coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(workplans): adopt ADR-007 derived identifiers for unregistered records

Browse source 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-25 20:13:23 +02:00
parent 23ab8397b6
commit 270a065383
5 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md
View file

@ -11,7 +11,7 @@ created: "2026-08-09"
updated: "2026-08-16"
depends_on:
- NK-WP-0025
state_hub_workstream_id: "70b78f21-be6d-4d6c-a537-037c38b2884a"
state_hub_workstream_id: "23eb67d4-cf10-57a1-92f6-90146a294bda"
---
# KEY-WP-0008 - registration handoff and client-aware MFA
@ -25,7 +25,7 @@ without making KeyCape an account store or weakening high-assurance clients.
id: KEY-WP-0008-T01
status: done
priority: high
state_hub_task_id: "31627b02-4300-4f11-a8bb-8ff2bebb9566"
state_hub_task_id: "e5fb4d73-1e19-565c-80d5-e0eee274ce63"
```
Define an allow-listed registration URL for eligible clients and preserve
@ -48,7 +48,7 @@ user-engine-owned per NK-WP-0025; KeyCape only issues the return envelope.
id: KEY-WP-0008-T02
status: done
priority: high
state_hub_task_id: "c2b56182-e717-4ca3-84e3-0963b69ce32f"
state_hub_task_id: "1ba50454-b6f5-578e-a526-da74b8082a89"
```
Replace the single require-for-all switch with policy that combines client
@ -77,7 +77,7 @@ to the client's `enrollmentUrl` instead of completing authorization.
id: KEY-WP-0008-T03
status: done
priority: high
state_hub_task_id: "bfa56396-1b94-4404-a4d5-fc5b4ae2b8e8"
state_hub_task_id: "f7acbc12-e597-5d1e-8b29-bfa02237730f"
```
Implement supported ACR/max-age or equivalent IAM Profile parameters, invoke
@ -98,7 +98,7 @@ and `mfa: true` only after successful verification.
id: KEY-WP-0008-T04
status: done
priority: high
state_hub_task_id: "d4208f77-f4a6-4f2e-a436-de4f779cfaca"
state_hub_task_id: "bc660767-387e-59a5-bfce-caccf4082c08"
```
Test known and unknown users, registration link eligibility, state expiry and