coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(workplans): adopt ADR-007 derived identifiers for unregistered records

Browse source 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-25 20:13:23 +02:00
parent 23ab8397b6
commit 270a065383
5 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-07-23"
updated: "2026-07-29"
state_hub_workstream_id: "ad6fa711-ba5b-4e7d-86e3-641f9acaf853"
state_hub_workstream_id: "817709be-5756-5ef7-9ccd-dcb84b6b9c64"
---
# Binky Hedgehog GmbH as first NetKingdom tenant + qonto runtime workload identity
@ -48,7 +48,7 @@ that package/rail path exists.
id: KEY-WP-0004-T01
status: done
priority: high
state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe"
state_hub_task_id: "c3bdbdb6-6b3f-51b5-8521-d67f113f1c3d"
```
**Decided 2026-07-23 (Bernd):** the IAM profile's `tenant:customer:<name>` /
@ -119,7 +119,7 @@ grouping vocabulary. The live service-token proof carries
id: KEY-WP-0004-T02
status: done
priority: high
state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e"
state_hub_task_id: "202c419e-838f-5c2f-8a52-9b1c36a6d6b9"
```
Create the user in key-cape's current backend, enroll MFA per profile
@ -181,7 +181,7 @@ The live token then carried `tenant:friendly:binky`, roles `user` and
id: KEY-WP-0004-T03
status: done
priority: high
state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7"
state_hub_task_id: "0d3ccd35-bad5-5c30-95a3-61fce584425d"
```
Register an OIDC client per the profile's service-account/workload-identity
@ -218,7 +218,7 @@ secret and excessive scope were denied.
id: KEY-WP-0004-T04
status: done
priority: high
state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59"
state_hub_task_id: "9cb09dbf-1fd0-55c5-9c45-b3b7296ecd91"
```
Coordinate with `secrets-engine` to create a scoped OpenBao lane for this
@ -250,7 +250,7 @@ handling.
id: KEY-WP-0004-T05
status: done
priority: high
state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d"
state_hub_task_id: "39f1f803-732e-5905-97d9-c7493c66c8ee"
```
This is the task that directly minimizes Bernd's ongoing engagement: add an
@ -290,7 +290,7 @@ the metadata-only M3/prod posture check both pass.
id: KEY-WP-0004-T06
status: cancel
priority: low
state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c"
state_hub_task_id: "fbee11fc-7a60-5dd7-8522-f80ddb4aea55"
```
Forward-looking per Bernd's framing ("I guess it will later be helpful") —
@ -314,7 +314,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
id: KEY-WP-0004-T07
status: done
priority: low
state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
state_hub_task_id: "77b0556f-62fd-5046-9ba1-718246151a6f"
```
Mark workplan finished when T01–T05 are done (T06 may legitimately remain