From 1b6975919005bd680d89cfff1ff00b707ffa9502 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 3 Oct 2026 22:21:37 +0200 Subject: [PATCH] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-10-03: - update .custodian-brief.md for net-kingdom Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29 --- .custodian-brief.md | 45 ++++++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index f49f80a..c198857 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,48 +2,55 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-10-03 20:00 UTC +**Last synced:** 2026-10-03 20:21 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker -Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` - -**Open tasks:** -- · Admit the database consumer `2fe6f100` -- · Package the broker deployment `32d1411b` -- · Integrate an upstream identity provider `6697a994` -- · Define federated assurance `d845380d` -- · Verify IAM conformance and coexistence `9cb7fd93` -- · Enforce tenant and platform boundaries `38998c68` -- · Prove recovery and audit delivery `e5f44ddc` -- … and 1 more open tasks - ### Implement deterministic posture and evidence feedback Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` **Open tasks:** - ! Obtain audit-core freshness adoption `7d2029d2` - *(wait: audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose.)* + *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)* ### Publish the NetKingdom emission-cadence security profile Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` **Open tasks:** - ! Bind and hand off the published contract `e3fbc8b8` - *(wait: Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft.)* + *(wait: InfoTechCanon publication is delivered and bound. Waiting on Approval Engine/Qonto owner envelope migration, local-identity incompatibility disposition, actual audit-core observer evidence and Kings Guard handoff.)* ### Reconcile reef placement and security-zone canon dependencies Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` **Open tasks:** - ! T02 — Extend provider declarations to reefs `5b35b646` - *(wait: Proposal to repo-manager: extend Decision 5.5 provider declaration to substrate providers.)* + *(wait: Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.)* - ! T03 — Reconcile reef ceilings mechanically `e3f0bb0f` *(wait: Mechanical join of reef ceilings to consumer V declarations waits on T02.)* - ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d` - *(wait: DataClassification vocabulary mismatch between rapp-policy-nexus (public) and ops-warden dataclass_floor must be resolved with those owners.)* + *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)* + +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` + +**Open tasks:** +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks ### Let workloads require MFA for all or part of their features Progress: 1/2 done | workplan_id: `3f702215-704b-5788-8ca0-b8b9ba2dd3f8` @@ -64,7 +71,7 @@ Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` **Open tasks:** - ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` - *(wait: Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated.)* + *(wait: Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence.)* --- ## MCP Orientation (when available)