diff --git a/.custodian-brief.md b/.custodian-brief.md index e72e568..68e4d26 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,25 +2,11 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-10-13 21:42 UTC +**Last synced:** 2026-10-14 21:39 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Implement deterministic posture and evidence feedback -Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` - -**Open tasks:** -- ! Obtain audit-core freshness adoption `7d2029d2` - *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)* - -### Publish the NetKingdom emission-cadence security profile -Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` - -**Open tasks:** -- ! Bind and hand off the published contract `e3fbc8b8` - *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)* - ### Reconcile reef placement and security-zone canon dependencies Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` @@ -32,20 +18,34 @@ Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` - ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d` *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)* -### Remove bootstrap secret output and verify separated recovery custody -Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` +### Publish the NetKingdom emission-cadence security profile +Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` **Open tasks:** -- ! Verify owner-approved recovery and current native callers `d68cd4d3` - *(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)* -- ► Reconcile other legacy custody callers and root-output boundaries `479d6970` +- ! Bind and hand off the published contract `e3fbc8b8` + *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)* -### Define an execution-attribution receipt for Railiance runs -Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` +### Implement deterministic posture and evidence feedback +Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` **Open tasks:** -- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` - *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* +- ! Obtain audit-core freshness adoption `7d2029d2` + *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)* + +### Show who a workload sign-in actually is +Progress: 0/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b` + +**Open tasks:** +- ! KeyCape shows the principal before the callback `a78219bb` + *(wait: After T01. key-cape implements the pre-redirect page and the uid log line. NetKingdom does not edit the issuer.)* +- ! Account site shows both sessions `bdc8b414` + *(wait: After T01. user-engine renders the account-site uid and the Authelia uid as two lines. NetKingdom does not edit the account page.)* +- ! Enroll the negative-login factor `afb5816f` + *(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)* +- ! Hand the OpenBao proof back to its owners `86fb4a6b` + *(wait: After T01. ops-mason and railiance-platform own the caller proof and the UI role choice. NetKingdom does not change OpenBao.)* +- · Write the diagnosis contract `c969161a` +- · Preview directory groups for a uid `65f85a11` ### Establish SecurityCaseTypes so that known security cases are light Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` @@ -56,6 +56,13 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` - ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` *(wait: The next types follow once the first one is proven end to end.)* +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* + ### Register Playwright human and agent consumers through governed identity delivery Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` @@ -64,6 +71,14 @@ Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* - ► Deliver custody integration and guarded registration activation `a9dadd07` +### Remove bootstrap secret output and verify separated recovery custody +Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` + +**Open tasks:** +- ! Verify owner-approved recovery and current native callers `d68cd4d3` + *(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)* +- ► Reconcile other legacy custody callers and root-output boundaries `479d6970` + ### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` diff --git a/docs/sign-in-diagnosis.md b/docs/sign-in-diagnosis.md new file mode 100644 index 0000000..0b63c37 --- /dev/null +++ b/docs/sign-in-diagnosis.md @@ -0,0 +1,67 @@ +# Sign-in diagnosis contract + +Status: accepted contract for NK-WP-0051. This document is the only copy of +the field list; other repositories link here instead of restating it. + +## Why + +MASON-WP-0011 took a day because three facts about one login were split +across the account site, Authelia, and OpenBao. OpenBao said only +`claim "groups" does not match any associated bound claim values`. Every +surface below shows the same three facts, named the same way, for **this +authorization request and no earlier one**. + +## Fields + +| Field | Meaning | Source | +| --- | --- | --- | +| `uid` | The uid KeyCape resolved for this request | Authelia `preferred_username` (fallback `sub`), as KeyCape's Authelia adapter resolves it | +| `groups` | Directory group display names, sorted | That uid's LLDAP `memberOf`, reduced to display names | +| `assurance` | `aal2` if this request verified a one-time code, else `aal1` | KeyCape's assurance decision for this request (`MFAVerified`) | +| `client_id` | The relying party the login returns to | The authorization request | +| `openbao_error` | OpenBao's error text, verbatim | ops-mason receipt only | + +`assurance` is per request. A reused session that was `aal2` earlier is +`aal1` here unless this request asked for and verified the one-time code. +Enrolling a factor is not `aal2`. + +## Never shown or logged + +Tokens (ID, access, refresh, OpenBao), authorization codes, email +addresses, one-time passwords or seeds, passwords, session cookies, and raw +`memberOf` DNs. Group display names and the uid are the diagnosis; they are +not secret. + +## Where each field appears + +| Surface | Fields | Owner | Task | +| --- | --- | --- | --- | +| KeyCape page before the redirect to the application. Opt-in per client (registration flag, default off), enabled first for the OpenBao client. One action: continue, plus how to sign in as someone else | `uid`, `groups`, `assurance`, `client_id` | key-cape | NK-WP-0051-T02 | +| The existing KeyCape auth log line | `client_id`, `uid`, `assurance` | key-cape | NK-WP-0051-T02 | +| Account site `users.coulomb.social`: account-site uid and current Authelia uid on two separate lines. Authelia's cookie domain stays `coulomb.social` | `uid` (twice, labelled by session) | user-engine | NK-WP-0051-T03 | +| `lldap_admin.py groups --user ` (read-only preview) | `uid`, `groups` | net-kingdom | NK-WP-0051-T04 | +| ops-mason verifier receipt for an attended `bao login` | `uid`, `openbao_error` (and `assurance` when known) | ops-mason | NK-WP-0051-T06 | + +Matching `groups` to an OpenBao role stays a metadata read in ops-mason. + +## Negative-login fixture + +Fixture uid: `signin-probe-negative`. + +- not a member of `reuse-surface-hub-writers` +- not a platform admin (`net-kingdom-admins`) +- holds a one-time password (enrolled by the founder in NK-WP-0051-T05 at + `https://pink-account.coulomb.social/`, realm `coulomb`) + +The user is never created or described with credentials in git. A +successful diagnosis of this fixture shows `uid=signin-probe-negative`, +groups without `reuse-surface-hub-writers`, `assurance=aal2`, and then the +OpenBao groups refusal. + +## Evidence + +| Item | Value | +| --- | --- | +| key-cape image digest with the page and log line | _pending NK-WP-0051-T02_ | +| user-engine change | _pending NK-WP-0051-T03_ | +| ops-mason / railiance-platform acceptance | _pending NK-WP-0051-T06_ | diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md index b37bb12..3634722 100644 --- a/workplans/NK-WP-0051-sign-in-diagnosis.md +++ b/workplans/NK-WP-0051-sign-in-diagnosis.md @@ -61,7 +61,7 @@ Group display names and the uid are the diagnosis. They are not secret. ```task id: NK-WP-0051-T01 -status: todo +status: done priority: high state_hub_task_id: "c969161a-cf81-57b0-9bbf-12989134e0eb" ```