diff --git a/.custodian-brief.md b/.custodian-brief.md index ea9ccd0..d4811a8 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,43 +2,64 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-10-15 17:24 UTC +**Last synced:** 2026-10-17 02:33 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Implement deterministic posture and evidence feedback -Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` - -**Open tasks:** -- ! Obtain audit-core freshness adoption `7d2029d2` - *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)* - ### Publish the NetKingdom emission-cadence security profile -Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` +Progress: 5/6 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` **Open tasks:** -- ! Bind and hand off the published contract `e3fbc8b8` - *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)* +- ► Bind and hand off the published contract `e3fbc8b8` -### Reconcile reef placement and security-zone canon dependencies -Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` +### Register Playwright human and agent consumers through governed identity delivery +Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` **Open tasks:** -- ! T02 — Extend provider declarations to reefs `5b35b646` - *(wait: Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration.)* -- ! T03 — Reconcile reef ceilings mechanically `e3f0bb0f` - *(wait: Mechanical join of reef ceilings to consumer V declarations waits on T02.)* -- ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d` - *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)* +- ! Verify issuer and real consumer acceptance `5a3aaf57` + *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* +- ► Deliver custody integration and guarded registration activation `a9dadd07` ### Remove bootstrap secret output and verify separated recovery custody -Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` +Progress: 26/38 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` **Open tasks:** -- ! Verify owner-approved recovery and current native callers `d68cd4d3` - *(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)* -- ► Reconcile other legacy custody callers and root-output boundaries `479d6970` +- ! Accept remaining recovery and caller evidence and close the G08 handoff `d68cd4d3` + *(wait: Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete.)* +- ! Resolve historical credential and configuration-preserving rotation dispositions `3ea6bf00` + *(wait: Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged.)* +- ! Verify current caller and provider admission at their actual boundaries `77aa42be` + *(wait: Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers.)* +- ! Prove retained privacyIDEA token decryption and existing-token MFA `6f8af1a7` + *(wait: LLDAP T16, token-material T31 and audit T20 passed; await the exact isolated MFA adapter and owner-selected retained-token/factor inputs.)* +- ! Prove restored KeyCape issuer, policy and consumer continuity `141dd773` + *(wait: Source and synthetic KeyCape lifecycle proof are delivered in T32; await exact owner-held recovery attempt preparation T33, selected consumer acceptance and retained-token MFA for the selected flow.)* +- ! Prove restored Authelia storage and OIDC continuity `b47f9975` + *(wait: LLDAP recovery T16 passed; await the exact isolated Authelia adapter/procedure and private authentication-flow inputs from T15.)* +- ! Prepare the exact owner-held KeyCape recovery attempt `56c8d469` + *(wait: Source custody/preflight preparation is evidenced in T34; await original TLS/trust recovery disposition T35 and selected original registration/private-admission metadata T36 before final reviewed command and existing owner process.)* +- … and 5 more open tasks + +### Establish SecurityCaseTypes so that known security cases are light +Progress: 17/23 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` + +**Open tasks:** +- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` + *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* +- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` + *(wait: The next types follow once the first one is proven end to end.)* +- ► T14 — Admit governed group rollback against native owner boundaries `fce95440` +- · T12 — Prepare NetKingdom-owned attended step adapters `7ce4eee3` +- · T15 — Define authenticated recovery for lost registration process state `1b825705` +- · T16 — Select and review the actual machine descriptor composition `200bf500` + +### Define an execution-attribution receipt for Railiance runs +Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` + +**Open tasks:** +- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` + *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* ### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` @@ -60,37 +81,6 @@ Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* - … and 1 more open tasks -### Establish SecurityCaseTypes so that known security cases are light -Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` - -**Open tasks:** -- ! T05 — Acknowledge the type through informed-decision `d9b26bcf` - *(wait: Type1.2 architecture has a confirmed source-only founder acknowledgment; canonical1.1 remains unchanged/default and the1.2 reference case stays proposed. Needs explicit version selection/reference-source integration without normal admission bypass, closed owner adapters plus global/native receipt verifier (WARDEN-WP-0044-T03), independently verified six-object structural materialization and CCR42 claims/created-only provenance, exact broker/case/source reconciliation, then separately authorized native mint/delivery and attended registry/consumer verification. Source acknowledgment, a bundle or local tests do not prove implemented/materialized/live status.)* -- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` - *(wait: The next types follow once the first one is proven end to end.)* - -### Register Playwright human and agent consumers through governed identity delivery -Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` - -**Open tasks:** -- ! Verify issuer and real consumer acceptance `5a3aaf57` - *(wait: Await owner-scoped registry/custody activation, native cluster authentication and individual transport, then real human and agent acceptance under CUST-WP-0080-T05.)* -- ► Deliver custody integration and guarded registration activation `a9dadd07` - -### Define an execution-attribution receipt for Railiance runs -Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` - -**Open tasks:** -- ! Agree the evidence holder and schema with audit-core and Railiance `963120c1` - *(wait: Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance.)* - -### Cut over NetKingdom identity to railiance01 and retire CoulombCore -Progress: 7/8 done | workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da` - -**Open tasks:** -- ! T08 - Final deletion and closure `42a3b4c0` - *(wait: Founder 2026-10-11: coulombcore is retired and the machine reused (D4 batch approved). Order: host-side inventory (containers, on-disk manifests; no kube API, certs expired 2026-08-31), then stop k3s for good and wipe for reuse. Executes after Sol's passing railiance01 restore/restart drill receipt. Never rotate certs or restart k3s there first.)* - --- ## MCP Orientation (when available) diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 420eeec..246b63a 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -761,6 +761,7 @@ of these native custody, authorization, owner-acceptance or production claims. ```task id: NK-WP-0048-T15 status: todo +depends_on: [NK-WP-0048-T31] priority: high state_hub_task_id: "1b825705-4848-5edc-832f-b1622cd9bdb7" ``` @@ -807,6 +808,7 @@ authenticated original-attempt holder. ```task id: NK-WP-0048-T16 status: todo +depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29, NK-WP-0048-T30] priority: high state_hub_task_id: "200bf500-5084-5ae7-be26-3033fe1f296e" ``` @@ -1236,3 +1238,138 @@ acceptance was delivered. T14 retains these live gates with its original UUID and progress status. This completed review adds no duplicate T21 acceptance credit; publication, task UUID allocation and projection remain coordinator follow-through and no UUID is hand-assigned here. + +## T24 — Ensure-groups adapter source candidate + +```task +id: NK-WP-0048-T24 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind group creation to T14's journal/provenance seam; refuse without trusted journal callbacks. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. NetKingdom (directory) owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T25 — Mint-secret adapter source candidate + +```task +id: NK-WP-0048-T25 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned custody evidence seam: the adapter records value-free mint evidence only and never handles secret values. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. Platform owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T26 — Deliver-secret adapter source candidate + +```task +id: NK-WP-0048-T26 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Platform-owned delivery evidence seam (ESO/custody), value-free. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. Platform owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T27 — Bind-env adapter source candidate + +```task +id: NK-WP-0048-T27 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Bind the issuer Deployment env reference to the delivered secret reference, without values. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. NetKingdom runtime owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T28 — Deliver-consumer-secret adapter source candidate + +```task +id: NK-WP-0048-T28 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Consumer-side delivery evidence seam, value-free. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. Platform and Apps owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T29 — Hand-over adapter source candidate + +```task +id: NK-WP-0048-T29 +status: todo +priority: high +``` + +Split from T16 on 2026-10-17 so each candidate fits one per-task budget. Apps-owned consumer verification and hand-over receipt seam. +Source candidate only, modelled on the T13 registration adapter +(`sso-mfa/k8s/keycape/keycape-registration-adapter.py`, its tests and +`registration-adapter.md`). Requires positive and refusal fixtures and +created-only rollback. Keeps canonical 1.1 as the default and uses no +`--allow-unimplemented` admission. Done means the candidate and its tests are +committed. Apps owner source review before pinning, and any native action, +stay separate gates and are not supplied by this task. + +## T30 — Compose the descriptor set over the reviewed candidates + +```task +id: NK-WP-0048-T30 +status: todo +depends_on: [NK-WP-0048-T24, NK-WP-0048-T25, NK-WP-0048-T26, NK-WP-0048-T27, NK-WP-0048-T28, NK-WP-0048-T29] +priority: high +``` + +Split from T16 on 2026-10-17. Compose the seven-step source 1.2 descriptor set +through the existing explicit version-root selection over T13 and T24–T29. No +partial descriptor map, canonical 1.1 stays the default, and new descriptor bytes +need a reviewed successor revision under canon section 6. Owner review and +admission remain T16's. + +## T31 — Restart and lost-receipt fixtures against Warden's original-intent interface + +```task +id: NK-WP-0048-T31 +status: todo +priority: high +``` + +Split from T15 on 2026-10-17. ops-warden published the original-intent +lookup/context interface in `src/warden/case_run.py` (`OriginalIntent`, +`Journal.original_intent`, `Adapter.reconcile_original`; commit `a45cf47`). +Build T15's restart/lost-receipt fixtures for the registration adapter against +it: the original intent is kept separate from the reconcile attempt; wrong +attempt/case/source/principal and unavailable-holder cases refuse; and a missing +or ambiguous record stays uncertain, with no add replay or undo. The interface +is Warden's own dispatch record, not owner-authenticated created-only provenance. +Selecting the actual authenticated holder stays a T15 owner gate.