coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/workplans
History
tegwick bae9f85160 KEY-WP-0039: probe registration packet and attended negative-probe script 
T01 done: railiance-platform agreed the case list. The packet adds an
otherwise-valid expiry client and pins audience on the claim probes so each
token fails only the claim under test. The script prints one refused boolean
and refusal class per case, revokes any accepted token, and never counts a
transport failure as a refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
2026-10-10 13:18:24 +02:00
..
ADHOC-2026-09-05.md Add bounded resource audiences and enforce browser scope grants 2026-09-05 00:41:17 +02:00
ADHOC-2026-09-07.md chore(consistency): register KEY-WP-0017 and ADHOC-2026-09-07 [auto] 2026-09-07 00:23:58 +02:00
ADHOC-2026-09-27.md Send split-horizon origin headers on the discovery/JWKS fetch too 2026-09-27 19:35:51 +02:00
KEY-WP-0001-keycape-implementation.md Add bounded resource audiences and enforce browser scope grants 2026-09-05 00:41:17 +02:00
KEY-WP-0002-container-image-gitea.md Add bounded resource audiences and enforce browser scope grants 2026-09-05 00:41:17 +02:00
KEY-WP-0003-bootstrap-console-oidc-mfa-login.md Normalize agent instructions and workplan frontmatter (STATE-WP-0067) 2026-06-22 23:16:27 +02:00
KEY-WP-0004-binky-hedgehog-tenant-onboarding.md fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:13:23 +02:00
KEY-WP-0005-iam-profile-core-claims.md fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:13:23 +02:00
KEY-WP-0006-client-credentials-service-tokens.md fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:13:23 +02:00
KEY-WP-0007-user-engine-portal-oidc-client.md fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:13:23 +02:00
KEY-WP-0008-registration-handoff-and-client-mfa-policy.md fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:13:23 +02:00
KEY-WP-0009-provider-capabilities-and-service-identities.md Correct platform infrastructure client tenant bindings 2026-09-27 16:43:31 +02:00
KEY-WP-0010-openbao-operator-loopback-callback.md chore(registrar): assign State Hub identifiers 2026-08-23 13:19:35 +02:00
KEY-WP-0011-live-secret-exposure-recovery.md security: rotate exposed KeyCape credentials 2026-08-23 14:26:36 +02:00
KEY-WP-0012-userinfo-canonical-subject-resolution.md repo.work.assign_missing_identifiers 2026-09-01 01:36:20 +02:00
KEY-WP-0013-approval-engine-resource-audience.md KEY-WP-0013: record the proposed CCR-2026-0018 disablement sequence 2026-10-10 12:40:37 +02:00
KEY-WP-0014-native-credential-lane-handoff.md Close T04 and pin the single route by which a principal becomes human 2026-09-10 23:05:16 +02:00
KEY-WP-0015-scope-intent-assessment.md Align approval registrations to the tenant:platform decision 2026-09-06 22:30:32 +02:00
KEY-WP-0016-authorization-code-protocol-hardening.md chore(consistency): register KEY-WP-0016 and refresh work records [auto] 2026-09-06 22:44:55 +02:00
KEY-WP-0017-canonical-model-and-discovery-conformance.md chore(consistency): register KEY-WP-0017 and ADHOC-2026-09-07 [auto] 2026-09-07 00:23:58 +02:00
KEY-WP-0018-export-completeness-evidence.md chore(consistency): register KEY-WP-0018 and refresh work records [auto] 2026-09-07 08:47:00 +02:00
KEY-WP-0019-upstream-provider-token-verification.md Record what the consolidated verifier's tests actually establish 2026-09-07 09:05:16 +02:00
KEY-WP-0020-migration-contract-preservation.md chore(consistency): register KEY-WP-0020 and refresh work records [auto] 2026-09-07 13:49:40 +02:00
KEY-WP-0021-snapshot-attribute-validation.md chore(consistency): register KEY-WP-0021 [auto] 2026-09-07 23:23:38 +02:00
KEY-WP-0022-replacement-harness-and-external-conformance.md chore(consistency): register KEY-WP-0022 [auto] 2026-09-07 23:32:51 +02:00
KEY-WP-0023-live-migration-proof.md chore(consistency): register KEY-WP-0023 [auto] 2026-09-08 08:55:52 +02:00
KEY-WP-0024-tenant-roles-opt-in-wiring.md chore(consistency): register KEY-WP-0024 [auto] 2026-09-08 09:00:39 +02:00
KEY-WP-0025-runtime-lifecycle-and-readiness.md chore(consistency): register KEY-WP-0025 [auto] 2026-09-08 09:44:33 +02:00
KEY-WP-0026-packaging-bootstrap-and-credential-handling.md chore(consistency): register KEY-WP-0026 [auto] 2026-09-08 09:52:42 +02:00
KEY-WP-0027-rollout-readiness-and-live-state.md docs(identity): record verified live upstream issuer and completed cleanup 2026-09-08 23:50:54 +02:00
KEY-WP-0028-browser-client-field-validation.md Record the stale-claim correction alongside the others 2026-09-09 16:41:10 +02:00
KEY-WP-0029-scope-reassessment.md chore(consistency): register KEY-WP-0029 [auto] 2026-09-09 20:07:24 +02:00
KEY-WP-0030-tenant-precondition-guard.md Split the gate-house ruling work into its own workplan 2026-09-10 08:05:49 +02:00
KEY-WP-0031-gate-house-tenant-ruling.md chore(consistency): register KEY-WP-0031 [auto] 2026-09-10 08:07:09 +02:00
KEY-WP-0032-principal-type-provenance-guard.md chore(consistency): register KEY-WP-0032 and refresh records [auto] 2026-09-10 23:07:49 +02:00
KEY-WP-0033-vergabe-fresh-login.md Record the completed fresh login and account switch. 2026-09-25 01:49:42 +02:00
KEY-WP-0034-account-recovery.md Record the completed fresh login and account switch. 2026-09-25 01:49:42 +02:00
KEY-WP-0035-optional-mfa.md Record deployed P06 policy and completed platform acceptance 2026-09-14 00:10:25 +02:00
KEY-WP-0036-platform-factor-recovery.md Pin final P04 release and native ownership-lock evidence 2026-09-13 21:30:50 +02:00
KEY-WP-0037-secrets-engine-openbao-registration-custody.md KEY-WP-0037-T04 done: live issuance verified for secrets-engine-openbao 2026-10-07 02:26:03 +02:00
KEY-WP-0038-forgejo-oidc-client.md KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens 2026-10-10 12:29:32 +02:00
KEY-WP-0039-openbao-negative-probe-tokens.md KEY-WP-0039: probe registration packet and attended negative-probe script 2026-10-10 13:18:24 +02:00