coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record canonical portal hostname and callback cutover
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 00:16:33 +02:00
parent bea425cf78
commit dc42b0344c
6 changed files with 78 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/NK-WP-0036-restore-user-portal-client-registration.md
View file

@ -8,7 +8,7 @@ status: active
owner: the-custodian
topic_slug: netkingdom
created: "2026-09-11"
updated: "2026-09-11"
updated: "2026-09-12"
related: [KEY-WP-0007, RAPPS-WP-0014, VERGABE-WP-0019]
state_hub_workstream_id: "6e1358d6-87e4-52e7-b3dd-09abdc48cefc"
---
@ -155,3 +155,24 @@ lane, then verify provider login, user creation/linkage and password setup as a
single native onboarding journey. Preserve credential secrecy and avoid
unbounded password-check retries. Actual demo users and application admission
remain RAPPS-WP-0014 and VERGABE-WP-0019.
## Admit the canonical users hostname and preserve callback validation
```task
id: NK-WP-0036-T06
status: done
priority: high
state_hub_task_id: "d736f4d1-1c97-5cf3-894e-600ea113c785"
```
Operator supplied DNS for users.coulomb.social on 2026-09-12. The contained
portal-client-rollout helper now upgrades only the exact legacy public client
by appending https://users.coulomb.social/oidc/callback. It preserves unrelated
configuration bytes and Secret fields; six synthetic tests pass, including
idempotence and refusal of altered scopes/type/callbacks. The bootstrap and
registration declarations agree. Server dry-run passed; guarded Secret revision
59999030 became 60090393, UID unchanged. KeyCape restarted at its unchanged
image/resources. Canonical authorize redirects to Authelia; wrong callback and
missing PKCE return 400. The runtime package owns portal routing and callback
cutover; final human login confirmation is recorded there. No password rotated.