coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): register KEY-WP-0016 and refresh work records [auto]

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
This commit is contained in:
tegwick 2026-09-06 22:44:55 +02:00
parent 139b6ff351
commit 2e78648fb2
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
WORK-RECORDS.md
View file

@ -24,6 +24,7 @@
| workplan | KEY-WP-0013 | blocked | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
| workplan | KEY-WP-0014 | blocked | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
| workplan | KEY-WP-0015 | finished | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
| workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
| task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@ -101,4 +102,8 @@
| task | KEY-WP-0014-T03 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
| task | KEY-WP-0014-T04 | wait | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
| task | KEY-WP-0015-T01 | done | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
| task | KEY-WP-0016-T01 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
| task | KEY-WP-0016-T02 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
| task | KEY-WP-0016-T03 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
| task | KEY-WP-0016-T04 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
| intake | KEY-IN-0001 | closed | — | intakes/intakes.md |

5
workplans/KEY-WP-0016-authorization-code-protocol-hardening.md
View file

@ -9,6 +9,7 @@ owner: claude
topic_slug: authorization-code-protocol-hardening
created: "2026-09-06"
updated: "2026-09-06"
state_hub_workstream_id: "22698171-f283-59a9-9443-183faaeb6287"
---
Closes gap G01 of `history/2026-09-05-011726-scope-intent-assessment.md`, the
@ -27,6 +28,7 @@ separate trust-contract decision and is not addressed here.
id: KEY-WP-0016-T01
status: done
priority: high
state_hub_task_id: "a5171df0-4905-518d-a52f-7152b980af79"
```
`SessionStore.Get` reads a code and `Delete` removes it in separate lock
@ -49,6 +51,7 @@ PKCE-failed exchange left the code replayable. Both now fail closed —
id: KEY-WP-0016-T02
status: done
priority: high
state_hub_task_id: "1d0fb108-273f-5c9a-a7c7-7640f19bad9d"
```
On the authorization-code path: require `redirect_uri` and compare it for exact
@ -80,6 +83,7 @@ the authclient test stub was recording no redirect and is now faithful to real
id: KEY-WP-0016-T03
status: done
priority: high
state_hub_task_id: "336db63a-e4fd-522d-86b6-0bf54a31af1c"
```
UserInfo verifies an RSA signature and expiry but ignores its own `Issuer` field
@ -106,6 +110,7 @@ isolates the header check.
id: KEY-WP-0016-T04
status: done
priority: medium
state_hub_task_id: "90efa6ef-9495-5716-bee2-49d01c9ce05d"
```
Update `SCOPE.md`'s protocol-hardening limit and G01's closure status in the