From 3ceead4903aa62c487e3fd03ddcf2437091b702f Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 10 Oct 2026 15:25:34 +0200 Subject: [PATCH] KEY-WP-0038: record type review closure and 1.1 re-pin Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 779409@bnt-lap001 Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3 --- workplans/KEY-WP-0038-forgejo-oidc-client.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/workplans/KEY-WP-0038-forgejo-oidc-client.md b/workplans/KEY-WP-0038-forgejo-oidc-client.md index 8cb7c00..ea89b6f 100644 --- a/workplans/KEY-WP-0038-forgejo-oidc-client.md +++ b/workplans/KEY-WP-0038-forgejo-oidc-client.md @@ -119,6 +119,17 @@ secret value. Acceptance: discovery metadata lists the client's redirect URI. The secret is readable by Forgejo's custody path only. +2026-10-10: key-cape reviewed the type's composition +(`docs/oidc-browser-relying-party-type-review.md`). net-kingdom fixed the findings +in `61ab6bc`, a 1.0 patch: redirects with `?` or `#` refused, the groups scope +required, and descriptions corrected. A new 1.1 (`e2174ce`, founder go) adds the +`consumer-enforces-groups` verification. For Forgejo, that is the required-claim +setting railiance-apps configures. `security-cases/forgejo-netkingdom-oidc.yaml` +is re-pinned to @1.1, with parameters unchanged. KeyCape added `keycape +check-config` (`c528daa`), which register-client runs before the restart. T02 still +waits on NK-WP-0048-T06, which needs both executors' light paths (MASON-WP-0010-T03, +WARDEN-WP-0044-T03). + ```task id: KEY-WP-0038-T03 status: wait