coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the completed fresh login and account switch.

Browse source 
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
This commit is contained in:
tegwick 2026-09-25 01:49:42 +02:00
parent 004a72cd5c
commit f16559280c
4 changed files with 53 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/KEY-WP-0033-vergabe-fresh-login.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Preserve fresh-user authentication for the Vergabe company handoff"
domain: infotech
repo: key-cape
status: active
status: finished
flavor: implementation
owner: codex
topic_slug: netkingdom
created: "2026-09-12"
updated: "2026-09-23"
updated: "2026-09-25"
related: [VERGABE-WP-0019, NK-WP-0037, USER-WP-0025]
state_hub_workstream_id: "144dd430-1a09-51e1-9aad-e799ee86c338"
---
@ -34,7 +34,7 @@ contains four service clients and the admitted human approver client.
```task
id: KEY-WP-0033-T02
status: progress
status: done
priority: high
state_hub_task_id: "7b58f08c-6063-554a-8700-a1edbc805ca4"
```
@ -83,6 +83,11 @@ than the KeyCape request, max_age needs one within that age, and a missing
auth_time fails closed (event `stale_upstream_authentication`). Known edge: a
user whose Authelia login is under 10s old at request time is not re-prompted
and is refused rather than admitted. Also fixed the stale example-count test left
by 651625c/1620ce2 (6 service + 1 human). Full Go suite passes. Not deployed:
needs a release plus the attended window, then a completed rerun of the
bernd.worsch-99 journey. Redirect-only checks do not count as proof.
by 651625c/1620ce2 (6 service + 1 human). Full Go suite passes.
The image was already the live issuer
(`sha256:8dc35801`, Forgejo run 69, source `11ce29a`). No second rollout.
2026-09-24 23:46 UTC the founder completed the Vergabe journey: one
`token_exchange_error`, then `auth_success` and `token_issued` for
`vergabe-demo-company`. No `stale_upstream_authentication`. Receipt:
`docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.