coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the completed fresh login and account switch.

Browse source 
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
This commit is contained in:
tegwick 2026-09-25 01:49:42 +02:00
parent 004a72cd5c
commit f16559280c
4 changed files with 53 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

22
docs/evidence/2026-09-24-fresh-login-and-account-switch.md Normal file
View file

@ -0,0 +1,22 @@
# Fresh login and account switch — 2026-09-24
Issuer image already running:
`forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`
(Forgejo image run 69, source `11ce29a`). No further rollout was made.
The founder completed the browser journeys and reported that both worked.
Issuer telemetry for 23:40–23:46 UTC, event type and client only:
| Time | Event | Client | Result |
|---|---|---|---|
| 23:42:25 | `mfa_failed` | `user-engine-portal` | failure |
| 23:43:20 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:44:45 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:45:37 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:46:10 | `token_exchange_error`, then `auth_failed` | `vergabe-demo-company` | failure |
| 23:46:38 | `auth_success` then `token_issued` | `vergabe-demo-company` | success |
No `stale_upstream_authentication` in the window. Each portal success was a new
`auth_start`, so the earlier session was not silently reused. The Vergabe
token was issued after one failed code exchange, on a second attempt. Already
issued application JWTs are not revoked by provider logout.

18
docs/operations.md
View file

@ -174,13 +174,14 @@ workload or customer data, any sign the transcript left the workstation, or a
planned key rotation. The same workplan removes the problem class by giving
agents a cluster identity that cannot read these objects at all.
## Unreleased fail-closed startup changes (read before the next rollout)
## Fail-closed startup changes shipped in the live image
The deployed image at the time of writing is
`sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611`, built
from `dcebd46`. The changes below on `main` postdate it, all affect startup or
issuance, and **all fail closed**, so they land together on the next rollout and
a mistake in either presents as a refusal rather than as a warning.
The live issuer is
`sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`,
Forgejo run 69, source `11ce29a`, confirmed running on 2026-09-25. The changes
below shipped in that image. They fail closed. The 2026-09-24 Vergabe journey
completed after one token-exchange failure; see
`docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.
**1. Browser clients reject service-identity fields (`74b35b6`, KEY-WP-0028).**
Config validation now rejects `serviceSubject` or `roles` on a client whose
@ -212,9 +213,8 @@ or is absent (`stale_upstream_authentication`). This changes nothing for clients
that do not ask for freshness. The proof is a completed fresh-login journey,
not a redirect check.
None of these has been exercised against a running issuer. The honest proof for both is
a live boot with the new binary, which belongs to the attended rollout window and
not to a session running against production on its own.
The live boot is the image above. A further rollout is not required for these
three changes.
## What is not claimed