key-cape/docs/evidence/2026-09-24-fresh-login-and-account-switch.md

23 lines
1.2 KiB
Markdown
Raw Normal View History

# Fresh login and account switch — 2026-09-24
Issuer image already running:
`forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`
(Forgejo image run 69, source `11ce29a`). No further rollout was made.
The founder completed the browser journeys and reported that both worked.
Issuer telemetry for 23:40–23:46 UTC, event type and client only:
| Time | Event | Client | Result |
|---|---|---|---|
| 23:42:25 | `mfa_failed` | `user-engine-portal` | failure |
| 23:43:20 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:44:45 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:45:37 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:46:10 | `token_exchange_error`, then `auth_failed` | `vergabe-demo-company` | failure |
| 23:46:38 | `auth_success` then `token_issued` | `vergabe-demo-company` | success |
No `stale_upstream_authentication` in the window. Each portal success was a new
`auth_start`, so the earlier session was not silently reused. The Vergabe
token was issued after one failed code exchange, on a second attempt. Already
issued application JWTs are not revoked by provider logout.