From 49a8992d6e6747f2b2b2aff20f903a6c1be0c383 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 28 Jul 2026 16:49:27 +0200 Subject: [PATCH] Advance Binky human onboarding --- WORK-RECORDS.md | 2 +- .../KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | 10 +++++++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 11c9add..bf46365 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -50,7 +50,7 @@ | task | KEY-WP-0003-T04 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | task | KEY-WP-0003-T05 | done | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | task | KEY-WP-0004-T01 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | -| task | KEY-WP-0004-T02 | wait | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | +| task | KEY-WP-0004-T02 | progress | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T03 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T04 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | task | KEY-WP-0004-T05 | done | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md index 60080ce..cc9188e 100644 --- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md +++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md @@ -117,7 +117,7 @@ grouping vocabulary. The live service-token proof carries ```task id: KEY-WP-0004-T02 -status: wait +status: progress priority: high state_hub_task_id: "b5cb4497-095c-4dd7-af31-831deddd422e" ``` @@ -140,6 +140,14 @@ and receives a token carrying `tenant:friendly:binky` and a tenant-admin role claim; the same token does **not** grant access to `tenant:platform` or any other tenant. +2026-07-28: user-engine's deployed portal API created the tenant-admin +membership and provisioned/linked the LLDAP identity through the reusable +NetKingdom adapter. The identity is intentionally in +`password_setup_required`; LLDAP has no SMTP configuration for its native +reset delivery. First-password handoff, MFA enrollment, and final human-token +claim/denial evidence remain. No operator-set password or raw credential was +used as a shortcut. + ## Task: Register a workload-identity OIDC client for the qonto runtime ```task