coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens

Browse source 
Forgejo's secret now lives at platform/workloads/keycape/forgejo, as derived by
oidc-browser-relying-party 1.0 (net-kingdom 074b3a0). KEY-WP-0039 answers
railiance-platform's CCR-2026-0038 question with one-mismatch probe registrations
instead of an issuer path that could mint arbitrary claims.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
This commit is contained in:
tegwick 2026-10-10 12:29:32 +02:00
parent f8ef4d418c
commit ab5cccdcf3
4 changed files with 103 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/forgejo-oidc-client-request.yaml
View file

@ -32,7 +32,12 @@ client:
custody:
# Minted straight into custody in T02; no value in git, State Hub or chat.
proposed_openbao_path: platform/workloads/forgejo/netkingdom-oidc-client
# Derived by SecurityCaseType oidc-browser-relying-party 1.0 as
# platform/workloads/keycape/{client_id}; a case may not set it (net-kingdom
# 074b3a0, after ops-mason MASON-WP-0010-T01). Replaces the earlier proposal
# platform/workloads/forgejo/netkingdom-oidc-client.
openbao_path: platform/workloads/keycape/forgejo
keycape_delivery: ESO Secret sso/keycape-forgejo-client (role external-secrets-keycape-forgejo)
field: CLIENT_SECRET
custody_owner: railiance-platform
keycape_environment: KEYCAPE_FORGEJO_CLIENT_SECRET