b8dda4115a
source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
1.6 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0012 | workplan | Repair UserInfo canonical subject resolution | infotech | key-cape | finished | codex | userinfo-canonical-subject-resolution | 2026-08-31 | 2026-09-01 | 2aca83d8-4e80-52c6-8929-f1e957576b47 |
Repair subject lookup
id: KEY-WP-0012-T01
status: done
priority: high
state_hub_task_id: "bc1ee2c7-a321-5914-96d1-9cb871f0ee1b"
Resolve the canonical LDAP-DN sub emitted by the token endpoint without
passing it to the username-only repository lookup. Preserve stable subject
semantics and verify any preferred_username lookup against the canonical ID.
Regression verification
id: KEY-WP-0012-T02
status: done
priority: high
state_hub_task_id: "7073cc30-a518-5c27-acaf-1a323fd981c6"
Cover canonical-ID, legacy username-sub, missing subject, and suspended-user behavior. Run the KeyCape test suite and image build checks.
Deploy and verify OpenBao OIDC
id: KEY-WP-0012-T03
status: done
priority: high
state_hub_task_id: "571c5237-93fa-5c61-87af-974e02fd8929"
Publish and deploy the corrected KeyCape image, prove /userinfo accepts a
fresh human access token, then resume the governed Policy Nexus bootstrap.
Completed 2026-09-01. Forgejo Actions run 14 built commit
153258b9d39273d53ca7ab5d1bdc09961ea9026e; image digest
sha256:4c7193efc3e50bd72a01812a583e823cc04f41ca96ef387b31ba9ae2533b80d0
rolled out successfully. A fresh OpenBao OIDC flow passed /userinfo, and the
governed Policy Nexus bootstrap subsequently completed with deterministic
session revocation.