railiance-platform/docs/playwright-identity-handoff.md

Playwright consumer identity activation handoff

Status: source prepared; owner activation and real human/agent evidence pending. The user already admitted all identified platform humans and coding agents. This handoff implements ADR-0006 without inventing registration acceptance, distributing admin kubeconfigs or broadening other service credentials.

Owner	Concrete change	Required return
railiance-cluster	Review and integrate config/playwright/authentication-config.candidate.yaml into the K3s API-server configuration	Native config validation, rollout/recovery receipt, preserved existing authentication, real allowed/denied requests
key-cape / net-kingdom	Review and register config/playwright/keycape-public-client.candidate.json; dedicated per-agent confidential registrations	Exact claim/expiry contract, issuer rollout, registration and custody references without values
ops-bridge / cluster access owner	Supported per-caller TLS API route on local port 16444	Human and agent transport instructions using their own identities
railiance-platform	Run scripts/playwright_consumer.py verify and provider trials for both identity kinds	API-returned identity, permission negatives, responsive/keyboard trial receipts
rapp-playwright	Review native consumer receipts and update managed availability	Accepted RAPP-PLAYWRIGHT-WP-0004-T01/T03 and declaration/registry evidence

Coordination requests sent October 13: cluster f643ce05-b71d-4492-83a3-ae142d0d3535, KeyCape 60b22d25-a573-4957-aaae-3a66f5713466, NetKingdom 94a0096c-f34c-463c-b336-b13cf629b968. No reply had arrived when preparing this source. Owner source/activation receipts remain necessary.

The candidate uses issuer https://kc.coulomb.social, dedicated audience playwright-kubernetes, access scope playwright:connect, and a constant mapped group playwright-consumers. Subjects become keycape:human:<sub> or keycape:service:<sub>. KeyCape represents registered coding agents as service principals with the coding-agent role. Other services fail this mapping; token groups cannot inject Kubernetes privileges. Human tenants are not rewritten or restricted to tenant:platform. Dedicated registrations determine who can obtain this audience and scope.

The public client uses exact PKCE callback http://127.0.0.1:18764/callback. Native KeyCape login verifies issuer/JWKS, scope, audience, state and nonce. Use its access token: ID tokens have client audience and no access scope. Human lifetime inherits issuer settings; confirm it is at most one hour before activation. Do not add per-client tokenLifetime to the public client: KeyCape supports that override only for client-credentials registrations.

Each coding agent needs a distinct new client registration with the dedicated audience/scope, unique service subject, coding-agent role, its actual registered tenant and preferably 15-minute lifetime. Its new secretRef must have an existing governed custody/delivery contract before activation. No existing OpenBao client secret or audience is reused. The browser-RP registration helper's accepted HTTPS/standard-scope type does not cover this loopback/custom-scope client; its case-acceptance requirement cannot be satisfied by fabricating a receipt.

Cluster integration must preserve unrelated authenticators and the SSH/admin recovery route. AuthenticationConfiguration is an API-server file, not a resource accepted by kubectl apply. Review existing K3s flags and config fragments, natively validate CEL against the deployed Kubernetes version, establish rollback before activation, and coordinate any required single-node API-server restart. The source candidate has not been compiled by Kubernetes or applied. Source: Kubernetes 1.35 authentication configuration and exec plugins.

Before availability is published, prove wrong audience, missing scope, expired token, tampered signature, ordinary service and nonmember refusals at the native API. The helper's synthetic tests do not establish those server-side properties. Prove positive human and coding-agent access via SelfSubjectReview, permission checks and browser trials, with no --as impersonation. Client disablement stops issuance; issued JWTs remain valid until expiry, and existing port-forwards need explicit termination. Keep the provider availability tasks open until those receipts are accepted. Existing operator-driven pilot/restart evidence remains valid with its documented limits.