From 0ca0a9b4d4603490c87ec7f3770c8cc6fc0f43e5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 9 Aug 2026 01:36:28 +0200 Subject: [PATCH] Point intent/scope at NetKingdom user-management path (CSOC-WP-0002) Register CSOC-WP-0002 for identity-first reestablish; defer Bubble content claim behind the authenticated shell. CSOC-WP-0001 notes the priority shift. --- INTENT.md | 3 + SCOPE.md | 5 +- WORK-RECORDS.md | 11 +- .../CSOC-WP-0001-bubble-io-exit-assessment.md | 6 + ...-netkingdom-user-management-reestablish.md | 286 ++++++++++++++++++ 5 files changed, 308 insertions(+), 3 deletions(-) create mode 100644 workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md diff --git a/INTENT.md b/INTENT.md index a4ac625..57f4a56 100644 --- a/INTENT.md +++ b/INTENT.md @@ -69,6 +69,9 @@ The rebuild is deliberately **product-faithful first**: UI and content parity ma - `GOAL.md` — operator bootstrap note for this repo - `SCOPE.md` — in/out boundaries and orientation +- `workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md` — **current path**: NetKingdom user management first; content later +- `workplans/CSOC-WP-0001-bubble-io-exit-assessment.md` — Bubble assessment; content claim deferred - `the-custodian/docs/coulomb-social-rebuild-seed.md` — original workplan seed (CUST-WP-0058-T08) - `the-custodian/canon/standards/business-app-service-contract_v0.1.md` +- NetKingdom: IAM Profile, user-engine boundary, KeyCape/Keycloak modes - Reference delivery lane: `vergabe-teilnahme` diff --git a/SCOPE.md b/SCOPE.md index 1c17d03..d6f4fc4 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -65,11 +65,12 @@ coulomb.social connects people around shared projects and complementary capabili ## Current State -- Status: bootstrap / greenfield -- Implementation: orientation docs only; no application code yet +- Status: bootstrap / greenfield — identity-first reestablish in progress +- Implementation: orientation docs + design extract; application scaffold pending (`CSOC-WP-0002`) - Stability: evolving - Usage: internal — product rebuild not yet serving members from this stack - Prior art: rebuild seed from CUST-WP-0058-T08; topic `coulomb-social` already exists in State Hub under domain `communication` +- Active path: **NetKingdom user management** (`CSOC-WP-0002`); Bubble content claim deferred --- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 00c5d8c..e2a677b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,8 +8,17 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | CSOC-WP-0001 | ready | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | +| workplan | CSOC-WP-0001 | active | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | +| workplan | CSOC-WP-0002 | ready | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | | task | CSOC-WP-0001-T01 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | | task | CSOC-WP-0001-T02 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | | task | CSOC-WP-0001-T03 | wait | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | | task | CSOC-WP-0001-T04 | todo | — | workplans/CSOC-WP-0001-bubble-io-exit-assessment.md | +| task | CSOC-WP-0002-T01 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T02 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T03 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T04 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T05 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T06 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T07 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | +| task | CSOC-WP-0002-T08 | todo | — | workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md | diff --git a/workplans/CSOC-WP-0001-bubble-io-exit-assessment.md b/workplans/CSOC-WP-0001-bubble-io-exit-assessment.md index 2a27c93..bf822a2 100644 --- a/workplans/CSOC-WP-0001-bubble-io-exit-assessment.md +++ b/workplans/CSOC-WP-0001-bubble-io-exit-assessment.md @@ -24,6 +24,12 @@ schema. This plan originates from the CUST-WP-0058-T08 seed in Repo bootstrap (INTENT, SCOPE, TRSL LICENSE, State Hub registration, agent files) was completed as part of opening this workplan. +**Priority note (2026-08-09):** product **reestablish** proceeds first via +`CSOC-WP-0002` (NetKingdom user management + authenticated shell). **Content +claim / migration** from Bubble remains in this workplan’s scope but is +**deferred** until after the identity shell lands — do not block WP-0002 on +inventory completion. + ## Inventory bubble.io app ```task diff --git a/workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md b/workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md new file mode 100644 index 0000000..49084e6 --- /dev/null +++ b/workplans/CSOC-WP-0002-netkingdom-user-management-reestablish.md @@ -0,0 +1,286 @@ +--- +id: CSOC-WP-0002 +type: workplan +title: "Reestablish coulomb.social with NetKingdom user management" +domain: communication +repo: coulomb-social +status: ready +owner: bernd +topic_slug: coulomb-social +created: "2026-08-09" +updated: "2026-08-09" +depends_on: + - CSOC-WP-0001 +related: + - NK-WP-0023 + - NK-WP-0024 + - KEY-WP-0004 + - USER-WP-0020 +origin: operator +origin_ref: session-2026-08-09-netkingdom-users +state_hub_workstream_id: "b9addc9a-cc08-4b08-bb67-b6544579beb8" +--- + +# Reestablish coulomb.social with NetKingdom user management + +Stand up a **new** coulomb.social application whose members authenticate and are +administered through **NetKingdom infrastructure** (IAM Profile + issuer, +user-engine for user-domain facts, flex-auth for authorization decisions) — +not Bubble app-local accounts and not a password store inside this repo. + +**Content and product parity with the live Bubble app are deferred.** This +workplan delivers identity, membership, and a minimal authenticated shell so +the platform can exist again on the Railiance delivery lane. Claiming / +migrating Bubble content is a later workplan (after or alongside +`CSOC-WP-0001` assessment), not a gate for user management. + +## Why NetKingdom (not pure app-local) + +Business-app service contract v0.1 baseline is app-local accounts (DR-3 A) +with a bounded auth module for a later OIDC switch. coulomb.social is a +**multi-member social product**: platform identity and user-domain services +are the intended long-term shape. + +| Concern | Owner | This repo does | +|---------|--------|----------------| +| OIDC login, MFA, token lifecycle | NetKingdom issuer (KeyCape lightweight or Keycloak expanded) via **IAM Profile** | OIDC client + PKCE; no password store | +| User account, profile, membership facts | **user-engine** | Consumes projections / APIs; maps `(issuer, sub)` → local app context | +| Fine-grained authorization | **flex-auth** (PDP) | PEP only — register protected system + check decisions | +| Session cookie for browser | This app | Short-lived app session after successful OIDC; secrets via OpenBao at deploy | +| Product content (pages, artefacts, chunks) | **Later workplan** | Out of scope here | + +Canonical references: + +- `net-kingdom/canon/standards/iam-profile_v0.2.md` (or current v0.3) +- `net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md` +- `net-kingdom/docs/user-engine-interface-guidance.md` +- `the-custodian/canon/standards/business-app-service-contract_v0.1.md` §§1–2 +- Delivery lane reference: `vergabe-teilnahme` + +## Out of scope (explicit) + +- Bubble content inventory, export, or migration (CSOC-WP-0001 / follow-on) +- Full UI parity with the live product +- Marketplace / co-creation domain features beyond auth shell +- Owning KeyCape, Keycloak, user-engine, or flex-auth implementation +- Platform SSO for *other* Binky apps (this work only onboards **this** app) + +## Acceptance (workplan done when) + +1. A deployed (or locally runnable) coulomb.social instance completes OIDC login + against a NetKingdom IAM Profile issuer (dev/bootstrap allowed). +2. Successful login creates or links a **user-engine** identity link and + application membership for coulomb.social; logout ends the app session. +3. Unauthenticated visitors cannot reach member routes; at least one protected + “signed-in home” shell renders with principal display name/subject. +4. Auth is isolated behind a single module/boundary (service contract §2.3). +5. Tenant key present from migration one (Binky / client #1). +6. Docs record the onboarding bindings (OIDC client, user-engine app id, + flex-auth system id if registered) without secrets. +7. No Bubble dependency for login or member identity. + +--- + +## T01 — ADR: NetKingdom identity for coulomb.social + +```task +id: CSOC-WP-0002-T01 +status: todo +priority: high +state_hub_task_id: "57a7b778-b1d6-44fe-95ba-f12373c0355c" +``` + +Write `docs/adr/ADR-0001-netkingdom-identity.md` deciding: + +- IAM Profile as the only authentication contract (issuer-agnostic). +- user-engine as source of truth for user-domain facts and memberships. +- flex-auth as PDP for protected actions (fail-closed for sensitive writes). +- Explicit **non-goals**: app-local password DB; Bubble as IdP; content migration in this plan. +- Relationship to DR-3 A (contract baseline) vs this product’s NetKingdom path. +- Dev/bootstrap path (local-identity or KeyCape) vs production issuer. + +**Done when:** ADR reviewed and linked from INTENT/SCOPE. + +## T02 — Application scaffold and tenant model + +```task +id: CSOC-WP-0002-T02 +status: todo +priority: high +state_hub_task_id: "7ffa6485-4929-4958-b3b1-af98241beb02" +``` + +Scaffold the standalone service (stack choice recorded; prefer alignment with +the business delivery lane unless ADR says otherwise): + +- App entrypoints, config, health/ready probes. +- DB migrations: `tenant_id` on all client-owned tables from day one. +- Empty **member context** table(s) keyed by tenant + stable user-engine + `user_id` / external identity link — **no password columns**. +- Dev compose / run instructions in README or `docs/dev.md`. + +**Done when:** `make test` (or equivalent) passes smoke tests for boot + +migrations; no product domain models beyond auth shell. + +## T03 — NetKingdom OIDC client binding + +```task +id: CSOC-WP-0002-T03 +status: todo +priority: high +state_hub_task_id: "1b1d1162-d44a-45db-b906-05ebd7110f21" +``` + +Register coulomb.social as an OIDC client against the active NetKingdom issuer +mode (document which: KeyCape vs Keycloak vs local-identity for dev): + +- client_id, redirect URIs (no wildcards), scopes, PKCE. +- Secrets only in OpenBao / local 0600 files — never Git. +- Conformance: tokens satisfy IAM Profile claims needed by the app + (`sub`, issuer, tenant/principal claims as required). + +Record non-secret binding facts under `docs/identity/oidc-client.md`. + +**Done when:** browser authorization code + PKCE login completes against the +chosen issuer in a dev environment; evidence in `docs/identity/`. + +## T04 — user-engine application onboarding + +```task +id: CSOC-WP-0002-T04 +status: todo +priority: high +state_hub_task_id: "bbf8183c-2dd6-448b-a257-8d837d2d5ebf" +``` + +Per application onboarding contract +(`user-engine-interface-guidance.md`): + +- Register application `coulomb-social` in user-engine (display name, owner, + allowed profile scopes, projection types). +- On first successful OIDC login: create/link external identity + `(issuer, sub)` → `user_id`; ensure tenant membership for Binky / client #1. +- Define minimal application profile attributes needed for shell (display + name, avatar optional) — **not** Bubble content fields. +- Document bindings in `docs/identity/user-engine-binding.md`. + +Coordinate with NetKingdom/user-engine operators if platform registration +steps are outside this repo’s authority (NK-WP-0023/0024, USER-WP-*). + +**Done when:** login yields a resolvable user-engine projection usable by the +app; second login is idempotent (same user_id). + +## T05 — App auth module (OIDC session boundary) + +```task +id: CSOC-WP-0002-T05 +status: todo +priority: high +state_hub_task_id: "ea546dd7-e1c8-4040-a738-270d5004fd73" +``` + +Implement a **single** auth boundary module (§2.3): + +- Login start / callback / logout routes. +- Secure session after code exchange (httpOnly cookie or equivalent). +- Middleware: unauthenticated → login; authenticated → attach principal + (issuer, sub, user_id, tenant_id, display claims). +- No credentials stored in app DB; refresh strategy documented. +- Unit/integration tests for happy path + rejected/expired tokens. + +**Done when:** tests green; module is the only place that talks OIDC. + +## T06 — Authenticated shell and member routes + +```task +id: CSOC-WP-0002-T06 +status: todo +priority: medium +state_hub_task_id: "b2d48db3-a216-440e-afbf-51fa9c33b4da" +``` + +Ship a minimal product surface that proves user management works: + +- Public landing (unauthenticated) with “Sign in”. +- Protected home (`/app` or similar) showing signed-in identity summary. +- Sign out control. +- Optional: admin-only stub route gated via flex-auth or coarse IAM role + (if flex-auth not ready, document temporary claim check + follow-up). + +**Do not** rebuild Bubble Research / Pages / Artefacts here. + +**Done when:** manual smoke checklist in `docs/identity/smoke.md` passes. + +## T07 — flex-auth protected system (minimal) + +```task +id: CSOC-WP-0002-T07 +status: todo +priority: medium +state_hub_task_id: "04c13dad-1c6e-45b9-96ba-438458e2c388" +``` + +Register coulomb.social as a flex-auth protected system with a **tiny** +resource/action vocabulary (e.g. `shell:view`, `member:self:read`). Wire the +app as PEP (fail-closed when policy engine unavailable for protected actions). + +If cluster flex-auth is not yet available for this app, deliver: + +- local policy adapter for dev, and +- a blocked residual / intake for production flex-auth binding. + +**Done when:** at least one protected action is decided via the authz port; +docs record system id and vocabulary. + +## T08 — Delivery-lane packaging stub + +```task +id: CSOC-WP-0002-T08 +status: todo +priority: medium +state_hub_task_id: "4718f21c-d509-45b9-a8f5-31de2099fd3f" +``` + +Align with business-app delivery lane without full production cutover: + +- Container image build from commit SHA (or documented path to it). +- Placeholder railiance-apps values notes / chart stub. +- Runtime secret references (OIDC client secret, DB) named for OpenBao — + values not in Git. +- Health endpoints suitable for deploy smoke. + +**Done when:** image builds in CI or documented local script; deploy notes in +`docs/deploy.md`. + +--- + +## Sequencing + +```text +T01 ADR + └─► T02 scaffold + tenant model + ├─► T03 OIDC client + └─► T04 user-engine binding + └─► T05 auth module + └─► T06 shell + ├─► T07 flex-auth + └─► T08 packaging stub +``` + +T03 and T04 can proceed in parallel after T02 once redirect URIs and app id +are known. + +## Handoffs / residuals (later plans) + +| Residual | Future home | +|----------|-------------| +| Bubble content claim & migration | New workplan after CSOC-WP-0001 T03 cut | +| Full product UI (Research, Pages, …) | Post-shell product workplans | +| Production Keycloak expanded mode | NetKingdom (NK-WP-0011 triggers) if demand | +| Member invitation email at scale | email-connect / NK-WP-0024 lanes | + +## Related + +- `workplans/CSOC-WP-0001-bubble-io-exit-assessment.md` — assessment; content later +- `docs/design-extract/` — visual language for future UI (not blocking T01–T08) +- `docs/design-extract-auth.md` — Bubble scrape auth only; not product IdP