From 0647301c0310fc95a137cc9158848c69c8e4c159 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 12 Sep 2026 02:53:55 +0200 Subject: [PATCH] Record published fresh-login image and attended rollout gate Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- workplans/KEY-WP-0033-vergabe-fresh-login.md | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/workplans/KEY-WP-0033-vergabe-fresh-login.md b/workplans/KEY-WP-0033-vergabe-fresh-login.md index f94cb67..ff3dc72 100644 --- a/workplans/KEY-WP-0033-vergabe-fresh-login.md +++ b/workplans/KEY-WP-0033-vergabe-fresh-login.md @@ -10,6 +10,7 @@ topic_slug: netkingdom created: "2026-09-12" updated: "2026-09-12" related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025] +state_hub_workstream_id: "144dd430-1a09-51e1-9aad-e799ee86c338" --- ## Forward login freshness to the actual authentication provider @@ -18,6 +19,7 @@ related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025] id: KEY-WP-0033-T01 status: done priority: high +state_hub_task_id: "fe05486b-f079-503b-ade1-fca65bf64b34" ``` KeyCape parsed prompt=login and max_age but dropped them before Authelia. @@ -31,8 +33,10 @@ contains four service clients and the admitted human approver client. ```task id: KEY-WP-0033-T02 -status: todo +status: wait +blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout." priority: high +state_hub_task_id: "7b58f08c-6063-554a-8700-a1edbc805ca4" ``` Publish the exact source and validate current live config before replacing the @@ -44,3 +48,9 @@ assertion or MFA downgrade. Confirm prompt=login reaches Authelia through the live redirect, wrong callbacks and missing PKCE fail, and the actual recipient uses their own identity. Provider restart invalidates pending in-memory logins; USER-WP-0025-T03 still owns full provider sign-out coordination. + +2026-09-12 release prepared: source 8d4336e, Forgejo image run 45 succeeded, +digest sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a. +The exact client-registration and deployment server dry runs pass. The runtime +is unchanged. Await the attended window required by docs/operations.md; the +complete packet is railiance-apps/docs/vergabe-demo-company-sso-rollout.md.