coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance Binky identity onboarding

Browse source
This commit is contained in:
tegwick 2026-07-27 20:39:13 +02:00
parent 0fa9ec9673
commit e54bcd9a40
2 changed files with 26 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
WORK-RECORDS.md
View file

@ -13,7 +13,7 @@
| workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| workplan | KEY-WP-0006 | active | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@ -61,5 +61,5 @@
| task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T04 | progress | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T05 | wait | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |

29
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -46,7 +46,7 @@ that package/rail path exists.
```task
id: KEY-WP-0004-T01
status: todo
status: done
priority: high
state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe"
```
@ -108,6 +108,11 @@ Done when: `tenant:coulomb`'s place in the grouping scheme is resolved; the
`net-kingdom` canon-update question above is answered (drafted or explicitly
deferred); a test-subject token carries the `tenant:friendly:binky` claim.
2026-07-27: IAM Profile v0.2 now preserves `tenant:platform` and
`tenant:coulomb` as reserved ungrouped tenants and ratifies the external
grouping vocabulary. The live service-token proof carries
`tenant:friendly:binky` without platform authority.
## Task: Provision bernd.worsch@binky-hedgehog.com as tenant-admin
```task
@ -135,7 +140,7 @@ other tenant.
```task
id: KEY-WP-0004-T03
status: progress
status: done
priority: high
state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7"
```
@ -164,11 +169,15 @@ anywhere in this repo's history.
principal/client names, least-privilege claims, non-secret evidence, and the
automation/custody boundary. Actual client issuance remains open.
2026-07-27: `KEY-WP-0006` delivered `rapp-qonto-client`. Live exchange
produced only the documented tenant, role, and `qonto:read` scope; wrong
secret and excessive scope were denied.
## Task: Route client_secret custody through secrets-engine + OpenBao
```task
id: KEY-WP-0004-T04
status: progress
status: done
priority: high
state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59"
```
@ -191,11 +200,16 @@ founder authority act through `warden desk`. No secret was requested or read.
All repeatable verification and revocation work is designated for sanctioned
agent execution and later functional automation.
2026-07-27: Custody is established at
`platform/workloads/rapp-qonto/keycape-client`, with runtime injection through
`sso/keycape-rapp-qonto-client`. No raw value entered evidence or human
handling.
## Task: Register the credential lane with ops-warden
```task
id: KEY-WP-0004-T05
status: progress
status: done
priority: high
state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d"
```
@ -228,11 +242,14 @@ access`, not direct key-cape/OpenBao admin knowledge.
documented. Catalog publication waits for the real client and OpenBao role so
the route does not advertise an unusable lane.
2026-07-27: Published route `rapp-qonto-keycape-client`; route resolution and
the metadata-only M3/prod posture check both pass.
## Task: automation@binky-hedgehog.com service identity (deferred)
```task
id: KEY-WP-0004-T06
status: todo
status: cancel
priority: low
state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c"
```
@ -256,7 +273,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
```task
id: KEY-WP-0004-T07
status: todo
status: wait
priority: low
state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
```