coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(identity): record verified live upstream issuer and completed cleanup

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 23:50:54 +02:00
parent 7ecc78f410
commit 41f6916a5d
5 changed files with 177 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -42,7 +42,7 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
```
Needs deployment-owned custody for both new service secret references and the
upstream issuer precondition. Deploy the implementation and service registrations together,
configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together,
then prove live JWKS verification and denied excess scopes without logging values.
Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.
The separate human UI callback gate is retained in T05; a bearer-only resource
@ -253,3 +253,23 @@ command ran as UID 65534 with no network and a read-only filesystem and produced
the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md`
and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and
configuration-owner admission; no production resource or custody value changed.
### 2026-09-08 attended upstream issuer proof — T02 return
The user explicitly admitted the prepared temporary probe. At 21:44:44 UTC its
actual Authelia authorization-code exchange verified the signed issuer
**`https://auth.coulomb.social`**, including signature, keycape audience, validity
window and browser-bound nonce. The pinned Job exited 0. No token or user claim
was retained, and no downstream credential was issued.
All five temporary resources and the Pod were removed with scoped cleanup;
KeyCape Deployment and config Secret metadata remained unchanged. Receipt:
`docs/evidence/2026-09-08-upstream-issuer-live-proof.json`.
This closes the actual-token issuer observation gate. T02 remains wait for the
configuration owner to ensure `authelia.issuer` is pinned to the verified HTTPS
value, named CCR-2026-0017/0018 reviews, custody delivery and compatible rollout.
The diagnostic did not prove downstream KeyCape MFA/application login and did
not activate custody. Do not repeat discovery or request another observation
unless the provider/configuration or proof context changes.

9
workplans/KEY-WP-0027-rollout-readiness-and-live-state.md
View file

@ -119,3 +119,12 @@ pin, and the `error_type` to look for if it bites — plus a note that the two
approval clients remain unprovisioned, confirmed by inspection rather than
asserted. G10 stays open: nothing here admits custody, registers the human
callback, or reconciles the OpenBao-token boundary, and no repo-local change can.
2026-09-08 live return: the actual signed-token uncertainty in T03 is now
resolved by KEY-WP-0013-T02's admitted probe. The issuer is exactly
`https://auth.coulomb.social`; signature/audience/time/nonce checks passed and
the Job exited 0. The temporary route, policies, service and Job/Pod were removed.
`docs/evidence/2026-09-08-upstream-issuer-live-proof.json` is the source receipt.
The configuration owner still ensures the exact pin before main rollout; no
normal config or Deployment changed during this proof.