coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Track post-split password reset authority and consumer return
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
tegwick 2026-10-31 13:29:30 +01:00
parent 55fe8303f3
commit 05fa8f67f6
3 changed files with 173 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

60
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -423,3 +423,63 @@ that each row has a holder, a location and a last-proven date.
**Done when:** no row is marked `TO CONFIRM`, the freshness check exists and the first
`admin`-operated drill (NK-WP-0053) has verified the list.
## Assess the post-split password-reset boundary
```task
id: NK-WP-0054-T09
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0054-T05]
```
Completed 2026-10-31 as the consumer-return assessment for CSOC-WP-0015-T06.
T05's completed bind migration and post-split restore drill prove their stated
login/MFA scope. Neither proves a password change through Authelia. The founder
receipt at 2026-10-30T18:53:16Z records svc-authelia in lldap_strict_readonly.
Read-only native metadata at 2026-10-31T12:27:58Z finds the svc-authelia ConfigMap
and Ready Authelia generation 31 / LLDAP generation 9, at the exact image digests
used by Coulomb's isolated native reset proof. That proof shows first factor and
reset-link verification succeed, but password change returns HTTP 200/KO, leaving
the old password valid. The ordinary-user password-manager fixture succeeds;
this is not approval for that role or evidence of every privilege boundary.
Evidence: docs/evidence/2026-10-31-reset-authority/consumer-assessment.json, linked
founder receipts and Coulomb native proofs. No production reset, email, directory
membership read, credential access or runtime change occurred. Current membership
since the dated owner receipt is unknown; no live failed reset is claimed.
T05 remains done for its original scope. T10 owns the newly explicit reset return.
## Restore and verify supported post-split password reset
```task
id: NK-WP-0054-T10
status: todo
priority: high
assignee: codex
depends_on: [NK-WP-0054-T09]
```
Residual of the completed bind split, required by CSOC-WP-0015-T06 and the existing
personal password-reset behavior. Review a supported, bounded reset authority or
recovery path without restoring the shared human-admin credential. Preparation can
start now; a runtime grant/change requires a separate reviewed founder decision.
The earlier split approval is not approval to widen svc-authelia's privileges.
First verify current effective membership through an owner-approved value-free
observation. Rehearse the proposed authority on the pinned native images, including
ordinary-user password change, privileged-account limits, service interactive-login
exclusion, rejected unverified/expired/replayed requests, and unrelated directory
write denial. Compare all rights, not only HTTP status. Prepare exact target-bound
execution/rollback, custody/declaration updates and the post-change backup/restore
check under the existing bind/custody ownership. Do not change the canonical
read-only split helper or declaration to imply an unapproved live grant.
Done when the reviewed path has an attended native return, a fresh reset actually
changes the eligible user's password and permits app login, old-password and replay
checks refuse, MFA/TLS/directory boundaries are preserved, and the current archived
configuration restores the same supported behavior. Retain secret-free evidence
and explicit productive verdict; hand the result to CSOC-WP-0015-T06. Existing
personal reset acceptance remains historical evidence, not a post-split return.