6323db59ba
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
63 lines
4.5 KiB
Markdown
63 lines
4.5 KiB
Markdown
# Playwright consumer identity activation handoff
|
|
|
|
Status: source prepared; owner activation and real human/agent evidence pending.
|
|
The user already admitted all identified platform humans and coding agents.
|
|
This handoff implements ADR-0006 without inventing registration acceptance,
|
|
distributing admin kubeconfigs or broadening other service credentials.
|
|
|
|
| Owner | Concrete change | Required return |
|
|
| --- | --- | --- |
|
|
| railiance-cluster | Review and integrate `config/playwright/authentication-config.candidate.yaml` into the K3s API-server configuration | Native config validation, rollout/recovery receipt, preserved existing authentication, real allowed/denied requests |
|
|
| key-cape / net-kingdom | Review and register `config/playwright/keycape-public-client.candidate.json`; dedicated per-agent confidential registrations | Exact claim/expiry contract, issuer rollout, registration and custody references without values |
|
|
| ops-bridge / cluster access owner | Supported per-caller TLS API route on local port 16444 | Human and agent transport instructions using their own identities |
|
|
| railiance-platform | Run `scripts/playwright_consumer.py verify` and provider trials for both identity kinds | API-returned identity, permission negatives, responsive/keyboard trial receipts |
|
|
| rapp-playwright | Review native consumer receipts and update managed availability | Accepted RAPP-PLAYWRIGHT-WP-0004-T01/T03 and declaration/registry evidence |
|
|
|
|
Coordination requests sent October 13: cluster
|
|
`f643ce05-b71d-4492-83a3-ae142d0d3535`, KeyCape
|
|
`60b22d25-a573-4957-aaae-3a66f5713466`, NetKingdom
|
|
`94a0096c-f34c-463c-b336-b13cf629b968`. No reply had arrived when preparing
|
|
this source. Owner source/activation receipts remain necessary.
|
|
|
|
The candidate uses issuer `https://kc.coulomb.social`, dedicated audience
|
|
`playwright-kubernetes`, access scope `playwright:connect`, and a constant mapped
|
|
group `playwright-consumers`. Subjects become `keycape:human:<sub>` or
|
|
`keycape:service:<sub>`. KeyCape represents registered coding agents as service
|
|
principals with the `coding-agent` role. Other services fail this mapping; token
|
|
groups cannot inject Kubernetes privileges. Human tenants are not rewritten or
|
|
restricted to `tenant:platform`. Dedicated registrations determine who can obtain
|
|
this audience and scope.
|
|
|
|
The public client uses exact PKCE callback `http://127.0.0.1:18764/callback`.
|
|
Native KeyCape login verifies issuer/JWKS, scope, audience, state and nonce.
|
|
Use its access token: ID tokens have client audience and no access scope.
|
|
Human lifetime inherits issuer settings; confirm it is at most one hour before
|
|
activation. Do not add per-client `tokenLifetime` to the public client: KeyCape
|
|
supports that override only for client-credentials registrations.
|
|
|
|
Each coding agent needs a distinct new client registration with the dedicated
|
|
audience/scope, unique service subject, `coding-agent` role, its actual registered
|
|
tenant and preferably 15-minute lifetime. Its new secretRef must have an existing
|
|
governed custody/delivery contract before activation. No existing OpenBao client
|
|
secret or audience is reused. The browser-RP registration helper's accepted
|
|
HTTPS/standard-scope type does not cover this loopback/custom-scope client; its
|
|
case-acceptance requirement cannot be satisfied by fabricating a receipt.
|
|
|
|
Cluster integration must preserve unrelated authenticators and the SSH/admin
|
|
recovery route. `AuthenticationConfiguration` is an API-server file, not a
|
|
resource accepted by `kubectl apply`. Review existing K3s flags and config
|
|
fragments, natively validate CEL against the deployed Kubernetes version,
|
|
establish rollback before activation, and coordinate any required single-node
|
|
API-server restart. The source candidate has not been compiled by Kubernetes
|
|
or applied. Source: [Kubernetes 1.35 authentication configuration and exec
|
|
plugins](https://v1-35.docs.kubernetes.io/docs/reference/access-authn-authz/authentication/).
|
|
|
|
Before availability is published, prove wrong audience, missing scope, expired
|
|
token, tampered signature, ordinary service and nonmember refusals at the native
|
|
API. The helper's synthetic tests do not establish those server-side properties.
|
|
Prove positive human and coding-agent access via SelfSubjectReview, permission
|
|
checks and browser trials, with no `--as` impersonation. Client disablement stops
|
|
issuance; issued JWTs remain valid until expiry, and existing port-forwards need
|
|
explicit termination. Keep the provider availability tasks open until those
|
|
receipts are accepted. Existing operator-driven pilot/restart evidence remains
|
|
valid with its documented limits.
|