coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
337 commits 1 branch 0 tags 83 MiB
Commit graph

337 commits

This branch
This branch
All branches
Author SHA1 Message Date
custodian-sync
aec060a631 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:03:36 +02:00
tegwick
e67cca104a Add KEY-WP-0040: recovery preview defect and OTP prompt help link from attended MFA run 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 23:02:25 +02:00
tegwick
6398e41dad Sync work-record index after requalification 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:48:40 +02:00
custodian-sync
eeb868ed25 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:48:39 +02:00
tegwick
e4dfd047ac Requalify tasks after round-2 founder decisions and fix mislabeled human gates (2026-10-11) 
See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
 2026-10-11 20:47:54 +02:00
tegwick
21c664643b Record verified KEY39 source acceptance and remaining execution prerequisites 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 19:35:51 +02:00
tegwick
e956fd1b52 Refresh work-record index after reviewed JWT source completion 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 18:37:44 +02:00
tegwick
0f47e0c666 Publish reviewed bounded JWT ready handoff and retained owner history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 18:31:04 +02:00
tegwick
f60e7419a9 Preserve JWT input refusal and bounded successor acknowledgment 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 17:30:10 +02:00
custodian-sync
8764b57939 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 15:47:09 +02:00
tegwick
a46024bf3e Publish reviewed KEY39 lifecycle source and preserve failed review history 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 15:33:14 +02:00
tegwick
aef56bcba1 Bind JWT negative probes to exact claim and cleanup evidence 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 02:21:03 +02:00
custodian-sync
f97f006ede chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-11:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
 2026-10-11 02:18:34 +02:00
tegwick
3ceead4903 KEY-WP-0038: record type review closure and 1.1 re-pin 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 15:25:34 +02:00
custodian-sync
b2762a3d8c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:30:10 +02:00
tegwick
c528daa5be Add keycape check-config; reject duplicate clientIds
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m25s
Details
Authentication acceptance / provider-contract (push) Successful in 25s
Details
Build and Publish Container Image / build-and-push (push) Successful in 43s
Details 
net-kingdom asked for a way to validate a rendered configuration before
keycape-client.py restarts KeyCape (oidc-browser-relying-party review R4).
check-config runs every startup check that needs no secret, key or upstream:
validation, registry build, global tokenLifetime, policy-store clients and,
with --env-names, the secretRef bindings. The report carries no values.

ValidateConfig now refuses a clientId registered twice. The registry is a
map, so a duplicate silently replaced the earlier registration.

Also records the owners' amended CCR-2026-0018 sequence in KEY-WP-0013.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:28:36 +02:00
tegwick
5bc4a366b0 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:20:43 +02:00
custodian-sync
79b0a9f9c6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:20:30 +02:00
tegwick
bae9f85160 KEY-WP-0039: probe registration packet and attended negative-probe script 
T01 done: railiance-platform agreed the case list. The packet adds an
otherwise-valid expiry client and pins audience on the claim probes so each
token fails only the claim under test. The script prints one refused boolean
and refusal class per case, revokes any accepted token, and never counts a
transport failure as a refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:18:24 +02:00
custodian-sync
01b318db87 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:42:09 +02:00
tegwick
158f13b871 KEY-WP-0013: record the proposed CCR-2026-0018 disablement sequence 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:40:37 +02:00
tegwick
60384834fe Review oidc-browser-relying-party 1.0 against KeyCape's client field rules 
Answers net-kingdom's NK-WP-0048-T04 review request. Two blocking findings:
redirect URIs with '?' pass the type but make KeyCape exit at startup, and
access_groups is enforced only by the consumer, never by KeyCape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:39:31 +02:00
tegwick
45a04c14bb chore(consistency): record State Hub IDs for KEY-WP-0039 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:30:17 +02:00
custodian-sync
fba29a33e6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:30:12 +02:00
tegwick
ab5cccdcf3 KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens 
Forgejo's secret now lives at platform/workloads/keycape/forgejo, as derived by
oidc-browser-relying-party 1.0 (net-kingdom 074b3a0). KEY-WP-0039 answers
railiance-platform's CCR-2026-0038 question with one-mismatch probe registrations
instead of an issuer path that could mint arbitrary claims.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:29:32 +02:00
custodian-sync
f8ef4d418c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 23:04:37 +02:00
tegwick
213b98feb1 KEY-WP-0038-T04 cancelled: entry point moved to net-kingdom NK-WP-0048-T09 
Remove the draft key-cape.oidc-client-registration declaration; net-kingdom
declares net-kingdom.keycape-client-registration beside the live deployment
machinery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 23:03:58 +02:00
tegwick
9fab7912f5 chore(consistency): record State Hub ID for KEY-WP-0038-T04 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:45:23 +02:00
custodian-sync
6e0ddd64fa chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:45:21 +02:00
tegwick
c737e361ce Declare key-cape.oidc-client-registration; add KEY-WP-0038-T04 entry point 
Playbook capability (contract PASS, maturity planned) composed by net-kingdom's
SecurityCaseType oidc-browser-relying-party. T04 implements tools/keycape-client,
generalizing the per-client rollout helpers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:44:43 +02:00
tegwick
d8f3668a18 KEY-WP-0038-T02: register Forgejo as the first KnownSecurityCase 
No hand-built rollout; depends on net-kingdom NK-WP-0048-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:17:03 +02:00
tegwick
9645a0604d chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:27:17 +02:00
custodian-sync
acdc828219 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:27:15 +02:00
tegwick
05e05aa945 KEY-WP-0038-T01 done: founder accepted the Forgejo client request 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:26:37 +02:00
tegwick
ee36e1fb45 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:54 +02:00
custodian-sync
823197a313 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:52 +02:00
custodian-sync
d11bf87c2b chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-10-08:
  - workplan status: ready → active

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:39 +02:00
tegwick
73d97e3323 KEY-WP-0038-T01: draft the Forgejo OIDC client request packet 
Non-secret claim contract for founder acceptance and railiance-apps agreement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:00 +02:00
tegwick
c4a8b75884 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:13:31 +02:00
custodian-sync
4bd40930fc chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:12:44 +02:00
tegwick
ff6890788b Add KEY-WP-0038: Forgejo as a NetKingdom OIDC client 
ORGREF-WP-0002-T04; founder-approved 2026-10-08. Counterpart: railiance-apps
RAPPS-WP-0016.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:12:09 +02:00
custodian-sync
96fb4eaf02 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 16:03:17 +02:00
tegwick
4672ef5390 Correct the in-pod verify-client cause in the T04 receipt 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 13:57:05 +02:00
custodian-sync
6230e1706a chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:26:49 +02:00
tegwick
e0b5faea52 KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:26:03 +02:00
custodian-sync
5504a9c25c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:23:45 +02:00
tegwick
b2e1efcd0e KEY-WP-0037-T03 done: secrets-engine-openbao registered live 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:21:59 +02:00
tegwick
e583988599 Link KEY-WP-0037-T03 to the in-bao custody design and approval decision 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 14:29:54 +02:00
tegwick
7d96ee4a43 Confirm groups and MFA for the secrets-engine-openbao operator reader 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 14:05:37 +02:00
custodian-sync
7dab16935a chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-06:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 13:47:58 +02:00