One-line, byte-preserving edit of sso/keycape-config with inspect, server
dry-run, attended apply and an exact rollback. No values are emitted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
keycape-client.py --check-config runs KeyCape's startup checks (key-cape
c528daa) on the live and proposed registry via stdin; apply refuses a
registry KeyCape would refuse at start. Type 1.1 patch names the option.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
R1: redirect URIs refuse '?' and '#' in the type and keycape-client.py.
R2: allowed_scopes always includes groups; access_groups is enforced by the
consumer, not KeyCape. R3/R4: mfa_required false and restart-for-all-clients
documented. The consumer-enforcement verification step (1.1) awaits a decision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
Founder go 2026-10-10. Live already carries the value via rapp-user-engine
(the apply home); this file is not applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 736651@bnt-lap001
Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
Founder-approved. Image only (kubectl set image); service groups ensure/revoke
present in the running pod, readyz 200. Rollback digest recorded in the workplan.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 469893@bnt-lap001
Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb
Derive custody at platform/workloads/keycape/{client_id} (secret_ref is no
longer case-settable), reuse the workload-kv-read-keycape-* policy family with
templated bodies, add the external-secrets-keycape-{client_id} ESO role, name
the catalog entry {consuming_service}-keycape-client and collapse the duplicate
KV-path rollback. Schema and validator require a body on policy/role items.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 330051@bnt-lap001
Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b
One case-driven entry point for the live KeyCape client registry, with the
existing safeguards; apply requires the case acceptance record. Declaration
net-kingdom.keycape-client-registration (implemented). The type pins it and
adds the confidential delivery and env-binding steps. 48 + 71 tests pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012
Founder live go caafe4be. Config resourceVersion 71471711 -> 71655453 with only
this client added; KeyCape restarted on the kept image 6f79a2af.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Owner-specific exact-match merge and rollback for sso/keycape-config, the one
proposed env secretKeyRef, synthetic tests and NK-WP-0046 for KEY-WP-0037-T03.
Nothing is applied; the live rollout waits on decision caafe4be.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
Operator-run rollout 2026-09-27: the previous rollout (911e9de) broke
every KeyCape login on Authelia 4.38 -- the provider-metadata/JWKS
discovery fetch used for ID-token verification never carried the
split-horizon X-Forwarded-Proto/Host headers, only the token exchange
did. Fixed in key-cape 8be8065 with a regression test.
Rollback digest: sha256:248e449a031c972529f829ff36aa3faa92f8894a41e873beadcb0de34e7c3b9e
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
Operator-run rollout 2026-09-27: fixes INFD-IN-0005 — completeAuthorization
was reusing an existing kc_login cookie's IssuedAt as authTime even after
a freshly-validated MFA token in the same request, which understated
freshness for downstream binding-grade checks (flex-auth's 900s review
window denied informed-decision's infd-20260927-b01 approval as a result).
See key-cape commit 911e9de and workplans/ADHOC-2026-09-27.md.
Rollback digest: sha256:7c99cd6c6fdf63afaf22e47dad31e20dcb3a8b2079206f198cb425047be495b3
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999
