coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance Binky human onboarding

Browse source
This commit is contained in:
tegwick 2026-07-28 16:49:27 +02:00
parent 2bfd115f11
commit 49a8992d6e
2 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -50,7 +50,7 @@
| task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T02 | wait | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T02 | progress | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |

10
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -117,7 +117,7 @@ grouping vocabulary. The live service-token proof carries
```task
id: KEY-WP-0004-T02
status: wait
status: progress
priority: high
state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e"
```
@ -140,6 +140,14 @@ and receives a token carrying `tenant:friendly:binky` and a tenant-admin role
claim; the same token does **not** grant access to `tenant:platform` or any
other tenant.
2026-07-28: user-engine's deployed portal API created the tenant-admin
membership and provisioned/linked the LLDAP identity through the reusable
NetKingdom adapter. The identity is intentionally in
`password_setup_required`; LLDAP has no SMTP configuration for its native
reset delivery. First-password handoff, MFA enrollment, and final human-token
claim/denial evidence remain. No operator-set password or raw credential was
used as a shortcut.
## Task: Register a workload-identity OIDC client for the qonto runtime
```task