coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record deployed issuer and company-welcome configuration
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 03:12:45 +02:00
parent eb5aac2ace
commit 4d71e1bd16
3 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/NK-WP-0037-vergabe-company-welcome.md
View file

@ -37,8 +37,7 @@ Existing setup links remain process-local and expire on restart.
```task
id: NK-WP-0037-T02
status: wait
blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
status: progress
priority: high
state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"
```
@ -67,3 +66,18 @@ patches are in the KeyCape and provisioner directories. Deployment waits for
the attended shared-issuer window. See
railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration,
credential, recipient data or application session was changed.
2026-09-12 attended rollout executed after explicit operator approval. KeyCape
and password setup are Ready on the prepared digests; exact public client
registration was CAS-applied (config resourceVersion 60123977) with unrelated
config bytes/Secret data preserved. Existing portal and product client both
pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
login start, native issuer redirect, private company/media protection and
invalid callback/confirmation rejection. Initial readback showed zero accounts,
identity mappings and staff accounts. Native invited-user sign-in/MFA and
confirmation are now requested from the operator; no user credential was used
by the agent. Recovery and two-user acceptance remain their existing tasks.
Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.