coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T02: keep authentication-policy-rollout for greenfield/recovery activation

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
This commit is contained in:
tegwick 2026-10-23 00:18:06 +02:00
parent dfe5a5ed28
commit 21ce056221
2 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json
View file

@ -8,7 +8,7 @@
"pending_columns": [],
"summary": {
"current": 59,
"retire-candidate": 1,
"owner-deferred (greenfield/initial activation only)": 1,
"retired": 11,
"owner-deferred (greenfield bootstrap only)": 3,
"current, superseded on 1.3 admission": 1,
@ -467,10 +467,10 @@
"owner": "net-kingdom",
"credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)",
"consumers": "none after initial activation; later changes use the authenticated policy journey",
"native_evidence": "one-shot migration of two baseline registrations, completed",
"next_task": "NK-WP-0049-T22: convert to refusing entry point",
"native_evidence": "initial activation of the two baseline registrations; later changes use the authenticated policy journey; covered by test_authentication_policy_rollout.py",
"next_task": "none on the current estate; retained for greenfield/recovery rebuild of the issuer",
"documented_in": [],
"disposition": "retire-candidate"
"disposition": "owner-deferred (greenfield/initial activation only)"
},
{
"path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh",

6
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -404,9 +404,9 @@ the next task for all entries, and route checks to T21 and T22.
2026-10-23 slices 2 and 3 are complete. T02 is **done**. Every one of the 93
entries now records a disposition, owner, credential route, consumers, evidence
and next task: 59 current, 12 current diagnostic, 7 current
recovery/internal/repair, 11 retired, 3 owner-deferred greenfield bootstrap, 1
retire-candidate (`authentication-policy-rollout.py`, a completed one-shot that
should become a refusing entry point under T22), and 1 superseded once
recovery/internal/repair, 11 retired, 4 owner-deferred greenfield/initial
activation (including `authentication-policy-rollout.py`, retained because a
recovery rebuild of the issuer needs its initial activation again), and 1 superseded once
NK-WP-0048 admits 1.3 (`vergabe-client-rollout.py`). The 5 drifted entries are
attributed to their reviewed commits. Historical objects: `sso/keycape-pi-token`
and `mfa/privacyidea-trigger-admin` are retired in source (no current reader),