[External Validation] security/security.identity_oidc - security-ops

[tradecatlabs]

External Validation Work Item

• Work item: external-work.adb578beb167a8b2
• Domain: security
• Category: security.identity_oidc
• Owner: security-ops
• Priority: P0
• Occurrences: external.00c22c200a19d314, external.014fcb004baa901d, external.0256e6dab0fef727, external.08668971f6eb9104, external.1456a8f570f5b2fd, external.1d156788f14a6569, external.1d9811f140a12178, external.2aad72b915e458a0, external.2f93d1a12032b095, external.7216c8c2d670fa18, external.7db11c8931f65dc6, external.81acfb60a9b756e9, external.960e87e0914d4d2a, external.9b57b699d0fc8343, external.b83657c9e035c585, external.bc0da4984c2cc8a3, external.bcf673af1de12d4d, external.c45900e9dc8b5d8a, external.cefb4afa33537e82, external.cff3e3082b9bc795, external.eea0d3f3287ee4fb, external.f0cbf452dd821851

Required Credentials

• IdP admin access
• JWKS read proof
• OIDC issuer metadata
• OIDC/IdP tenant
• client credentials or signed proof ref
• tenant authorization test account

Required Evidence

• OIDC login/token validation proof ref accepted
• RBAC scope smoke passed

Operator Commands

• bash scripts/external-validation-proof-ref-gate.sh --work-queue-json <work-queue-json> --evidence-json <proof-ref-bundle-json> --output-json <proof-ref-gate-json>
• bash scripts/security-externalization-gate.sh --evidence-json <redacted-proof.json> --output-json <path>
• bash scripts/security-externalization-gate.sh --output-json <security-externalization-json>
• bash scripts/security-smoke.sh --output-json <security-smoke-json>

Proof Ref Template

• Pattern: evidence://external-validation/security-identity-oidc/<run-id>
• Artifact hash: sha256:<64 lowercase hex artifact digest>
• Verification command: bash scripts/external-validation-proof-ref-gate.sh --work-queue-json <work-queue-json> --evidence-json <proof-ref-bundle-json> --output-json <proof-ref-gate-json>

Blocking Items

• category_live_evidence_missing
• category_live_pending
• proof_ref_missing
• stale_owner_pending

Closure Condition

OIDC issuer/JWKS, scope enforcement and tenant negative authorization tests pass with redacted proof refs.

Non-Claims

• This issue does not prove live validation has passed.
• Do not paste token, secret, DSN, endpoint URL, chat id, user input, report body or production logs.