coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record exercised live issuer pin and unchanged production deployment
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 00:40:23 +02:00
parent ad9979b159
commit 896c1200c0
2 changed files with 102 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

93
docs/evidence/2026-09-09-keycape-upstream-issuer-pin.json Normal file
View file

@ -0,0 +1,93 @@
{
"schema": "netkingdom.keycape-issuer-pin-live-evidence.v1",
"recorded_at": "2026-09-08T22:24:00.262369+00:00",
"authorization": "User continuation: good, go on, after the explicit next step to ensure the verified issuer configuration pin.",
"source_commit": "ad9979b159f56a5d77004031dea4a897e61751dc",
"signed_issuer_proof_ref": "key-cape/docs/evidence/2026-09-08-upstream-issuer-live-proof.json",
"check_before": {
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": false,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:58.199881+00:00",
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"pin": {
"after": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"before": {
"resource_version": "51346058",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": true,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-pin-live",
"observed_at": "2026-09-08T22:23:58.727554+00:00",
"other_secret_data_unchanged": true,
"prior_pin_state": "absent",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"unrelated_config_bytes_preserved": true,
"verified_issuer": "https://auth.coulomb.social"
},
"check_after": {
"before": {
"resource_version": "58713343",
"uid": "2e94519d-1550-41c7-9701-2efe47fe1fd3"
},
"config_changed": false,
"deployment_changed": false,
"issuer_matches": true,
"mode": "issuer-check-live",
"observed_at": "2026-09-08T22:23:59.920100+00:00",
"prior_pin_state": "matching",
"schema": "netkingdom.keycape-issuer-pin.v1",
"secret_values_emitted": false,
"target": "sso/keycape-config",
"verified_issuer": "https://auth.coulomb.social"
},
"deployment_before": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_after": {
"uid": "99ddd83c-cb3f-4847-bcf8-35f1aa87627f",
"resource_version": "55113259",
"generation": 29,
"images": [
{
"name": "keycape",
"image": "forgejo.coulomb.social/coulomb/key-cape:main-153258b"
}
],
"ready_replicas": 1,
"available_replicas": 1
},
"deployment_unchanged": true,
"tests_passed": 13,
"credential_values_emitted": false,
"custody_activated": false,
"ccr_reviews_completed": false,
"process_reload_or_new_image_proved": false
}

10
docs/keycape-upstream-issuer-pin.md
View file

@ -1,6 +1,6 @@
# Pin KeyCape's verified upstream issuer
Exercise status: read-only check exercised 2026-09-09 by codex; guarded write unexercised.
Exercise status: read-only check and guarded live write exercised 2026-09-09 by codex under user continuation authorization.
Owner implementation: `sso-mfa/k8s/keycape/openbao-client-config.py`.
Dependency: KEY-WP-0013-T02 / HFACT-WP-0001-T03. The actual signed upstream
@ -50,3 +50,11 @@ passes 13 tests, covering byte preservation, duplicate/alias rejection, stale
revision refusal, atomic preconditions, readback conflict and secret-free failure
output. The first live check on 2026-09-09 found the pin absent at resourceVersion
`51346058`, UID `2e94519d-1550-41c7-9701-2efe47fe1fd3`.
Live result: the guarded write at 2026-09-08T22:23:58Z (00:23:58 Berlin on
September 9) inserted the missing issuer, advancing the Secret resourceVersion
from `51346058` to `58713343`. Independent check returned `issuer_matches=true`;
all other configuration bytes and Secret data entries were unchanged. The
Deployment stayed at generation 29 with one ready/available replica.
[Receipt](evidence/2026-09-09-keycape-upstream-issuer-pin.json).