2.6 KiB
| id | type | title | domain | repo | status | flavor | owner | topic_slug | created | updated | state_hub_workstream_id |
|---|---|---|---|---|---|---|---|---|---|---|---|
| KEY-WP-0034 | workplan | Browser authentication recovery and confirmed shared sign-out | infotech | key-cape | finished | implementation | codex | key-cape | 2026-09-12 | 2026-09-25 | 49b0cd1d-fb9d-5351-99eb-9be9143a092d |
The operator reports a dead-end authentication error after using an account outside the product tenant. Recent issuer telemetry indicates token exchange failure; tenant rejection and provider failure must not be conflated.
Implement and validate recovery
id: KEY-WP-0034-T01
status: done
priority: high
state_hub_task_id: "ba285335-4ead-5478-8fb7-89a2ec1ba695"
Route failed browser login to the public account recovery surface without codes, state or unverified identity. Show verified portal identity, tenant memberships, and recorded workload memberships; preserve operator/customer separation. Provide CSRF-protected portal logout and confirmed shared provider sign-out with fixed owner-configured return locations. No automatic reauthentication loops, MFA downgrade, global JWT revocation claim or inferred workload entitlements.
Publish and verify the recovery flow
id: KEY-WP-0034-T02
status: done
priority: high
state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2"
Publish immutable images, update canonical runtime pins, verify anonymous recovery and sign-out confirmation live, and record actual account switching only after browser evidence. Existing application sessions may outlive provider logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.
Source verification: Full Go suite passed; final OIDC/config tests passed after recovery expansion. Immutable publication and live checks are in progress.
Live recovery rollout — 2026-09-12
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
(Helm revision 3). All three are Ready. Six provider checks, eleven product
checks and six fresh anonymous Chromium checks pass, including actual provider
logout POST and return to the portal without test overrides. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer
recorded one mfa_failed for user-engine-portal, then three separate
auth_start → auth_success → token_issued sequences. A silent reuse of
the previous portal session would not have produced those new successes.
Provider logout still does not revoke already issued application JWTs.
Receipt: docs/evidence/2026-09-24-fresh-login-and-account-switch.md.