coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(records): attach issuer proof to the receiving admission task
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 00:07:02 +02:00
parent 8f40d73d0f
commit e06d7fc390
1 changed files with 16 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

33
workplans/RPF-WP-0035-credential-lane-implementation.md
View file

@ -187,6 +187,22 @@ exact claim bindings with excess scopes denied (operator `consume`, human
and every receipt is metadata-only. If either registration is abandoned, KeyCape
disables it before the KV version is destroyed.
### 2026-09-08 actual upstream issuer returned
The admitted KeyCape one-shot probe verified the actual signed upstream issuer
as **`https://auth.coulomb.social`** at 21:44:44 UTC. Signature, audience,
validity window and nonce checks passed and the pinned Job exited 0. All
five temporary resources and the Pod were removed; normal KeyCape Deployment
and config Secret metadata are unchanged. See
`docs/evidence/2026-09-08-keycape-upstream-issuer-proof.json`.
T05's unknown-issuer input is resolved. The configuration owner still ensures
`authelia.issuer` equals that exact HTTPS value before the custody window.
Both CCRs remain proposed and await the named reviews; this probe grants no
custody mutation or client-side read. Keep the current authority preflight and
this signed-token proof as separate receipts. Live ESO/client/approval and
separate audit/client-side custody acceptance remain open.
## Dependency review — 2026-09-06
SECRETS-WP-0008-T02 now records the local PIP claim/validation join implemented
@ -220,20 +236,3 @@ T05 remains wait: both CCRs are still proposed, the actual upstream ID-token
issuer precondition remains open, and no verifier-side credential is provisioned.
Client-side retrieval and audit-sender custody are still separate owner returns.
The capability receipt is not a review approval or service readiness proof.
### 2026-09-08 actual upstream issuer returned
The admitted KeyCape one-shot probe verified the actual signed upstream issuer
as **`https://auth.coulomb.social`** at 21:44:44 UTC. Signature, audience,
validity window and nonce checks passed and the pinned Job exited 0. All
five temporary resources and the Pod were removed; normal KeyCape Deployment
and config Secret metadata are unchanged. See
`docs/evidence/2026-09-08-keycape-upstream-issuer-proof.json`.
T05's unknown-issuer input is resolved. The configuration owner still ensures
`authelia.issuer` equals that exact HTTPS value before the custody window.
Both CCRs remain proposed and await the named reviews; this probe grants no
custody mutation or client-side read. Keep the current authority preflight and
this signed-token proof as separate receipts. Live ESO/client/approval and
separate audit/client-side custody acceptance remain open.