Track post-split password reset authority and consumer return
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
parent
55fe8303f3
commit
05fa8f67f6
3 changed files with 173 additions and 0 deletions
|
|
@ -319,6 +319,8 @@
|
|||
| task | NK-WP-0054-T06 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T07 | progress | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T08 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T09 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0054-T10 | todo | — | workplans/NK-WP-0054-service-identity-policy.md |
|
||||
| task | NK-WP-0055-T01 | done | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
|
||||
| task | NK-WP-0055-T02 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
|
||||
| task | NK-WP-0055-T03 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,111 @@
|
|||
{
|
||||
"schema": "coulomb.reset-owner-boundary.v1",
|
||||
"observed_at": "2026-10-31T12:27:58.389484+00:00",
|
||||
"configmap_uid": "7af1fa0d-1bd4-47e1-8873-0f620788ef3f",
|
||||
"configmap_resource_version": "82819079",
|
||||
"configuration_sha256": "0a8bca50641a4c6f27830f476c2c9f413fc3795711becccb8344ee4d6c376e80",
|
||||
"bind_is_svc_authelia": true,
|
||||
"reset_disabled_in_config": false,
|
||||
"deployments": {
|
||||
"authelia": {
|
||||
"uid": "dc40a925-2306-4a3b-89c0-e714187503c3",
|
||||
"generation": 31,
|
||||
"observed_generation": 31,
|
||||
"ready_replicas": 1,
|
||||
"images": [
|
||||
"docker.io/authelia/authelia@sha256:bd97cff4fcbf715b5ff1f9ae286afbe6033afce385302520b0368122d43a6f54"
|
||||
]
|
||||
},
|
||||
"lldap": {
|
||||
"uid": "743a86bd-5cb0-4ca0-9c56-a3438f4746a8",
|
||||
"generation": 9,
|
||||
"observed_generation": 9,
|
||||
"ready_replicas": 1,
|
||||
"images": [
|
||||
"docker.io/lldap/lldap@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d"
|
||||
]
|
||||
}
|
||||
},
|
||||
"directory_memberships_read_here": false,
|
||||
"password_reset_attempted": false,
|
||||
"secret_read": false,
|
||||
"email_sent": false,
|
||||
"runtime_changed": false,
|
||||
"status": "reset_authority_return_incomplete",
|
||||
"owner_bind_split_task": "NK-WP-0054-T05",
|
||||
"owner_bind_split_status": "done",
|
||||
"owner_followthrough": "NK-WP-0054-T10",
|
||||
"consumer_task": "CSOC-WP-0015-T06",
|
||||
"owner_membership_receipt_at": "2026-10-30T18:53:16.176849+00:00",
|
||||
"owner_receipt_bind_groups": [
|
||||
"lldap_strict_readonly"
|
||||
],
|
||||
"owner_restore_drill_proves": [
|
||||
"independent retrieval",
|
||||
"directory login",
|
||||
"Authelia first factor",
|
||||
"by-user MFA",
|
||||
"cleanup"
|
||||
],
|
||||
"owner_restore_drill_proves_password_change": false,
|
||||
"deployed_images_match_isolated_reset_proof": true,
|
||||
"isolated_readonly_reset_result": "HTTP 200/KO; old password accepted; replacement refused",
|
||||
"isolated_password_manager_reset_result": "ordinary fixture user changed password; directory group creation refused",
|
||||
"production_password_reset_failure_claimed": false,
|
||||
"current_membership_unknown_since_owner_receipt": true,
|
||||
"prior_personal_reset_acceptance": "preserved as historical; does not prove post-split reset",
|
||||
"knowledge_orientation": {
|
||||
"version": "0.2.7",
|
||||
"digest": "22b7294e24137c0a350764b9cf37f3d4f2e9f35eb7c97a287d9c89477ef24d7a",
|
||||
"cards": [
|
||||
"start",
|
||||
"identity"
|
||||
],
|
||||
"source_status": "verified-files",
|
||||
"authority": "orientation only"
|
||||
},
|
||||
"sources": [
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
|
||||
"path": "workplans/NK-WP-0054-service-identity-policy.md",
|
||||
"sha256": "1b5411a38583edede8124881825f252b2498335de22559e23d52c787d9c9581a"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
|
||||
"path": "docs/evidence/2026-10-30-nk54-bind-split/10-verify.json",
|
||||
"sha256": "b6318e9239623a09d3f6eac1208b0fd7c7a3d3facf55a4c31c8f628454e42ebb"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
|
||||
"path": "docs/evidence/2026-10-31-identity-restore-drill/drill.json",
|
||||
"sha256": "47a5a88bdc8a7494d9e5e6687372398367931dca84e38d7de9f6290375caffa2"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
|
||||
"path": "tools/bootstrap-recovery/isolated-authelia.py",
|
||||
"sha256": "6139294f6ebdcbaad35934f04b11177d8cf89d134506a730f0c0ebbb3a4967be"
|
||||
},
|
||||
{
|
||||
"repo": "net-kingdom",
|
||||
"commit": "55fe8303f31d7476de5180f35c736652f5b4c475",
|
||||
"path": "sso-mfa/k8s/lldap/bind-split.py",
|
||||
"sha256": "4decc3bbe65120ff6c4cef5613b9a41a60168ae64ecd4c1380f61a2fcd37b6b3"
|
||||
},
|
||||
{
|
||||
"repo": "coulomb-social",
|
||||
"commit": "a786a8050db92807d0f16e637043fbd191ab9335",
|
||||
"path": "docs/release/native-password-reset-2026-10-30.json",
|
||||
"sha256": "0666b35773ee3888e12d8d8d877bd8690c9c41b6f98096bf3c5a50195be2294f"
|
||||
},
|
||||
{
|
||||
"repo": "coulomb-social",
|
||||
"commit": "a786a8050db92807d0f16e637043fbd191ab9335",
|
||||
"path": "docs/release/native-recovery-browser-2026-10-31.json",
|
||||
"sha256": "4d3b644cdf0e76e8ff775a79d8845831f7573a1e2e716e60dd53416343b6e3ba"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -423,3 +423,63 @@ that each row has a holder, a location and a last-proven date.
|
|||
|
||||
**Done when:** no row is marked `TO CONFIRM`, the freshness check exists and the first
|
||||
`admin`-operated drill (NK-WP-0053) has verified the list.
|
||||
|
||||
|
||||
## Assess the post-split password-reset boundary
|
||||
|
||||
```task
|
||||
id: NK-WP-0054-T09
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0054-T05]
|
||||
```
|
||||
|
||||
Completed 2026-10-31 as the consumer-return assessment for CSOC-WP-0015-T06.
|
||||
T05's completed bind migration and post-split restore drill prove their stated
|
||||
login/MFA scope. Neither proves a password change through Authelia. The founder
|
||||
receipt at 2026-10-30T18:53:16Z records svc-authelia in lldap_strict_readonly.
|
||||
Read-only native metadata at 2026-10-31T12:27:58Z finds the svc-authelia ConfigMap
|
||||
and Ready Authelia generation 31 / LLDAP generation 9, at the exact image digests
|
||||
used by Coulomb's isolated native reset proof. That proof shows first factor and
|
||||
reset-link verification succeed, but password change returns HTTP 200/KO, leaving
|
||||
the old password valid. The ordinary-user password-manager fixture succeeds;
|
||||
this is not approval for that role or evidence of every privilege boundary.
|
||||
|
||||
Evidence: docs/evidence/2026-10-31-reset-authority/consumer-assessment.json, linked
|
||||
founder receipts and Coulomb native proofs. No production reset, email, directory
|
||||
membership read, credential access or runtime change occurred. Current membership
|
||||
since the dated owner receipt is unknown; no live failed reset is claimed.
|
||||
T05 remains done for its original scope. T10 owns the newly explicit reset return.
|
||||
|
||||
## Restore and verify supported post-split password reset
|
||||
|
||||
```task
|
||||
id: NK-WP-0054-T10
|
||||
status: todo
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0054-T09]
|
||||
```
|
||||
|
||||
Residual of the completed bind split, required by CSOC-WP-0015-T06 and the existing
|
||||
personal password-reset behavior. Review a supported, bounded reset authority or
|
||||
recovery path without restoring the shared human-admin credential. Preparation can
|
||||
start now; a runtime grant/change requires a separate reviewed founder decision.
|
||||
The earlier split approval is not approval to widen svc-authelia's privileges.
|
||||
|
||||
First verify current effective membership through an owner-approved value-free
|
||||
observation. Rehearse the proposed authority on the pinned native images, including
|
||||
ordinary-user password change, privileged-account limits, service interactive-login
|
||||
exclusion, rejected unverified/expired/replayed requests, and unrelated directory
|
||||
write denial. Compare all rights, not only HTTP status. Prepare exact target-bound
|
||||
execution/rollback, custody/declaration updates and the post-change backup/restore
|
||||
check under the existing bind/custody ownership. Do not change the canonical
|
||||
read-only split helper or declaration to imply an unapproved live grant.
|
||||
|
||||
Done when the reviewed path has an attended native return, a fresh reset actually
|
||||
changes the eligible user's password and permits app login, old-password and replay
|
||||
checks refuse, MFA/TLS/directory boundaries are preserved, and the current archived
|
||||
configuration restores the same supported behavior. Retain secret-free evidence
|
||||
and explicit productive verdict; hand the result to CSOC-WP-0015-T06. Existing
|
||||
personal reset acceptance remains historical evidence, not a post-split return.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue