coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
372 commits 1 branch 0 tags 83 MiB
Commit graph

372 commits

This branch
This branch
All branches
Author SHA1 Message Date
tegwick
a140a4ab05 KEY-WP-0046: deployed in net-kingdom; finished 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:52:27 +01:00
tegwick
b3150f3530 KEY-WP-0046-T02: image main-e2b5fa1 published and pinned in net-kingdom 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:34:12 +01:00
tegwick
731a6d7096 KEY-WP-0045, KEY-WP-0046: hub IDs written back by fix-consistency 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:25:35 +01:00
tegwick
e2b5fa1442 KEY-WP-0046: directory bind password from KEYCAPE_LLDAP_BIND_PW
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details 
config.Load uses the variable when lldap.bindPW is empty, accepts equal
values (migration, logged as redundant) and refuses differing values with an
error that names neither. check-config and identity-facts report the source,
never the value. For net-kingdom NK-WP-0056-T04 (ESO-delivered svc-keycape bind).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:24:22 +01:00
tegwick
a1ab8ff807 KEY-WP-0045: value-safe identity-facts export for NK-WP-0054-T04
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 23s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
keycape identity-facts --config PATH and make identity-facts print client
registry, directory bind and admin-surface facts without credential values or
secret reference names. Fixture and committed-config tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
 2026-10-28 09:50:54 +01:00
tegwick
1af86580e3 KEY-WP-0044: record hub ids 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
 2026-10-28 01:13:57 +01:00
tegwick
9adfb0bf4d KEY-WP-0044: traceparent correlation task and audit-core intake package (NK-WP-0055-T11) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
 2026-10-27 23:28:54 +01:00
tegwick
fc9f09a8c2 Record KeyCape owner acceptance of NK-WP-0049 isolated restore (issuer side) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
 2026-10-27 21:40:11 +01:00
tegwick
7190f5dfb7 KEY-WP-0043: record hub ids written by fix-consistency 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
 2026-10-24 23:53:01 +02:00
tegwick
3acc86fdef KEY-WP-0043: per-run agent identity assessment and proposed workplan 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
 2026-10-24 23:49:33 +02:00
tegwick
41cd07c784 Declare the identity backends behind the key-cape facade. 
Authelia, LLDAP, privacyIDEA, identity-provisioner, and their backup
CronJobs are one unit contained by keycape. Manifests remain in net-kingdom.

Assistant: grok
Assistant-Session: 01a16923-5dc2-7a33-94e9-834572d7bba0
 2026-10-23 17:42:45 +02:00
tegwick
f638b91b0c Declare the live release units for this owner. 
The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.

Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
 2026-10-23 15:49:54 +02:00
tegwick
a3f1b7dd12 build: keep generated orientation brief local and untracked 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
 2026-10-19 13:44:09 +02:00
tegwick
5defa33cd8 build: adopt staged work-record index generation 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
 2026-10-19 13:15:16 +02:00
tegwick
e2c5a94782 Bind online human ID tokens to the exact current access grant
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m4s
Details
Authentication acceptance / provider-contract (push) Successful in 12s
Details
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 12:13:56 +02:00
tegwick
08c083bae9 Share current-token verification and scoped cleanup through one producer client
Some checks failed
Authentication acceptance / acceptance (push) Failing after 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 11:36:26 +02:00
tegwick
67a0869c1e Add opt-in issuer-owned access-token status and scoped revocation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 10:10:38 +02:00
tegwick
d803e9282a docs(key39): scope pending task authorization correctly 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:39:02 +02:00
tegwick
26ec9bb9b1 docs(key39): clarify original client approval scope 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:36:07 +02:00
tegwick
40de616e07 docs(key39): record coordinator finalization review 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:27:15 +02:00
tegwick
e76d4130f3 KEY-WP-0039-T02: record Platform source-prepared owner returns 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:33:43 +02:00
tegwick
39c475ca07 KEY-WP-0040-T01: record founder-confirmed serial suffix E1D 
The earlier closing record claimed every Done-when condition held before the
suffix had been checked. The founder has now confirmed the previewed TOTP is
the same E1D factor as on Oct 11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:22:21 +02:00
tegwick
258d899a78 Finish KEY-WP-0040: OTP help link and recovery preview accepted live. 
Founder-attended 2026-10-17: the OTP challenge shows the lost-authenticator
link (T02), and the platform-root factor-recovery preview of tegwick lists the
TOTP without invalid_request (T01, F6 fixed). No factor was changed. U08 is
handed back to user-engine (USER-WP-0028-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:15:22 +02:00
tegwick
834b0d06a1 Review exact offline checker behavior for browser registration 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
 2026-10-16 22:08:05 +02:00
tegwick
3c71226a1a docs: reconcile deployed MFA help and remaining recovery acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
 2026-10-16 21:24:41 +02:00
tegwick
6a4afd8080 Finish KEY-WP-0041: diagnosis page accepted on a live OpenBao login. 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:33:09 +02:00
tegwick
59c1df71e3 Record the live openbao-admin signInDiagnosis flag (KEY-WP-0041-T02). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:25:23 +02:00
tegwick
3b8d69546b Record live image cdec9dd7 with the sign-in diagnosis page (KEY-WP-0041-T02). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:09:11 +02:00
tegwick
8c6c071ad9 Record the State Hub ids for KEY-WP-0041. 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-14 23:46:34 +02:00
tegwick
44b2434100 Add KEY-WP-0041 for the NK-WP-0051-T02 sign-in diagnosis page.
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m19s
Details
Authentication acceptance / provider-contract (push) Successful in 23s
Details
Build and Publish Container Image / build-and-push (push) Successful in 42s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-14 23:45:20 +02:00
tegwick
af3b1b0dfb Add opt-in sign-in diagnosis page and uid/assurance on auth log (NK-WP-0051-T02). 
A client registration flag, signInDiagnosis (default off), makes the
callback render uid, sorted groups, assurance and client_id before the
redirect, with one continue link to the unchanged code. assurance is aal2
only when this request verified a one-time code. The auth_success log
line now carries uid and assurance beside client_id. Enabled for
openbao-admin in the dev config; the live flag is documented in
docs/operations.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-14 23:45:11 +02:00
tegwick
205a1c0edc Link the MFA challenge to lost-authenticator help.
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m1s
Details
Authentication acceptance / provider-contract (push) Successful in 24s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
The OTP page now points at the account security page without carrying challenge state, and the render test checks that link. Workplan headings sit above their task blocks so the hub titles match KEY-WP-0038 and KEY-WP-0039. KEY-WP-0039-T02 stays waiting on the Forgejo identity gate.

Assistant: grok
Assistant-Session: 01a13b3b-6856-7900-9d04-bccba2337a30
 2026-10-14 18:29:33 +02:00
tegwick
61ee563b1f docs(reuse): establish reviewed NetKingdom security capabilities 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
 2026-10-14 06:39:53 +02:00
tegwick
1344fc80e5 fix: preserve directory subjects in factor recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 57s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
 2026-10-12 01:23:29 +02:00
tegwick
f8ea591ba4 Sync work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:03:37 +02:00
custodian-sync
aec060a631 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:03:36 +02:00
tegwick
e67cca104a Add KEY-WP-0040: recovery preview defect and OTP prompt help link from attended MFA run 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:02:25 +02:00
tegwick
6398e41dad Sync work-record index after requalification 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:48:40 +02:00
custodian-sync
eeb868ed25 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:48:39 +02:00
tegwick
e4dfd047ac Requalify tasks after round-2 founder decisions and fix mislabeled human gates (2026-10-11) 
See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:47:54 +02:00
tegwick
21c664643b Record verified KEY39 source acceptance and remaining execution prerequisites 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 19:35:51 +02:00
tegwick
e956fd1b52 Refresh work-record index after reviewed JWT source completion 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 18:37:44 +02:00
tegwick
0f47e0c666 Publish reviewed bounded JWT ready handoff and retained owner history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 18:31:04 +02:00
tegwick
f60e7419a9 Preserve JWT input refusal and bounded successor acknowledgment 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 17:30:10 +02:00
custodian-sync
8764b57939 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 15:47:09 +02:00
tegwick
a46024bf3e Publish reviewed KEY39 lifecycle source and preserve failed review history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 15:33:14 +02:00
tegwick
aef56bcba1 Bind JWT negative probes to exact claim and cleanup evidence 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 02:21:03 +02:00
custodian-sync
f97f006ede chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 02:18:34 +02:00
tegwick
3ceead4903 KEY-WP-0038: record type review closure and 1.1 re-pin 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 15:25:34 +02:00
custodian-sync
b2762a3d8c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:30:10 +02:00