coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
373 commits 1 branch 0 tags 83 MiB
Commit graph

198 commits

Author SHA1 Message Date
tegwick
a140a4ab05 KEY-WP-0046: deployed in net-kingdom; finished 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:52:27 +01:00
tegwick
b3150f3530 KEY-WP-0046-T02: image main-e2b5fa1 published and pinned in net-kingdom 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:34:12 +01:00
tegwick
731a6d7096 KEY-WP-0045, KEY-WP-0046: hub IDs written back by fix-consistency 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:25:35 +01:00
tegwick
e2b5fa1442 KEY-WP-0046: directory bind password from KEYCAPE_LLDAP_BIND_PW
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details 
config.Load uses the variable when lldap.bindPW is empty, accepts equal
values (migration, logged as redundant) and refuses differing values with an
error that names neither. check-config and identity-facts report the source,
never the value. For net-kingdom NK-WP-0056-T04 (ESO-delivered svc-keycape bind).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
 2026-10-31 10:24:22 +01:00
tegwick
a1ab8ff807 KEY-WP-0045: value-safe identity-facts export for NK-WP-0054-T04
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m12s
Details
Authentication acceptance / provider-contract (push) Successful in 23s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
keycape identity-facts --config PATH and make identity-facts print client
registry, directory bind and admin-surface facts without credential values or
secret reference names. Fixture and committed-config tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
 2026-10-28 09:50:54 +01:00
tegwick
1af86580e3 KEY-WP-0044: record hub ids 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
 2026-10-28 01:13:57 +01:00
tegwick
9adfb0bf4d KEY-WP-0044: traceparent correlation task and audit-core intake package (NK-WP-0055-T11) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
 2026-10-27 23:28:54 +01:00
tegwick
7190f5dfb7 KEY-WP-0043: record hub ids written by fix-consistency 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
 2026-10-24 23:53:01 +02:00
tegwick
3acc86fdef KEY-WP-0043: per-run agent identity assessment and proposed workplan 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
 2026-10-24 23:49:33 +02:00
tegwick
e2c5a94782 Bind online human ID tokens to the exact current access grant
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m4s
Details
Authentication acceptance / provider-contract (push) Successful in 12s
Details
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 12:13:56 +02:00
tegwick
08c083bae9 Share current-token verification and scoped cleanup through one producer client
Some checks failed
Authentication acceptance / acceptance (push) Failing after 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 11:36:26 +02:00
tegwick
67a0869c1e Add opt-in issuer-owned access-token status and scoped revocation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 59s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 32s
Details 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
 2026-10-18 10:10:38 +02:00
tegwick
d803e9282a docs(key39): scope pending task authorization correctly 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:39:02 +02:00
tegwick
26ec9bb9b1 docs(key39): clarify original client approval scope 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:36:07 +02:00
tegwick
40de616e07 docs(key39): record coordinator finalization review 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa
 2026-10-17 13:27:15 +02:00
tegwick
e76d4130f3 KEY-WP-0039-T02: record Platform source-prepared owner returns 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:33:43 +02:00
tegwick
39c475ca07 KEY-WP-0040-T01: record founder-confirmed serial suffix E1D 
The earlier closing record claimed every Done-when condition held before the
suffix had been checked. The founder has now confirmed the previewed TOTP is
the same E1D factor as on Oct 11.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:22:21 +02:00
tegwick
258d899a78 Finish KEY-WP-0040: OTP help link and recovery preview accepted live. 
Founder-attended 2026-10-17: the OTP challenge shows the lost-authenticator
link (T02), and the platform-root factor-recovery preview of tegwick lists the
TOTP without invalid_request (T01, F6 fixed). No factor was changed. U08 is
handed back to user-engine (USER-WP-0028-T03).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 903097@bnt-lap001
Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
 2026-10-17 04:15:22 +02:00
tegwick
834b0d06a1 Review exact offline checker behavior for browser registration 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
 2026-10-16 22:08:05 +02:00
tegwick
3c71226a1a docs: reconcile deployed MFA help and remaining recovery acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
 2026-10-16 21:24:41 +02:00
tegwick
6a4afd8080 Finish KEY-WP-0041: diagnosis page accepted on a live OpenBao login. 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:33:09 +02:00
tegwick
59c1df71e3 Record the live openbao-admin signInDiagnosis flag (KEY-WP-0041-T02). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:25:23 +02:00
tegwick
3b8d69546b Record live image cdec9dd7 with the sign-in diagnosis page (KEY-WP-0041-T02). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-15 00:09:11 +02:00
tegwick
8c6c071ad9 Record the State Hub ids for KEY-WP-0041. 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-14 23:46:34 +02:00
tegwick
44b2434100 Add KEY-WP-0041 for the NK-WP-0051-T02 sign-in diagnosis page.
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m19s
Details
Authentication acceptance / provider-contract (push) Successful in 23s
Details
Build and Publish Container Image / build-and-push (push) Successful in 42s
Details 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
 2026-10-14 23:45:20 +02:00
tegwick
205a1c0edc Link the MFA challenge to lost-authenticator help.
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m1s
Details
Authentication acceptance / provider-contract (push) Successful in 24s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
The OTP page now points at the account security page without carrying challenge state, and the render test checks that link. Workplan headings sit above their task blocks so the hub titles match KEY-WP-0038 and KEY-WP-0039. KEY-WP-0039-T02 stays waiting on the Forgejo identity gate.

Assistant: grok
Assistant-Session: 01a13b3b-6856-7900-9d04-bccba2337a30
 2026-10-14 18:29:33 +02:00
tegwick
1344fc80e5 fix: preserve directory subjects in factor recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 57s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
 2026-10-12 01:23:29 +02:00
tegwick
f8ea591ba4 Sync work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:03:37 +02:00
tegwick
e67cca104a Add KEY-WP-0040: recovery preview defect and OTP prompt help link from attended MFA run 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:02:25 +02:00
tegwick
e4dfd047ac Requalify tasks after round-2 founder decisions and fix mislabeled human gates (2026-10-11) 
See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:47:54 +02:00
tegwick
21c664643b Record verified KEY39 source acceptance and remaining execution prerequisites 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 19:35:51 +02:00
tegwick
0f47e0c666 Publish reviewed bounded JWT ready handoff and retained owner history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 18:31:04 +02:00
tegwick
a46024bf3e Publish reviewed KEY39 lifecycle source and preserve failed review history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 15:33:14 +02:00
tegwick
aef56bcba1 Bind JWT negative probes to exact claim and cleanup evidence 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 02:21:03 +02:00
tegwick
3ceead4903 KEY-WP-0038: record type review closure and 1.1 re-pin 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 15:25:34 +02:00
tegwick
c528daa5be Add keycape check-config; reject duplicate clientIds
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m25s
Details
Authentication acceptance / provider-contract (push) Successful in 25s
Details
Build and Publish Container Image / build-and-push (push) Successful in 43s
Details 
net-kingdom asked for a way to validate a rendered configuration before
keycape-client.py restarts KeyCape (oidc-browser-relying-party review R4).
check-config runs every startup check that needs no secret, key or upstream:
validation, registry build, global tokenLifetime, policy-store clients and,
with --env-names, the secretRef bindings. The report carries no values.

ValidateConfig now refuses a clientId registered twice. The registry is a
map, so a duplicate silently replaced the earlier registration.

Also records the owners' amended CCR-2026-0018 sequence in KEY-WP-0013.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:28:36 +02:00
tegwick
bae9f85160 KEY-WP-0039: probe registration packet and attended negative-probe script 
T01 done: railiance-platform agreed the case list. The packet adds an
otherwise-valid expiry client and pins audience on the claim probes so each
token fails only the claim under test. The script prints one refused boolean
and refusal class per case, revokes any accepted token, and never counts a
transport failure as a refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:18:24 +02:00
tegwick
158f13b871 KEY-WP-0013: record the proposed CCR-2026-0018 disablement sequence 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:40:37 +02:00
tegwick
45a04c14bb chore(consistency): record State Hub IDs for KEY-WP-0039 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:30:17 +02:00
tegwick
ab5cccdcf3 KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens 
Forgejo's secret now lives at platform/workloads/keycape/forgejo, as derived by
oidc-browser-relying-party 1.0 (net-kingdom 074b3a0). KEY-WP-0039 answers
railiance-platform's CCR-2026-0038 question with one-mismatch probe registrations
instead of an issuer path that could mint arbitrary claims.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:29:32 +02:00
tegwick
213b98feb1 KEY-WP-0038-T04 cancelled: entry point moved to net-kingdom NK-WP-0048-T09 
Remove the draft key-cape.oidc-client-registration declaration; net-kingdom
declares net-kingdom.keycape-client-registration beside the live deployment
machinery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 23:03:58 +02:00
tegwick
9fab7912f5 chore(consistency): record State Hub ID for KEY-WP-0038-T04 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:45:23 +02:00
tegwick
c737e361ce Declare key-cape.oidc-client-registration; add KEY-WP-0038-T04 entry point 
Playbook capability (contract PASS, maturity planned) composed by net-kingdom's
SecurityCaseType oidc-browser-relying-party. T04 implements tools/keycape-client,
generalizing the per-client rollout helpers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:44:43 +02:00
tegwick
d8f3668a18 KEY-WP-0038-T02: register Forgejo as the first KnownSecurityCase 
No hand-built rollout; depends on net-kingdom NK-WP-0048-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:17:03 +02:00
tegwick
05e05aa945 KEY-WP-0038-T01 done: founder accepted the Forgejo client request 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:26:37 +02:00
custodian-sync
d11bf87c2b chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-10-08:
  - workplan status: ready → active

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:39 +02:00
tegwick
73d97e3323 KEY-WP-0038-T01: draft the Forgejo OIDC client request packet 
Non-secret claim contract for founder acceptance and railiance-apps agreement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:00 +02:00
tegwick
c4a8b75884 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:13:31 +02:00
tegwick
ff6890788b Add KEY-WP-0038: Forgejo as a NetKingdom OIDC client 
ORGREF-WP-0002-T04; founder-approved 2026-10-08. Counterpart: railiance-apps
RAPPS-WP-0016.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:12:09 +02:00
tegwick
e0b5faea52 KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:26:03 +02:00