From 18ec776fba1de1d571482449bfa031110730db40 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 19 Aug 2026 21:21:16 +0200 Subject: [PATCH] Added workplan and work records --- WORK-RECORDS.md | 41 +++++++ ...social-netkingdom-login-and-jit-profile.md | 113 ++++++++++++++++++ 2 files changed, 154 insertions(+) create mode 100644 WORK-RECORDS.md create mode 100644 workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md new file mode 100644 index 0000000..d6cb48c --- /dev/null +++ b/WORK-RECORDS.md @@ -0,0 +1,41 @@ +# Work Records — helix-forge + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | HF-WP-0001 | finished | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| workplan | HF-WP-0002 | finished | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| workplan | HF-WP-0003 | finished | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| workplan | HF-WP-0004 | archived | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | +| task | HF-WP-0001-T01 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T02 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T03 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T04 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T05 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T06 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T07 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T08 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T09 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0001-T10 | done | — | workplans/HF-WP-0001-establish-ops-hub-first-extension.md | +| task | HF-WP-0002-T01 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0002-T02 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0002-T03 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0002-T04 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0002-T05 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0002-T06 | done | — | workplans/HF-WP-0002-openbao-browser-ui-at-bao-coulomb-social.md | +| task | HF-WP-0003-T01 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0003-T02 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0003-T03 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0003-T04 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0003-T05 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0003-T06 | done | — | workplans/HF-WP-0003-openbao-keycape-login-overlay.md | +| task | HF-WP-0004-T01 | cancel | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | +| task | HF-WP-0004-T02 | cancel | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | +| task | HF-WP-0004-T03 | cancel | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | +| task | HF-WP-0004-T04 | cancel | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | +| task | HF-WP-0004-T05 | cancel | — | workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md | diff --git a/workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md b/workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md new file mode 100644 index 0000000..3653646 --- /dev/null +++ b/workplans/HF-WP-0004-coulomb-social-netkingdom-login-and-jit-profile.md @@ -0,0 +1,113 @@ +--- +id: HF-WP-0004 +type: workplan +title: "Integrate coulomb.social with NetKingdom login and JIT profiles" +domain: infotech +repo: helix-forge +status: archived +owner: codex +topic_slug: netkingdom +created: "2026-08-09" +updated: "2026-08-09" +depends_on: + - NK-WP-0025 + - USER-WP-0022 + - KEY-WP-0008 +state_hub_workstream_id: "ba123393-fccc-48a0-a228-b7d0aa2fd663" +--- + +# HF-WP-0004 - coulomb.social login and first-login profile + +Add NetKingdom OIDC as an alternative to coulomb.social local registration. +The application keeps ownership of its local profile and authorization while +using KeyCape for authentication. + +## T01 - Pin the OIDC consumer and account-link contract + +```task +id: HF-WP-0004-T01 +status: cancel +priority: high +state_hub_task_id: "71db76f0-8842-4e00-a314-ee26669e2ce3" +``` + +Implement authorization-code plus PKCE against the existing coulomb-social +KeyCape client and exact production callback. Store the stable issuer/subject +link separately from username and email. Define explicit handling for an +existing local account whose verified email matches the OIDC identity. + +Done when email matching cannot silently attach or replace an existing local +account. + +## T02 - Create the profile idempotently on first login + +```task +id: HF-WP-0004-T02 +status: cancel +priority: high +state_hub_task_id: "34d0c78a-08db-49a8-8f5c-71f9a5c15dce" +``` + +On a valid callback, atomically find-or-create the coulomb.social application +profile keyed by issuer/subject, seed ordinary-user defaults, establish the +application session, and redirect to the intended page. Repeated callbacks, +concurrent tabs, and retries must return the same profile. + +Done when an existing LLDAP user with no application profile can sign in and +receive exactly one regular coulomb.social profile. + +## T03 - Add login and registration choices + +```task +id: HF-WP-0004-T03 +status: cancel +priority: high +state_hub_task_id: "6b33b969-3fad-4579-abc5-0bc3856d12cc" +``` + +Offer Sign in with NetKingdom, Create NetKingdom account, and the existing +local-account path according to product policy. The registration choice uses +the signed return flow from NK-WP-0025; completion starts a fresh OIDC login. +Avoid user enumeration and open redirects. + +Done when a completely new person can register from the coulomb.social +landing page and return as an authenticated regular user. + +## T04 - Enforce profile/action assurance + +```task +id: HF-WP-0004-T04 +status: cancel +priority: high +state_hub_task_id: "4fc5253a-f485-4259-8cea-ed0968f958e5" +``` + +Accept password-level assurance for ordinary profiles unless the application +profile or requested action requires MFA. For step-up, send a fresh KeyCape +authorization request and verify the returned assurance before completing the +action. Never infer MFA from email or application session age alone. + +Done when the attended tegwick profile works without MFA by default and can +be configured to require MFA without changing another user's profile. + +## T05 - Migrate, deploy, and prove both cases + +```task +id: HF-WP-0004-T05 +status: cancel +priority: high +state_hub_task_id: "4b178f15-bace-496d-8e59-efedd79e37be" +``` + +Add database migration, uniqueness constraints, rollback, session security, +logout, audit correlation, and railiance deployment configuration. Test Case A +existing LLDAP user/JIT profile and Case B new registration/LLDAP creation, +plus collisions, replay, concurrent callback, suspended identity, unlink, +local-account coexistence, and step-up. + +Done when both cases pass on the rebuilt coulomb.social application and local +account rollback remains available. + +2026-08-09: Cancelled before implementation because repository inspection +found the Django consumer in the dedicated coulomb-social repository, where +CSOC-WP-0002 already owns the NetKingdom shell. Successor: CSOC-WP-0003.