Forward fresh-login requirements to the authentication provider

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

workplans/KEY-WP-0033-vergabe-fresh-login.md

@@ -0,0 +1,46 @@
+---
+id: KEY-WP-0033
+type: workplan
+title: "Preserve fresh-user authentication for the Vergabe company handoff"
+domain: infotech
+repo: key-cape
+status: active
+owner: codex
+topic_slug: netkingdom
+created: "2026-09-12"
+updated: "2026-09-12"
+related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
+---
+
+## Forward login freshness to the actual authentication provider
+
+```task
+id: KEY-WP-0033-T01
+status: done
+priority: high
+```
+
+KeyCape parsed prompt=login and max_age but dropped them before Authelia.
+Forward these through the provider-neutral AuthRequest and the Authelia adapter.
+Absent values retain ordinary SSO behavior. Handler and adapter regressions
+cover forced login and zero/nonzero maximum age. Full Go suite passes after
+correcting the existing example-count regression: the example file already
+contains four service clients and the admitted human approver client.
+
+## Publish, preflight and prove the fresh recipient boundary
+
+```task
+id: KEY-WP-0033-T02
+status: todo
+priority: high
+```
+
+Publish the exact source and validate current live config before replacing the
+single issuer instance. The live image is dcebd46/digest 7ff54c54; current main
+also contains startup validation and tenant provenance changes documented in
+docs/operations.md. Preserve all unrelated client, credential and MFA policy
+configuration. NK-WP-0037 adds the exact public Vergabe callback with no tenant
+assertion or MFA downgrade. Confirm prompt=login reaches Authelia through the
+live redirect, wrong callbacks and missing PKCE fail, and the actual recipient
+uses their own identity. Provider restart invalidates pending in-memory logins;
+USER-WP-0025-T03 still owns full provider sign-out coordination.