coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
323 commits 1 branch 0 tags 83 MiB
Commit graph

323 commits

This branch
This branch
All branches
Author SHA1 Message Date
custodian-sync
b2762a3d8c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:30:10 +02:00
tegwick
c528daa5be Add keycape check-config; reject duplicate clientIds
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m25s
Details
Authentication acceptance / provider-contract (push) Successful in 25s
Details
Build and Publish Container Image / build-and-push (push) Successful in 43s
Details 
net-kingdom asked for a way to validate a rendered configuration before
keycape-client.py restarts KeyCape (oidc-browser-relying-party review R4).
check-config runs every startup check that needs no secret, key or upstream:
validation, registry build, global tokenLifetime, policy-store clients and,
with --env-names, the secretRef bindings. The report carries no values.

ValidateConfig now refuses a clientId registered twice. The registry is a
map, so a duplicate silently replaced the earlier registration.

Also records the owners' amended CCR-2026-0018 sequence in KEY-WP-0013.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:28:36 +02:00
tegwick
5bc4a366b0 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:20:43 +02:00
custodian-sync
79b0a9f9c6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:20:30 +02:00
tegwick
bae9f85160 KEY-WP-0039: probe registration packet and attended negative-probe script 
T01 done: railiance-platform agreed the case list. The packet adds an
otherwise-valid expiry client and pins audience on the claim probes so each
token fails only the claim under test. The script prints one refused boolean
and refusal class per case, revokes any accepted token, and never counts a
transport failure as a refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 13:18:24 +02:00
custodian-sync
01b318db87 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:42:09 +02:00
tegwick
158f13b871 KEY-WP-0013: record the proposed CCR-2026-0018 disablement sequence 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:40:37 +02:00
tegwick
60384834fe Review oidc-browser-relying-party 1.0 against KeyCape's client field rules 
Answers net-kingdom's NK-WP-0048-T04 review request. Two blocking findings:
redirect URIs with '?' pass the type but make KeyCape exit at startup, and
access_groups is enforced only by the consumer, never by KeyCape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:39:31 +02:00
tegwick
45a04c14bb chore(consistency): record State Hub IDs for KEY-WP-0039 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:30:17 +02:00
custodian-sync
fba29a33e6 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-10:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:30:12 +02:00
tegwick
ab5cccdcf3 KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens 
Forgejo's secret now lives at platform/workloads/keycape/forgejo, as derived by
oidc-browser-relying-party 1.0 (net-kingdom 074b3a0). KEY-WP-0039 answers
railiance-platform's CCR-2026-0038 question with one-mismatch probe registrations
instead of an issuer path that could mint arbitrary claims.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
 2026-10-10 12:29:32 +02:00
custodian-sync
f8ef4d418c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 23:04:37 +02:00
tegwick
213b98feb1 KEY-WP-0038-T04 cancelled: entry point moved to net-kingdom NK-WP-0048-T09 
Remove the draft key-cape.oidc-client-registration declaration; net-kingdom
declares net-kingdom.keycape-client-registration beside the live deployment
machinery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 23:03:58 +02:00
tegwick
9fab7912f5 chore(consistency): record State Hub ID for KEY-WP-0038-T04 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:45:23 +02:00
custodian-sync
6e0ddd64fa chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:45:21 +02:00
tegwick
c737e361ce Declare key-cape.oidc-client-registration; add KEY-WP-0038-T04 entry point 
Playbook capability (contract PASS, maturity planned) composed by net-kingdom's
SecurityCaseType oidc-browser-relying-party. T04 implements tools/keycape-client,
generalizing the per-client rollout helpers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:44:43 +02:00
tegwick
d8f3668a18 KEY-WP-0038-T02: register Forgejo as the first KnownSecurityCase 
No hand-built rollout; depends on net-kingdom NK-WP-0048-T06.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 22:17:03 +02:00
tegwick
9645a0604d chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:27:17 +02:00
custodian-sync
acdc828219 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:27:15 +02:00
tegwick
05e05aa945 KEY-WP-0038-T01 done: founder accepted the Forgejo client request 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 21:26:37 +02:00
tegwick
ee36e1fb45 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:54 +02:00
custodian-sync
823197a313 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:52 +02:00
custodian-sync
d11bf87c2b chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-10-08:
  - workplan status: ready → active

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:39 +02:00
tegwick
73d97e3323 KEY-WP-0038-T01: draft the Forgejo OIDC client request packet 
Non-secret claim contract for founder acceptance and railiance-apps agreement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:32:00 +02:00
tegwick
c4a8b75884 chore(consistency): refresh the work-record index 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:13:31 +02:00
custodian-sync
4bd40930fc chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:12:44 +02:00
tegwick
ff6890788b Add KEY-WP-0038: Forgejo as a NetKingdom OIDC client 
ORGREF-WP-0002-T04; founder-approved 2026-10-08. Counterpart: railiance-apps
RAPPS-WP-0016.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
 2026-10-08 19:12:09 +02:00
custodian-sync
96fb4eaf02 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 16:03:17 +02:00
tegwick
4672ef5390 Correct the in-pod verify-client cause in the T04 receipt 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 13:57:05 +02:00
custodian-sync
6230e1706a chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:26:49 +02:00
tegwick
e0b5faea52 KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:26:03 +02:00
custodian-sync
5504a9c25c chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-07:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:23:45 +02:00
tegwick
b2e1efcd0e KEY-WP-0037-T03 done: secrets-engine-openbao registered live 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-07 02:21:59 +02:00
tegwick
e583988599 Link KEY-WP-0037-T03 to the in-bao custody design and approval decision 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 14:29:54 +02:00
tegwick
7d96ee4a43 Confirm groups and MFA for the secrets-engine-openbao operator reader 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 14:05:37 +02:00
custodian-sync
7dab16935a chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-06:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 13:47:58 +02:00
tegwick
457854fad5 Record prepared KEY-WP-0037-T03 dependencies and the corrected KV path 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
 2026-10-06 13:47:31 +02:00
custodian-sync
e22029e232 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-05:
  - update .custodian-brief.md for key-cape

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
 2026-10-05 09:39:11 +02:00
tegwick
1e65bd3f47 chore(consistency): refresh the work-record index 
Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
 2026-10-05 09:38:27 +02:00
custodian-sync
103102ab7b chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-05:
  - update .custodian-brief.md for key-cape

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
 2026-10-05 09:31:58 +02:00
tegwick
5e431eccc5 Record the approved OpenBao custody boundary. 
The founder resolved 632a8893 as the custody boundary only. T02 is done.
T03 waits on the still-open live registration decision caafe4be.

Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
 2026-10-05 09:30:49 +02:00
tegwick
7e4c76998d Route the OpenBao custody approval to an open decision. 
Assistant: grok
Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd
 2026-10-05 02:39:36 +02:00
tegwick
f485d6fe9c Record managed registration and custody work identities 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 11:17:19 +02:00
custodian-sync
31ed8bb686 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-04:
  - update .custodian-brief.md for key-cape

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 11:16:47 +02:00
tegwick
44cc067aa2 Name secrets-engine OpenBao registration and custody owner gates 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
 2026-10-04 11:15:44 +02:00
tegwick
672e1faf4b Minor update 2026-10-03 00:38:23 +02:00
custodian-sync
985d8bf686 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-30:
  - update .custodian-brief.md for key-cape

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 101414@bnt-lap001
Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6
 2026-09-30 12:50:08 +02:00
tegwick
74064e1391 KEY-WP-0013: all tasks done, status blocked -> finished (CUST-WP-0074) 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 101414@bnt-lap001
Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6
 2026-09-30 12:49:13 +02:00
tegwick
1164f65d89 Map explicit Railiance admin directory group for alert acknowledgment
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m13s
Details
Authentication acceptance / provider-contract (push) Successful in 16s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m12s
Details 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f
 2026-09-28 10:48:17 +02:00
tegwick
8be8065347 Send split-horizon origin headers on the discovery/JWKS fetch too
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m23s
Details
Authentication acceptance / provider-contract (push) Successful in 15s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details 
setPublicOriginHeaders (key-cape@3b0446e) annotated only the token
exchange with X-Forwarded-Proto/Host so Authelia can derive the public
issuer in a split-horizon deployment. idTokenVerifier's separate
provider-metadata/JWKS fetch never got the same treatment, so an
in-cluster discovery request reached Authelia unmarked and Authelia
4.38 failed closed on it ("invalid X-Forwarded-Proto header value
'http'"), breaking every login regardless of client.

Extracted setPublicOriginHeaders to a package-level function and gave
idTokenVerifier the same resolved public base URL so its discovery/JWKS
requests carry the same headers as the token exchange.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
 2026-09-27 19:35:51 +02:00