net-kingdom/WORK-RECORDS.md

# Work Records — net-kingdom

> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]

| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | adhoc-2026-07-02 | finished | — | workplans/ADHOC-2026-07-02.md |
| workplan | ADHOC-2026-08-14 | finished | — | workplans/ADHOC-2026-08-14.md |
| workplan | ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| workplan | NK-WP-0009 | backlog | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| workplan | NK-WP-0011 | backlog | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| workplan | NK-WP-0022 | blocked | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| workplan | NK-WP-0024 | finished | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
| workplan | NK-WP-0025 | finished | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| workplan | NK-WP-0026 | finished | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
| workplan | NK-WP-0027 | blocked | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| workplan | NK-WP-0028 | finished | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| workplan | NK-WP-0031 | blocked | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| workplan | NK-WP-0032 | blocked | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| workplan | NK-WP-0033 | active | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
| task | ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
| task | ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
| task | ADHOC-2026-08-14-T02 | done | — | workplans/ADHOC-2026-08-14.md |
| task | ADHOC-2026-08-14-T03 | done | — | workplans/ADHOC-2026-08-14.md |
| task | ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T04 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T05 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NK-WP-0009-T01 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0009-T02 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0009-T03 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0009-T04 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0009-T05 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0009-T06 | todo | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| task | NK-WP-0011-T01 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T02 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T03 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T04 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T05 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T06 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T07 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0011-T08 | todo | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
| task | NK-WP-0021-T01 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| task | NK-WP-0021-T02 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| task | NK-WP-0021-T03 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| task | NK-WP-0021-T04 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| task | NK-WP-0021-T05 | done | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
| task | NK-WP-0022-T01 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T02 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T03 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T04 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T05 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T06 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T07 | done | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0022-T08 | wait | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
| task | NK-WP-0023-T01 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T02 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T03 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T04 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T05 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T06 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T07 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0023-T08 | done | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
| task | NK-WP-0024-T01 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
| task | NK-WP-0024-T02 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
| task | NK-WP-0024-T03 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
| task | NK-WP-0024-T04 | done | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| task | NK-WP-0025-T02 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| task | NK-WP-0025-T03 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| task | NK-WP-0025-T04 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| task | NK-WP-0025-T05 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
| task | NK-WP-0026-T01 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
| task | NK-WP-0026-T02 | done | — | workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md |
| task | NK-WP-0027-T01 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0027-T02 | wait | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0027-T03 | wait | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0027-T04 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0027-T05 | done | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0027-T06 | wait | — | workplans/NK-WP-0027-reef-placement-reconciliation.md |
| task | NK-WP-0028-T01 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
| task | NK-WP-0028-T02 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
| task | NK-WP-0028-T03 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
| task | NK-WP-0028-T04 | done | — | workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md |
| task | NK-WP-0029-T01 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| task | NK-WP-0029-T02 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| task | NK-WP-0029-T03 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| task | NK-WP-0029-T04 | done | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| task | NK-WP-0030-T01 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| task | NK-WP-0030-T02 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| task | NK-WP-0030-T03 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| task | NK-WP-0030-T04 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| task | NK-WP-0030-T05 | done | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| task | NK-WP-0031-T01 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T02 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T04 | wait | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T03 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T04 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T02 | progress | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T03 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T04 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T05 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
Add routed intakes NK-IN-0001/0002 for activity-core SSO operators. ACTIVITY-WP-0025 residual T06: LLDAP group activity-core-operators and Authelia domain rules for activity/temporal.coulomb.social. File-backed work records registered in State Hub (C-32). 2026-07-22 10:47:25 +02:00			`# Work Records — net-kingdom`

			> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
			`> stage 3). Do not edit by hand — edit the source file/block listed for`
			`> each record and re-run fix-consistency to refresh this index. Archived`
			`> workplans are omitted; closed decisions/intakes/engagements stay listed`
			`> so recently-resolved work is still visible. [auto]`

			`\| Kind \| ID \| Status \| Lane \| Source \|`
			`\| --- \| --- \| --- \| --- \| --- \|`
			`\| workplan \| adhoc-2026-07-02 \| finished \| — \| workplans/ADHOC-2026-07-02.md \|`
Refresh completed ad-hoc work index 2026-08-14 20:12:52 +02:00			`\| workplan \| ADHOC-2026-08-14 \| finished \| — \| workplans/ADHOC-2026-08-14.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 11:28:30 +02:00			`\| workplan \| ADHOC-2026-08-23 \| finished \| — \| workplans/ADHOC-2026-08-23.md \|`
Add routed intakes NK-IN-0001/0002 for activity-core SSO operators. ACTIVITY-WP-0025 residual T06: LLDAP group activity-core-operators and Authelia domain rules for activity/temporal.coulomb.social. File-backed work records registered in State Hub (C-32). 2026-07-22 10:47:25 +02:00			`\| workplan \| NET-WP-0020 \| finished \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
			`\| workplan \| NK-WP-0009 \| backlog \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| workplan \| NK-WP-0011 \| backlog \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
chore: refresh WORK-RECORDS.md after NK-WP-0021 finish 2026-07-22 15:48:23 +02:00			`\| workplan \| NK-WP-0021 \| finished \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
Deploy KeyCape client MFA override for coulomb-social Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration. 2026-08-09 22:42:51 +02:00			`\| workplan \| NK-WP-0022 \| blocked \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Close portal integration MVP and narrow identity cutover 2026-07-30 00:52:52 +02:00			`\| workplan \| NK-WP-0023 \| finished \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Refresh NetKingdom work records 2026-08-14 17:42:09 +02:00			`\| workplan \| NK-WP-0024 \| finished \| — \| workplans/NK-WP-0024-user-engine-portal-integration-expansion.md \|`
Refresh completed registration work record 2026-08-14 19:16:12 +02:00			`\| workplan \| NK-WP-0025 \| finished \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
NK-WP-0026 finished: user-engine caller identity verified live against railiance01 T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-19 22:01:12 +02:00			`\| workplan \| NK-WP-0026 \| finished \| — \| workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md \|`
docs(canon): reconcile workload and tenant grouping semantics Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-22 14:53:31 +02:00			`\| workplan \| NK-WP-0027 \| blocked \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| workplan \| NK-WP-0028 \| finished \| — \| workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md \|`
docs(scope): reconcile capability with intent Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 11:58:39 +02:00			`\| workplan \| NK-WP-0029 \| finished \| — \| workplans/NK-WP-0029-scope-and-intent-reconciliation.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 13:26:15 +02:00			`\| workplan \| NK-WP-0030 \| finished \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
			`\| workplan \| NK-WP-0031 \| blocked \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 14:08:12 +02:00			`\| workplan \| NK-WP-0032 \| blocked \| — \| workplans/NK-WP-0032-openbao-operator-loopback-callback.md \|`
			`\| workplan \| NK-WP-0033 \| active \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
Add routed intakes NK-IN-0001/0002 for activity-core SSO operators. ACTIVITY-WP-0025 residual T06: LLDAP group activity-core-operators and Authelia domain rules for activity/temporal.coulomb.social. File-backed work records registered in State Hub (C-32). 2026-07-22 10:47:25 +02:00			`\| task \| ADHOC-2026-07-02-T01 \| done \| — \| workplans/ADHOC-2026-07-02.md \|`
			`\| task \| ADHOC-2026-07-02-T02 \| done \| — \| workplans/ADHOC-2026-07-02.md \|`
Track and harden NK-WP-0025 residuals 2026-08-14 19:35:46 +02:00			`\| task \| ADHOC-2026-08-14-T01 \| done \| — \| workplans/ADHOC-2026-08-14.md \|`
			`\| task \| ADHOC-2026-08-14-T02 \| done \| — \| workplans/ADHOC-2026-08-14.md \|`
Refresh completed ad-hoc work index 2026-08-14 20:12:52 +02:00			`\| task \| ADHOC-2026-08-14-T03 \| done \| — \| workplans/ADHOC-2026-08-14.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 11:28:30 +02:00			`\| task \| ADHOC-2026-08-23-T01 \| done \| — \| workplans/ADHOC-2026-08-23.md \|`
Add routed intakes NK-IN-0001/0002 for activity-core SSO operators. ACTIVITY-WP-0025 residual T06: LLDAP group activity-core-operators and Authelia domain rules for activity/temporal.coulomb.social. File-backed work records registered in State Hub (C-32). 2026-07-22 10:47:25 +02:00			`\| task \| NET-WP-0020-T01 \| done \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
			`\| task \| NET-WP-0020-T02 \| done \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
			`\| task \| NET-WP-0020-T03 \| done \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
			`\| task \| NET-WP-0020-T04 \| done \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
			`\| task \| NET-WP-0020-T05 \| done \| — \| workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md \|`
docs(canon): reconcile workload and tenant grouping semantics Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-22 14:53:31 +02:00			`\| task \| NK-WP-0009-T01 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0009-T02 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0009-T03 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0009-T04 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0009-T05 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0009-T06 \| todo \| — \| workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md \|`
			`\| task \| NK-WP-0011-T01 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T02 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T03 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T04 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T05 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T06 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T07 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
			`\| task \| NK-WP-0011-T08 \| todo \| — \| workplans/NK-WP-0011-enterprise-federation-saml.md \|`
chore: refresh WORK-RECORDS.md after NK-WP-0021 finish 2026-07-22 15:48:23 +02:00			`\| task \| NK-WP-0021-T01 \| done \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
			`\| task \| NK-WP-0021-T02 \| done \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
			`\| task \| NK-WP-0021-T03 \| done \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
			`\| task \| NK-WP-0021-T04 \| done \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
			`\| task \| NK-WP-0021-T05 \| done \| — \| workplans/NK-WP-0021-activity-core-ops-sso-operators.md \|`
Complete identity seams and email login 2026-07-29 23:14:09 +02:00			`\| task \| NK-WP-0022-T01 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Complete CoulombCore identity backup gate 2026-07-28 09:26:16 +02:00			`\| task \| NK-WP-0022-T02 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Reconcile identity state onto railiance01 2026-07-28 12:11:45 +02:00			`\| task \| NK-WP-0022-T03 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Verify railiance01 identity dependencies 2026-07-28 12:59:12 +02:00			`\| task \| NK-WP-0022-T04 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Complete identity seams and email login 2026-07-29 23:14:09 +02:00			`\| task \| NK-WP-0022-T05 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Complete reversible identity retirement 2026-07-30 09:28:05 +02:00			`\| task \| NK-WP-0022-T06 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
			`\| task \| NK-WP-0022-T07 \| done \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Register identity cutover workplan 2026-07-27 21:41:00 +02:00			`\| task \| NK-WP-0022-T08 \| wait \| — \| workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md \|`
Deploy internal user-engine portal foundation 2026-07-27 23:24:36 +02:00			`\| task \| NK-WP-0023-T01 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Deploy identity drift reconciliation 2026-07-29 23:41:42 +02:00			`\| task \| NK-WP-0023-T02 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Complete identity seams and email login 2026-07-29 23:14:09 +02:00			`\| task \| NK-WP-0023-T03 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Close portal integration MVP and narrow identity cutover 2026-07-30 00:52:52 +02:00			`\| task \| NK-WP-0023-T04 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Complete user-engine runtime custody 2026-07-30 00:40:43 +02:00			`\| task \| NK-WP-0023-T05 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Close portal integration MVP and narrow identity cutover 2026-07-30 00:52:52 +02:00			`\| task \| NK-WP-0023-T06 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Complete identity seams and email login 2026-07-29 23:14:09 +02:00			`\| task \| NK-WP-0023-T07 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
			`\| task \| NK-WP-0023-T08 \| done \| — \| workplans/NK-WP-0023-user-engine-portal-platform-integration.md \|`
Sync integration task completion 2026-08-14 00:43:07 +02:00			`\| task \| NK-WP-0024-T01 \| done \| — \| workplans/NK-WP-0024-user-engine-portal-integration-expansion.md \|`
Refresh NetKingdom work records 2026-08-14 17:42:09 +02:00			`\| task \| NK-WP-0024-T02 \| done \| — \| workplans/NK-WP-0024-user-engine-portal-integration-expansion.md \|`
Sync integration task completion 2026-08-14 00:43:07 +02:00			`\| task \| NK-WP-0024-T03 \| done \| — \| workplans/NK-WP-0024-user-engine-portal-integration-expansion.md \|`
Refresh NetKingdom work records 2026-08-14 17:42:09 +02:00			`\| task \| NK-WP-0024-T04 \| done \| — \| workplans/NK-WP-0024-user-engine-portal-integration-expansion.md \|`
Deploy KeyCape client MFA override for coulomb-social Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration. 2026-08-09 22:42:51 +02:00			`\| task \| NK-WP-0025-T01 \| done \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
Refresh NetKingdom work records 2026-08-14 17:42:09 +02:00			`\| task \| NK-WP-0025-T02 \| done \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
Sync integration task completion 2026-08-14 00:43:07 +02:00			`\| task \| NK-WP-0025-T03 \| done \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
Refresh NetKingdom work records 2026-08-14 17:42:09 +02:00			`\| task \| NK-WP-0025-T04 \| done \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
Refresh completed registration work record 2026-08-14 19:16:12 +02:00			`\| task \| NK-WP-0025-T05 \| done \| — \| workplans/NK-WP-0025-public-self-registration-and-application-jit.md \|`
NK-WP-0026 finished: user-engine caller identity verified live against railiance01 T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2026-08-19 22:01:12 +02:00			`\| task \| NK-WP-0026-T01 \| done \| — \| workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md \|`
			`\| task \| NK-WP-0026-T02 \| done \| — \| workplans/NK-WP-0026-flex-auth-caller-identity-rollout.md \|`
docs(canon): reconcile workload and tenant grouping semantics Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-22 14:53:31 +02:00			`\| task \| NK-WP-0027-T01 \| done \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0027-T02 \| wait \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0027-T03 \| wait \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0027-T04 \| done \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0027-T05 \| done \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0027-T06 \| wait \| — \| workplans/NK-WP-0027-reef-placement-reconciliation.md \|`
			`\| task \| NK-WP-0028-T01 \| done \| — \| workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md \|`
			`\| task \| NK-WP-0028-T02 \| done \| — \| workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md \|`
			`\| task \| NK-WP-0028-T03 \| done \| — \| workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md \|`
			`\| task \| NK-WP-0028-T04 \| done \| — \| workplans/NK-WP-0028-canon-publication-and-grouping-semantics.md \|`
docs(scope): reconcile capability with intent Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 11:58:39 +02:00			`\| task \| NK-WP-0029-T01 \| done \| — \| workplans/NK-WP-0029-scope-and-intent-reconciliation.md \|`
			`\| task \| NK-WP-0029-T02 \| done \| — \| workplans/NK-WP-0029-scope-and-intent-reconciliation.md \|`
			`\| task \| NK-WP-0029-T03 \| done \| — \| workplans/NK-WP-0029-scope-and-intent-reconciliation.md \|`
			`\| task \| NK-WP-0029-T04 \| done \| — \| workplans/NK-WP-0029-scope-and-intent-reconciliation.md \|`
feat(orchestration): compose security scenarios Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 12:40:52 +02:00			`\| task \| NK-WP-0030-T01 \| done \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
			`\| task \| NK-WP-0030-T02 \| done \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
			`\| task \| NK-WP-0030-T03 \| done \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 13:26:15 +02:00			`\| task \| NK-WP-0030-T04 \| done \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
feat(orchestration): compose security scenarios Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 12:40:52 +02:00			`\| task \| NK-WP-0030-T05 \| done \| — \| workplans/NK-WP-0030-deterministic-security-scenario-composition.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 13:26:15 +02:00			`\| task \| NK-WP-0031-T01 \| done \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
			`\| task \| NK-WP-0031-T02 \| done \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
			`\| task \| NK-WP-0031-T03 \| done \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
			`\| task \| NK-WP-0031-T04 \| wait \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
			`\| task \| NK-WP-0031-T05 \| done \| — \| workplans/NK-WP-0031-deterministic-posture-feedback.md \|`
chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb 2026-08-23 14:08:12 +02:00			`\| task \| NK-WP-0032-T01 \| done \| — \| workplans/NK-WP-0032-openbao-operator-loopback-callback.md \|`
			`\| task \| NK-WP-0032-T02 \| done \| — \| workplans/NK-WP-0032-openbao-operator-loopback-callback.md \|`
			`\| task \| NK-WP-0032-T03 \| wait \| — \| workplans/NK-WP-0032-openbao-operator-loopback-callback.md \|`
			`\| task \| NK-WP-0032-T04 \| wait \| — \| workplans/NK-WP-0032-openbao-operator-loopback-callback.md \|`
			`\| task \| NK-WP-0033-T01 \| done \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
			`\| task \| NK-WP-0033-T02 \| progress \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
			`\| task \| NK-WP-0033-T03 \| wait \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
			`\| task \| NK-WP-0033-T04 \| wait \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
			`\| task \| NK-WP-0033-T05 \| wait \| — \| workplans/NK-WP-0033-keycape-secret-exposure-rotation.md \|`
Add NK-WP-0021 for activity-core ops SSO least-privilege. Promote NK-IN-0001/0002 after scope/intent review into a single ready workplan (LLDAP operator group, membership runbook, Authelia domain rules, live verification). Hub workstream and tasks registered via fix-consistency. 2026-07-22 15:21:22 +02:00			`\| intake \| NK-IN-0001 \| closed \| blue \| docs/intakes/activity-core-ops-sso-operators.md \|`
			`\| intake \| NK-IN-0002 \| closed \| blue \| docs/intakes/activity-core-ops-sso-operators.md \|`