coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance Binky identity onboarding

Browse source
This commit is contained in:
tegwick 2026-07-27 20:39:13 +02:00
parent 0fa9ec9673
commit e54bcd9a40
2 changed files with 26 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
WORK-RECORDS.md
View file

@ -13,7 +13,7 @@
| workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md | | workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
| workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md | | workplan | KEY-WP-0004 | active | — | workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md |
| workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md | | workplan | KEY-WP-0005 | finished | — | workplans/KEY-WP-0005-iam-profile-core-claims.md |
| workplan | KEY-WP-0006 | active | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | workplan | KEY-WP-0006 | finished | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
| task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md | | task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@ -61,5 +61,5 @@
| task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T01 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T02 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T03 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T04 | progress | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T04 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |
| task | KEY-WP-0006-T05 | wait | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md | | task | KEY-WP-0006-T05 | done | — | workplans/KEY-WP-0006-client-credentials-service-tokens.md |

29
workplans/KEY-WP-0004-binky-hedgehog-tenant-onboarding.md
View file

@ -46,7 +46,7 @@ that package/rail path exists.
```task ```task
id: KEY-WP-0004-T01 id: KEY-WP-0004-T01
status: todo status: done
priority: high priority: high
state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe" state_hub_task_id: "ec65d1be-11cb-421f-84dd-f401206526fe"
``` ```
@ -108,6 +108,11 @@ Done when: `tenant:coulomb`'s place in the grouping scheme is resolved; the
`net-kingdom` canon-update question above is answered (drafted or explicitly `net-kingdom` canon-update question above is answered (drafted or explicitly
deferred); a test-subject token carries the `tenant:friendly:binky` claim. deferred); a test-subject token carries the `tenant:friendly:binky` claim.
2026-07-27: IAM Profile v0.2 now preserves `tenant:platform` and
`tenant:coulomb` as reserved ungrouped tenants and ratifies the external
grouping vocabulary. The live service-token proof carries
`tenant:friendly:binky` without platform authority.
## Task: Provision bernd.worsch@binky-hedgehog.com as tenant-admin ## Task: Provision bernd.worsch@binky-hedgehog.com as tenant-admin
```task ```task
@ -135,7 +140,7 @@ other tenant.
```task ```task
id: KEY-WP-0004-T03 id: KEY-WP-0004-T03
status: progress status: done
priority: high priority: high
state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7" state_hub_task_id: "fbe9d2e0-7532-4403-8e12-947aa8fd0da7"
``` ```
@ -164,11 +169,15 @@ anywhere in this repo's history.
principal/client names, least-privilege claims, non-secret evidence, and the principal/client names, least-privilege claims, non-secret evidence, and the
automation/custody boundary. Actual client issuance remains open. automation/custody boundary. Actual client issuance remains open.
2026-07-27: `KEY-WP-0006` delivered `rapp-qonto-client`. Live exchange
produced only the documented tenant, role, and `qonto:read` scope; wrong
secret and excessive scope were denied.
## Task: Route client_secret custody through secrets-engine + OpenBao ## Task: Route client_secret custody through secrets-engine + OpenBao
```task ```task
id: KEY-WP-0004-T04 id: KEY-WP-0004-T04
status: progress status: done
priority: high priority: high
state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59" state_hub_task_id: "80901eb3-a959-49ab-bcde-01ddaafa8e59"
``` ```
@ -191,11 +200,16 @@ founder authority act through `warden desk`. No secret was requested or read.
All repeatable verification and revocation work is designated for sanctioned All repeatable verification and revocation work is designated for sanctioned
agent execution and later functional automation. agent execution and later functional automation.
2026-07-27: Custody is established at
`platform/workloads/rapp-qonto/keycape-client`, with runtime injection through
`sso/keycape-rapp-qonto-client`. No raw value entered evidence or human
handling.
## Task: Register the credential lane with ops-warden ## Task: Register the credential lane with ops-warden
```task ```task
id: KEY-WP-0004-T05 id: KEY-WP-0004-T05
status: progress status: done
priority: high priority: high
state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d" state_hub_task_id: "a91326a6-f498-4569-a56b-95a49fe5794d"
``` ```
@ -228,11 +242,14 @@ access`, not direct key-cape/OpenBao admin knowledge.
documented. Catalog publication waits for the real client and OpenBao role so documented. Catalog publication waits for the real client and OpenBao role so
the route does not advertise an unusable lane. the route does not advertise an unusable lane.
2026-07-27: Published route `rapp-qonto-keycape-client`; route resolution and
the metadata-only M3/prod posture check both pass.
## Task: automation@binky-hedgehog.com service identity (deferred) ## Task: automation@binky-hedgehog.com service identity (deferred)
```task ```task
id: KEY-WP-0004-T06 id: KEY-WP-0004-T06
status: todo status: cancel
priority: low priority: low
state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c" state_hub_task_id: "d3460058-6e4c-426b-b575-1bbad192e40c"
``` ```
@ -256,7 +273,7 @@ this task stays `todo` and does not block closing the rest of this workplan.
```task ```task
id: KEY-WP-0004-T07 id: KEY-WP-0004-T07
status: todo status: wait
priority: low priority: low
state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737" state_hub_task_id: "9511a7ef-0a04-45db-8a7b-598ab77ce737"
``` ```