coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(oidc): prepare one-shot upstream issuer proof without token disclosure
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-08 23:14:46 +02:00
parent 5c7db26b7c
commit 6f33abddcf
7 changed files with 836 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -213,3 +213,33 @@ proof remain distinct gates. Public discovery currently advertises
`https://auth.coulomb.social`; that alone is not the signed-token observation.
T06 completion: full Go suite and vet passed; published code `dcebd46` and pulled the image by digest `sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`. Container `keycape verify-client --help` confirms the command is present. `docs/approval-clients-rollout.md` and its proposed deployment patch record configuration/issuer, first-provision, single-instance rollout, acceptance and rollback. This closes verifier preparation only; T02 and T05 retain the explicit live dependencies.
## Prepare a bounded upstream issuer observation before client rollout
```task
id: KEY-WP-0013-T07
status: progress
priority: high
assignee: the-custodian
```
2026-09-08: T02's actual upstream signed-token issuer gate had no executable
observation path. A downstream OpenBao/KeyCape login cannot return the upstream
Authelia token; it remains inside the adapter. Prepare `probe-upstream-issuer`
and an exact-state temporary route so one attended flow can be verified before
changing the normal KeyCape Deployment or its configuration.
Acceptance: signed issuer/audience/time/nonce proof without token or user-claim
output; browser/state binding and one-shot refusal; finite issuer allowlist;
ten-minute bound; no downstream credential; current Traefik route isolation;
immutable image; reviewed temporary Job/config projection, network policies and
owner-reference cleanup. Normal callbacks and the production issuer stay on
the existing Deployment. The probe mounts only `config.yaml`, not `key.pem`,
and has no Kubernetes API token. That file contains existing credential data;
its use by the temporary diagnostic needs deployment-owner admission.
Source tests, image and deployment packet close this preparation task. The
attended live receipt and issuer pin remain in T02, alongside the named CCR
reviews and custody/rollout acceptance. Preparing the diagnostic does not
approve CCR-2026-0017/0018 or close any live factory gate.