net-kingdom/docs/keycape-upstream-issuer-pin.md

Pin KeyCape's verified upstream issuer

Exercise status: read-only check and guarded live write exercised 2026-09-09 by codex under user continuation authorization.

Owner implementation: sso-mfa/k8s/keycape/openbao-client-config.py. Dependency: KEY-WP-0013-T02 / HFACT-WP-0001-T03. The actual signed upstream issuer was verified as https://auth.coulomb.social at 2026-09-08T21:44:44Z; KeyCape retains that signed-token receipt. This procedure ensures its exact authelia.issuer configuration pin before the separately reviewed client rollout.

The existing patch mode also reconciles client registrations and LLDAP defaults. Use the dedicated issuer modes for this operation. They read the live Secret in captured process memory and emit only metadata and fixed result fields. They do not print the configuration, private key, prior field value or Kubernetes errors. No Secret backup or patch is written to disk. The patch travels only through child stdin, never command arguments. The current Kubernetes owner context is used; no credential is fetched through a generic or unrelated Warden route.

python3 -B sso-mfa/k8s/keycape/openbao-client-config.py issuer-check-live
python3 -B sso-mfa/k8s/keycape/openbao-client-config.py issuer-pin-live \
  --expected-uid <uid-from-check> \
  --expected-resource-version <resource-version-from-check>

The target is fixed to sso/keycape-config; the issuer is fixed to the verified HTTPS value. The write requires both the observed UID and resourceVersion and tests them atomically in a JSON patch. A matching pin is a no-op. A concurrent change refuses the write instead of replaying stale configuration. Duplicate mapping keys, aliases, anchors and unsupported YAML shapes fail closed.

The mutation inserts or replaces only the issuer scalar. Every other configuration byte is preserved, and readback compares every Secret data entry, including the existing private key, without publishing hashes or values. API or parser failures return fixed reason codes. A readback mismatch stops without another write; the owner must reconcile the current revision before retrying. There is no automatic rollback that could overwrite a concurrent credential rotation.

This step changes no Deployment, process, client registration, credential or custody policy. The existing process is not restarted. Its separate compatible image/configuration cutover must still prove readiness and existing human login, and must retain its owner-controlled rollback pair. Do not call this stored configuration check proof that the current process has reloaded the field.

The CCR-2026-0017/0018 named reviews and attended custody window remain separate gates. This field pin does not approve either request.

Validation: python3 -B -m unittest discover -s sso-mfa/k8s/keycape -p 'test_*.py' -v passes 13 tests, covering byte preservation, duplicate/alias rejection, stale revision refusal, atomic preconditions, readback conflict and secret-free failure output. The first live check on 2026-09-09 found the pin absent at resourceVersion 51346058, UID 2e94519d-1550-41c7-9701-2efe47fe1fd3.

Live result: the guarded write at 2026-09-08T22:23:58Z (00:23:58 Berlin on September 9) inserted the missing issuer, advancing the Secret resourceVersion from 51346058 to 58713343. Independent check returned issuer_matches=true; all other configuration bytes and Secret data entries were unchanged. The Deployment stayed at generation 29 with one ready/available replica. Receipt.