tegwick
c9bb7fac58
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 47s
informed-decision submitted client_id informed-decision-approver and redirect https://decisions.coulomb.social/auth/callback, with the origin already live and verified by them rather than reported: both / and /auth/callback return 200 on a Let's Encrypt certificate valid to 2026-12-09. The host is decisions, not the decide of an earlier draft. Its path serves a placeholder for now, which does not matter -- the redirect is matched as an exact string and never fetched. Published as a public authorization_code client with S256 PKCE, audience approval-engine, scopes openid/approval:read/approval:approve, mfaRequired true and a declared tenant:platform. No secretRef, since PKCE is the whole proof. TestApproverRegistrationShapeIsExact pins every field, so widening a scope or relaxing MFA fails the build rather than reading as an edit, and asserts the registration passes startup validation -- proving the KEY-WP-0028 tenant exemption holds for the registration that actually depends on it. Two existing guards fired on the way in and neither was loosened. The tenant pin refused an unreviewed client carrying a tenant, which is its purpose, so the approver was added to its reviewed set deliberately. And the audience test panicked slicing secretRef[4:], an assumption that held while the fixture had only confidential clients; the approver is the first public one, so the loop now guards on the env: prefix. The declared tenant reaches the token by the GH-DEC-2026-013 gap route by construction, and tenant_source says so: registration, never directory. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6 |
||
|---|---|---|
| .. | ||
| ADHOC-2026-09-05.md | ||
| ADHOC-2026-09-07.md | ||
| KEY-WP-0001-keycape-implementation.md | ||
| KEY-WP-0002-container-image-gitea.md | ||
| KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | ||
| KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | ||
| KEY-WP-0005-iam-profile-core-claims.md | ||
| KEY-WP-0006-client-credentials-service-tokens.md | ||
| KEY-WP-0007-user-engine-portal-oidc-client.md | ||
| KEY-WP-0008-registration-handoff-and-client-mfa-policy.md | ||
| KEY-WP-0009-provider-capabilities-and-service-identities.md | ||
| KEY-WP-0010-openbao-operator-loopback-callback.md | ||
| KEY-WP-0011-live-secret-exposure-recovery.md | ||
| KEY-WP-0012-userinfo-canonical-subject-resolution.md | ||
| KEY-WP-0013-approval-engine-resource-audience.md | ||
| KEY-WP-0014-native-credential-lane-handoff.md | ||
| KEY-WP-0015-scope-intent-assessment.md | ||
| KEY-WP-0016-authorization-code-protocol-hardening.md | ||
| KEY-WP-0017-canonical-model-and-discovery-conformance.md | ||
| KEY-WP-0018-export-completeness-evidence.md | ||
| KEY-WP-0019-upstream-provider-token-verification.md | ||
| KEY-WP-0020-migration-contract-preservation.md | ||
| KEY-WP-0021-snapshot-attribute-validation.md | ||
| KEY-WP-0022-replacement-harness-and-external-conformance.md | ||
| KEY-WP-0023-live-migration-proof.md | ||
| KEY-WP-0024-tenant-roles-opt-in-wiring.md | ||
| KEY-WP-0025-runtime-lifecycle-and-readiness.md | ||
| KEY-WP-0026-packaging-bootstrap-and-credential-handling.md | ||
| KEY-WP-0027-rollout-readiness-and-live-state.md | ||
| KEY-WP-0028-browser-client-field-validation.md | ||
| KEY-WP-0029-scope-reassessment.md | ||
| KEY-WP-0030-tenant-precondition-guard.md | ||
| KEY-WP-0031-gate-house-tenant-ruling.md | ||