From ff1b25f515b3d5348c1424aafc0224848a0de8de Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 12 Sep 2026 02:53:55 +0200 Subject: [PATCH] Prepare pinned company-welcome and shared-issuer rollout patches Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c --- .../company-welcome.proposed.patch.yaml | 9 +++++++++ .../vergabe-fresh-login.proposed.patch.yaml | 6 ++++++ workplans/NK-WP-0037-vergabe-company-welcome.md | 15 ++++++++++++++- 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml create mode 100644 sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml diff --git a/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml new file mode 100644 index 0000000..135ecfb --- /dev/null +++ b/sso-mfa/k8s/identity-provisioner/company-welcome.proposed.patch.yaml @@ -0,0 +1,9 @@ +spec: + template: + spec: + containers: + - name: provisioner + image: forgejo.coulomb.social/coulomb/identity-provisioner@sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6 + env: + - name: PASSWORD_SETUP_TENANT_RETURNS + value: '{"tenant:trial:demo-company":"https://vergabe-teilnahme.coulomb.social/demo-company/"}' diff --git a/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml b/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml new file mode 100644 index 0000000..638078f --- /dev/null +++ b/sso-mfa/k8s/keycape/vergabe-fresh-login.proposed.patch.yaml @@ -0,0 +1,6 @@ +spec: + template: + spec: + containers: + - name: keycape + image: forgejo.coulomb.social/coulomb/key-cape@sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a diff --git a/workplans/NK-WP-0037-vergabe-company-welcome.md b/workplans/NK-WP-0037-vergabe-company-welcome.md index 3567ca8..11ffa59 100644 --- a/workplans/NK-WP-0037-vergabe-company-welcome.md +++ b/workplans/NK-WP-0037-vergabe-company-welcome.md @@ -10,6 +10,7 @@ topic_slug: netkingdom created: "2026-09-12" updated: "2026-09-12" related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014] +state_hub_workstream_id: "15f59624-ab25-5894-9b05-1e6b261749e5" --- ## Keep the company return inside the one-use setup grant @@ -18,6 +19,7 @@ related: [VERGABE-WP-0019, KEY-WP-0033, RAPPS-WP-0014] id: NK-WP-0037-T01 status: done priority: high +state_hub_task_id: "61f71d46-8218-5c50-8b1b-5cd1c096d9d3" ``` PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies @@ -35,8 +37,10 @@ Existing setup links remain process-local and expire on restart. ```task id: NK-WP-0037-T02 -status: todo +status: wait +blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout." priority: high +state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7" ``` Register public client vergabe-demo-company with only openid/profile/groups, @@ -54,3 +58,12 @@ setter, credential references and directory contents. Recipient sign-in and provider-required MFA need an attended acceptance; no credential capture or operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and RAPPS-WP-0014 retains application placement and recovery. + +2026-09-12 release prepared: source 48a75b1, published provisioner digest +sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6. +Sixteen tests pass against that runtime image. The exact public client helper's +server dry run passes with unrelated Secret/config bytes preserved; candidate +patches are in the KeyCape and provisioner directories. Deployment waits for +the attended shared-issuer window. See +railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration, +credential, recipient data or application session was changed.