coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(identity): record verified live upstream issuer and completed cleanup

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 23:50:54 +02:00
parent 7ecc78f410
commit 41f6916a5d
5 changed files with 177 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/approval-clients-rollout.md
View file

@ -23,14 +23,16 @@ verification. Provider response bodies and tokens are never printed.
platform-operator and key-cape-owner reviews precede any activation.
[provisioning request](approval-engine-provisioning-request.yaml) records the
exact paths, `CLIENT_SECRET` field and Kubernetes/env mappings.
2. NetKingdom must observe and verify the **actual signed upstream ID token**
from the existing human flow, recording only the issuer claim and proof
metadata. Pin that exact value in `authelia.issuer` through the configuration
owner's contained path. Public discovery currently advertises
`https://auth.coulomb.social`; discovery alone does not satisfy this gate.
2. The actual signed upstream issuer is now proved as
**`https://auth.coulomb.social`** by the admitted one-shot probe on 2026-09-08
at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
Job exited 0 and every temporary resource was removed. See
[the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
through its contained configuration path. This run left the config unchanged.
Preserve the existing signing key and client registrations. Prove an existing
human login before and after cutover; this image also includes stricter
authorization-code redirect and grant binding.
human login before and after cutover; the probe established upstream identity
only, while this image also changes redirect and grant binding.
3. The platform-owned attended first-provision command uses only
`warden access openbao-platform-admin-login --exec -- <reviewed-command>`
with its unique metadata-only receipt. It must follow the two CCRs and the