coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Write the sign-in diagnosis contract (NK-WP-0051-T01).

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-14 23:40:25 +02:00
parent 8f0a590200
commit 106d97f4a8
3 changed files with 107 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

63
.custodian-brief.md
View file

@ -2,25 +2,11 @@
# Custodian Brief — net-kingdom
**Domain:** infotech
**Last synced:** 2026-10-13 21:42 UTC
**Last synced:** 2026-10-14 21:39 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
### Implement deterministic posture and evidence feedback
Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
**Open tasks:**
- ! Obtain audit-core freshness adoption `7d2029d2`
*(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
### Publish the NetKingdom emission-cadence security profile
Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
**Open tasks:**
- ! Bind and hand off the published contract `e3fbc8b8`
*(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
### Reconcile reef placement and security-zone canon dependencies
Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
@ -32,20 +18,34 @@ Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
- ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d`
*(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)*
### Remove bootstrap secret output and verify separated recovery custody
Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
### Publish the NetKingdom emission-cadence security profile
Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
**Open tasks:**
- ! Verify owner-approved recovery and current native callers `d68cd4d3`
*(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)*
- ► Reconcile other legacy custody callers and root-output boundaries `479d6970`
- ! Bind and hand off the published contract `e3fbc8b8`
*(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
### Define an execution-attribution receipt for Railiance runs
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
### Implement deterministic posture and evidence feedback
Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
**Open tasks:**
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
- ! Obtain audit-core freshness adoption `7d2029d2`
*(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
### Show who a workload sign-in actually is
Progress: 0/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
**Open tasks:**
- ! KeyCape shows the principal before the callback `a78219bb`
*(wait: After T01. key-cape implements the pre-redirect page and the uid log line. NetKingdom does not edit the issuer.)*
- ! Account site shows both sessions `bdc8b414`
*(wait: After T01. user-engine renders the account-site uid and the Authelia uid as two lines. NetKingdom does not edit the account page.)*
- ! Enroll the negative-login factor `afb5816f`
*(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)*
- ! Hand the OpenBao proof back to its owners `86fb4a6b`
*(wait: After T01. ops-mason and railiance-platform own the caller proof and the UI role choice. NetKingdom does not change OpenBao.)*
- · Write the diagnosis contract `c969161a`
- · Preview directory groups for a uid `65f85a11`
### Establish SecurityCaseTypes so that known security cases are light
Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
@ -56,6 +56,13 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
*(wait: The next types follow once the first one is proven end to end.)*
### Define an execution-attribution receipt for Railiance runs
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
**Open tasks:**
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
### Register Playwright human and agent consumers through governed identity delivery
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
@ -64,6 +71,14 @@ Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
- ► Deliver custody integration and guarded registration activation `a9dadd07`
### Remove bootstrap secret output and verify separated recovery custody
Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
**Open tasks:**
- ! Verify owner-approved recovery and current native callers `d68cd4d3`
*(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)*
- ► Reconcile other legacy custody callers and root-output boundaries `479d6970`
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`

67
docs/sign-in-diagnosis.md Normal file
View file

@ -0,0 +1,67 @@
# Sign-in diagnosis contract
Status: accepted contract for NK-WP-0051. This document is the only copy of
the field list; other repositories link here instead of restating it.
## Why
MASON-WP-0011 took a day because three facts about one login were split
across the account site, Authelia, and OpenBao. OpenBao said only
`claim "groups" does not match any associated bound claim values`. Every
surface below shows the same three facts, named the same way, for **this
authorization request and no earlier one**.
## Fields
| Field | Meaning | Source |
| --- | --- | --- |
| `uid` | The uid KeyCape resolved for this request | Authelia `preferred_username` (fallback `sub`), as KeyCape's Authelia adapter resolves it |
| `groups` | Directory group display names, sorted | That uid's LLDAP `memberOf`, reduced to display names |
| `assurance` | `aal2` if this request verified a one-time code, else `aal1` | KeyCape's assurance decision for this request (`MFAVerified`) |
| `client_id` | The relying party the login returns to | The authorization request |
| `openbao_error` | OpenBao's error text, verbatim | ops-mason receipt only |
`assurance` is per request. A reused session that was `aal2` earlier is
`aal1` here unless this request asked for and verified the one-time code.
Enrolling a factor is not `aal2`.
## Never shown or logged
Tokens (ID, access, refresh, OpenBao), authorization codes, email
addresses, one-time passwords or seeds, passwords, session cookies, and raw
`memberOf` DNs. Group display names and the uid are the diagnosis; they are
not secret.
## Where each field appears
| Surface | Fields | Owner | Task |
| --- | --- | --- | --- |
| KeyCape page before the redirect to the application. Opt-in per client (registration flag, default off), enabled first for the OpenBao client. One action: continue, plus how to sign in as someone else | `uid`, `groups`, `assurance`, `client_id` | key-cape | NK-WP-0051-T02 |
| The existing KeyCape auth log line | `client_id`, `uid`, `assurance` | key-cape | NK-WP-0051-T02 |
| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session) | user-engine | NK-WP-0051-T03 |
| `lldap_admin.py groups --user <uid>` (read-only preview) | `uid`, `groups` | net-kingdom | NK-WP-0051-T04 |
| ops-mason verifier receipt for an attended `bao login` | `uid`, `openbao_error` (and `assurance` when known) | ops-mason | NK-WP-0051-T06 |
Matching `groups` to an OpenBao role stays a metadata read in ops-mason.
## Negative-login fixture
Fixture uid: `signin-probe-negative`.
- not a member of `reuse-surface-hub-writers`
- not a platform admin (`net-kingdom-admins`)
- holds a one-time password (enrolled by the founder in NK-WP-0051-T05 at
`https://pink-account.coulomb.social/`, realm `coulomb`)
The user is never created or described with credentials in git. A
successful diagnosis of this fixture shows `uid=signin-probe-negative`,
groups without `reuse-surface-hub-writers`, `assurance=aal2`, and then the
OpenBao groups refusal.
## Evidence
| Item | Value |
| --- | --- |
| key-cape image digest with the page and log line | _pending NK-WP-0051-T02_ |
| user-engine change | _pending NK-WP-0051-T03_ |
| ops-mason / railiance-platform acceptance | _pending NK-WP-0051-T06_ |

2
workplans/NK-WP-0051-sign-in-diagnosis.md
View file

@ -61,7 +61,7 @@ Group display names and the uid are the diagnosis. They are not secret.
```task
id: NK-WP-0051-T01
status: todo
status: done
priority: high
state_hub_task_id: "c969161a-cf81-57b0-9bbf-12989134e0eb"
```