rdmbair15m5-changelog-20260830-1653-passkey-cutover-restaged-owner-gate

Rejected an unvalidated Google-only completion claim, restored both documentation sites to the approved Google-plus-OTP Access stage, and left the exact owner passkey prompt visible without selecting an account or handling a credential.

Scope

Coordination host: rdmbair15m5
Provider/runtime host: rdmsm4x
Production sites: dev.ecs0.net and dev.dataroo.net
Services changed: Cloudflare Access application configuration and coordination metadata only

Freshly observed pre-state

One Google IdP and one account-level one-time-PIN IdP existed.
Both self-hosted Access applications were Google-only, used 720h sessions, and had auto_redirect_to_identity: true.
/Users/richh/dataroo.net/nginx_auth.conf had Basic Auth disabled and the loopback origin returned HTTP 200.
The 2026-08-29 completion record contained no real Access Google-passkey browser validation and listed passkey enrollment as an outstanding owner action.
The nginx backup /Users/richh/dataroo.net/nginx_auth.conf.bak-20260829-passkey-cutover predates newer /stitch-* routing in the live file and therefore is not safe to copy wholesale.

Changes applied

Ran /Users/richh/dev/_handoff/codex-out/dev-auth-passkeys-20260829/manage_dev_docs_access.zsh stage on rdmsm4x.
Set both Access applications to Google plus OTP, 720h sessions, and auto_redirect_to_identity: false.
Re-applied and verified each exact-email owner policy.
Updated /Users/richh/.agent-coordination/checkins/codex-rdmbair15m5-passkey-access-20260829.json to record the staged provider state, visible owner prompt, prior drift, retained nginx backup, and unresolved Basic Auth state.
Replied to the earlier completion broadcast with a correction and notified claude@rdmsm4x through fleet message 20260830-165415-60ABF9A0.

Deliberately unchanged

No Google OAuth client, client secret, IdP credential, or Google-account principal was read, selected, transmitted, or changed.
No Cloudflare team-domain, DNS, Tunnel, TLS, origin, loopback binding, or site content was changed.
No account-level IdP was deleted.
Nginx was not edited or reloaded. Basic Auth remains off; the historically exposed credential was not reactivated and newer routing was not overwritten.

Verification evidence

verify-stage passed for dev.ecs0.net and dev.dataroo.net.
Redacted inventory reports exactly one app per hostname, one Google IdP, one OTP IdP, two allowed IdPs per app, 720h sessions, and automatic redirect disabled.
The live ECS0 browser prompt is Log in to ECS0 development wiki, offering Google and an Email / Send login code fallback.
The browser remains at the Cloudflare Access prompt; no Google account has been selected and no passkey challenge has been triggered.
Canonical check-in SHA-256: 158e7e73421939f886914b59c515f01ba199d88f18cefe4d2c9c38720e7e42d9.
Current nginx SHA-256: deefdc47bf3d211be7bb63cca7ad3f2fb9ce8e7882cae6f1fde58a0f2583368b.
Pre-cutover nginx backup SHA-256: 6fdd4963eaee9f34473a9e008d8875ddc7442554d598bd3d5a7ef81bdbeb73db.

Rollback and forward gates

Provider rollback to OTP-only 24-hour access, retaining both app shells: ssh [email protected] 'zsh /Users/richh/dev/_handoff/codex-out/dev-auth-passkeys-20260829/manage_dev_docs_access.zsh rollback'
Google-only cutover remains available through the guarded cutover --allow-cutover action but must not run until Rich completes real ECS0 and Dataroo browser validation.
Restoring nginx Basic Auth requires a targeted edit against the current file plus credential rotation; do not replace the current file with the older backup.

Exact outstanding owner action

In the visible Cloudflare Access page, choose Google.
Select the verified owner Google account.
Complete Google's passkey/biometric prompt personally.
Confirm that dev.ecs0.net loads, then return to this task for the separate dev.dataroo.net validation.