diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 53bbb20..8c60789 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -47,7 +47,7 @@ | workplan | KEY-WP-0034 | finished | — | workplans/KEY-WP-0034-account-recovery.md | | workplan | KEY-WP-0035 | finished | — | workplans/KEY-WP-0035-optional-mfa.md | | workplan | KEY-WP-0036 | finished | — | workplans/KEY-WP-0036-platform-factor-recovery.md | -| workplan | KEY-WP-0037 | active | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| workplan | KEY-WP-0037 | finished | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md | | task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md | | task | ADHOC-2026-09-27-T01 | done | — | workplans/ADHOC-2026-09-27.md | @@ -204,6 +204,6 @@ | task | KEY-WP-0036-T03 | done | — | workplans/KEY-WP-0036-platform-factor-recovery.md | | task | KEY-WP-0037-T01 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | task | KEY-WP-0037-T02 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | -| task | KEY-WP-0037-T03 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | -| task | KEY-WP-0037-T04 | wait | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| task | KEY-WP-0037-T03 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | +| task | KEY-WP-0037-T04 | done | — | workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md | | intake | KEY-IN-0001 | closed | — | intakes/intakes.md | diff --git a/bin/keycape b/bin/keycape index b68a0f4..e7887df 100755 Binary files a/bin/keycape and b/bin/keycape differ diff --git a/bin/keycape-to-keycloak b/bin/keycape-to-keycloak index e336926..592504f 100755 Binary files a/bin/keycape-to-keycloak and b/bin/keycape-to-keycloak differ diff --git a/bin/lldap-export b/bin/lldap-export index c2bcead..e49fe21 100755 Binary files a/bin/lldap-export and b/bin/lldap-export differ diff --git a/bin/lldap-to-ldap b/bin/lldap-to-ldap index 05c67ca..9609697 100755 Binary files a/bin/lldap-to-ldap and b/bin/lldap-to-ldap differ diff --git a/bin/validator b/bin/validator index ee69ee3..b732e32 100755 Binary files a/bin/validator and b/bin/validator differ diff --git a/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json b/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json index e50de47..2278d99 100644 --- a/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json +++ b/docs/evidence/2026-10-07-secrets-engine-openbao-issuance.json @@ -53,7 +53,7 @@ "human_login_after_restart": "founder OIDC login through KeyCape succeeded (the operator reader login above)", "not_established": [ "the 900s token lifetime was not measured; it rests on the registration's tokenLifetime 15m", - "no in-pod verification: the deployed 1164f65 cannot fetch its own discovery document from inside the cluster (fixed in 8be8065)", + "no in-pod verification: verify-client inside the keycape pod failed at discovery of https://kc.coulomb.social. Corrected 2026-10-07: this is in-cluster reachability of the public issuer, not an image defect. 1164f65 already contains 8be8065, which concerns the upstream Authelia fetch, and main has no newer source", "the OpenBao JWT role and login proof remain RPF-WP-0035-T02", "the secrets-engine probe-openbao end-to-end run remains SECRETS-WP-0012-T03" ],