coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
262 commits 1 branch 0 tags 62 MiB
Commit graph

262 commits

This branch
This branch
All branches
Author SHA1 Message Date
tegwick
004a72cd5c Record the deferred rotation and its triggers (CUST-WP-0073). 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-24 01:27:36 +02:00
tegwick
49565a345b Record the Secret template-dump trap and the 2026-09-23 exposure. 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:12:04 +02:00
custodian-sync
709790a533 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-23:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:08:25 +02:00
tegwick
51e541c9a1 Adopt the agent environment orientation for KeyCape's live objects. 
Write Secrets with kubectl replace in the rotation script, since apply copies
the data into the last-applied annotation. Record in operations.md the
live-change rules that apply here and the open finding: four live Secrets
carry that annotation, and removing it waits for the founder's go-ahead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:07:23 +02:00
custodian-sync
012e695947 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-23:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:01:41 +02:00
tegwick
11ce29af8b Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m27s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details 
Authelia 4.38 refuses prompt=login for every real login because it registers
the authorization request after authentication. Send a bounded max_age
upstream and check the verified upstream auth_time against prompt=login /
max_age in the callback, failing closed when auth_time is missing.

Also update the service-client example count left stale by 651625c/1620ce2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 21:59:21 +02:00
tegwick
9cb950752f Declare key-cape's layer as Tooling in INTENT.md frontmatter. 
Discharges the §11 declaration obligation found in FLEX-WP-0030 B2 and
raised by gate-house (GH-WP-0004-T08). Form per GH-DEC-2026-017: INTENT.md
governs, no sidecar, no standard version. Records the PIP-shaped tension of
the token endpoint and the access-engine claims boundary from this side.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
 2026-09-21 12:36:03 +02:00
tegwick
1620ce2edd Register informed-decision-sitting-requester as create-only.
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m7s
Details
Authentication acceptance / provider-contract (push) Successful in 15s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
Pin tenant:platform, approval:create only, and the KeyCape env name.
Live secret custody remains railiance-platform attended apply.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
 2026-09-15 20:08:07 +02:00
tegwick
f67d98ff63 Classify open workplans with flavor (CUST-WP-0072). 
Set flavor on open workplans from origin/prose/status. Copy existing
depends_on aliases only. Do not promote residuals.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
 2026-09-14 15:50:43 +02:00
tegwick
b854e1ed0c Fix missing live Informed Decision browser registration 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 02:54:52 +02:00
tegwick
651625c547 Register create-only Secrets Engine approval requester 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 02:47:31 +02:00
tegwick
6bcc2a5919 Synchronize session work records 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:16:31 +02:00
custodian-sync
672da6ff7d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-14:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:11:48 +02:00
tegwick
e17b3f4631 Record deployed P06 policy and completed platform acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:10:25 +02:00
tegwick
e0b3c25f06 Implement scoped P06 authentication policy and guarded optional onboarding
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m22s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:00:05 +02:00
tegwick
aa709fb854 Implement P05 checked services and safe selected delivery recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m1s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 22:11:49 +02:00
tegwick
187c49abe5 Pin final P04 release and native ownership-lock evidence 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:30:50 +02:00
tegwick
63b3070853 Refuse multi-owner factors and lock ownership during recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m5s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:21:24 +02:00
custodian-sync
30cd99cad1 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:19:55 +02:00
tegwick
a10c2f7f98 Record completed P04 recovery rollout and acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:19:13 +02:00
tegwick
d15f4dde0b Reconcile recovery by support reference and bound provider lookup
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m4s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:11:03 +02:00
tegwick
cb51584f58 Connect P04 audited recovery to fresh-MFA platform browser flow
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m14s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:05:33 +02:00
custodian-sync
317d897b85 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:31:15 +02:00
tegwick
4d893ed3c2 Verify factor identity again after recovery mutation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m6s
Details
Authentication acceptance / provider-contract (push) Successful in 12s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:30:23 +02:00
tegwick
3b7df9047e Implement audited lost-factor recovery and track remaining P04 acceptance
All checks were successful
Authentication acceptance / acceptance (push) Successful in 58s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:28:45 +02:00
custodian-sync
244e7e096f chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:25:26 +02:00
tegwick
502a2d5c56 Retain provider acceptance CI and synchronized assurance task binding 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:06:32 +02:00
custodian-sync
7f3a6da042 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:05:13 +02:00
tegwick
ecca6cb4ba Record verified enrollment assurance release and automate provider contract tests
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m13s
Details
Authentication acceptance / provider-contract (push) Successful in 28s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:03:44 +02:00
tegwick
113f3a6296 Verify reader scope before accepting absence of enrolled factors
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m6s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:59:09 +02:00
tegwick
122a0d1369 Require confirmed enrollment and genuine OTP evidence for MFA
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:37:08 +02:00
custodian-sync
3a36f1a507 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:26:53 +02:00
tegwick
74b4f7f1bc Establish scoped KeyCape factor custody and verified automatic renewal 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:25:33 +02:00
custodian-sync
fd34ac98f0 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:28:27 +02:00
tegwick
78f5a718e9 Record provider credential renewal release and remaining owner handoff 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:27:35 +02:00
custodian-sync
f4d8e44f0b chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:24:50 +02:00
tegwick
632b1f1376 Support provider credential renewal and reject unsuccessful OTP validation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 44s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:23:24 +02:00
tegwick
85f5deaf4a Support opt-in MFA per browser client with authoritative enrollment checks 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:28:09 +02:00
custodian-sync
9a226e9cd0 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:27:39 +02:00
tegwick
ac8ed65203 Support opt-in MFA per browser client with authoritative enrollment checks
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:27:28 +02:00
tegwick
e1e292919a Record generated State Hub recovery task bindings 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 17:10:41 +02:00
custodian-sync
51f2bad145 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 17:10:02 +02:00
tegwick
62a86a4ba0 Record live account recovery and browser sign-out verification 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:50:35 +02:00
tegwick
4d8b8fe934 Allow registered provider redirects after sign-out confirmation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:47:33 +02:00
tegwick
91efb6d988 Preserve browser Origin on the confirmed sign-out form
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 35s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:43:32 +02:00
tegwick
074c2ce498 Add central login recovery and confirmed shared sign-out
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 44s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:34:41 +02:00
custodian-sync
89694ad6df chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 03:20:30 +02:00
tegwick
22788787c1 Record attended fresh-login rollout and verification 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 03:12:45 +02:00
custodian-sync
d68389861e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:55:27 +02:00
tegwick
0647301c03 Record published fresh-login image and attended rollout gate 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:53:55 +02:00