coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare guarded reset-role transition and native recovery proof

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
tegwick 2026-10-31 14:26:17 +01:00
parent 2387409d08
commit c07e6ebe34
8 changed files with 1027 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

76
docs/evidence/2026-10-31-reset-authority/role-refresh.json Normal file
View file

@ -0,0 +1,76 @@
{
"schema": "coulomb.native-reset-role-refresh.v1",
"observed_at": "2026-10-31T13:23:16.597535+00:00",
"data": "synthetic",
"status": "native_role_refresh_verified",
"images": {
"lldap": "sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d",
"authelia": "sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54",
"client": "sha256:512819463a1902b43a615beee14be7bf97e6a05e016385082b9380692ad1a8cd"
},
"production_access": false,
"provider_smtp_contacted": false,
"owner_runtime_or_permission_change_performed": false,
"no_ports_host_mounts_or_external_routes": true,
"backend_container_flags_verified_before_fixture_import": true,
"source_manifest_sha256": "f3c6d7b5a286d15d3049bba7e4c543052388f6a95a5e3254414f3b51da1285d0",
"findings": {
"scenarios": [
{
"bind_role": "lldap_strict_readonly",
"same_authelia_process": true,
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
},
{
"bind_role": "lldap_password_manager",
"same_authelia_process": true,
"status": "reset_completed",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": null,
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": false,
"new_password_accepted_after": true
},
{
"bind_role": "lldap_strict_readonly",
"same_authelia_process": true,
"status": "reset_refused",
"only_loopback_interface": true,
"external_routes_absent": true,
"old_password_initially_accepted": true,
"new_password_initially_refused": true,
"native_first_factor": true,
"interactive_service_login_refused": true,
"reset_http_status": 200,
"reset_response_status": "KO",
"native_identity_finish": true,
"reset_without_verified_challenge_refused": true,
"consumed_identity_token_replay_refused": true,
"old_password_accepted_after": true,
"new_password_accepted_after": false
}
],
"cleanup_verified": true
}
}

74
docs/evidence/2026-10-31-reset-authority/transition-validation.json Normal file
View file

@ -0,0 +1,74 @@
{
"schema": "netkingdom.reset-transition-validation.v1",
"status": "tested_proposal_not_granted",
"unit_checks": 25,
"native_controller_checks": 4,
"failures": 0,
"errors": 0,
"skipped": 0,
"junit_sha256": "26911e26b410c242f3dafb1915301875a4bfd3f5d88770be3b7bec5ce4c5c3d5",
"ruff": "passed",
"native_findings": [
"grant and rollback preserve all other user IDs and group memberships",
"real process death after removal or addition recovers read-only without replaying grant",
"membership rollback leaves prior HTTP token rights active; freshly issued token loses those rights"
],
"authelia_findings": "same running process refuses reset before grant, allows after grant, refuses after rollback; three fresh consumed challenges, old/new password checks; all confined containers removed",
"runtime_observation": {
"schema": "netkingdom.reset-runtime.v1",
"kube-system_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
"sso_uid": "a4a148d8-92ab-41e6-b975-4e67b73edfc0",
"authelia": {
"uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
"images": [
"docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54"
],
"ready": true
},
"lldap": {
"uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
"images": [
"docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
],
"ready": true
},
"authelia_configuration": {
"uid": "7af1fa0d-1bd4-47e1-8873-0f620788ef3f",
"sha256": "0a8bca50641a4c6f27830f476c2c9f413fc3795711becccb8344ee4d6c376e80",
"bind_is_svc_authelia": true
}
},
"production_membership_changed": false,
"grant_approved": false,
"productive_acceptance": false,
"sources": [
{
"path": "sso-mfa/k8s/lldap/reset-role-transition.py",
"sha256": "cc405861bb5cc0adf419a1cf98a90872d8395eecbfc7d4d38947cb4008bee217"
},
{
"path": "sso-mfa/k8s/lldap/reset-role-plan.json",
"sha256": "703e281ee6a17e1ef0a1dffbad35b8025ab3480d51d3fc2c36323f2bc6227106"
},
{
"path": "tests/test_reset_role_transition.py",
"sha256": "1437761ac60a7aeba16db70ccf07d48a9f5332617a00e7a325e678951985a08e"
},
{
"path": "sso-mfa/k8s/lldap/test_reset_role_transition_native.py",
"sha256": "13c53e8a757ed0e954ffd28df14283d51dd9d7d3278c1d7d7d5759b419a2a89a"
},
{
"path": "sso-mfa/k8s/lldap/test_bind_split.py",
"sha256": "ae69051a3df4596fe220306d88a28b2c12e42fbfe3587e02135e3684eb5f354a"
},
{
"path": "sso-mfa/k8s/lldap/bind-split-rehearsal.py",
"sha256": "9ab873d1e941807fb19a48fb18c3af246a98bf0788660d8d79a14fb0c0e0a067"
},
{
"path": "docs/evidence/2026-10-31-reset-authority/role-refresh.json",
"sha256": "325f446960134e9510591a2a27f5833bc80fa858d77e6a88082af41307993b65"
}
]
}