coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(workplans): adopt ADR-007 derived identifiers for unregistered records

Browse source 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-25 20:13:23 +02:00
parent 23ab8397b6
commit 270a065383
5 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-07-23"
updated: "2026-07-29"
state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853"
state_hub_workstream_id: "817709be-5756-5ef7-9ccd-dcb84b6b9c64"
---
# Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity
@ -48,7 +48,7 @@ that package/rail path exists.
id: KEY-WP-0004-T01
status: done
priority: high
state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe"
state_hub_task_id: "c3bdbdb6-6b3f-51b5-8521-d67f113f1c3d"
```
**Decided 2026-07-23 (Bernd):** the IAM profile's `tenant:customer:<name>` /
@ -119,7 +119,7 @@ grouping vocabulary. The live service-token proof carries
id: KEY-WP-0004-T02
status: done
priority: high
state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e"
state_hub_task_id: "202c419e-838f-5c2f-8a52-9b1c36a6d6b9"
```
Create the user in key-cape's current backend, enroll MFA per profile
@ -181,7 +181,7 @@ The live token then carried `tenant:friendly:binky`, roles `user` and
id: KEY-WP-0004-T03
status: done
priority: high
state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7"
state_hub_task_id: "0d3ccd35-bad5-5c30-95a3-61fce584425d"
```
Register an OIDC client per the profile's service-account/workload-identity
@ -218,7 +218,7 @@ secret and excessive scope were denied.
id: KEY-WP-0004-T04
status: done
priority: high
state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59"
state_hub_task_id: "9cb09dbf-1fd0-55c5-9c45-b3b7296ecd91"
```
Coordinate with `secrets-engine` to create a scoped OpenBao lane for this
@ -250,7 +250,7 @@ handling.
id: KEY-WP-0004-T05
status: done
priority: high
state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d"
state_hub_task_id: "39f1f803-732e-5905-97d9-c7493c66c8ee"
```
This is the task that directly minimizes Bernd's ongoing engagement: add an
@ -290,7 +290,7 @@ the metadata-only M3/prod posture check both pass.
id: KEY-WP-0004-T06
status: cancel
priority: low
state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c"
state_hub_task_id: "fbee11fc-7a60-5dd7-8522-f80ddb4aea55"
```
Forward-looking per Bernd's framing ("I guess it will later be helpful") —
@ -314,7 +314,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
id: KEY-WP-0004-T07
status: done
priority: low
state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
state_hub_task_id: "77b0556f-62fd-5046-9ba1-718246151a6f"
```
Mark workplan finished when T01–T05 are done (T06 may legitimately remain

8
workplans/KEY-WP-0005-iam-profile-core-claims.md
View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-07-23"
updated: "2026-07-23"
state_hub_workstream_id: "74ac0d31-b86e-449d-89b2-4e15263bf050"
state_hub_workstream_id: "711a8303-69aa-5db6-9043-92530c6dc81b"
---
# IAM Profile core claims: tenant, principal_type, groups, roles, assurance, tenant_roles
@ -47,7 +47,7 @@ correct `tenant:friendly:binky` token at all).
id: KEY-WP-0005-T01
status: done
priority: high
state_hub_task_id: "66107caf-ba26-4291-bb09-1f9e58275505"
state_hub_task_id: "32d5fbdc-cd2b-5bc8-9d2b-1a410b55e806"
```
Bring `token.go`'s claim assembly up to `iam-profile_v0.3.md`'s Core Claims
@ -141,7 +141,7 @@ human included.
id: KEY-WP-0005-T02
status: done
priority: high
state_hub_task_id: "1b8f44b4-2763-4d5a-a3eb-1c2b9a25dd15"
state_hub_task_id: "c3ee6021-b28d-50a5-be60-ecb5631f56e9"
```
At token-issuance time, call `tenant-engine`'s cache-read endpoint
@ -204,7 +204,7 @@ whatever id shape the test author happened to pick and never caught this.
id: KEY-WP-0005-T03
status: done
priority: low
state_hub_task_id: "34555bf7-0f18-4dac-ade2-6ff3738f353f"
state_hub_task_id: "c88a3457-2964-5c44-8220-76f82df3a753"
```
Confirm T01–T02 done; conformance suite green for both tasks together.

12
workplans/KEY-WP-0006-client-credentials-service-tokens.md
View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-07-27"
updated: "2026-07-27"
state_hub_workstream_id: "f2d5df23-9dd2-4995-b218-be5904e07508"
state_hub_workstream_id: "d8d20d8f-61e0-54e2-9a88-a3958f0b6f2d"
---
# KEY-WP-0006 - Client credentials and service tokens
@ -23,7 +23,7 @@ Implement the missing service-principal half of the IAM Profile so
id: KEY-WP-0006-T01
status: done
priority: high
state_hub_task_id: "4e7addc2-5773-499f-84e4-ffddc1800952"
state_hub_task_id: "993913a7-f951-50ee-9b10-d5b9e67b523c"
```
Extend static client registration with an explicit service subject, tenant,
@ -42,7 +42,7 @@ reporting the variable name—not its value—on failure.
id: KEY-WP-0006-T02
status: done
priority: high
state_hub_task_id: "9fd408dc-6f71-4765-ace2-22ee7bb1cf57"
state_hub_task_id: "801a6d55-2f91-51b1-88e4-cc7f0867238d"
```
Accept confidential client authentication through HTTP Basic, compare secrets
@ -63,7 +63,7 @@ token.
id: KEY-WP-0006-T03
status: done
priority: high
state_hub_task_id: "e37a346b-f6bc-4b29-9c13-94ec1c79a381"
state_hub_task_id: "e5c2a8b1-0879-57fa-a197-250a34c75bdb"
```
Cover valid exchange, unknown client, public client, missing/wrong secret,
@ -81,7 +81,7 @@ module.
id: KEY-WP-0006-T04
status: done
priority: high
state_hub_task_id: "ba65d39f-63b8-42aa-87bb-99ec26821a8e"
state_hub_task_id: "31af6b8c-96ff-5060-87db-3803b9a9dd12"
```
Generate the client secret without disclosure, store it through the approved
@ -105,7 +105,7 @@ used TLS-preserving direct resolution to railiance01 (`92.205.62.239`).
id: KEY-WP-0006-T05
status: done
priority: low
state_hub_task_id: "7c9cdac6-c53f-4a32-81d2-8d2e73de0039"
state_hub_task_id: "8c72d7d9-4086-5e64-b939-a12bff076124"
```
Close after T01-T04 pass and the repeatable verification path is documented.

8
workplans/KEY-WP-0007-user-engine-portal-oidc-client.md
View file

@ -12,7 +12,7 @@ updated: "2026-07-29"
depends_on:
- KEY-WP-0005
- USER-WP-0020
state_hub_workstream_id: "92727f0c-09a8-4431-88c4-3cb6fe946d27"
state_hub_workstream_id: "24db4178-705c-5b09-b7db-ee7a345d71a0"
---
# KEY-WP-0007 - User-engine portal OIDC relying-party integration
@ -27,7 +27,7 @@ not move user-domain or authorization ownership into KeyCape.
id: KEY-WP-0007-T01
status: done
priority: high
state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e"
state_hub_task_id: "7d722cae-bf6d-52e0-80f4-cc51e9fb42f0"
```
Register `user-engine-portal` for authorization code with mandatory S256 PKCE,
@ -40,7 +40,7 @@ implicit flow, client secret, or dynamic registration is allowed.
id: KEY-WP-0007-T02
status: done
priority: high
state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928"
state_hub_task_id: "0b222062-4352-5ae6-9e85-95787af08409"
```
Update the railiance01 KeyCape configuration without exposing its signing key
@ -53,7 +53,7 @@ unregistered callback denial and successful token exchange through the portal.
id: KEY-WP-0007-T03
status: done
priority: high
state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
state_hub_task_id: "859e7322-71dc-58cc-9f44-6f869c2d0b59"
```
Prove issuer, audience, tenant, groups, roles and assurance claims are verified

10
workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
View file

@ -11,7 +11,7 @@ created: "2026-08-09"
updated: "2026-08-16"
depends_on:
- NK-WP-0025
state_hub_workstream_id: "70b78f21-be6d-4d6c-a537-037c38b2884a"
state_hub_workstream_id: "23eb67d4-cf10-57a1-92f6-90146a294bda"
---
# KEY-WP-0008 - registration handoff and client-aware MFA
@ -25,7 +25,7 @@ without making KeyCape an account store or weakening high-assurance clients.
id: KEY-WP-0008-T01
status: done
priority: high
state_hub_task_id: "31627b02-4300-4f11-a8bb-8ff2bebb9566"
state_hub_task_id: "e5fb4d73-1e19-565c-80d5-e0eee274ce63"
```
Define an allow-listed registration URL for eligible clients and preserve
@ -48,7 +48,7 @@ user-engine-owned per NK-WP-0025; KeyCape only issues the return envelope.
id: KEY-WP-0008-T02
status: done
priority: high
state_hub_task_id: "c2b56182-e717-4ca3-84e3-0963b69ce32f"
state_hub_task_id: "1ba50454-b6f5-578e-a526-da74b8082a89"
```
Replace the single require-for-all switch with policy that combines client
@ -77,7 +77,7 @@ to the client's `enrollmentUrl` instead of completing authorization.
id: KEY-WP-0008-T03
status: done
priority: high
state_hub_task_id: "bfa56396-1b94-4404-a4d5-fc5b4ae2b8e8"
state_hub_task_id: "f7acbc12-e597-5d1e-8b29-bfa02237730f"
```
Implement supported ACR/max-age or equivalent IAM Profile parameters, invoke
@ -98,7 +98,7 @@ and `mfa: true` only after successful verification.
id: KEY-WP-0008-T04
status: done
priority: high
state_hub_task_id: "d4208f77-f4a6-4f2e-a436-de4f779cfaca"
state_hub_task_id: "bc660767-387e-59a5-bfce-caccf4082c08"
```
Test known and unknown users, registration link eligibility, state expiry and