coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0048: oidc-browser-relying-party 1.1; re-pin the Forgejo case
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Adds verification consumer-enforces-groups and makes hand-over require the
consumer to enforce access_groups (key-cape review R2). Founder go to move to
1.1 before any apply, so no 1.0 run overlaps.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
This commit is contained in:
tegwick 2026-10-10 13:25:54 +02:00
parent 61ab6bcc33
commit e2174cebaf
7 changed files with 47 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/NK-WP-0048-security-case-types.md
View file

@ -407,6 +407,15 @@ re-pinning. Also open with key-cape: a KeyCape entry point that validates a
rendered client registry without starting the server; until then
`keycape-client.py` mirrors the redirect rule.
2026-10-10: founder go for 1.1, so no 1.0 run overlaps. The type adds
verification `consumer-enforces-groups`, and hand-over now requires the consumer
to enforce `access_groups` (minor, canon section 6; risk class unchanged, no new
acknowledgment; history in the type README). The accepted Forgejo case and both
examples are re-pinned to `oidc-browser-relying-party@1.1` before any apply; the
acknowledgment intake keeps `@1.0` as the record of what was acknowledged.
ops-mason's build and ops-warden's case-ref digest predate this and need a
re-render.
```task
id: NK-WP-0048-T07
status: wait