coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Consume verified owner configuration pin before custody rollout

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 00:40:23 +02:00
parent e30ba7b3c0
commit cf23469ead
3 changed files with 113 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/approval-clients-rollout.md
View file

@ -28,9 +28,10 @@ verification. Provider response bodies and tokens are never printed.
at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
Job exited 0 and every temporary resource was removed. See
[the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
through its contained configuration path. This run left the config unchanged.
Preserve the existing signing key and client registrations. Prove an existing
NetKingdom pinned that exact value in `authelia.issuer` on 2026-09-09
through its exercised issuer-only helper; Secret revision `58713343`.
[Pin receipt](evidence/2026-09-09-upstream-issuer-pin.json) proves all other
config bytes and Secret data unchanged. The running Deployment was unchanged. Prove an existing
human login before and after cutover; the probe established upstream identity
only, while this image also changes redirect and grant binding.
3. The platform-owned attended first-provision command uses only

93
docs/evidence/2026-09-09-upstream-issuer-pin.json Normal file
View file

@ -0,0 +1,93 @@
{
"schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
"recorded_at": "2026-09-08T22:24:00.262369+00:00",
"authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
"source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
"signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
"check_before": {
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": false,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:58.199881+00:00",
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"pin": {
"after": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": true,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-pin-live",
"observed_at": "2026-09-08T22:23:58.727554+00:00",
"other_secret_data_unchanged": true,
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"unrelated_config_bytes_preserved": true,
"verified_issuer": "https://auth.coulomb.social"
},
"check_after": {
"before": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:59.920100+00:00",
"prior_pin_state": "matching",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"deployment_before": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_after": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_unchanged": true,
"tests_passed": 13,
"credential_values_emitted": false,
"custody_activated": false,
"ccr_reviews_completed": false,
"process_reload_or_new_image_proved": false
}

18
workplans/KEY-WP-0013-approval-engine-resource-audience.md
View file

@ -8,7 +8,7 @@ status: blocked
owner: codex
topic_slug: approval-engine-resource-audience
created: "2026-09-05"
updated: "2026-09-08"
updated: "2026-09-09"
state_hub_workstream_id: "6e815d88-b0e3-5ce0-be5d-13ab15917f7f"
---
@ -42,7 +42,8 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8"
```
Needs deployment-owned custody for both new service secret references and the
configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together,
compatible image/configuration rollout. The upstream issuer is now verified and
pinned by NetKingdom (2026-09-09). Deploy the implementation and service registrations together,
then prove live JWKS verification and denied excess scopes without logging values.
Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md.
The separate human UI callback gate is retained in T05; a bearer-only resource
@ -134,6 +135,19 @@ The diagnostic did not prove downstream KeyCape MFA/application login and did
not activate custody. Do not repeat discovery or request another observation
unless the provider/configuration or proof context changes.
2026-09-09 configuration-owner return: NetKingdom's exercised, revision-guarded
issuer-only helper inserted `authelia.issuer: https://auth.coulomb.social` into
`sso/keycape-config`; resourceVersion `51346058` -> `58713343`. Independent
readback matches. Every other configuration byte and Secret data entry, including
the private key, was preserved. Thirteen tests passed. Receipt:
`docs/evidence/2026-09-09-upstream-issuer-pin.json`.
The stored issuer configuration prerequisite is closed. No process restart,
image rollout, custody activation or downstream login proof occurred. T02 stays
wait for the named CCR reviews, attended custody and compatible rollout. The
single-instance replacement and existing-human-login checks remain mandatory.
## Reconcile tenant vocabularies across approval layers
```task