tegwick
e1e292919a
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
58 lines
2.2 KiB
Markdown
58 lines
2.2 KiB
Markdown
---
|
|
id: KEY-WP-0034
|
|
type: workplan
|
|
title: "Browser authentication recovery and confirmed shared sign-out"
|
|
domain: infotech
|
|
repo: key-cape
|
|
status: active
|
|
owner: codex
|
|
topic_slug: key-cape
|
|
created: "2026-09-12"
|
|
updated: "2026-09-12"
|
|
state_hub_workstream_id: "49b0cd1d-fb9d-5351-99eb-9be9143a092d"
|
|
---
|
|
|
|
The operator reports a dead-end authentication error after using an account
|
|
outside the product tenant. Recent issuer telemetry indicates token exchange
|
|
failure; tenant rejection and provider failure must not be conflated.
|
|
|
|
## Implement and validate recovery
|
|
|
|
```task
|
|
id: KEY-WP-0034-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ba285335-4ead-5478-8fb7-89a2ec1ba695"
|
|
```
|
|
|
|
Route failed browser login to the public account recovery surface without codes,
|
|
state or unverified identity. Show verified portal identity, tenant memberships,
|
|
and recorded workload memberships; preserve operator/customer separation.
|
|
Provide CSRF-protected portal logout and confirmed shared provider sign-out with
|
|
fixed owner-configured return locations. No automatic reauthentication loops,
|
|
MFA downgrade, global JWT revocation claim or inferred workload entitlements.
|
|
|
|
## Publish and verify the recovery flow
|
|
|
|
```task
|
|
id: KEY-WP-0034-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2"
|
|
```
|
|
|
|
Publish immutable images, update canonical runtime pins, verify anonymous
|
|
recovery and sign-out confirmation live, and record actual account switching
|
|
only after browser evidence. Existing application sessions may outlive provider
|
|
logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.
|
|
|
|
Source verification: Full Go suite passed; final OIDC/config tests passed after recovery expansion. Immutable publication and live checks are in progress.
|
|
|
|
### Live recovery rollout — 2026-09-12
|
|
|
|
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
|
|
(Helm revision 3). All three are Ready. Six provider checks, eleven product
|
|
checks and six fresh anonymous Chromium checks pass, including actual provider
|
|
logout POST and return to the portal without test overrides. Real-user identity
|
|
switching is still awaiting operator evidence; no authenticated/MFA acceptance
|
|
is inferred. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
|