coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance pre-cutover identity conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 16:48:47 +02:00
parent c639306c53
commit a58df4c3e6
5 changed files with 53 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

25
docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md
View file

@ -186,6 +186,31 @@ TLS-preserving direct resolution to `92.205.62.239` returned HTTP 200 with
successful certificate verification for `auth`, `login`, `lldap`, `pink`,
and `pink-account` under `coulomb.social`.
## Pre-cutover conformance progress
KeyCape's canonical issuer is `https://kc.coulomb.social`;
`auth.coulomb.social` and `login.coulomb.social` belong to Authelia. The
user-engine portal currently returns a 303 to KeyCape with an exact callback
and S256 PKCE challenge.
The `rapp-qonto-client` service flow passes against KeyCape: `qonto:read`
returns a token, a deliberately wrong secret returns 401 without a token, and
the excessive `qonto:write` scope returns 400 without a token.
The deployed user-engine API created the Binky tenant-admin lifecycle record,
membership, LLDAP subject, and identity link. The provider reports
`password_setup_required`. This flow found a newline-bearing runtime Secret
that could not legally be sent as an HTTP header; user-engine commit
`0ef2ae5` normalizes transport whitespace, passes 105 tests with three
integration skips, and is deployed as `user-engine:portal-0ef2ae5`.
The human conformance gate is not yet complete. LLDAP's native self-service
password reset requires configured SMTP, but this deployment has no SMTP
settings. The existing Binky mailbox route authorizes read-only IMAP and
explicitly does not authorize SMTP. No operator-set initial password was used
as a shortcut. A reusable NetKingdom password-setup or transactional-mail
handoff must precede Binky MFA enrollment and final claim/denial evidence.
## Required next evidence
1. Exercise platform-root and Binky login/MFA using TLS-preserving direct