codex
79e9cd9022
These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
3.7 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | depends_on | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HF-WP-0004 | workplan | Integrate coulomb.social with NetKingdom login and JIT profiles | infotech | helix-forge | archived | codex | netkingdom | 2026-08-09 | 2026-08-09 |
|
de95c70e-f4e1-5f10-8274-a389a9c94f9f |
HF-WP-0004 - coulomb.social login and first-login profile
Add NetKingdom OIDC as an alternative to coulomb.social local registration. The application keeps ownership of its local profile and authorization while using KeyCape for authentication.
T01 - Pin the OIDC consumer and account-link contract
id: HF-WP-0004-T01
status: cancel
priority: high
state_hub_task_id: "29d034db-57c0-5cea-8f4f-385a15e36a18"
Implement authorization-code plus PKCE against the existing coulomb-social KeyCape client and exact production callback. Store the stable issuer/subject link separately from username and email. Define explicit handling for an existing local account whose verified email matches the OIDC identity.
Done when email matching cannot silently attach or replace an existing local account.
T02 - Create the profile idempotently on first login
id: HF-WP-0004-T02
status: cancel
priority: high
state_hub_task_id: "00d31d83-bab2-57a6-a0a0-7708f777e266"
On a valid callback, atomically find-or-create the coulomb.social application profile keyed by issuer/subject, seed ordinary-user defaults, establish the application session, and redirect to the intended page. Repeated callbacks, concurrent tabs, and retries must return the same profile.
Done when an existing LLDAP user with no application profile can sign in and receive exactly one regular coulomb.social profile.
T03 - Add login and registration choices
id: HF-WP-0004-T03
status: cancel
priority: high
state_hub_task_id: "7a405cf4-f05e-52f7-ad4d-2b7f1e6b8b95"
Offer Sign in with NetKingdom, Create NetKingdom account, and the existing local-account path according to product policy. The registration choice uses the signed return flow from NK-WP-0025; completion starts a fresh OIDC login. Avoid user enumeration and open redirects.
Done when a completely new person can register from the coulomb.social landing page and return as an authenticated regular user.
T04 - Enforce profile/action assurance
id: HF-WP-0004-T04
status: cancel
priority: high
state_hub_task_id: "bd570133-3861-5ea6-9bef-eaf011f4ccf8"
Accept password-level assurance for ordinary profiles unless the application profile or requested action requires MFA. For step-up, send a fresh KeyCape authorization request and verify the returned assurance before completing the action. Never infer MFA from email or application session age alone.
Done when the attended tegwick profile works without MFA by default and can be configured to require MFA without changing another user's profile.
T05 - Migrate, deploy, and prove both cases
id: HF-WP-0004-T05
status: cancel
priority: high
state_hub_task_id: "ffbf15fe-0166-5491-bb68-233c935f6519"
Add database migration, uniqueness constraints, rollback, session security, logout, audit correlation, and railiance deployment configuration. Test Case A existing LLDAP user/JIT profile and Case B new registration/LLDAP creation, plus collisions, replay, concurrent callback, suspended identity, unlink, local-account coexistence, and step-up.
Done when both cases pass on the rebuilt coulomb.social application and local account rollback remains available.
2026-08-09: Cancelled before implementation because repository inspection found the Django consumer in the dedicated coulomb-social repository, where CSOC-WP-0002 already owns the NetKingdom shell. Successor: CSOC-WP-0003.