coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy identity drift reconciliation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-29 23:41:42 +02:00
parent 1d24d671bc
commit 12ac63f32c
4 changed files with 36 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -41,7 +41,7 @@ now so later enterprise directories do not require a domain rewrite.
```task
id: NK-WP-0023-T02
status: progress
status: done
priority: high
state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350"
```
@ -61,6 +61,16 @@ only user-engine to call it and only LLDAP/DNS egress. A live create/replay/dele
conformance run returned `resumed: false`, then `resumed: true`, and removed the
disposable subject. Reconciliation, compensation, and drift reporting remain.
2026-07-29 completion: image `identity-provisioner:12cdef5` adds read-only
drift inspection, active convergence of adapter-owned tenant groups and
suspension state, replay-safe deprovisioning, and best-effort compensation
when initial group projection fails. User-engine exposes these operations
through its provider-neutral port and retries one transient failure only under
the mandatory idempotency key. A disposable live probe proved clean initial
state, detected induced suspension drift, reported both the unexpected group
and status mismatch, removed the drift, returned to `in_sync`, deprovisioned,
and accepted the repeated deletion. The probe identity was removed.
## T03 - Integrate KeyCape login, claims, and MFA handoffs
```task
@ -188,6 +198,11 @@ passed. The test also detected and corrected newline handling for mounted
Kubernetes secrets before any identity was created. The broader negative,
outage, suspension, restore, and browser/MFA matrix remains.
2026-07-29 increment: provider-path conformance now also covers
machine-readable drift detection, automated repair, compensation semantics,
transient retry, and replay-safe deletion. The broader browser, authorization,
provider-outage, and restore matrix remains open.
## T07 - Complete KEY-WP-0004 through the reusable portal
```task