coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Consume verified owner configuration pin before custody rollout

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 00:40:23 +02:00
parent e30ba7b3c0
commit cf23469ead
3 changed files with 113 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/approval-clients-rollout.md
View file

@ -28,9 +28,10 @@ verification. Provider response bodies and tokens are never printed.
at 21:44:44 UTC. Signature, audience, validity window and nonce passed; the
Job exited 0 and every temporary resource was removed. See
[the live receipt](evidence/2026-09-08-upstream-issuer-live-proof.json).
NetKingdom must now ensure that exact value is pinned in `authelia.issuer`
through its contained configuration path. This run left the config unchanged.
Preserve the existing signing key and client registrations. Prove an existing
NetKingdom pinned that exact value in `authelia.issuer` on 2026-09-09
through its exercised issuer-only helper; Secret revision `58713343`.
[Pin receipt](evidence/2026-09-09-upstream-issuer-pin.json) proves all other
config bytes and Secret data unchanged. The running Deployment was unchanged. Prove an existing
human login before and after cutover; the probe established upstream identity
only, while this image also changes redirect and grant binding.
3. The platform-owned attended first-provision command uses only

93
docs/evidence/2026-09-09-upstream-issuer-pin.json Normal file
View file

@ -0,0 +1,93 @@
{
"schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
"recorded_at": "2026-09-08T22:24:00.262369+00:00",
"authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
"source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
"signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
"check_before": {
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": false,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:58.199881+00:00",
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"pin": {
"after": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": true,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-pin-live",
"observed_at": "2026-09-08T22:23:58.727554+00:00",
"other_secret_data_unchanged": true,
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"unrelated_config_bytes_preserved": true,
"verified_issuer": "https://auth.coulomb.social"
},
"check_after": {
"before": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:59.920100+00:00",
"prior_pin_state": "matching",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"deployment_before": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_after": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_unchanged": true,
"tests_passed": 13,
"credential_values_emitted": false,
"custody_activated": false,
"ccr_reviews_completed": false,
"process_reload_or_new_image_proved": false
}