From 41f6916a5d00fdc946cf1f3b099198821a83674a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 8 Sep 2026 23:50:54 +0200 Subject: [PATCH] docs(identity): record verified live upstream issuer and completed cleanup Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- docs/approval-clients-rollout.md | 16 ++- ...2026-09-08-upstream-issuer-live-proof.json | 133 ++++++++++++++++++ docs/upstream-issuer-proof.md | 8 +- ...-0013-approval-engine-resource-audience.md | 22 ++- ...P-0027-rollout-readiness-and-live-state.md | 9 ++ 5 files changed, 177 insertions(+), 11 deletions(-) create mode 100644 docs/evidence/2026-09-08-upstream-issuer-live-proof.json diff --git a/docs/approval-clients-rollout.md b/docs/approval-clients-rollout.md index 659070b..b31b3ee 100644 --- a/docs/approval-clients-rollout.md +++ b/docs/approval-clients-rollout.md @@ -23,14 +23,16 @@ verification. Provider response bodies and tokens are never printed. platform-operator and key-cape-owner reviews precede any activation. [provisioning request](approval-engine-provisioning-request.yaml) records the exact paths, `CLIENT_SECRET` field and Kubernetes/env mappings. -2. NetKingdom must observe and verify the **actual signed upstream ID token** - from the existing human flow, recording only the issuer claim and proof - metadata. Pin that exact value in `authelia.issuer` through the configuration - owner's contained path. Public discovery currently advertises - `https://auth.coulomb.social`; discovery alone does not satisfy this gate. +2. The actual signed upstream issuer is now proved as + **`https://auth.coulomb.social`** by the admitted one-shot probe on 2026-09-08 + at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the + Job exited 0 and every temporary resource was removed. See + [the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json). + NetKingdom must now ensure that exact value is pinned in `authelia.issuer` + through its contained configuration path. This run left the config unchanged. Preserve the existing signing key and client registrations. Prove an existing - human login before and after cutover; this image also includes stricter - authorization-code redirect and grant binding. + human login before and after cutover; the probe established upstream identity + only, while this image also changes redirect and grant binding. 3. The platform-owned attended first-provision command uses only `warden access openbao-platform-admin-login --exec -- ` with its unique metadata-only receipt. It must follow the two CCRs and the diff --git a/docs/evidence/2026-09-08-upstream-issuer-live-proof.json b/docs/evidence/2026-09-08-upstream-issuer-live-proof.json new file mode 100644 index 0000000..85dab93 --- /dev/null +++ b/docs/evidence/2026-09-08-upstream-issuer-live-proof.json @@ -0,0 +1,133 @@ +{ + "recorded_at": "2026-09-08T21:50:10.049099+00:00", + "authorization": { + "source": "User response in this session: yes, go on", + "scope": "Prepared ten-minute temporary issuer probe; existing config read in workload, exact-state callback and cleanup", + "custody_activation_authorized": false + }, + "source": { + "repo": "key-cape", + "code_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec", + "published_owner_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03", + "packet": "docs/upstream-issuer-proof.md", + "image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4" + }, + "proof": { + "audience_verified": true, + "downstream_credential_issued": false, + "issuer": "https://auth.coulomb.social", + "nonce_verified": true, + "observed_at": "2026-09-08T21:44:44Z", + "schema": "keycape.upstream-issuer-proof.v1", + "signature_verified": true, + "status": "verified", + "tokens_retained": false, + "validity_window_verified": true + }, + "job": { + "name": "keycape-issuer-proof-532da53dc96a", + "started_at": "2026-09-08T21:43:34.019545+00:00", + "created_resources": [ + { + "kind": "Job", + "name": "keycape-issuer-proof-532da53dc96a", + "uid": "4e01daef-9184-4866-ac4d-9d61cd8d79ae" + }, + { + "kind": "Service", + "name": "keycape-issuer-proof-532da53dc96a", + "uid": "3359ce09-cbe2-487b-b9d9-a4cc5c484047" + }, + { + "kind": "NetworkPolicy", + "name": "keycape-issuer-proof-532da53dc96a", + "uid": "8940e5b4-3665-4395-8a0d-39b4b08ae12d" + }, + { + "kind": "NetworkPolicy", + "name": "keycape-issuer-proof-532da53dc96a-authelia", + "uid": "13d72383-0864-4665-af28-eefc76452131" + }, + { + "kind": "IngressRoute", + "name": "keycape-issuer-proof-532da53dc96a", + "uid": "7d705d80-f491-408f-a133-0bc4abd2c867" + } + ] + }, + "pod_evidence": [ + { + "name": "keycape-issuer-proof-532da53dc96a-tgpxh", + "uid": "c9230c57-0fad-4dcf-b798-d586385db9a2", + "phase": "Succeeded", + "containers": [ + { + "name": "probe", + "image": "sha256:204d8a4b04f47fa93c508b0a74c600e9954cfeab8e4e6566a8feaab327e8f793", + "imageID": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4", + "ready": false, + "state": { + "terminated": { + "exitCode": 0, + "finishedAt": "2026-09-08T21:44:44Z", + "reason": "Completed", + "startedAt": "2026-09-08T21:43:37Z" + } + } + } + ] + } + ], + "browser": { + "route_head_status": 405, + "launcher_exit": 0, + "url_scope": "exact generated HTTPS issuer-proof start path" + }, + "cleanup": { + "completed_at": "2026-09-08T21:45:17.886281+00:00", + "removed": [ + { + "kind": "IngressRoute", + "name": "keycape-issuer-proof-532da53dc96a", + "uid_precondition": true + }, + { + "kind": "Job", + "name": "keycape-issuer-proof-532da53dc96a", + "uid_precondition": true + }, + { + "kind": "Service", + "name": "keycape-issuer-proof-532da53dc96a", + "already_absent": true + }, + { + "kind": "NetworkPolicy", + "name": "keycape-issuer-proof-532da53dc96a", + "already_absent": true + }, + { + "kind": "NetworkPolicy", + "name": "keycape-issuer-proof-532da53dc96a-authelia", + "already_absent": true + } + ], + "all_temporary_resources_absent": true, + "production_metadata_unchanged": true, + "before": { + "production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b", + "deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29", + "secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058" + }, + "after": { + "production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b", + "deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29", + "secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058" + } + }, + "config_issuer_pinned_by_this_run": false, + "custody_activated": false, + "normal_keycape_deployment_changed": false, + "downstream_mfa_or_application_login_proved": false, + "next_return": "Configuration owner ensures authelia.issuer equals the verified HTTPS issuer; named CCR reviews and attended custody/compatible image rollout remain open" +} diff --git a/docs/upstream-issuer-proof.md b/docs/upstream-issuer-proof.md index e5a8c47..4e7d26b 100644 --- a/docs/upstream-issuer-proof.md +++ b/docs/upstream-issuer-proof.md @@ -1,8 +1,10 @@ # One-shot upstream issuer proof -Prepared for KEY-WP-0013-T02/T07 on 2026-09-08. This packet needs -NetKingdom/platform deployment-owner admission before its temporary workload -uses the existing KeyCape configuration. It does not approve CCR-2026-0017/0018. +Executed with explicit user admission on 2026-09-08: the verified signed issuer +is **`https://auth.coulomb.social`**. The Job exited successfully and all temporary +resources were removed. [Live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json). +This completed run did not approve CCR-2026-0017/0018 or change the normal config. +The procedure below is retained for an admitted recheck after relevant changes. The missing evidence is the actual signed Authelia ID token produced by the existing confidential `keycape` registration and server-side token exchange. diff --git a/workplans/KEY-WP-0013-approval-engine-resource-audience.md b/workplans/KEY-WP-0013-approval-engine-resource-audience.md index 3f43b85..bc22791 100644 --- a/workplans/KEY-WP-0013-approval-engine-resource-audience.md +++ b/workplans/KEY-WP-0013-approval-engine-resource-audience.md @@ -42,7 +42,7 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8" ``` Needs deployment-owned custody for both new service secret references and the -upstream issuer precondition. Deploy the implementation and service registrations together, +configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together, then prove live JWKS verification and denied excess scopes without logging values. Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md. The separate human UI callback gate is retained in T05; a bearer-only resource @@ -253,3 +253,23 @@ command ran as UID 65534 with no network and a read-only filesystem and produced the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md` and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and configuration-owner admission; no production resource or custody value changed. + + +### 2026-09-08 attended upstream issuer proof — T02 return + +The user explicitly admitted the prepared temporary probe. At 21:44:44 UTC its +actual Authelia authorization-code exchange verified the signed issuer +**`https://auth.coulomb.social`**, including signature, keycape audience, validity +window and browser-bound nonce. The pinned Job exited 0. No token or user claim +was retained, and no downstream credential was issued. + +All five temporary resources and the Pod were removed with scoped cleanup; +KeyCape Deployment and config Secret metadata remained unchanged. Receipt: +`docs/evidence/2026-09-08-upstream-issuer-live-proof.json`. + +This closes the actual-token issuer observation gate. T02 remains wait for the +configuration owner to ensure `authelia.issuer` is pinned to the verified HTTPS +value, named CCR-2026-0017/0018 reviews, custody delivery and compatible rollout. +The diagnostic did not prove downstream KeyCape MFA/application login and did +not activate custody. Do not repeat discovery or request another observation +unless the provider/configuration or proof context changes. diff --git a/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md b/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md index b5cefc0..57e01b2 100644 --- a/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md +++ b/workplans/KEY-WP-0027-rollout-readiness-and-live-state.md @@ -119,3 +119,12 @@ pin, and the `error_type` to look for if it bites — plus a note that the two approval clients remain unprovisioned, confirmed by inspection rather than asserted. G10 stays open: nothing here admits custody, registers the human callback, or reconciles the OpenBao-token boundary, and no repo-local change can. + + +2026-09-08 live return: the actual signed-token uncertainty in T03 is now +resolved by KEY-WP-0013-T02's admitted probe. The issuer is exactly +`https://auth.coulomb.social`; signature/audience/time/nonce checks passed and +the Job exited 0. The temporary route, policies, service and Job/Pod were removed. +`docs/evidence/2026-09-08-upstream-issuer-live-proof.json` is the source receipt. +The configuration owner still ensures the exact pin before main rollout; no +normal config or Deployment changed during this proof.