coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete Binky tenant onboarding

Browse source
This commit is contained in:
tegwick 2026-07-29 22:13:53 +02:00
parent abd9e6fa2b
commit 2465481e3c
1 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity" title: "Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity"
domain: infotech domain: infotech
repo: key-cape repo: key-cape
status: active status: finished
owner: codex owner: codex
topic_slug: netkingdom topic_slug: netkingdom
created: "2026-07-23" created: "2026-07-23"
updated: "2026-07-26" updated: "2026-07-29"
state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853" state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853"
--- ---
@ -117,7 +117,7 @@ grouping vocabulary. The live service-token proof carries
```task ```task
id: KEY-WP-0004-T02 id: KEY-WP-0004-T02
status: progress status: done
priority: high priority: high
state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e" state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e"
``` ```
@ -170,7 +170,10 @@ default QR label exposed only the token serial. The live
`coulomb-friendly-token-labels` enrollment policy now emits issuer `Coulomb` `coulomb-friendly-token-labels` enrollment policy now emits issuer `Coulomb`
and label `{user}@{realm}` for future tokens; existing authenticator entries and label `{user}@{realm}` for future tokens; existing authenticator entries
must be renamed locally because wallets do not accept remote label updates. must be renamed locally because wallets do not accept remote label updates.
Final claim/denial evidence remains. The live token then carried `tenant:friendly:binky`, roles `user` and
`tenant-admin`, only the Binky users/admins groups, and AAL2 assurance with
`pwd` + `otp` and `mfa: true`. The same session was denied access to both
`tenant:platform` and `tenant:coulomb` administration. Acceptance complete.
## Task: Register a workload-identity OIDC client for the qonto runtime ## Task: Register a workload-identity OIDC client for the qonto runtime
@ -309,7 +312,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
```task ```task
id: KEY-WP-0004-T07 id: KEY-WP-0004-T07
status: wait status: done
priority: low priority: low
state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737" state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
``` ```
@ -323,3 +326,7 @@ nothing else; the credential lane is discoverable via `warden access` without
Bernd touching key-cape/OpenBao admin surfaces directly. The runtime follow-up Bernd touching key-cape/OpenBao admin surfaces directly. The runtime follow-up
then continues in `QONTO-WP-0004` and `RAILIANCE-WP-0019`. Run then continues in `QONTO-WP-0004` and `RAILIANCE-WP-0019`. Run
`statehub fix-consistency`. `statehub fix-consistency`.
2026-07-29 closure: T01–T05 are complete, T06 is intentionally cancelled,
the human Binky flow passed AAL2 and tenant-isolation acceptance, and the qonto
workload client passed its positive-scope and negative credential/scope checks.