docs(identity): record verified live upstream issuer and completed cleanup
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
parent
7ecc78f410
commit
41f6916a5d
5 changed files with 177 additions and 11 deletions
|
|
@ -23,14 +23,16 @@ verification. Provider response bodies and tokens are never printed.
|
|||
platform-operator and key-cape-owner reviews precede any activation.
|
||||
[provisioning request](approval-engine-provisioning-request.yaml) records the
|
||||
exact paths, `CLIENT_SECRET` field and Kubernetes/env mappings.
|
||||
2. NetKingdom must observe and verify the **actual signed upstream ID token**
|
||||
from the existing human flow, recording only the issuer claim and proof
|
||||
metadata. Pin that exact value in `authelia.issuer` through the configuration
|
||||
owner's contained path. Public discovery currently advertises
|
||||
`https://auth.coulomb.social`; discovery alone does not satisfy this gate.
|
||||
2. The actual signed upstream issuer is now proved as
|
||||
**`https://auth.coulomb.social`** by the admitted one-shot probe on 2026-09-08
|
||||
at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
|
||||
Job exited 0 and every temporary resource was removed. See
|
||||
[the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
|
||||
NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
|
||||
through its contained configuration path. This run left the config unchanged.
|
||||
Preserve the existing signing key and client registrations. Prove an existing
|
||||
human login before and after cutover; this image also includes stricter
|
||||
authorization-code redirect and grant binding.
|
||||
human login before and after cutover; the probe established upstream identity
|
||||
only, while this image also changes redirect and grant binding.
|
||||
3. The platform-owned attended first-provision command uses only
|
||||
`warden access openbao-platform-admin-login --exec -- <reviewed-command>`
|
||||
with its unique metadata-only receipt. It must follow the two CCRs and the
|
||||
|
|
|
|||
133
docs/evidence/2026-09-08-upstream-issuer-live-proof.json
Normal file
133
docs/evidence/2026-09-08-upstream-issuer-live-proof.json
Normal file
|
|
@ -0,0 +1,133 @@
|
|||
{
|
||||
"recorded_at": "2026-09-08T21:50:10.049099+00:00",
|
||||
"authorization": {
|
||||
"source": "User response in this session: yes, go on",
|
||||
"scope": "Prepared ten-minute temporary issuer probe; existing config read in workload, exact-state callback and cleanup",
|
||||
"custody_activation_authorized": false
|
||||
},
|
||||
"source": {
|
||||
"repo": "key-cape",
|
||||
"code_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
|
||||
"published_owner_commit": "7ecc78f4100c04f9b4ea7751240114bcc485de03",
|
||||
"packet": "docs/upstream-issuer-proof.md",
|
||||
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4"
|
||||
},
|
||||
"proof": {
|
||||
"audience_verified": true,
|
||||
"downstream_credential_issued": false,
|
||||
"issuer": "https://auth.coulomb.social",
|
||||
"nonce_verified": true,
|
||||
"observed_at": "2026-09-08T21:44:44Z",
|
||||
"schema": "keycape.upstream-issuer-proof.v1",
|
||||
"signature_verified": true,
|
||||
"status": "verified",
|
||||
"tokens_retained": false,
|
||||
"validity_window_verified": true
|
||||
},
|
||||
"job": {
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"started_at": "2026-09-08T21:43:34.019545+00:00",
|
||||
"created_resources": [
|
||||
{
|
||||
"kind": "Job",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "4e01daef-9184-4866-ac4d-9d61cd8d79ae"
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "3359ce09-cbe2-487b-b9d9-a4cc5c484047"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "8940e5b4-3665-4395-8a0d-39b4b08ae12d"
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
||||
"uid": "13d72383-0864-4665-af28-eefc76452131"
|
||||
},
|
||||
{
|
||||
"kind": "IngressRoute",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid": "7d705d80-f491-408f-a133-0bc4abd2c867"
|
||||
}
|
||||
]
|
||||
},
|
||||
"pod_evidence": [
|
||||
{
|
||||
"name": "keycape-issuer-proof-532da53dc96a-tgpxh",
|
||||
"uid": "c9230c57-0fad-4dcf-b798-d586385db9a2",
|
||||
"phase": "Succeeded",
|
||||
"containers": [
|
||||
{
|
||||
"name": "probe",
|
||||
"image": "sha256:204d8a4b04f47fa93c508b0a74c600e9954cfeab8e4e6566a8feaab327e8f793",
|
||||
"imageID": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
|
||||
"ready": false,
|
||||
"state": {
|
||||
"terminated": {
|
||||
"exitCode": 0,
|
||||
"finishedAt": "2026-09-08T21:44:44Z",
|
||||
"reason": "Completed",
|
||||
"startedAt": "2026-09-08T21:43:37Z"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"browser": {
|
||||
"route_head_status": 405,
|
||||
"launcher_exit": 0,
|
||||
"url_scope": "exact generated HTTPS issuer-proof start path"
|
||||
},
|
||||
"cleanup": {
|
||||
"completed_at": "2026-09-08T21:45:17.886281+00:00",
|
||||
"removed": [
|
||||
{
|
||||
"kind": "IngressRoute",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid_precondition": true
|
||||
},
|
||||
{
|
||||
"kind": "Job",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"uid_precondition": true
|
||||
},
|
||||
{
|
||||
"kind": "Service",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"already_absent": true
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a",
|
||||
"already_absent": true
|
||||
},
|
||||
{
|
||||
"kind": "NetworkPolicy",
|
||||
"name": "keycape-issuer-proof-532da53dc96a-authelia",
|
||||
"already_absent": true
|
||||
}
|
||||
],
|
||||
"all_temporary_resources_absent": true,
|
||||
"production_metadata_unchanged": true,
|
||||
"before": {
|
||||
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
||||
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
||||
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
||||
},
|
||||
"after": {
|
||||
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
|
||||
"deployment": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29",
|
||||
"secret": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
|
||||
}
|
||||
},
|
||||
"config_issuer_pinned_by_this_run": false,
|
||||
"custody_activated": false,
|
||||
"normal_keycape_deployment_changed": false,
|
||||
"downstream_mfa_or_application_login_proved": false,
|
||||
"next_return": "Configuration owner ensures authelia.issuer equals the verified HTTPS issuer; named CCR reviews and attended custody/compatible image rollout remain open"
|
||||
}
|
||||
|
|
@ -1,8 +1,10 @@
|
|||
# One-shot upstream issuer proof
|
||||
|
||||
Prepared for KEY-WP-0013-T02/T07 on 2026-09-08. This packet needs
|
||||
NetKingdom/platform deployment-owner admission before its temporary workload
|
||||
uses the existing KeyCape configuration. It does not approve CCR-2026-0017/0018.
|
||||
Executed with explicit user admission on 2026-09-08: the verified signed issuer
|
||||
is **`https://auth.coulomb.social`**. The Job exited successfully and all temporary
|
||||
resources were removed. [Live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
|
||||
This completed run did not approve CCR-2026-0017/0018 or change the normal config.
|
||||
The procedure below is retained for an admitted recheck after relevant changes.
|
||||
|
||||
The missing evidence is the actual signed Authelia ID token produced by the
|
||||
existing confidential `keycape` registration and server-side token exchange.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue