the-custodian/docs/changes/netkingdom-target-2026-10-18/forgejo-current-token-r1

Actual Forgejo callback and issuer current-grant binding

This source checkpoint consumes the existing producer-owned KeyCape client inside actual Forgejo source. It does not introduce a token registry, PDP or independently maintained client. The generated five-file adapter is exact from KeyCape 08c083ba; issuer source e2c5a947 adds the online human ID token's exact RS256 at_hash binding. Legacy disabled-profile issuance is unchanged. The OIDC definition supplies the hash rule; requiring it is the explicit proposed online-consumer profile, not a claim that the code flow universally requires this optional field.

The callback requires independently admitted application tenant and current-token configuration. It separates ID-token purpose from access-grant jti/scope, checks the signed exact token-pair hash before private caller access, and joins issuer, owning client, subject, tenant, principal type, issuance, assurance, original authentication time and tenant provenance. Fresh authenticated status checks precede the PDP and follow its response. No stale positive is cached; missing, revoked, substituted, suspended, unavailable or withdrawn-trust inputs refuse, without a group-only fallback or disclosed bearer/credential value.

Verification

• Two new purpose counterexamples fail against the original ID verifier (three failure events including the parent test); the corrected latest focused suite passes 91 test/subtest results without skips.
• The complete actual issuer race suite passes 726 test/subtest results with the same six preexisting native/external skips, listed in issuer-full-race.json. New checks verify exact signed pair correspondence, distinct grants/resource audience separation and unchanged disabled-profile output.
• A compiled actual Forgejo test binary executes in five separate consumer processes against real fixture HTTPS token/discovery/UserInfo/status/revocation handlers. Two current grants pass; a mixed pair, revoked original and suspended human refuse. The provider FetchUser, guarded callback and generated current client execute. The identical consumer fails against the preceding issuer.
• All 49 consumer source postimages and six issuer source delta postimages replay exactly from their pinned source archives with fuzz zero. Compiled runtime and generated client bytes match. The sole later source change adds a tested owner-tenant negative vector.

Positive integration phases execute actual discovery and FetchUser. Negative phases supply a completed-authentication snapshot to exercise the callback current-status boundary directly. MFA authentication sessions and PDP admission/signing are synthetic. Tokens and private signing/TLS/client material remain in fixture memory/tmpfs, never public receipts. The actual paired source fixture is not a native browser, deployed Forgejo, production issuer/custody or second real consumer acceptance. A complete frontend/static release and OCI rebuild for the new patch remain outstanding. Earlier release artifacts apply to their original patch only.

The first composed run passed 114 results and skipped the existing private file-replacement check because its reused fixture directory was exhausted. The runner now creates new read-only/private fixture aliases per trial. The original skip and its cause remain in the receipts; they are not PostgreSQL/native proof. The final composed rerun passes 116 test/subtest results without skips, as recorded in validation-summary.json.

Selected ongoing profile and remaining work

The user selected current KeyCape checks on every API/Git/SSH operation for NetKingdom-linked accounts, retaining the separate local break-glass path. State Hub decision b96ef564-c713-4a48-9ab2-849958cec681 records that conversation choice and grants no native mutation. Actual ongoing route/resource/action/group enforcement is still implementation work under RAPPS16-T09/NK48-T43. This callback checkpoint cannot satisfy it.

Current protected operation/inverse identities, approval/effect correspondence, private journal custody/retention, every release writer, independent owner review, complete package/type/source admission and all native acceptance remain open. The full CUST-WP-0080 scope stays sixteen gates, G01–G13 and 116 ledger entries; no native gate closes here. Existing owner task UUIDs/statuses are preserved.

Apps publication retains the initial four-file source commit and a separate two-file validation-document correction. apps-owner-source preserves initial postimages; apps-owner-source-correction preserves final corrections. The original executed correction manifest is byte-exact alongside its capsule-path projection. Runtime and patch bytes do not change in that refinement.