From e30ba7b3c06112f49f85e79601a7e985885ba53c Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 9 Sep 2026 00:07:01 +0200 Subject: [PATCH] docs(records): attach issuer proof to the receiving admission task Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- ...-0013-approval-engine-resource-audience.md | 39 +++++++++---------- 1 file changed, 19 insertions(+), 20 deletions(-) diff --git a/workplans/KEY-WP-0013-approval-engine-resource-audience.md b/workplans/KEY-WP-0013-approval-engine-resource-audience.md index bc22791..4cc0cc2 100644 --- a/workplans/KEY-WP-0013-approval-engine-resource-audience.md +++ b/workplans/KEY-WP-0013-approval-engine-resource-audience.md @@ -115,6 +115,25 @@ Task stays `wait`. What is owed from elsewhere is unchanged and unreduced: the two secret values through an admitted custody path, and the exact human `client_id` and callback URI. Nothing here provisions anything. +### 2026-09-08 attended upstream issuer proof — T02 return + +The user explicitly admitted the prepared temporary probe. At 21:44:44 UTC its +actual Authelia authorization-code exchange verified the signed issuer +**`https://auth.coulomb.social`**, including signature, keycape audience, validity +window and browser-bound nonce. The pinned Job exited 0. No token or user claim +was retained, and no downstream credential was issued. + +All five temporary resources and the Pod were removed with scoped cleanup; +KeyCape Deployment and config Secret metadata remained unchanged. Receipt: +`docs/evidence/2026-09-08-upstream-issuer-live-proof.json`. + +This closes the actual-token issuer observation gate. T02 remains wait for the +configuration owner to ensure `authelia.issuer` is pinned to the verified HTTPS +value, named CCR-2026-0017/0018 reviews, custody delivery and compatible rollout. +The diagnostic did not prove downstream KeyCape MFA/application login and did +not activate custody. Do not repeat discovery or request another observation +unless the provider/configuration or proof context changes. + ## Reconcile tenant vocabularies across approval layers ```task @@ -253,23 +272,3 @@ command ran as UID 65534 with no network and a read-only filesystem and produced the expected bounded idle-timeout receipt. See `docs/upstream-issuer-proof.md` and `docs/evidence/upstream-issuer-probe.json`. T02 retains the live proof and configuration-owner admission; no production resource or custody value changed. - - -### 2026-09-08 attended upstream issuer proof — T02 return - -The user explicitly admitted the prepared temporary probe. At 21:44:44 UTC its -actual Authelia authorization-code exchange verified the signed issuer -**`https://auth.coulomb.social`**, including signature, keycape audience, validity -window and browser-bound nonce. The pinned Job exited 0. No token or user claim -was retained, and no downstream credential was issued. - -All five temporary resources and the Pod were removed with scoped cleanup; -KeyCape Deployment and config Secret metadata remained unchanged. Receipt: -`docs/evidence/2026-09-08-upstream-issuer-live-proof.json`. - -This closes the actual-token issuer observation gate. T02 remains wait for the -configuration owner to ensure `authelia.issuer` is pinned to the verified HTTPS -value, named CCR-2026-0017/0018 reviews, custody delivery and compatible rollout. -The diagnostic did not prove downstream KeyCape MFA/application login and did -not activate custody. Do not repeat discovery or request another observation -unless the provider/configuration or proof context changes.