build: keep generated orientation brief local and untracked
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
parent
bde143e030
commit
1bd869c7a6
3 changed files with 11 additions and 91 deletions
|
|
@ -1,91 +0,0 @@
|
||||||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
|
||||||
# Custodian Brief — net-kingdom
|
|
||||||
|
|
||||||
**Domain:** infotech
|
|
||||||
**Last synced:** 2026-10-17 09:16 UTC
|
|
||||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
|
||||||
|
|
||||||
## Active Workstreams
|
|
||||||
|
|
||||||
### Publish the NetKingdom emission-cadence security profile
|
|
||||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
|
||||||
|
|
||||||
### Register Playwright human and agent consumers through governed identity delivery
|
|
||||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
|
||||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
|
||||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
|
||||||
|
|
||||||
### Remove bootstrap secret output and verify separated recovery custody
|
|
||||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
|
||||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
|
||||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
|
||||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
|
||||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
|
||||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
|
||||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
|
||||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
|
||||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
|
||||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
|
||||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
|
||||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
|
||||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
|
||||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
|
||||||
- … and 5 more open tasks
|
|
||||||
|
|
||||||
### Establish SecurityCaseTypes so that known security cases are light
|
|
||||||
Progress: 25/31 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
|
||||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
|
||||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
|
||||||
*(wait: The next types follow once the first one is proven end to end.)*
|
|
||||||
- ! T15 — Define authenticated recovery for lost registration process state `1b825705`
|
|
||||||
*(wait: Source candidate 061461e is merged. Waiting on the owner to select the real authenticated original-attempt holder and native readback, and on independent re-review of the changed T13 adapter source.)*
|
|
||||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
|
||||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
|
||||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
|
||||||
|
|
||||||
### Define an execution-attribution receipt for Railiance runs
|
|
||||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
|
||||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
|
||||||
|
|
||||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
|
||||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
|
||||||
|
|
||||||
**Open tasks:**
|
|
||||||
- ! Admit the database consumer `2fe6f100`
|
|
||||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
|
||||||
- ! Package the broker deployment `32d1411b`
|
|
||||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
|
||||||
- ! Integrate an upstream identity provider `6697a994`
|
|
||||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
|
||||||
- ! Define federated assurance `d845380d`
|
|
||||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
|
||||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
|
||||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
|
||||||
- ! Enforce tenant and platform boundaries `38998c68`
|
|
||||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
|
||||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
|
||||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
|
||||||
- … and 1 more open tasks
|
|
||||||
|
|
||||||
---
|
|
||||||
## MCP Orientation (when available)
|
|
||||||
|
|
||||||
If the state-hub MCP server is reachable, call:
|
|
||||||
`get_domain_summary("infotech")`
|
|
||||||
This provides richer cross-domain context.
|
|
||||||
If the MCP call fails, use this file as your orientation source.
|
|
||||||
3
.gitignore
vendored
3
.gitignore
vendored
|
|
@ -189,3 +189,6 @@ cython_debug/
|
||||||
|
|
||||||
# Patch backups written by scripts/patch-*.py — git history is the real backup
|
# Patch backups written by scripts/patch-*.py — git history is the real backup
|
||||||
*.bak-*
|
*.bak-*
|
||||||
|
|
||||||
|
# Generated workstation orientation; keep local, regenerate from State Hub.
|
||||||
|
/.custodian-brief.md
|
||||||
|
|
|
||||||
8
SCOPE.md
8
SCOPE.md
|
|
@ -254,3 +254,11 @@ unstaged authored work and refuse receiver conflicts or alternate-index writes.
|
||||||
Only the local receiver is staged; sibling sources and runtime registries are
|
Only the local receiver is staged; sibling sources and runtime registries are
|
||||||
untouched. Missing owner source checkouts fail closed. Multi-owner binding
|
untouched. Missing owner source checkouts fail closed. Multi-owner binding
|
||||||
publication and actual receiver activation retain their existing owner gates.
|
publication and actual receiver activation retain their existing owner gates.
|
||||||
|
|
||||||
|
|
||||||
|
## Local orientation brief
|
||||||
|
|
||||||
|
`.custodian-brief.md` is a generated local orientation snapshot. It remains on
|
||||||
|
disk for offline use and is root-ignored rather than versioned. Regenerate it
|
||||||
|
with the State Hub brief renderer; workplans and other authored repository
|
||||||
|
records remain authoritative. Brief refreshes must not create Git commits.
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue