tegwick
c9bb7fac58
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 47s
informed-decision submitted client_id informed-decision-approver and redirect https://decisions.coulomb.social/auth/callback, with the origin already live and verified by them rather than reported: both / and /auth/callback return 200 on a Let's Encrypt certificate valid to 2026-12-09. The host is decisions, not the decide of an earlier draft. Its path serves a placeholder for now, which does not matter -- the redirect is matched as an exact string and never fetched. Published as a public authorization_code client with S256 PKCE, audience approval-engine, scopes openid/approval:read/approval:approve, mfaRequired true and a declared tenant:platform. No secretRef, since PKCE is the whole proof. TestApproverRegistrationShapeIsExact pins every field, so widening a scope or relaxing MFA fails the build rather than reading as an edit, and asserts the registration passes startup validation -- proving the KEY-WP-0028 tenant exemption holds for the registration that actually depends on it. Two existing guards fired on the way in and neither was loosened. The tenant pin refused an unreviewed client carrying a tenant, which is its purpose, so the approver was added to its reviewed set deliberately. And the audience test panicked slicing secretRef[4:], an assumption that held while the fixture had only confidential clients; the approver is the first public one, so the loop now guards on the env: prefix. The declared tenant reaches the token by the GH-DEC-2026-013 gap route by construction, and tenant_source says so: registration, never directory. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6
103 lines
5.3 KiB
YAML
103 lines
5.3 KiB
YAML
# Non-secret static registration fragments for KeyCape's bounded JWT consumers. Merge these entries into the deployment-owned KeyCape config.
|
|
# The named environment variables must be materialized by an approved
|
|
# out-of-repository custody path; this file never contains their values.
|
|
clients:
|
|
- clientId: "codex-railiance-platform"
|
|
displayName: "Railiance platform coding agent"
|
|
allowedScopes: ["openbao:login"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_CODEX_RAILIANCE_PLATFORM_CLIENT_SECRET"
|
|
serviceSubject: "service:codex:railiance-platform"
|
|
tenant: "tenant:coulomb"
|
|
roles: ["coding-agent"]
|
|
tokenLifetime: "15m"
|
|
|
|
- clientId: "secrets-engine-openbao"
|
|
displayName: "secrets-engine OpenBao login"
|
|
allowedScopes: ["openbao:login"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET"
|
|
serviceSubject: "service:secrets-engine"
|
|
tenant: "tenant:coulomb"
|
|
roles: ["secrets-engine"]
|
|
tokenLifetime: "15m"
|
|
|
|
- clientId: "secrets-engine-approval"
|
|
displayName: "secrets-engine approval consume client"
|
|
audience: "approval-engine"
|
|
allowedScopes: ["approval:read", "approval:consume"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_SECRETS_ENGINE_APPROVAL_CLIENT_SECRET"
|
|
serviceSubject: "service:secrets-engine"
|
|
# Landlord-zone platform tenant, decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6.
|
|
# Exact spelling; no alias to tenant:coulomb. See docs/tenant-claim-contract.md.
|
|
tenant: "tenant:platform"
|
|
roles: ["secrets-engine"]
|
|
tokenLifetime: "15m"
|
|
|
|
# WITHDRAWN BY THE REQUESTING OWNER, 2026-09-09. approval-engine asked that this
|
|
# client not be provisioned: nothing in their repository obtains an OAuth token,
|
|
# and scope by scope the bundle does not describe a single actor —
|
|
# approval:approve now belongs to the informed-decision human client,
|
|
# approval:emit is redundant (the server emits its own heartbeat with no token),
|
|
# and no requester identity was ever settled for approval:create. It was a
|
|
# convenience bundle written when a lifecycle operator was assumed to exist.
|
|
#
|
|
# Kept rather than deleted at their request: verifier custody CCR-2026-0018
|
|
# stands, so the client stays authenticable if a presenter ever appears. It is
|
|
# already live from the 2026-09-09 attended rollout, so this annotation does not
|
|
# remove it — see KEY-WP-0013-T02.
|
|
#
|
|
# Do not widen it, and do not treat it as a template. When a presenter is named,
|
|
# approval-engine will re-request NARROWED to that presenter's scopes, and
|
|
# approval:approve must not travel with the operational scopes.
|
|
- clientId: "approval-engine-operator"
|
|
displayName: "approval-engine lifecycle operator (withdrawn: no presenter)"
|
|
audience: "approval-engine"
|
|
allowedScopes: ["approval:create", "approval:read", "approval:approve", "approval:revoke", "approval:supersede", "approval:observe", "approval:emit"]
|
|
grantTypes: ["client_credentials"]
|
|
clientType: "confidential"
|
|
secretRef: "env:KEYCAPE_APPROVAL_ENGINE_OPERATOR_CLIENT_SECRET"
|
|
serviceSubject: "service:approval-engine-operator"
|
|
# Landlord-zone platform tenant, decision 5ed3fb35-eca9-413a-82b9-95171ba85bf6.
|
|
# Exact spelling; no alias to tenant:coulomb. See docs/tenant-claim-contract.md.
|
|
tenant: "tenant:platform"
|
|
roles: ["approval-operator"]
|
|
tokenLifetime: "15m"
|
|
|
|
# Human approver browser client. Submitted by informed-decision 2026-09-10
|
|
# (INFD-WP-0001-T07) with the origin already live: both / and /auth/callback
|
|
# return 200 from 92.205.62.239 on a Let's Encrypt certificate
|
|
# CN=decisions.coulomb.social valid 2026-09-10 to 2026-12-09, deployed by
|
|
# railiance-apps. The host is decisions.coulomb.social, NOT the
|
|
# decide.coulomb.social an earlier draft proposed; register the string verbatim.
|
|
#
|
|
# The path currently serves an nginx placeholder while their surface is gated on
|
|
# APPROVAL-WP-0002-T01. That does not affect this registration: the redirect is
|
|
# matched as an exact string at /authorize and never fetched.
|
|
#
|
|
# No secretRef: this is a public client and authenticates with PKCE alone. No
|
|
# serviceSubject or roles either — on a browser client both are silently ignored
|
|
# and config validation rejects them (KEY-WP-0028); the subject and roles come
|
|
# from the directory user.
|
|
- clientId: "informed-decision-approver"
|
|
displayName: "informed-decision approver surface"
|
|
audience: "approval-engine"
|
|
redirectUris:
|
|
- "https://decisions.coulomb.social/auth/callback"
|
|
allowedScopes: ["openid", "approval:read", "approval:approve"]
|
|
grantTypes: ["authorization_code"]
|
|
clientType: "public"
|
|
# Declared, not inherited. Nothing populates domain.User.Tenant for approver
|
|
# users, so this reaches the token by the GH-DEC-2026-013 declared-gap route
|
|
# by construction, and the token says so: tenant_source is "registration",
|
|
# never "directory". Admissible for approval-engine's store-isolation gate;
|
|
# NOT admissible for any doctrine turning on this person's membership of the
|
|
# zone. See docs/tenant-claim-contract.md.
|
|
tenant: "tenant:platform"
|
|
# Approval is a human-in-the-loop control, so MFA is required rather than
|
|
# left to the provider default.
|
|
mfaRequired: true
|