From cf23469ead867966fbf21e732b4c8c7bea337b3b Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 9 Sep 2026 00:40:23 +0200 Subject: [PATCH] Consume verified owner configuration pin before custody rollout Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- docs/approval-clients-rollout.md | 7 +- .../2026-09-09-upstream-issuer-pin.json | 93 +++++++++++++++++++ ...-0013-approval-engine-resource-audience.md | 18 +++- 3 files changed, 113 insertions(+), 5 deletions(-) create mode 100644 docs/evidence/2026-09-09-upstream-issuer-pin.json diff --git a/docs/approval-clients-rollout.md b/docs/approval-clients-rollout.md index b31b3ee..7283b46 100644 --- a/docs/approval-clients-rollout.md +++ b/docs/approval-clients-rollout.md @@ -28,9 +28,10 @@ verification. Provider response bodies and tokens are never printed. at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the Job exited 0 and every temporary resource was removed. See [the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json). - NetKingdom must now ensure that exact value is pinned in `authelia.issuer` - through its contained configuration path. This run left the config unchanged. - Preserve the existing signing key and client registrations. Prove an existing + NetKingdom pinned that exact value in `authelia.issuer` on 2026-09-09 + through its exercised issuer-only helper; Secret revision `58713343`. + [Pin receipt](evidence/2026-09-09-upstream-issuer-pin.json) proves all other + config bytes and Secret data unchanged. The running Deployment was unchanged. Prove an existing human login before and after cutover; the probe established upstream identity only, while this image also changes redirect and grant binding. 3. The platform-owned attended first-provision command uses only diff --git a/docs/evidence/2026-09-09-upstream-issuer-pin.json b/docs/evidence/2026-09-09-upstream-issuer-pin.json new file mode 100644 index 0000000..62fe341 --- /dev/null +++ b/docs/evidence/2026-09-09-upstream-issuer-pin.json @@ -0,0 +1,93 @@ +{ + "schema": "netkingdom.keycape-issuer-pin-live-evidence.v1", + "recorded_at": "2026-09-08T22:24:00.262369+00:00", + "authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.", + "source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc", + "signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json", + "check_before": { + "before": { + "resource_version": "51346058", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": false, + "deployment_changed": false, + "issuer_matches": false, + "mode": "issuer-check-live", + "observed_at": "2026-09-08T22:23:58.199881+00:00", + "prior_pin_state": "absent", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "verified_issuer": "https://auth.coulomb.social" + }, + "pin": { + "after": { + "resource_version": "58713343", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "before": { + "resource_version": "51346058", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": true, + "deployment_changed": false, + "issuer_matches": true, + "mode": "issuer-pin-live", + "observed_at": "2026-09-08T22:23:58.727554+00:00", + "other_secret_data_unchanged": true, + "prior_pin_state": "absent", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "unrelated_config_bytes_preserved": true, + "verified_issuer": "https://auth.coulomb.social" + }, + "check_after": { + "before": { + "resource_version": "58713343", + "uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3" + }, + "config_changed": false, + "deployment_changed": false, + "issuer_matches": true, + "mode": "issuer-check-live", + "observed_at": "2026-09-08T22:23:59.920100+00:00", + "prior_pin_state": "matching", + "schema": "netkingdom.keycape-issuer-pin.v1", + "secret_values_emitted": false, + "target": "sso/keycape-config", + "verified_issuer": "https://auth.coulomb.social" + }, + "deployment_before": { + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "resource_version": "55113259", + "generation": 29, + "images": [ + { + "name": "keycape", + "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b" + } + ], + "ready_replicas": 1, + "available_replicas": 1 + }, + "deployment_after": { + "uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f", + "resource_version": "55113259", + "generation": 29, + "images": [ + { + "name": "keycape", + "image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b" + } + ], + "ready_replicas": 1, + "available_replicas": 1 + }, + "deployment_unchanged": true, + "tests_passed": 13, + "credential_values_emitted": false, + "custody_activated": false, + "ccr_reviews_completed": false, + "process_reload_or_new_image_proved": false +} diff --git a/workplans/KEY-WP-0013-approval-engine-resource-audience.md b/workplans/KEY-WP-0013-approval-engine-resource-audience.md index 4cc0cc2..718cb48 100644 --- a/workplans/KEY-WP-0013-approval-engine-resource-audience.md +++ b/workplans/KEY-WP-0013-approval-engine-resource-audience.md @@ -8,7 +8,7 @@ status: blocked owner: codex topic_slug: approval-engine-resource-audience created: "2026-09-05" -updated: "2026-09-08" +updated: "2026-09-09" state_hub_workstream_id: "6e815d88-b0e3-5ce0-be5d-13ab15917f7f" --- @@ -42,7 +42,8 @@ state_hub_task_id: "607897c5-bad9-55e5-86df-7802f592d6e8" ``` Needs deployment-owned custody for both new service secret references and the -configuration-owner pin to the now-verified upstream issuer. Deploy the implementation and service registrations together, +compatible image/configuration rollout. The upstream issuer is now verified and +pinned by NetKingdom (2026-09-09). Deploy the implementation and service registrations together, then prove live JWKS verification and denied excess scopes without logging values. Local signature proof is not live rollout evidence. See docs/approval-engine-auth-contract.md. The separate human UI callback gate is retained in T05; a bearer-only resource @@ -134,6 +135,19 @@ The diagnostic did not prove downstream KeyCape MFA/application login and did not activate custody. Do not repeat discovery or request another observation unless the provider/configuration or proof context changes. + +2026-09-09 configuration-owner return: NetKingdom's exercised, revision-guarded +issuer-only helper inserted `authelia.issuer: https://auth.coulomb.social` into +`sso/keycape-config`; resourceVersion `51346058` -> `58713343`. Independent +readback matches. Every other configuration byte and Secret data entry, including +the private key, was preserved. Thirteen tests passed. Receipt: +`docs/evidence/2026-09-09-upstream-issuer-pin.json`. + +The stored issuer configuration prerequisite is closed. No process restart, +image rollout, custody activation or downstream login proof occurred. T02 stays +wait for the named CCR reviews, attended custody and compatible rollout. The +single-instance replacement and existing-human-login checks remain mandatory. + ## Reconcile tenant vocabularies across approval layers ```task