coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the completed fresh login and account switch.

Browse source 
Assistant: grok
Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f
This commit is contained in:
tegwick 2026-09-25 01:49:42 +02:00
parent 004a72cd5c
commit f16559280c
4 changed files with 53 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/KEY-WP-0034-account-recovery.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Browser authentication recovery and confirmed shared sign-out"
domain: infotech
repo: key-cape
status: active
status: finished
flavor: implementation
owner: codex
topic_slug: key-cape
created: "2026-09-12"
updated: "2026-09-12"
updated: "2026-09-25"
state_hub_workstream_id: "49b0cd1d-fb9d-5351-99eb-9be9143a092d"
---
@ -37,7 +37,7 @@ MFA downgrade, global JWT revocation claim or inferred workload entitlements.
```task
id: KEY-WP-0034-T02
status: progress
status: done
priority: high
state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2"
```
@ -54,6 +54,11 @@ Source verification: Full Go suite passed; final OIDC/config tests passed after
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
(Helm revision 3). All three are Ready. Six provider checks, eleven product
checks and six fresh anonymous Chromium checks pass, including actual provider
logout POST and return to the portal without test overrides. Real-user identity
switching is still awaiting operator evidence; no authenticated/MFA acceptance
is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
logout POST and return to the portal without test overrides. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer
recorded one `mfa_failed` for `user-engine-portal`, then three separate
`auth_start` → `auth_success` → `token_issued` sequences. A silent reuse of
the previous portal session would not have produced those new successes.
Provider logout still does not revoke already issued application JWTs.
Receipt: `docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.