coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
114 commits 1 branch 0 tags 765 KiB
Commit graph

114 commits

This branch
This branch
All branches
Author SHA1 Message Date
custodian-sync
23ab8397b6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-25:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
 2026-08-25 19:53:11 +02:00
codex
5c730240af docs(agents): repoint remote State Hub URL to the in-cluster address 
The remote row pointed at 127.0.0.1:18000, a reverse tunnel back to the
workstation. On railiance01 the State Hub runs in the cluster on that same
machine, so the request left the box and came back to reach a local service.

Refs CUST-WP-0067-T07

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
 2026-08-25 00:21:16 +02:00
tegwick
93704fd242 ops: restart identity provisioner during keycape rotation 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 14:42:44 +02:00
tegwick
6a996bd71e security: rotate exposed KeyCape credentials 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 14:26:36 +02:00
custodian-sync
c9fd9b1f9a chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-23:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 14:24:54 +02:00
repo-manager
bb6dc8d7fc chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:57:59 +02:00
custodian-sync
a9dce795b7 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-23:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:57:58 +02:00
tegwick
b7b4985baa Track KeyCape live secret exposure recovery 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:56:09 +02:00
repo-manager
d150be1097 chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:19:35 +02:00
tegwick
48fb556ce8 Use canonical workplan ID for callback admission 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:16:46 +02:00
tegwick
f5cf77fa0c Admit operator-tunneled OpenBao callback
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 23s
Details 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:16:21 +02:00
repo-manager
34fadae1c1 chore(registrar): assign State Hub identifiers 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:13:38 +02:00
custodian-sync
56adce7652 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-23:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:13:37 +02:00
tegwick
efce3e9331 Implement KeyCape provider and service identity contracts
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 25s
Details 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:10:13 +02:00
custodian-sync
cdfb046b80 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-23:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c
 2026-08-23 13:00:52 +02:00
tegwick
0a7cc7e9e9 Refresh WORK-RECORDS after KEY-WP-0008 closeout 2026-08-16 01:06:27 +02:00
custodian-sync
bd90a0e82c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-16:
  - update .custodian-brief.md for key-cape
 2026-08-16 01:06:09 +02:00
tegwick
b6af6c5268 Finish KEY-WP-0008: registration handoff and client MFA isolation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 34s
Details 
Add signed registration/enrollment handoffs, per-request assurance
policy with login-session isolation, and /logout. coulomb-social
stays AAL1 unless acr_values or another client raises the bar.
 2026-08-16 01:05:27 +02:00
tegwick
fff9e39478 docs: point at RMASTER-WP-0019 after master prefix rename 2026-08-14 14:29:19 +02:00
tegwick
3bef507cb8 KEY-WP-0008: honor per-client mfaRequired and acr_values step-up
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 30s
Details 
Allow coulomb-social ordinary login at AAL1 via mfaRequired: false while
keeping provider requireForAll for clients without an override. Preserve
explicit acr_values=aal2 for step-up.
 2026-08-09 22:42:51 +02:00
custodian-sync
8e976bc60f chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-09:
  - update .custodian-brief.md for key-cape
 2026-08-09 21:56:59 +02:00
custodian-sync
460dcbce0d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-08-09:
  - update .custodian-brief.md for key-cape
 2026-08-09 20:52:35 +02:00
tegwick
cd33e118c0 Add coulomb-social public OIDC client to KeyCape dev-config 
Aligns local compose client list with live railiance01 registration.
 2026-08-09 01:50:52 +02:00
tegwick
09aafdb9c6 Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 
Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's
preliminary governing license, per target-revenue's
workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full
specialist legal review is deferred until out of beta (target-revenue
SCOPE.md §1). No Phase is yet declared for this repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-29 23:48:58 +02:00
tegwick
a6ff5384b1 Finish portal OIDC integration 2026-07-29 22:59:38 +02:00
custodian-sync
6b32fb1384 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-29:
  - update .custodian-brief.md for key-cape
 2026-07-29 22:55:54 +02:00
custodian-sync
253a5bac77 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-29:
  - update .custodian-brief.md for key-cape
 2026-07-29 22:15:20 +02:00
tegwick
2465481e3c Complete Binky tenant onboarding 2026-07-29 22:13:53 +02:00
tegwick
abd9e6fa2b Record Binky MFA login acceptance 2026-07-29 22:05:18 +02:00
tegwick
72b0eb404c Record platform-root authorization fix 2026-07-29 21:33:37 +02:00
tegwick
90a20783e5 Map platform-root group to platform operator
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 26s
Details
2026-07-29 21:30:56 +02:00
tegwick
41d2e1d1f6 Record Binky password handoff readiness 2026-07-28 17:56:14 +02:00
tegwick
49a8992d6e Advance Binky human onboarding 2026-07-28 16:49:27 +02:00
custodian-sync
2bfd115f11 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-28:
  - update .custodian-brief.md for key-cape
 2026-07-28 16:48:13 +02:00
tegwick
070c38f447 Record suspended identity enforcement 2026-07-28 01:33:24 +02:00
tegwick
909bb327fc Deny suspended directory identities
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 24s
Details
2026-07-28 01:23:22 +02:00
tegwick
76da0237ff Bind portal OIDC workplan to State Hub 2026-07-28 00:43:56 +02:00
custodian-sync
806bcf18d4 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-28:
  - update .custodian-brief.md for key-cape
 2026-07-28 00:40:13 +02:00
tegwick
e8b4eded88 Map explicit tenant groups into OIDC claims
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 26s
Details
2026-07-28 00:34:19 +02:00
tegwick
993a4dd589 Register user-engine portal OIDC client 2026-07-28 00:06:38 +02:00
tegwick
401ab9ca55 Refresh Binky onboarding records 2026-07-27 22:34:21 +02:00
custodian-sync
c9459b29fc chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - update .custodian-brief.md for key-cape
 2026-07-27 22:31:59 +02:00
tegwick
1cd137cd9d Route Binky onboarding through user portal 2026-07-27 22:31:43 +02:00
tegwick
3d108adeb8 Refresh work record index 2026-07-27 21:13:44 +02:00
custodian-sync
3def97b087 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - update .custodian-brief.md for key-cape
 2026-07-27 20:53:36 +02:00
tegwick
e54bcd9a40 Advance Binky identity onboarding 2026-07-27 20:39:13 +02:00
custodian-sync
0fa9ec9673 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - update .custodian-brief.md for key-cape
 2026-07-27 20:18:33 +02:00
tegwick
881fffc079 Complete KeyCape service-token rollout
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 25s
Details
2026-07-27 20:17:55 +02:00
custodian-sync
f4a2f7eb1e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - update .custodian-brief.md for key-cape
 2026-07-27 20:03:36 +02:00
custodian-sync
e4464278e7 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - KEY-WP-0006-T04: progress → wait
 2026-07-27 20:03:31 +02:00