coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
259 commits 1 branch 0 tags 62 MiB
Commit graph

259 commits

This branch
This branch
All branches
Author SHA1 Message Date
tegwick
51e541c9a1 Adopt the agent environment orientation for KeyCape's live objects. 
Write Secrets with kubectl replace in the rotation script, since apply copies
the data into the last-applied annotation. Record in operations.md the
live-change rules that apply here and the open finding: four live Secrets
carry that annotation, and removing it waits for the founder's go-ahead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:07:23 +02:00
custodian-sync
012e695947 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-23:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 22:01:41 +02:00
tegwick
11ce29af8b Enforce login freshness in KeyCape instead of forwarding prompt=login (KEY-WP-0033).
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m27s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details 
Authelia 4.38 refuses prompt=login for every real login because it registers
the authorization request after authentication. Send a bounded max_age
upstream and check the verified upstream auth_time against prompt=login /
max_age in the callback, failing closed when auth_time is missing.

Also update the service-client example count left stale by 651625c/1620ce2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 352750@bnt-lap001
Assistant-Session: de41ef1c-2113-4dd2-9b92-f318ffa7f98b
 2026-09-23 21:59:21 +02:00
tegwick
9cb950752f Declare key-cape's layer as Tooling in INTENT.md frontmatter. 
Discharges the §11 declaration obligation found in FLEX-WP-0030 B2 and
raised by gate-house (GH-WP-0004-T08). Form per GH-DEC-2026-017: INTENT.md
governs, no sidecar, no standard version. Records the PIP-shaped tension of
the token endpoint and the access-engine claims boundary from this side.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
 2026-09-21 12:36:03 +02:00
tegwick
1620ce2edd Register informed-decision-sitting-requester as create-only.
Some checks failed
Authentication acceptance / acceptance (push) Failing after 1m7s
Details
Authentication acceptance / provider-contract (push) Successful in 15s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
Pin tenant:platform, approval:create only, and the KeyCape env name.
Live secret custody remains railiance-platform attended apply.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
 2026-09-15 20:08:07 +02:00
tegwick
f67d98ff63 Classify open workplans with flavor (CUST-WP-0072). 
Set flavor on open workplans from origin/prose/status. Copy existing
depends_on aliases only. Do not promote residuals.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
 2026-09-14 15:50:43 +02:00
tegwick
b854e1ed0c Fix missing live Informed Decision browser registration 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 02:54:52 +02:00
tegwick
651625c547 Register create-only Secrets Engine approval requester 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 02:47:31 +02:00
tegwick
6bcc2a5919 Synchronize session work records 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:16:31 +02:00
custodian-sync
672da6ff7d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-14:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:11:48 +02:00
tegwick
e17b3f4631 Record deployed P06 policy and completed platform acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:10:25 +02:00
tegwick
e0b3c25f06 Implement scoped P06 authentication policy and guarded optional onboarding
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m22s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
 2026-09-14 00:00:05 +02:00
tegwick
aa709fb854 Implement P05 checked services and safe selected delivery recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m1s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details
Build and Publish Container Image / build-and-push (push) Successful in 36s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 22:11:49 +02:00
tegwick
187c49abe5 Pin final P04 release and native ownership-lock evidence 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:30:50 +02:00
tegwick
63b3070853 Refuse multi-owner factors and lock ownership during recovery
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m5s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:21:24 +02:00
custodian-sync
30cd99cad1 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:19:55 +02:00
tegwick
a10c2f7f98 Record completed P04 recovery rollout and acceptance 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:19:13 +02:00
tegwick
d15f4dde0b Reconcile recovery by support reference and bound provider lookup
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m4s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:11:03 +02:00
tegwick
cb51584f58 Connect P04 audited recovery to fresh-MFA platform browser flow
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m14s
Details
Authentication acceptance / provider-contract (push) Successful in 13s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 21:05:33 +02:00
custodian-sync
317d897b85 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:31:15 +02:00
tegwick
4d893ed3c2 Verify factor identity again after recovery mutation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m6s
Details
Authentication acceptance / provider-contract (push) Successful in 12s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:30:23 +02:00
tegwick
3b7df9047e Implement audited lost-factor recovery and track remaining P04 acceptance
All checks were successful
Authentication acceptance / acceptance (push) Successful in 58s
Details
Authentication acceptance / provider-contract (push) Successful in 14s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:28:45 +02:00
custodian-sync
244e7e096f chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:25:26 +02:00
tegwick
502a2d5c56 Retain provider acceptance CI and synchronized assurance task binding 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:06:32 +02:00
custodian-sync
7f3a6da042 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:05:13 +02:00
tegwick
ecca6cb4ba Record verified enrollment assurance release and automate provider contract tests
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m13s
Details
Authentication acceptance / provider-contract (push) Successful in 28s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 17:03:44 +02:00
tegwick
113f3a6296 Verify reader scope before accepting absence of enrolled factors
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m6s
Details
Build and Publish Container Image / build-and-push (push) Successful in 53s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:59:09 +02:00
tegwick
122a0d1369 Require confirmed enrollment and genuine OTP evidence for MFA
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:37:08 +02:00
custodian-sync
3a36f1a507 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:26:53 +02:00
tegwick
74b4f7f1bc Establish scoped KeyCape factor custody and verified automatic renewal 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 16:25:33 +02:00
custodian-sync
fd34ac98f0 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:28:27 +02:00
tegwick
78f5a718e9 Record provider credential renewal release and remaining owner handoff 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:27:35 +02:00
custodian-sync
f4d8e44f0b chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:24:50 +02:00
tegwick
632b1f1376 Support provider credential renewal and reject unsuccessful OTP validation
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m10s
Details
Build and Publish Container Image / build-and-push (push) Successful in 44s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 14:23:24 +02:00
tegwick
85f5deaf4a Support opt-in MFA per browser client with authoritative enrollment checks 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:28:09 +02:00
custodian-sync
9a226e9cd0 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-13:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:27:39 +02:00
tegwick
ac8ed65203 Support opt-in MFA per browser client with authoritative enrollment checks
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-13 00:27:28 +02:00
tegwick
e1e292919a Record generated State Hub recovery task bindings 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 17:10:41 +02:00
custodian-sync
51f2bad145 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 17:10:02 +02:00
tegwick
62a86a4ba0 Record live account recovery and browser sign-out verification 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:50:35 +02:00
tegwick
4d8b8fe934 Allow registered provider redirects after sign-out confirmation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:47:33 +02:00
tegwick
91efb6d988 Preserve browser Origin on the confirmed sign-out form
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 35s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:43:32 +02:00
tegwick
074c2ce498 Add central login recovery and confirmed shared sign-out
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 44s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 10:34:41 +02:00
custodian-sync
89694ad6df chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 03:20:30 +02:00
tegwick
22788787c1 Record attended fresh-login rollout and verification 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 03:12:45 +02:00
custodian-sync
d68389861e chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:55:27 +02:00
tegwick
0647301c03 Record published fresh-login image and attended rollout gate 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:53:55 +02:00
custodian-sync
7695a064bc chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-12:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:45:56 +02:00
tegwick
8d4336e944 Forward fresh-login requirements to the authentication provider
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 44s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
 2026-09-12 02:43:31 +02:00
tegwick
139994cfac chore(consistency): register KEY-WP-0032 and refresh records [auto] 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
 2026-09-10 23:07:49 +02:00