coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the live openbao-admin signInDiagnosis flag (KEY-WP-0041-T02).

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 00:25:23 +02:00
parent 3b8d69546b
commit 59c1df71e3
3 changed files with 16 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
.custodian-brief.md
View file

@ -2,17 +2,11 @@
# Custodian Brief — key-cape
**Domain:** infotech
**Last synced:** 2026-10-14 21:46 UTC
**Last synced:** 2026-10-14 22:10 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)
Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b`
**Open tasks:**
- · Deploy the image and record its digest `bd5db26c`
### Negative-check tokens for the secrets-engine OpenBao JWT role
Progress: 2/3 done | workplan_id: `09c3bddf-6058-5603-8488-cccdb7be4f86`
@ -36,6 +30,12 @@ Progress: 2/4 done | workplan_id: `098e3e2c-a138-560e-b2d3-3a15eb49d8a9`
- ! T02 — Register the client and hand over its secret `40ddaa29`
*(wait: Claims are verified against the registered client.)*
### Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)
Progress: 1/2 done | workplan_id: `092c7590-3700-524d-bbe0-a934e063be6b`
**Open tasks:**
- ► Deploy the image and record its digest `bd5db26c`
## Inbox Hygiene
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.

8
docs/operations.md
View file

@ -274,8 +274,10 @@ A client with `signInDiagnosis: true` in its registration shows a page before
the redirect back to it: `uid`, `groups`, `assurance` and `client_id` as defined
in `net-kingdom/docs/sign-in-diagnosis.md`, with one continue link carrying the
unchanged code. Default is off. The repo enables it only for `openbao-admin` in
`config/dev-config.yaml`; the live flag is set by the config custody owner on the
OpenBao browser client in `config.yaml` of the `sso/keycape-config` Secret, and
takes effect on the next issuer restart. A redirect URI that is not http(s)
`config/dev-config.yaml`; the live flag is set on the OpenBao browser client
(`openbao-admin`) in `config.yaml` of the `sso/keycape-config` Secret, and takes
effect on the next issuer restart. It is live since 2026-10-15 (rv 75372162),
set with net-kingdom `sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py`;
`--operation remove` plus a restart is the rollback. A redirect URI that is not http(s)
skips the page. Every `auth_success` log line now carries `client_id`, `uid` and
`assurance`, and no token, code, email or one-time password.

7
workplans/KEY-WP-0041-sign-in-diagnosis-page.md
View file

@ -57,6 +57,7 @@ evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
session: deployment needs operator approval.
2026-10-15: image `sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010`
(source `8c6c071`) is live; see `docs/operations.md`. Remaining: set
`signInDiagnosis: true` on the OpenBao browser client in `sso/keycape-config`
and restart the issuer. Until then the page is off for every client.
(source `8c6c071`) is live; see `docs/operations.md`. 2026-10-15: `signInDiagnosis: true` set on `openbao-admin` with
net-kingdom `openbao-signin-diagnosis-rollout.py` (rv 71655453 → 75372162,
unrelated bytes preserved) and the issuer restarted; pod ready, discovery 200.
Remaining: one attended OpenBao login shows the page.