coulomb/key-cape
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
key-cape/docs
History
tegwick c528daa5be
All checks were successful
Authentication acceptance / acceptance (push) Successful in 1m25s
Details
Authentication acceptance / provider-contract (push) Successful in 25s
Details
Build and Publish Container Image / build-and-push (push) Successful in 43s
Details
Add keycape check-config; reject duplicate clientIds 
net-kingdom asked for a way to validate a rendered configuration before
keycape-client.py restarts KeyCape (oidc-browser-relying-party review R4).
check-config runs every startup check that needs no secret, key or upstream:
validation, registry build, global tokenLifetime, policy-store clients and,
with --env-names, the secretRef bindings. The report carries no values.

ValidateConfig now refuses a clientId registered twice. The registry is a
map, so a duplicate silently replaced the earlier registration.

Also records the owners' amended CCR-2026-0018 sequence in KEY-WP-0013.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 779409@bnt-lap001
Assistant-Session: c658ca06-19b5-468d-be64-2985dc20bfd3
2026-10-10 13:28:36 +02:00
..
adr feat: implement T01-T04 — Go module, canonical model, LDAP validator, error taxonomy 2026-03-13 01:27:54 +01:00
evidence Correct the in-pod verify-client cause in the T04 receipt 2026-10-07 13:57:05 +02:00
approval-clients-deployment.patch.yaml docs(keycape): prepare pinned approval-client rollout and recovery 2026-09-08 17:03:59 +02:00
approval-clients-rollout.md docs: close live approval service registration gate 2026-09-09 02:18:12 +02:00
approval-engine-auth-contract.md Register the approver client now its callback exists 2026-09-10 22:50:13 +02:00
approval-engine-provisioning-request.yaml Register the approver client now its callback exists 2026-09-10 22:50:13 +02:00
authorization-code-bindings.md Document the authorization-code bindings for relying parties 2026-09-07 00:17:56 +02:00
credential-renewal-release-2026-09-13.md Record provider credential renewal release and remaining owner handoff 2026-09-13 14:27:35 +02:00
enrollment-assurance-release-2026-09-13.md Retain provider acceptance CI and synchronized assurance task binding 2026-09-13 17:06:32 +02:00
forgejo-oidc-client-request.yaml KEY-WP-0038: Forgejo custody path derived by case type; propose KEY-WP-0039 negative-probe tokens 2026-10-10 12:29:32 +02:00
native-authentication.md Ship the live-registration check both blocked tasks depend on 2026-09-08 14:30:43 +02:00
oidc-browser-relying-party-type-review.md Review oidc-browser-relying-party 1.0 against KeyCape's client field rules 2026-10-10 12:39:31 +02:00
openbao-negative-probe-clients.yaml KEY-WP-0039: probe registration packet and attended negative-probe script 2026-10-10 13:18:24 +02:00
openbao-service-auth-contract.md Correct platform infrastructure client tenant bindings 2026-09-27 16:43:31 +02:00
operations.md Add keycape check-config; reject duplicate clientIds 2026-10-10 13:28:36 +02:00
optional-mfa.md Record deployed P06 policy and completed platform acceptance 2026-09-14 00:10:25 +02:00
qonto-runtime-identity-contract.md Define Qonto runtime identity contract 2026-07-26 13:34:56 +02:00
secrets-engine-openbao-owner-packet.md Confirm groups and MFA for the secrets-engine-openbao operator reader 2026-10-06 14:05:37 +02:00
sitting-requester-registration.json Register informed-decision-sitting-requester as create-only. 2026-09-15 20:08:07 +02:00
t03-requester-registration.json Register create-only Secrets Engine approval requester 2026-09-14 02:47:31 +02:00
t03-requester-registration.md Register create-only Secrets Engine approval requester 2026-09-14 02:47:31 +02:00
tenant-claim-contract.md Correct platform infrastructure client tenant bindings 2026-09-27 16:43:31 +02:00
upstream-issuer-proof.md docs(identity): record verified live upstream issuer and completed cleanup 2026-09-08 23:50:54 +02:00