From e54bcd9a4009d7f59974dfaef9a2511106a3abef Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 27 Jul 2026 20:39:13 +0200 Subject: [PATCH] Advance Binky identity onboarding --- WORK-RECORDS.md | 6 ++-- ...P-0004-binky-hedgehog-tenant-onboarding.md | 29 +++++++++++++++---- 2 files changed, 26 insertions(+), 9 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8b79de3..4f7bf57 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -13,7 +13,7 @@ | workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | -| workplan | KEY-WP-0006 | active | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | +| workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | @@ -61,5 +61,5 @@ | task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | -| task | KEY-WP-0006-T04 | progress | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | -| task | KEY-WP-0006-T05 | wait | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | +| task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | +| task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | diff --git a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md index 0776d1f..38a0377 100644 --- a/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md +++ b/workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md @@ -46,7 +46,7 @@ that package/rail path exists. ```task id: KEY-WP-0004-T01 -status: todo +status: done priority: high state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe" ``` @@ -108,6 +108,11 @@ Done when: `tenant:coulomb`'s place in the grouping scheme is resolved; the `net-kingdom` canon-update question above is answered (drafted or explicitly deferred); a test-subject token carries the `tenant:friendly:binky` claim. +2026-07-27: IAM Profile v0.2 now preserves `tenant:platform` and +`tenant:coulomb` as reserved ungrouped tenants and ratifies the external +grouping vocabulary. The live service-token proof carries +`tenant:friendly:binky` without platform authority. + ## Task: Provision bernd.worsch@binky-hedgehog.com as tenant-admin ```task @@ -135,7 +140,7 @@ other tenant. ```task id: KEY-WP-0004-T03 -status: progress +status: done priority: high state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7" ``` @@ -164,11 +169,15 @@ anywhere in this repo's history. principal/client names, least-privilege claims, non-secret evidence, and the automation/custody boundary. Actual client issuance remains open. +2026-07-27: `KEY-WP-0006` delivered `rapp-qonto-client`. Live exchange +produced only the documented tenant, role, and `qonto:read` scope; wrong +secret and excessive scope were denied. + ## Task: Route client_secret custody through secrets-engine + OpenBao ```task id: KEY-WP-0004-T04 -status: progress +status: done priority: high state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59" ``` @@ -191,11 +200,16 @@ founder authority act through `warden desk`. No secret was requested or read. All repeatable verification and revocation work is designated for sanctioned agent execution and later functional automation. +2026-07-27: Custody is established at +`platform/workloads/rapp-qonto/keycape-client`, with runtime injection through +`sso/keycape-rapp-qonto-client`. No raw value entered evidence or human +handling. + ## Task: Register the credential lane with ops-warden ```task id: KEY-WP-0004-T05 -status: progress +status: done priority: high state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d" ``` @@ -228,11 +242,14 @@ access`, not direct key-cape/OpenBao admin knowledge. documented. Catalog publication waits for the real client and OpenBao role so the route does not advertise an unusable lane. +2026-07-27: Published route `rapp-qonto-keycape-client`; route resolution and +the metadata-only M3/prod posture check both pass. + ## Task: automation@binky-hedgehog.com service identity (deferred) ```task id: KEY-WP-0004-T06 -status: todo +status: cancel priority: low state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c" ``` @@ -256,7 +273,7 @@ this task stays `todo` and does not block closing the rest of this workplan. ```task id: KEY-WP-0004-T07 -status: todo +status: wait priority: low state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737" ```