From 8c1a3e052cc984a3e59202800653c9d7c60b1422 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 7 Sep 2026 08:52:28 +0200 Subject: [PATCH] chore(consistency): register KEY-WP-0019 [auto] Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6 --- WORK-RECORDS.md | 6 ++++++ .../KEY-WP-0019-upstream-provider-token-verification.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b4befb5..affc1c8 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -28,6 +28,7 @@ | workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md | | workplan | KEY-WP-0017 | finished | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md | | workplan | KEY-WP-0018 | finished | — | workplans/KEY-WP-0018-export-completeness-evidence.md | +| workplan | KEY-WP-0019 | active | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md | | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md | | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | @@ -117,4 +118,9 @@ | task | KEY-WP-0018-T01 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md | | task | KEY-WP-0018-T02 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md | | task | KEY-WP-0018-T03 | done | — | workplans/KEY-WP-0018-export-completeness-evidence.md | +| task | KEY-WP-0019-T01 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | +| task | KEY-WP-0019-T02 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | +| task | KEY-WP-0019-T03 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | +| task | KEY-WP-0019-T04 | done | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | +| task | KEY-WP-0019-T05 | todo | — | workplans/KEY-WP-0019-upstream-provider-token-verification.md | | intake | KEY-IN-0001 | closed | — | intakes/intakes.md | diff --git a/workplans/KEY-WP-0019-upstream-provider-token-verification.md b/workplans/KEY-WP-0019-upstream-provider-token-verification.md index 1eb3baf..e823bd1 100644 --- a/workplans/KEY-WP-0019-upstream-provider-token-verification.md +++ b/workplans/KEY-WP-0019-upstream-provider-token-verification.md @@ -9,6 +9,7 @@ owner: claude topic_slug: upstream-provider-token-verification created: "2026-09-07" updated: "2026-09-07" +state_hub_workstream_id: "87ea18ea-dc60-52ce-baf4-476b46aa06f9" --- Closes the remaining half of gap G01 in @@ -30,6 +31,7 @@ flag or transport telemetry is to be added. id: KEY-WP-0019-T01 status: done priority: high +state_hub_task_id: "68c1b099-96b4-5065-a4be-8592438a0ca9" ``` `internal/authclient` already contains a strict RS256 verifier — kid required, @@ -52,6 +54,7 @@ so a caller cannot leak which check failed back to whoever supplied the token. id: KEY-WP-0019-T02 status: done priority: high +state_hub_task_id: "8105030b-c91f-5a40-a221-4a38c8531e1c" ``` Before trusting any claim from the upstream ID token: verify the RS256 signature @@ -79,6 +82,7 @@ diagnostics but is documented as outside the authentication path. id: KEY-WP-0019-T03 status: done priority: high +state_hub_task_id: "163f64dd-aa87-5ce3-b3be-d134fa993eb6" ``` Negative tests per condition: forged signature, `alg: none` and other algorithms, @@ -99,6 +103,7 @@ real verification path instead of being routed around it. id: KEY-WP-0019-T04 status: done priority: medium +state_hub_task_id: "8a208092-7e85-5ad9-a8c4-0dddc66aaaee" ``` Update `SCOPE.md` and G01's status in the assessment to state that upstream @@ -116,6 +121,7 @@ including why no transport enforcement exists, so its absence reads as a choice. id: KEY-WP-0019-T05 status: todo priority: medium +state_hub_task_id: "0dc909fe-1772-5816-9e11-dbe7664a4e1f" ``` Move `internal/authclient`'s inline verification onto `internal/jose` so one