diff --git a/docs/evidence/2026-09-24-fresh-login-and-account-switch.md b/docs/evidence/2026-09-24-fresh-login-and-account-switch.md new file mode 100644 index 0000000..200863c --- /dev/null +++ b/docs/evidence/2026-09-24-fresh-login-and-account-switch.md @@ -0,0 +1,22 @@ +# Fresh login and account switch — 2026-09-24 + +Issuer image already running: +`forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9` +(Forgejo image run 69, source `11ce29a`). No further rollout was made. + +The founder completed the browser journeys and reported that both worked. +Issuer telemetry for 23:40–23:46 UTC, event type and client only: + +| Time | Event | Client | Result | +|---|---|---|---| +| 23:42:25 | `mfa_failed` | `user-engine-portal` | failure | +| 23:43:20 | `auth_success` then `token_issued` | `user-engine-portal` | success | +| 23:44:45 | `auth_success` then `token_issued` | `user-engine-portal` | success | +| 23:45:37 | `auth_success` then `token_issued` | `user-engine-portal` | success | +| 23:46:10 | `token_exchange_error`, then `auth_failed` | `vergabe-demo-company` | failure | +| 23:46:38 | `auth_success` then `token_issued` | `vergabe-demo-company` | success | + +No `stale_upstream_authentication` in the window. Each portal success was a new +`auth_start`, so the earlier session was not silently reused. The Vergabe +token was issued after one failed code exchange, on a second attempt. Already +issued application JWTs are not revoked by provider logout. diff --git a/docs/operations.md b/docs/operations.md index abcd278..c721088 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -174,13 +174,14 @@ workload or customer data, any sign the transcript left the workstation, or a planned key rotation. The same workplan removes the problem class by giving agents a cluster identity that cannot read these objects at all. -## Unreleased fail-closed startup changes (read before the next rollout) +## Fail-closed startup changes shipped in the live image -The deployed image at the time of writing is -`sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`, built -from `dcebd46`. The changes below on `main` postdate it, all affect startup or -issuance, and **all fail closed**, so they land together on the next rollout and -a mistake in either presents as a refusal rather than as a warning. +The live issuer is +`sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`, +Forgejo run 69, source `11ce29a`, confirmed running on 2026-09-25. The changes +below shipped in that image. They fail closed. The 2026-09-24 Vergabe journey +completed after one token-exchange failure; see +`docs/evidence/2026-09-24-fresh-login-and-account-switch.md`. **1. Browser clients reject service-identity fields (`74b35b6`, KEY-WP-0028).** Config validation now rejects `serviceSubject` or `roles` on a client whose @@ -212,9 +213,8 @@ or is absent (`stale_upstream_authentication`). This changes nothing for clients that do not ask for freshness. The proof is a completed fresh-login journey, not a redirect check. -None of these has been exercised against a running issuer. The honest proof for both is -a live boot with the new binary, which belongs to the attended rollout window and -not to a session running against production on its own. +The live boot is the image above. A further rollout is not required for these +three changes. ## What is not claimed diff --git a/workplans/KEY-WP-0033-vergabe-fresh-login.md b/workplans/KEY-WP-0033-vergabe-fresh-login.md index 640fb27..5b478f9 100644 --- a/workplans/KEY-WP-0033-vergabe-fresh-login.md +++ b/workplans/KEY-WP-0033-vergabe-fresh-login.md @@ -4,12 +4,12 @@ type: workplan title: "Preserve fresh-user authentication for the Vergabe company handoff" domain: infotech repo: key-cape -status: active +status: finished flavor: implementation owner: codex topic_slug: netkingdom created: "2026-09-12" -updated: "2026-09-23" +updated: "2026-09-25" related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025] state_hub_workstream_id: "144dd430-1a09-51e1-9aad-e799ee86c338" --- @@ -34,7 +34,7 @@ contains four service clients and the admitted human approver client. ```task id: KEY-WP-0033-T02 -status: progress +status: done priority: high state_hub_task_id: "7b58f08c-6063-554a-8700-a1edbc805ca4" ``` @@ -83,6 +83,11 @@ than the KeyCape request, max_age needs one within that age, and a missing auth_time fails closed (event `stale_upstream_authentication`). Known edge: a user whose Authelia login is under 10s old at request time is not re-prompted and is refused rather than admitted. Also fixed the stale example-count test left -by 651625c/1620ce2 (6 service + 1 human). Full Go suite passes. Not deployed: -needs a release plus the attended window, then a completed rerun of the -bernd.worsch-99 journey. Redirect-only checks do not count as proof. +by 651625c/1620ce2 (6 service + 1 human). Full Go suite passes. + +The image was already the live issuer +(`sha256:8dc35801`, Forgejo run 69, source `11ce29a`). No second rollout. +2026-09-24 23:46 UTC the founder completed the Vergabe journey: one +`token_exchange_error`, then `auth_success` and `token_issued` for +`vergabe-demo-company`. No `stale_upstream_authentication`. Receipt: +`docs/evidence/2026-09-24-fresh-login-and-account-switch.md`. diff --git a/workplans/KEY-WP-0034-account-recovery.md b/workplans/KEY-WP-0034-account-recovery.md index 220475e..eb58f99 100644 --- a/workplans/KEY-WP-0034-account-recovery.md +++ b/workplans/KEY-WP-0034-account-recovery.md @@ -4,12 +4,12 @@ type: workplan title: "Browser authentication recovery and confirmed shared sign-out" domain: infotech repo: key-cape -status: active +status: finished flavor: implementation owner: codex topic_slug: key-cape created: "2026-09-12" -updated: "2026-09-12" +updated: "2026-09-25" state_hub_workstream_id: "49b0cd1d-fb9d-5351-99eb-9be9143a092d" --- @@ -37,7 +37,7 @@ MFA downgrade, global JWT revocation claim or inferred workload entitlements. ```task id: KEY-WP-0034-T02 -status: progress +status: done priority: high state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2" ``` @@ -54,6 +54,11 @@ Source verification: Full Go suite passed; final OIDC/config tests passed after Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993 (Helm revision 3). All three are Ready. Six provider checks, eleven product checks and six fresh anonymous Chromium checks pass, including actual provider -logout POST and return to the portal without test overrides. Real-user identity -switching is still awaiting operator evidence; no authenticated/MFA acceptance -is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md. +logout POST and return to the portal without test overrides. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md. + +2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer +recorded one `mfa_failed` for `user-engine-portal`, then three separate +`auth_start` → `auth_success` → `token_issued` sequences. A silent reuse of +the previous portal session would not have produced those new successes. +Provider logout still does not revoke already issued application JWTs. +Receipt: `docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.