coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare Playwright consumer credentials and identity activation handoff

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
This commit is contained in:
codex 2026-10-13 21:21:58 +02:00
parent 5ea8b2dcd3
commit 6323db59ba
10 changed files with 652 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
workplans/README.md
View file

@ -16,7 +16,7 @@ Completed plans retain their IDs and managed UUIDs, including archived plans.
| [RPF-WP-0048](RPF-WP-0048-activity-core-gitops-adoption.md) (blocked) | T02 | Activity-core promotion evidence |
| [RPF-WP-0053](RPF-WP-0053-coulomb-paired-backup-admission.md) (proposed) | T01, T02, T03, T04, T05 | Paired archive execution/custody, retrieval/recovery and monitoring admission |
| [RPF-WP-0055](RPF-WP-0055-keycape-client-secret-rotation-residual.md) (backlog) | T01 | Unpromoted rotation residual; do not implement without demand/risk promotion |
| [RPF-WP-0056](RPF-WP-0056-playwright-consumer-admission.md) (blocked) | T03 | Dedicated Playwright consumer group, managed pilot and authenticated identity route |
| [RPF-WP-0056](RPF-WP-0056-playwright-consumer-admission.md) (blocked) | T03 | Pilot and consumer setup implemented; identity registration, API authentication/transport and real consumer proof pending |
October 13 review corrected WP-0038-T04's stale `todo` state to the documented
`wait`. RPF-IN-0012 remains an open independent execution/wrapped-delivery review;

31
workplans/RPF-WP-0056-playwright-consumer-admission.md
View file

@ -125,3 +125,34 @@ cross-version rollback or abrupt-interruption proof. T03 remains open for actual
consumer identity/group mapping and the remaining package-owner acceptance.
Group decision mirrored to State Hub d2426028-0b04-4ea2-b199-d7f9e19e38e6.
## Prepare consumer login delivery and owner activation inputs
```task
id: RPF-WP-0056-T05
status: done
priority: high
```
User authorized continuing with identity-owner implementation. Added
scripts/playwright_consumer.py: isolated kubeconfig setup, public-CA/destination
pinning before credential delivery, private KeyCape token-file consumption and
actual SelfSubjectReview plus nine allowed/denied access checks. Verification
refuses modified/impersonating configurations and administrator identities.
Nine focused tests pass, including misuse, file permission, wrong-destination,
expired/wrong-audience token and excessive-permission refusals; installed kubectl
parses the generated configuration. These synthetic tests do not prove native
JWT authentication or live identity access.
config/playwright/ contains the public cluster CA and review candidates for the
native JWT authenticator and public PKCE client. docs/playwright-consumer-access.md
now provides login/setup/verify/forward/trial commands; the exact owner activation
contract is docs/playwright-identity-handoff.md. Existing workstation API tunnel
uses its own SSH actor and is not a general per-consumer transport entitlement.
Dedicated coding-agent registration and governed secret delivery remain pending.
T03 stays wait: cluster/KeyCape/NetKingdom activation replies have not arrived,
the authenticator candidate has not been natively validated or activated, and
neither a real human nor agent consumer receipt exists. Do not update provider
managed availability to ready from this preparation. No new membership approval
is required. Evidence: docs/evidence/2026-10-13-playwright-consumer-preparation.json.