coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record final KeyCape recovery receipt
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093
This commit is contained in:
codex 2026-08-23 14:51:50 +02:00
parent 4619b8e08e
commit 18d61cd6a0
3 changed files with 28 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/keycape-exposure-rotation-approval.example.json
View file

@ -25,13 +25,13 @@
}, },
"post_rotation_observation": { "post_rotation_observation": {
"jwks_kid": "key-1", "jwks_kid": "key-1",
"jwks_sha256": "3d46c07b649432eb41112b9e5f5a929460027766127d1eb419ebac8eb9858c06", "jwks_sha256": "c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156",
"observed_at": "2026-08-23", "observed_at": "2026-08-23",
"source_revision_binding": "REQUIRED", "source_revision_binding": "93704fd2424503007c20b458b62a7f7d994bb288",
"downstream_refresh_confirmation": "REQUIRED" "downstream_refresh_confirmation": "keycape-authelia-lldap-privacyidea-identity-provisioner-ready-1-1"
}, },
"revisions": { "revisions": {
"key_cape": "REQUIRED", "key_cape": "93704fd2424503007c20b458b62a7f7d994bb288",
"net_kingdom": "REQUIRED", "net_kingdom": "REQUIRED",
"railiance_platform": "453fed3" "railiance_platform": "453fed3"
}, },
@ -45,8 +45,8 @@
"abort": "root-admin" "abort": "root-admin"
}, },
"acknowledgements": { "acknowledgements": {
"key_cape_message_id": null, "key_cape_message_id": "05b49688-76a8-4be9-a00d-95408c798697",
"net_kingdom_message_id": null "net_kingdom_message_id": "71b1008a-7fd7-4500-85c6-e8893a6d80d4"
}, },
"authorization": { "authorization": {
"human_go": true, "human_go": true,

11
docs/keycape-live-secret-exposure-recovery.md
View file

@ -80,6 +80,17 @@ A fresh public JWKS read on 2026-08-23 found kid `key-1` and SHA-256
Treat this as an observation only until KeyCape binds it to the source Treat this as an observation only until KeyCape binds it to the source
revision and confirms downstream cache refresh. revision and confirms downstream cache refresh.
KeyCape subsequently supplied source revision
`93704fd2424503007c20b458b62a7f7d994bb288`, final public JWKS kid `key-1`,
and SHA-256
`c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156`.
KeyCape, Authelia, LLDAP, privacyIDEA, and identity-provisioner were reported
Ready 1/1, with replacement/negative checks recorded. The persistent
privacyIDEA `lldap-coulomb` resolver remains an attended provider-admin
follow-up and is explicitly not complete; do not declare the incident closed
or perform further bundle mutation until that owner action is separately
authorized and evidenced.
## Ownership ## Ownership
| Boundary | Owner | Required contribution | | Boundary | Owner | Required contribution |

19
workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
View file

@ -57,15 +57,18 @@ status: progress
priority: high priority: high
``` ```
KeyCape acknowledged emergency rotation with deliberate JWT invalidation and KeyCape supplied source revision `93704fd2424503007c20b458b62a7f7d994bb288`,
JWKS/cache refresh required (message `aeb216b5-9f1b-404b-a483-fb08a00a49b1`), post-rotation JWKS SHA-256
but has not yet supplied the non-secret client-config revision or a post-change `c6faac5dfeef2453daf9cfc14671f62b535dd321befdf6014e3ee5c2cf1f1156`, and
JWKS digest. NetKingdom pinned the value-safe dependency and provider sequence rollout/predecessor evidence (messages `05b49688-76a8-4be9-a00d-95408c798697`
at `c24d67b` (message `71b1008a-7fd7-4500-85c6-e8893a6d80d4`), including the and `538046b9-2dbb-4704-b7b6-2dbf16c5e3bb`). NetKingdom pinned the value-safe
expiry-based privacyIDEA predecessor decision. The digest-bound approval dependency and provider sequence at `c24d67b` (message
`71b1008a-7fd7-4500-85c6-e8893a6d80d4`). The persistent privacyIDEA
`lldap-coulomb` resolver still requires an attended provider-admin update, so
T04 remains blocked for that explicit follow-up. The digest-bound approval
template is published at template is published at
`docs/keycape-exposure-rotation-approval.example.json`; all authorization `docs/keycape-exposure-rotation-approval.example.json`; no additional Secret
gates remain false pending the missing receipts and an exact human GO. apply is authorized by this receipt.
## T04 — Execute the attended rotation ## T04 — Execute the attended rotation