exact KeyCape issuer with prompt=login and max_age=0. Read-only store verification confirms schema 2, retained p01 and v7 policy digest. All process-local sessions reset. Evidence: docs/evidence/2026-10-03-fresh-auth-live-rollout.json. T02 remains wait solely for native human browser proof; no agent bound a memo.

Native proof completed 18:45:15 UTC: founder confirmed the review opened and accepted p01. Live policy observations show signed KeyCape MFA at 18:44:51 UTC, allowed exact p01 read/acknowledge/accept, and MFA age 24 seconds at accept. The exact native approval entry is confirmed and all four audit events delivered. Receipt: docs/evidence/2026-10-03-provisioning-window-p01-acceptance.json. T02 is done; no policy limit was relaxed. Existing intake INFD-IN-0005 retains the independent actionable-freshness-error UX requirement, with this proof recorded there. No remaining implementation or native-proof task in this plan.