coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record published fresh-login image and attended rollout gate

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 02:53:55 +02:00
parent 7695a064bc
commit 0647301c03
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/KEY-WP-0033-vergabe-fresh-login.md
View file

@ -10,6 +10,7 @@ topic_slug: netkingdom
created: "2026-09-12" created: "2026-09-12"
updated: "2026-09-12" updated: "2026-09-12"
related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025] related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
state_hub_workstream_id: "144dd430-1a09-51e1-9aad-e799ee86c338"
--- ---
## Forward login freshness to the actual authentication provider ## Forward login freshness to the actual authentication provider
@ -18,6 +19,7 @@ related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
id: KEY-WP-0033-T01 id: KEY-WP-0033-T01
status: done status: done
priority: high priority: high
state_hub_task_id: "fe05486b-f079-503b-ade1-fca65bf64b34"
``` ```
KeyCape parsed prompt=login and max_age but dropped them before Authelia. KeyCape parsed prompt=login and max_age but dropped them before Authelia.
@ -31,8 +33,10 @@ contains four service clients and the admitted human approver client.
```task ```task
id: KEY-WP-0033-T02 id: KEY-WP-0033-T02
status: todo status: wait
blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
priority: high priority: high
state_hub_task_id: "7b58f08c-6063-554a-8700-a1edbc805ca4"
``` ```
Publish the exact source and validate current live config before replacing the Publish the exact source and validate current live config before replacing the
@ -44,3 +48,9 @@ assertion or MFA downgrade. Confirm prompt=login reaches Authelia through the
live redirect, wrong callbacks and missing PKCE fail, and the actual recipient live redirect, wrong callbacks and missing PKCE fail, and the actual recipient
uses their own identity. Provider restart invalidates pending in-memory logins; uses their own identity. Provider restart invalidates pending in-memory logins;
USER-WP-0025-T03 still owns full provider sign-out coordination. USER-WP-0025-T03 still owns full provider sign-out coordination.
2026-09-12 release prepared: source 8d4336e, Forgejo image run 45 succeeded,
digest sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a.
The exact client-registration and deployment server dry runs pass. The runtime
is unchanged. Await the attended window required by docs/operations.md; the
complete packet is railiance-apps/docs/vergabe-demo-company-sso-rollout.md.