docs(identity): record verified live upstream issuer and completed cleanup
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
parent
7ecc78f410
commit
41f6916a5d
5 changed files with 177 additions and 11 deletions
|
|
@ -23,14 +23,16 @@ verification. Provider response bodies and tokens are never printed.
|
|||
platform-operator and key-cape-owner reviews precede any activation.
|
||||
[provisioning request](approval-engine-provisioning-request.yaml) records the
|
||||
exact paths, `CLIENT_SECRET` field and Kubernetes/env mappings.
|
||||
2. NetKingdom must observe and verify the **actual signed upstream ID token**
|
||||
from the existing human flow, recording only the issuer claim and proof
|
||||
metadata. Pin that exact value in `authelia.issuer` through the configuration
|
||||
owner's contained path. Public discovery currently advertises
|
||||
`https://auth.coulomb.social`; discovery alone does not satisfy this gate.
|
||||
2. The actual signed upstream issuer is now proved as
|
||||
**`https://auth.coulomb.social`** by the admitted one-shot probe on 2026-09-08
|
||||
at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
|
||||
Job exited 0 and every temporary resource was removed. See
|
||||
[the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
|
||||
NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
|
||||
through its contained configuration path. This run left the config unchanged.
|
||||
Preserve the existing signing key and client registrations. Prove an existing
|
||||
human login before and after cutover; this image also includes stricter
|
||||
authorization-code redirect and grant binding.
|
||||
human login before and after cutover; the probe established upstream identity
|
||||
only, while this image also changes redirect and grant binding.
|
||||
3. The platform-owned attended first-provision command uses only
|
||||
`warden access openbao-platform-admin-login --exec -- <reviewed-command>`
|
||||
with its unique metadata-only receipt. It must follow the two CCRs and the
|
||||
|
|
|
|||
133
docs/evidence/2026-09-08-upstream-issuer-live-proof.json
Normal file
133
docs/evidence/2026-09-08-upstream-issuer-live-proof.json
Normal file
|
|
@ -0,0 +1,133 @@
|
|||
{
|
||||
"recorded_at": "2026-09-08T21:50:10.049099+00:00",
|
||||
"authorization": {
|
||||
"source": "User response in this session: yes, go on",
|
||||
"scope": "Prepared ten-minute temporary issuer probe; existing config read in workload, exact-state callback and cleanup",
|
||||
"custody_activation_authorized": false
|
||||
},
|
||||
"source": {
|
||||
"repo": "key-cape",
|
||||
"code_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
|
||||
"published_owner_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
||||
"packet": "docs/upstream-issuer-proof.md",
|
||||
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4"
|
||||
},
|
||||
"proof": {
|
||||
"audience_verified": true,
|
||||
"downstream_credential_issued": false,
|
||||
"issuer": "https://auth.coulomb.social",
|
||||
"nonce_verified": true,
|
||||
"observed_at": "2026-09-08T21:44:44Z",
|
||||
"schema": "keycape.upstream-issuer-proof.v1",
|
||||
"signature_verified": true,
|
||||
"status": "verified",
|
||||
"tokens_retained": false,
|
||||
"validity_window_verified": true
|
||||
},
|
||||
"job": {
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"started_at": "2026-09-08T21:43:34.019545+00:00",
|
||||
"created_resources": [
|
||||
{
|
||||
"kind": "Job",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "4e01daef-9184-4866-ac4d-9d61cd8d79ae"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "3359ce09-cbe2-487b-b9d9-a4cc5c484047"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "8940e5b4-3665-4395-8a0d-39b4b08ae12d"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
||||
"uid": "13d72383-0864-4665-af28-eefc76452131"
|
||||
},
|
||||
{
|
||||
"kind": "IngressRoute",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "7d705d80-f491-408f-a133-0bc4abd2c867"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pod_evidence": [
|
||||
{
|
||||
"name": "keycape-issuer-proof-532da53dc96a-tgpxh",
|
||||
"uid": "c9230c57-0fad-4dcf-b798-d586385db9a2",
|
||||
"phase": "Succeeded",
|
||||
"containers": [
|
||||
{
|
||||
"name": "probe",
|
||||
"image": "sha256:204d8a4b04f47fa93c508b0a74c600e9954cfeab8e4e6566a8feaab327e8f793",
|
||||
"imageID": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
|
||||
"ready": false,
|
||||
"state": {
|
||||
"terminated": {
|
||||
"exitCode": 0,
|
||||
"finishedAt": "2026-09-08T21:44:44Z",
|
||||
"reason": "Completed",
|
||||
"startedAt": "2026-09-08T21:43:37Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"browser": {
|
||||
"route_head_status": 405,
|
||||
"launcher_exit": 0,
|
||||
"url_scope": "exact generated HTTPS issuer-proof start path"
|
||||
},
|
||||
"cleanup": {
|
||||
"completed_at": "2026-09-08T21:45:17.886281+00:00",
|
||||
"removed": [
|
||||
{
|
||||
"kind": "IngressRoute",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid_precondition": true
|
||||
},
|
||||
{
|
||||
"kind": "Job",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid_precondition": true
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"already_absent": true
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"already_absent": true
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
||||
"already_absent": true
|
||||
}
|
||||
],
|
||||
"all_temporary_resources_absent": true,
|
||||
"production_metadata_unchanged": true,
|
||||
"before": {
|
||||
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
||||
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
||||
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
||||
},
|
||||
"after": {
|
||||
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
||||
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
||||
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
||||
}
|
||||
},
|
||||
"config_issuer_pinned_by_this_run": false,
|
||||
"custody_activated": false,
|
||||
"normal_keycape_deployment_changed": false,
|
||||
"downstream_mfa_or_application_login_proved": false,
|
||||
"next_return": "Configuration owner ensures authelia.issuer equals the verified HTTPS issuer; named CCR reviews and attended custody/compatible image rollout remain open"
|
||||
}
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
# One-shot upstream issuer proof
|
||||
|
||||
Prepared for KEY-WP-0013-T02/T07 on 2026-09-08. This packet needs
|
||||
NetKingdom/platform deployment-owner admission before its temporary workload
|
||||
uses the existing KeyCape configuration. It does not approve CCR-2026-0017/0018.
|
||||
Executed with explicit user admission on 2026-09-08: the verified signed issuer
|
||||
is **`https://auth.coulomb.social`**. The Job exited successfully and all temporary
|
||||
resources were removed. [Live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
|
||||
This completed run did not approve CCR-2026-0017/0018 or change the normal config.
|
||||
The procedure below is retained for an admitted recheck after relevant changes.
|
||||
|
||||
The missing evidence is the actual signed Authelia ID token produced by the
|
||||
existing confidential `keycape` registration and server-side token exchange.
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
|
|||
```
|
||||
|
||||
Needs deployment-owned custody for both new service secret references and the
|
||||
upstream issuer precondition. Deploy the implementation and service registrations together,
|
||||
configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together,
|
||||
then prove live JWKS verification and denied excess scopes without logging values.
|
||||
Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.
|
||||
The separate human UI callback gate is retained in T05; a bearer-only resource
|
||||
|
|
@ -253,3 +253,23 @@ command ran as UID 65534 with no network and a read-only filesystem and produced
|
|||
the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md`
|
||||
and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and
|
||||
configuration-owner admission; no production resource or custody value changed.
|
||||
|
||||
|
||||
### 2026-09-08 attended upstream issuer proof — T02 return
|
||||
|
||||
The user explicitly admitted the prepared temporary probe. At 21:44:44 UTC its
|
||||
actual Authelia authorization-code exchange verified the signed issuer
|
||||
**`https://auth.coulomb.social`**, including signature, keycape audience, validity
|
||||
window and browser-bound nonce. The pinned Job exited 0. No token or user claim
|
||||
was retained, and no downstream credential was issued.
|
||||
|
||||
All five temporary resources and the Pod were removed with scoped cleanup;
|
||||
KeyCape Deployment and config Secret metadata remained unchanged. Receipt:
|
||||
`docs/evidence/2026-09-08-upstream-issuer-live-proof.json`.
|
||||
|
||||
This closes the actual-token issuer observation gate. T02 remains wait for the
|
||||
configuration owner to ensure `authelia.issuer` is pinned to the verified HTTPS
|
||||
value, named CCR-2026-0017/0018 reviews, custody delivery and compatible rollout.
|
||||
The diagnostic did not prove downstream KeyCape MFA/application login and did
|
||||
not activate custody. Do not repeat discovery or request another observation
|
||||
unless the provider/configuration or proof context changes.
|
||||
|
|
|
|||
|
|
@ -119,3 +119,12 @@ pin, and the `error_type` to look for if it bites — plus a note that the two
|
|||
approval clients remain unprovisioned, confirmed by inspection rather than
|
||||
asserted. G10 stays open: nothing here admits custody, registers the human
|
||||
callback, or reconciles the OpenBao-token boundary, and no repo-local change can.
|
||||
|
||||
|
||||
2026-09-08 live return: the actual signed-token uncertainty in T03 is now
|
||||
resolved by KEY-WP-0013-T02's admitted probe. The issuer is exactly
|
||||
`https://auth.coulomb.social`; signature/audience/time/nonce checks passed and
|
||||
the Job exited 0. The temporary route, policies, service and Job/Pod were removed.
|
||||
`docs/evidence/2026-09-08-upstream-issuer-live-proof.json` is the source receipt.
|
||||
The configuration owner still ensures the exact pin before main rollout; no
|
||||
normal config or Deployment changed during this proof.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue