coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record provider credential renewal release and remaining owner handoff

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 14:27:35 +02:00
parent f4d8e44f0b
commit 78f5a718e9
2 changed files with 44 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

40
docs/credential-renewal-release-2026-09-13.md Normal file
View file

@ -0,0 +1,40 @@
# Provider credential renewal release — 2026-09-13
Platform journey P05 consumer implementation, KEY-WP-0035-T04.
Source `632b1f1376cfcbde6340aed6137213ab79aa8708`.
Image `forgejo.coulomb.social/coulomb/key-cape@sha256:c9eb584d60efecfe00e1745a7e8cd3ebb4ae0f94faa715ef9594cd58a5dcebb6`.
Exclusive `adminTokenFile` supports per-request credential renewal for factor
lookup and OTP validation. Atomic file/symlink replacement is tested. Invalid or
missing input fails without stale/inline fallback or secret-bearing error text.
Regular absolute file input is bounded to 16 KiB. The default HTTP client refuses
redirects and bounds requests to ten seconds. OTP validation now requires both
provider success and a true validation result; false/missing success flags deny.
`go test ./...` passed, including five new test functions covering renewal,
invalid-source subcases, rejection/recovery, malformed provider outcomes and
redirect refusal. Authentication acceptance CI run 50 and image run 51 passed
for the exact source revision. The CI suite now executes on authentication source
changes. Synthetic test credentials only; no live factors or identities mutated.
Image-only live rollout used tests of cluster UID, deployment UID/resourceVersion
and predecessor image. KeyCape Ready 1/1. Four public provider checks passed:
health, readiness, OIDC discovery and the discovery-advertised JWKS endpoint.
Twelve isolated live Chromium recovery/sign-out checks passed. Pending issuer
login/code state is process-local and resets during Recreate replacement.
The source release includes previously tested optional-policy support, but no
client policy, credential value, mount or issuer signing-key configuration was
changed. Mounted-file renewal has NOT been activated live. The existing provider
credential failure is not claimed fixed. The owner must deliver and verify the
scoped credential, expiry/renewal and custody contract before enabling the file.
Canonical pin: net-kingdom/sso-mfa/k8s/keycape/deployment.yaml.
Rollback predecessor: `sha256:5f58563aa903ffa0c060e5ae9eb436aa963322d26bdde393efd2dd506dc6c4ed`.
Rollback was not required; it would restore the previous validation behavior.
Residual provider recovery/policy acceptance remains KEY-WP-0035-T02/T03 and
USER-WP-0030-T03. Owner contract
railiance-platform/docs/net-kingdom-credential-custody-contract.md remains draft
with required path/field placeholders; the registered route remains non-resolvable.
No live Secret read, issuance, renewal or policy mutation was performed.