diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md index 12baf0b..a50e910 100644 --- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md +++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom created: "2026-07-23" updated: "2026-07-29" -state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853" +state_hub_workstream_id: "817709be-5756-5ef7-9ccd-dcb84b6b9c64" --- # Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity @@ -48,7 +48,7 @@ that package/rail path exists. id: KEY-WP-0004-T01 status: done priority: high -state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe" +state_hub_task_id: "c3bdbdb6-6b3f-51b5-8521-d67f113f1c3d" ``` **Decided 2026-07-23 (Bernd):** the IAM profile's `tenant:customer:` / @@ -119,7 +119,7 @@ grouping vocabulary. The live service-token proof carries id: KEY-WP-0004-T02 status: done priority: high -state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e" +state_hub_task_id: "202c419e-838f-5c2f-8a52-9b1c36a6d6b9" ``` Create the user in key-cape's current backend, enroll MFA per profile @@ -181,7 +181,7 @@ The live token then carried `tenant:friendly:binky`, roles `user` and id: KEY-WP-0004-T03 status: done priority: high -state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7" +state_hub_task_id: "0d3ccd35-bad5-5c30-95a3-61fce584425d" ``` Register an OIDC client per the profile's service-account/workload-identity @@ -218,7 +218,7 @@ secret and excessive scope were denied. id: KEY-WP-0004-T04 status: done priority: high -state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59" +state_hub_task_id: "9cb09dbf-1fd0-55c5-9c45-b3b7296ecd91" ``` Coordinate with `secrets-engine` to create a scoped OpenBao lane for this @@ -250,7 +250,7 @@ handling. id: KEY-WP-0004-T05 status: done priority: high -state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d" +state_hub_task_id: "39f1f803-732e-5905-97d9-c7493c66c8ee" ``` This is the task that directly minimizes Bernd's ongoing engagement: add an @@ -290,7 +290,7 @@ the metadata-only M3/prod posture check both pass. id: KEY-WP-0004-T06 status: cancel priority: low -state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c" +state_hub_task_id: "fbee11fc-7a60-5dd7-8522-f80ddb4aea55" ``` Forward-looking per Bernd's framing ("I guess it will later be helpful") — @@ -314,7 +314,7 @@ this task stays `todo` and does not block closing the rest of this workplan. id: KEY-WP-0004-T07 status: done priority: low -state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737" +state_hub_task_id: "77b0556f-62fd-5046-9ba1-718246151a6f" ``` Mark workplan finished when T01–T05 are done (T06 may legitimately remain diff --git a/workplans/KEY-WP-0005-iam-profile-core-claims.md b/workplans/KEY-WP-0005-iam-profile-core-claims.md index f9e0114..648d240 100644 --- a/workplans/KEY-WP-0005-iam-profile-core-claims.md +++ b/workplans/KEY-WP-0005-iam-profile-core-claims.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom created: "2026-07-23" updated: "2026-07-23" -state_hub_workstream_id: "74ac0d31-b86e-449d-89b2-4e15263bf050" +state_hub_workstream_id: "711a8303-69aa-5db6-9043-92530c6dc81b" --- # IAM Profile core claims: tenant, principal_type, groups, roles, assurance, tenant_roles @@ -47,7 +47,7 @@ correct `tenant:friendly:binky` token at all). id: KEY-WP-0005-T01 status: done priority: high -state_hub_task_id: "66107caf-ba26-4291-bb09-1f9e58275505" +state_hub_task_id: "32d5fbdc-cd2b-5bc8-9d2b-1a410b55e806" ``` Bring `token.go`'s claim assembly up to `iam-profile_v0.3.md`'s Core Claims @@ -141,7 +141,7 @@ human included. id: KEY-WP-0005-T02 status: done priority: high -state_hub_task_id: "1b8f44b4-2763-4d5a-a3eb-1c2b9a25dd15" +state_hub_task_id: "c3ee6021-b28d-50a5-be60-ecb5631f56e9" ``` At token-issuance time, call `tenant-engine`'s cache-read endpoint @@ -204,7 +204,7 @@ whatever id shape the test author happened to pick and never caught this. id: KEY-WP-0005-T03 status: done priority: low -state_hub_task_id: "34555bf7-0f18-4dac-ade2-6ff3738f353f" +state_hub_task_id: "c88a3457-2964-5c44-8220-76f82df3a753" ``` Confirm T01–T02 done; conformance suite green for both tasks together. diff --git a/workplans/KEY-WP-0006-client-credentials-service-tokens.md b/workplans/KEY-WP-0006-client-credentials-service-tokens.md index cac2e97..632c4c2 100644 --- a/workplans/KEY-WP-0006-client-credentials-service-tokens.md +++ b/workplans/KEY-WP-0006-client-credentials-service-tokens.md @@ -9,7 +9,7 @@ owner: codex topic_slug: netkingdom created: "2026-07-27" updated: "2026-07-27" -state_hub_workstream_id: "f2d5df23-9dd2-4995-b218-be5904e07508" +state_hub_workstream_id: "d8d20d8f-61e0-54e2-9a88-a3958f0b6f2d" --- # KEY-WP-0006 - Client credentials and service tokens @@ -23,7 +23,7 @@ Implement the missing service-principal half of the IAM Profile so id: KEY-WP-0006-T01 status: done priority: high -state_hub_task_id: "4e7addc2-5773-499f-84e4-ffddc1800952" +state_hub_task_id: "993913a7-f951-50ee-9b10-d5b9e67b523c" ``` Extend static client registration with an explicit service subject, tenant, @@ -42,7 +42,7 @@ reporting the variable name—not its value—on failure. id: KEY-WP-0006-T02 status: done priority: high -state_hub_task_id: "9fd408dc-6f71-4765-ace2-22ee7bb1cf57" +state_hub_task_id: "801a6d55-2f91-51b1-88e4-cc7f0867238d" ``` Accept confidential client authentication through HTTP Basic, compare secrets @@ -63,7 +63,7 @@ token. id: KEY-WP-0006-T03 status: done priority: high -state_hub_task_id: "e37a346b-f6bc-4b29-9c13-94ec1c79a381" +state_hub_task_id: "e5c2a8b1-0879-57fa-a197-250a34c75bdb" ``` Cover valid exchange, unknown client, public client, missing/wrong secret, @@ -81,7 +81,7 @@ module. id: KEY-WP-0006-T04 status: done priority: high -state_hub_task_id: "ba65d39f-63b8-42aa-87bb-99ec26821a8e" +state_hub_task_id: "31af6b8c-96ff-5060-87db-3803b9a9dd12" ``` Generate the client secret without disclosure, store it through the approved @@ -105,7 +105,7 @@ used TLS-preserving direct resolution to railiance01 (`92.205.62.239`). id: KEY-WP-0006-T05 status: done priority: low -state_hub_task_id: "7c9cdac6-c53f-4a32-81d2-8d2e73de0039" +state_hub_task_id: "8c72d7d9-4086-5e64-b939-a12bff076124" ``` Close after T01-T04 pass and the repeatable verification path is documented. diff --git a/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md index 54d24a5..f1b04e1 100644 --- a/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md +++ b/workplans/KEY-WP-0007-user-engine-portal-oidc-client.md @@ -12,7 +12,7 @@ updated: "2026-07-29" depends_on: - KEY-WP-0005 - USER-WP-0020 -state_hub_workstream_id: "92727f0c-09a8-4431-88c4-3cb6fe946d27" +state_hub_workstream_id: "24db4178-705c-5b09-b7db-ee7a345d71a0" --- # KEY-WP-0007 - User-engine portal OIDC relying-party integration @@ -27,7 +27,7 @@ not move user-domain or authorization ownership into KeyCape. id: KEY-WP-0007-T01 status: done priority: high -state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e" +state_hub_task_id: "7d722cae-bf6d-52e0-80f4-cc51e9fb42f0" ``` Register `user-engine-portal` for authorization code with mandatory S256 PKCE, @@ -40,7 +40,7 @@ implicit flow, client secret, or dynamic registration is allowed. id: KEY-WP-0007-T02 status: done priority: high -state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928" +state_hub_task_id: "0b222062-4352-5ae6-9e85-95787af08409" ``` Update the railiance01 KeyCape configuration without exposing its signing key @@ -53,7 +53,7 @@ unregistered callback denial and successful token exchange through the portal. id: KEY-WP-0007-T03 status: done priority: high -state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2" +state_hub_task_id: "859e7322-71dc-58cc-9f44-6f869c2d0b59" ``` Prove issuer, audience, tenant, groups, roles and assurance claims are verified diff --git a/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md b/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md index 2279d73..438ab54 100644 --- a/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md +++ b/workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md @@ -11,7 +11,7 @@ created: "2026-08-09" updated: "2026-08-16" depends_on: - NK-WP-0025 -state_hub_workstream_id: "70b78f21-be6d-4d6c-a537-037c38b2884a" +state_hub_workstream_id: "23eb67d4-cf10-57a1-92f6-90146a294bda" --- # KEY-WP-0008 - registration handoff and client-aware MFA @@ -25,7 +25,7 @@ without making KeyCape an account store or weakening high-assurance clients. id: KEY-WP-0008-T01 status: done priority: high -state_hub_task_id: "31627b02-4300-4f11-a8bb-8ff2bebb9566" +state_hub_task_id: "e5fb4d73-1e19-565c-80d5-e0eee274ce63" ``` Define an allow-listed registration URL for eligible clients and preserve @@ -48,7 +48,7 @@ user-engine-owned per NK-WP-0025; KeyCape only issues the return envelope. id: KEY-WP-0008-T02 status: done priority: high -state_hub_task_id: "c2b56182-e717-4ca3-84e3-0963b69ce32f" +state_hub_task_id: "1ba50454-b6f5-578e-a526-da74b8082a89" ``` Replace the single require-for-all switch with policy that combines client @@ -77,7 +77,7 @@ to the client's `enrollmentUrl` instead of completing authorization. id: KEY-WP-0008-T03 status: done priority: high -state_hub_task_id: "bfa56396-1b94-4404-a4d5-fc5b4ae2b8e8" +state_hub_task_id: "f7acbc12-e597-5d1e-8b29-bfa02237730f" ``` Implement supported ACR/max-age or equivalent IAM Profile parameters, invoke @@ -98,7 +98,7 @@ and `mfa: true` only after successful verification. id: KEY-WP-0008-T04 status: done priority: high -state_hub_task_id: "d4208f77-f4a6-4f2e-a436-de4f779cfaca" +state_hub_task_id: "bc660767-387e-59a5-bfce-caccf4082c08" ``` Test known and unknown users, registration link eligibility, state expiry and