coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Share current-token verification and scoped cleanup through one producer client
Some checks failed
Authentication acceptance / acceptance (push) Failing after 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
This commit is contained in:
tegwick 2026-10-18 11:36:26 +02:00
parent 67a0869c1e
commit 08c083bae9
19 changed files with 2228 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/KEY-WP-0042-online-access-token-status.md
View file

@ -82,3 +82,35 @@ An isolated control omitting the revoked-state predicate fails seven intended
checks. This closes source task T02 only. T01 independent issuer/profile review,
T03 native admission and all existing consumer operation/effect bindings remain
open. Evidence is retained by CUST-WP-0080 under keycape-token-status-r1.
## Provide the shared producer client and owner-private command observations
```task
id: KEY-WP-0042-T04
status: done
priority: high
state_hub_task_id: "4c71c9f7-8e14-5fec-8491-d7a7995f97e2"
```
2026-10-18 source outcome: `internal/authclient/online.go` owns strict current
token/status joining, explicit HTTPS/CA/JWKS/current-credential admission,
identity-first credential access, per-check rereads, response/clock/lifetime
rechecks and independent read-only inactive observation. The existing executable
exposes `check-current-token`, `revoke-token`, `check-inactive-token`, with exact
token digest binding and new private observation outputs outside Git. Negative
output is explicitly inactive-for-client, never global revocation/ownership.
The public five-file Go adapter is generated from the same client and JOSE bytes;
ordinary source checks refuse drift. Source/contract: `docs/current-token-client.md`.
The full source race suite passes 724 test/subtest results with the same six
native/external skips. Human PKCE tests retain actual subject/assurance/auth-time/
tenant provenance and refuse ID-token substitution. A separate source fixture
uses the built CLI, generated Go consumer and actual Warden kernel across fresh
owner processes, with real fixture HTTPS status and independent negative cleanup
checks. Owner approvals/case/catalog and target are synthetic; there is no native
admission or second real application acceptance. The first CLI fixture's directory
permissions, archive-only Warden Git metadata failure and original API absence are
retained as failures, not backfilled successes. Source/evidence:
`the-custodian/docs/changes/netkingdom-target-2026-10-18/keycape-current-client-r1/`.
T01 independent issuer/profile review, T03 native lifecycle, NK48/Apps actual
operation/inverse/ongoing-resource bindings and all full target gates remain open.