NK-WP-0048: split T16 into T24-T30 and T15 fixtures into T31
Each adapter candidate fits one per-task budget; T31 builds on Warden's original-intent interface (ops-warden a45cf47). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 903097@bnt-lap001 Assistant-Session: aa320c8f-c3fa-46e7-8541-0b58e1e45d23
This commit is contained in:
parent
503a4f6175
commit
2019e823f0
2 changed files with 181 additions and 54 deletions
|
|
@ -2,43 +2,64 @@
|
|||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-15 17:24 UTC
|
||||
**Last synced:** 2026-10-17 02:33 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Implement deterministic posture and evidence feedback
|
||||
Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Obtain audit-core freshness adoption `7d2029d2`
|
||||
*(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Bind and hand off the published contract `e3fbc8b8`
|
||||
*(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
|
||||
- ► Bind and hand off the published contract `e3fbc8b8`
|
||||
|
||||
### Reconcile reef placement and security-zone canon dependencies
|
||||
Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T02 — Extend provider declarations to reefs `5b35b646`
|
||||
*(wait: Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.)*
|
||||
- ! T03 — Reconcile reef ceilings mechanically `e3f0bb0f`
|
||||
*(wait: Mechanical join of reef ceilings to consumer V declarations waits on T02.)*
|
||||
- ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d`
|
||||
*(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)*
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Remove bootstrap secret output and verify separated recovery custody
|
||||
Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify owner-approved recovery and current native callers `d68cd4d3`
|
||||
*(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)*
|
||||
- ► Reconcile other legacy custody callers and root-output boundaries `479d6970`
|
||||
- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3`
|
||||
*(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)*
|
||||
- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00`
|
||||
*(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)*
|
||||
- ! Verify current caller and provider admission at their actual boundaries `77aa42be`
|
||||
*(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)*
|
||||
- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7`
|
||||
*(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)*
|
||||
- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773`
|
||||
*(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)*
|
||||
- ! Prove restored Authelia storage and OIDC continuity `b47f9975`
|
||||
*(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)*
|
||||
- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469`
|
||||
*(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)*
|
||||
- … and 5 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 17/23 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
- ► T14 — Admit governed group rollback against native owner boundaries `fce95440`
|
||||
- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3`
|
||||
- · T15 — Define authenticated recovery for lost registration process state `1b825705`
|
||||
- · T16 — Select and review the actual machine descriptor composition `200bf500`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
|
@ -60,37 +81,6 @@ Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
|||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Acknowledge the type through informed-decision `d9b26bcf`
|
||||
*(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)*
|
||||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
|
||||
### Register Playwright human and agent consumers through governed identity delivery
|
||||
Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Verify issuer and real consumer acceptance `5a3aaf57`
|
||||
*(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)*
|
||||
- ► Deliver custody integration and guarded registration activation `a9dadd07`
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1`
|
||||
*(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)*
|
||||
|
||||
### Cut over NetKingdom identity to railiance01 and retire CoulombCore
|
||||
Progress: 7/8 done | workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T08 - Final deletion and closure `42a3b4c0`
|
||||
*(wait: Founder 2026-10-11: coulombcore is retired and the machine reused (D4 batch approved). Order: host-side inventory (containers, on-disk manifests; no kube API, certs expired 2026-08-31), then stop k3s for good and wipe for reuse. Executes after Sol's passing railiance01 restore/restart drill receipt. Never rotate certs or restart k3s there first.)*
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
|
|
|
|||
|
|
@ -761,6 +761,7 @@ of these native custody, authorization, owner-acceptance or production claims.
|
|||
```task
|
||||
id: NK-WP-0048-T15
|
||||
status: todo
|
||||
depends_on: [NK-WP-0048-T31]
|
||||
priority: high
|
||||
state_hub_task_id: "1b825705-4848-5edc-832f-b1622cd9bdb7"
|
||||
```
|
||||
|
|
@ -807,6 +808,7 @@ authenticated original-attempt holder.
|
|||
```task
|
||||
id: NK-WP-0048-T16
|
||||
status: todo
|
||||
depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29, NK-WP-0048-T30]
|
||||
priority: high
|
||||
state_hub_task_id: "200bf500-5084-5ae7-be26-3033fe1f296e"
|
||||
```
|
||||
|
|
@ -1236,3 +1238,138 @@ acceptance was delivered. T14 retains these live gates with its original UUID
|
|||
and progress status. This completed review adds no duplicate T21 acceptance
|
||||
credit; publication, task UUID allocation and projection remain coordinator
|
||||
follow-through and no UUID is hand-assigned here.
|
||||
|
||||
## T24 — Ensure-groups adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T24
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind group creation to T14's journal/provenance seam; refuse without trusted journal callbacks.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. NetKingdom (directory) owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T25 — Mint-secret adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T25
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned custody evidence seam: the adapter records value-free mint evidence only and never handles secret values.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. Platform owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T26 — Deliver-secret adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T26
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned delivery evidence seam (ESO/custody), value-free.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. Platform owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T27 — Bind-env adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T27
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind the issuer Deployment env reference to the delivered secret reference, without values.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. NetKingdom runtime owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T28 — Deliver-consumer-secret adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T28
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Consumer-side delivery evidence seam, value-free.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. Platform and Apps owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T29 — Hand-over adapter source candidate
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T29
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Apps-owned consumer verification and hand-over receipt seam.
|
||||
Source candidate only, modelled on the T13 registration adapter
|
||||
(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and
|
||||
`registration-adapter.md`). Requires positive and refusal fixtures and
|
||||
created-only rollback. Keeps canonical 1.1 as the default and uses no
|
||||
`--allow-unimplemented` admission. Done means the candidate and its tests are
|
||||
committed. Apps owner source review before pinning, and any native action,
|
||||
stay separate gates and are not supplied by this task.
|
||||
|
||||
## T30 — Compose the descriptor set over the reviewed candidates
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T30
|
||||
status: todo
|
||||
depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29]
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T16 on 2026-10-17. Compose the seven-step source 1.2 descriptor set
|
||||
through the existing explicit version-root selection over T13 and T24–T29. No
|
||||
partial descriptor map, canonical 1.1 stays the default, and new descriptor bytes
|
||||
need a reviewed successor revision under canon section 6. Owner review and
|
||||
admission remain T16's.
|
||||
|
||||
## T31 — Restart and lost-receipt fixtures against Warden's original-intent interface
|
||||
|
||||
```task
|
||||
id: NK-WP-0048-T31
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Split from T15 on 2026-10-17. ops-warden published the original-intent
|
||||
lookup/context interface in `src/warden/case_run.py` (`OriginalIntent`,
|
||||
`Journal.original_intent`, `Adapter.reconcile_original`; commit `a45cf47`).
|
||||
Build T15's restart/lost-receipt fixtures for the registration adapter against
|
||||
it: the original intent is kept separate from the reconcile attempt; wrong
|
||||
attempt/case/source/principal and unavailable-holder cases refuse; and a missing
|
||||
or ambiguous record stays uncertain, with no add replay or undo. The interface
|
||||
is Warden's own dispatch record, not owner-authenticated created-only provenance.
|
||||
Selecting the actual authenticated holder stays a T15 owner gate.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue