key-cape/docs/evidence/upstream-issuer-probe.json
tegwick 1b9793ffed docs(oidc): pin tested issuer probe and bounded owner execution packet
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
2026-09-08 23:18:11 +02:00

63 lines
2.1 KiB
JSON

{
"observed_at": "2026-09-08T21:17:50.880337+00:00",
"image": {
"image": "forgejo.coulomb.social/coulomb/key-cape@sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
"source_commit": "6f33abddcff6cbc348ced862057973cdcc4f78ec",
"published_tag": "main-6f33abd",
"packaged_command_proven": true,
"container_uid": 65534,
"container_network": "none",
"container_readonly": true,
"fixture_lifetime_seconds": 1,
"expected_exit": 1,
"observed_exit": 1,
"idle_receipt": {
"downstream_credential_issued": false,
"failure": "probe_deadline",
"schema": "keycape.upstream-issuer-proof.v1",
"status": "failed",
"tokens_retained": false
}
},
"validation": {
"go_test_race_all": "passed",
"go_vet_all": "passed",
"probe_tests_after_cli_fixture": "passed",
"python_renderer_and_receipt_tests": 5,
"traefik_route": {
"traefik": "3.6.7",
"exact_route_cases_passed": 7,
"ordinary_login_callbacks_preserved": true,
"live_cluster_changed": false
},
"server_dry_run": {
"accepted": true,
"resources": [
"Job",
"Service",
"IngressRoute",
"NetworkPolicy/probe",
"NetworkPolicy/Authelia"
],
"image_digest": "sha256:0c85ed377cae7ae6ca5b5c56b1a52930e706b3cb78009747e42f551e869a22e4",
"job_owner_uid": "fixture only; must bind the actual UID at execution"
}
},
"deployment_metadata": {
"deployment": {
"name": "keycape",
"metadata": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f 55113259 29"
},
"secret": {
"name": "keycape-config",
"metadata": "2e94519d-1550-41c7-9701-2efe47fe1fd3 51346058"
},
"production_image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b",
"probe_jobs_before": []
},
"live_upstream_issuer_proved": false,
"production_mutated": false,
"credential_values_extracted": false,
"custody_activated": false,
"required_next_return": "Deployment-owner admission for the temporary config-reading probe; attended signed issuer receipt and cleanup, then contained issuer pin and named CCR reviews"
}