coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record live image cdec9dd7 with the sign-in diagnosis page (KEY-WP-0041-T02).

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 00:09:11 +02:00
parent 8c6c071ad9
commit 3b8d69546b
2 changed files with 18 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/operations.md
View file

@ -186,15 +186,19 @@ workload or customer data, any sign the transcript left the workstation, or a
planned key rotation. The same workplan removes the problem class by giving planned key rotation. The same workplan removes the problem class by giving
agents a cluster identity that cannot read these objects at all. agents a cluster identity that cannot read these objects at all.
## Current image (2026-09-26) ## Current image (2026-10-15)
The live issuer is The live issuer is
`sha256:82f1e5ac481e4f963dbd4b05256aee75412c9e9b465d31c9356f5d17f26a6897`, `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`,
source `13afaa9`. The sign-out confirmation uses the NetKingdom Identity source `8c6c071`. Over the previous live source `1164f65` it adds the
page design. Recorded as `ADMINISTER @ realm:kubernetes/railiance01`, duplicate-clientId startup check (`c528daa`), the lost-authenticator help link
`activation=APPROVED`. The patch replaced only the image. Strategy stayed (`205a1c0`), and the opt-in sign-in diagnosis page with `uid`/`assurance` on
Recreate and requests stayed 25m/32Mi. Rollback is `auth_success` (`af3b1b0`). Founder-run on 2026-10-15: `keycape check-config`
`sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`. on the live config was valid (13 clients, no errors), `kubectl diff` showed only
the image, server dry-run passed, Recreate rollout succeeded, pod ready with 0
restarts and discovery answering 200. The owner manifest is
`net-kingdom/sso-mfa/k8s/keycape/deployment.yaml`. Rollback is
`sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8`.
## Fail-closed startup changes from source 11ce29a ## Fail-closed startup changes from source 11ce29a

9
workplans/KEY-WP-0041-sign-in-diagnosis-page.md
View file

@ -8,7 +8,7 @@ status: active
owner: claude-code owner: claude-code
topic_slug: netkingdom topic_slug: netkingdom
created: "2026-10-14" created: "2026-10-14"
updated: "2026-10-14" updated: "2026-10-15"
flavor: implementation flavor: implementation
depends_on: [] depends_on: []
state_hub_workstream_id: "092c7590-3700-524d-bbe0-a934e063be6b" state_hub_workstream_id: "092c7590-3700-524d-bbe0-a934e063be6b"
@ -45,7 +45,7 @@ state_hub_task_id: "5947be07-bc84-5672-b807-608070a39d10"
```task ```task
id: KEY-WP-0041-T02 id: KEY-WP-0041-T02
status: todo status: progress
priority: high priority: high
state_hub_task_id: "bd5db26c-b71c-5291-bdc3-7c0f718651db" state_hub_task_id: "bd5db26c-b71c-5291-bdc3-7c0f718651db"
``` ```
@ -55,3 +55,8 @@ on the OpenBao browser client in `sso/keycape-config`, roll the issuer under
the usual live-change approval, and send the digest to net-kingdom for the the usual live-change approval, and send the digest to net-kingdom for the
evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
session: deployment needs operator approval. session: deployment needs operator approval.
2026-10-15: image `sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
(source `8c6c071`) is live; see `docs/operations.md`. Remaining: set
`signInDiagnosis: true` on the OpenBao browser client in `sso/keycape-config`
and restart the issuer. Until then the page is off for every client.