coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add native verified login and service-token commands
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06e87-e039-7ed2-b85c-20ad37f8a21b
This commit is contained in:
tegwick 2026-09-05 01:08:58 +02:00
parent 66df5fcf07
commit b989de4e90
12 changed files with 928 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

49
workplans/KEY-WP-0014-native-credential-lane-handoff.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Review native login and client credential lane handoffs"
domain: infotech
repo: key-cape
status: proposed
status: blocked
owner: codex
topic_slug: native-credential-lane-handoff
created: "2026-09-05"
@ -13,14 +13,14 @@ state_hub_workstream_id: "0d003df3-f7d3-5063-8ca0-e1e33f7df74a"
---
Source: ops-warden inbox message 0dd9c7bd-0ecd-42d1-806f-7cc4ba9730ed.
The issuer supports client_secret_basic exchange, but has no native exchange or
rotation CLI. Existing machine issuance ownership does not complete this handoff.
The native service exchange and public PKCE login commands are now implemented.
Cross-owner rotation and consumer-specific route cutover remain outstanding.
## Design owner command and custody boundaries
```task
id: KEY-WP-0014-T01
status: todo
status: done
priority: medium
state_hub_task_id: "0c0a0b61-c19e-5631-9cda-8b2dc0f47d8f"
```
@ -35,7 +35,7 @@ retiring the proxy until replacement commands have equivalent verification.
```task
id: KEY-WP-0014-T02
status: todo
status: done
priority: low
state_hub_task_id: "d9a5de97-b7d5-5599-98c2-eaab32f51495"
```
@ -43,3 +43,42 @@ state_hub_task_id: "d9a5de97-b7d5-5599-98c2-eaab32f51495"
Ops-warden reports KEY-WP-0009-T04's claimed reply did not arrive. Verify prior
receipts for all four named recipients before claiming successful notification.
No outbound coordination messages were sent during the 2026-09-05 repo review.
## Implement and verify native caller commands
```task
id: KEY-WP-0014-T03
status: done
priority: high
state_hub_task_id: "4e46f474-a15e-594f-ae07-ad37a9667d89"
```
Implemented keycape service-token and login with HTTPS discovery, RS256/JWKS
verification, exact audience bindings, PKCE/state/nonce, private out-of-Git file
delivery and redacted errors. Service Basic authentication now form-decodes
credentials. Integration tests exercise the real token/JWKS handlers and browser
callback, including forged state, tampering, excess scope and unsafe output.
See docs/native-authentication.md for invocation and ownership boundaries.
## Admit rotation and verify consumer handoff
```task
id: KEY-WP-0014-T04
status: wait
priority: high
state_hub_task_id: "e7632c71-9676-5837-a925-7f905e3015c5"
```
Qonto rotation requires admitted custody/provider transaction and rollback
semantics; see the exact review sequence in docs/native-authentication.md.
The current login proxy yields an OpenBao token, so it cannot be replaced by a
JWT-writing command without adapting its consumer contract. Verify that split
with the platform owner and ops-warden before route changes. No route was changed.
2026-09-05 receipt audit: GET /messages/?from_agent=key-cape returned one
2026-03 image-publication message and no KEY-WP-0009 handoff receipts for
NetKingdom, secrets-engine, ops-warden or railiance-platform. Corrected the
unsupported statement in KEY-WP-0009-T04. This proves only that no receipts
are present in the current Hub response, not that no message ever existed.
No replacement outbound messages were sent.