fix(workplans): normalize legacy task identifiers
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
parent
429c91b3a2
commit
25ed9281bb
4 changed files with 19 additions and 19 deletions
|
|
@ -547,6 +547,6 @@ an explicit check:
|
|||
- Which tenant metadata is required before a service can register
|
||||
resources with flex-auth?
|
||||
- What precise per-tenant trigger and dual-issuer coexistence rule should
|
||||
NK-WP-0011-T1 use for Keycloak expanded mode?
|
||||
NK-WP-0011-T01 use for Keycloak expanded mode?
|
||||
- Does Topaz run centrally for the platform, per tenant, or per service
|
||||
for the first production deployment?
|
||||
|
|
|
|||
|
|
@ -66,7 +66,7 @@ Out of scope:
|
|||
## Tasks
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T1
|
||||
id: NK-WP-0009-T01
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "79150b07-f25d-4407-a118-e08b6e588d37"
|
||||
|
|
@ -77,7 +77,7 @@ commands, manifests, verification, rollback, threat checks, and
|
|||
cross-repo ownership notes.
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T2
|
||||
id: NK-WP-0009-T02
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "07647ba6-90e1-4569-947a-ebccce7a2d5e"
|
||||
|
|
@ -89,7 +89,7 @@ flex-auth authorization, object-store STS exchange, and SDK consumer
|
|||
configuration.
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T3
|
||||
id: NK-WP-0009-T03
|
||||
status: todo
|
||||
priority: high
|
||||
state_hub_task_id: "0f34eda3-f1f3-4c49-9eba-36167b6c5ea9"
|
||||
|
|
@ -101,7 +101,7 @@ Platform workplan and covering auth methods, secret engines, CSI/ESO
|
|||
integration, leases, unseal, backup, and break-glass.
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T4
|
||||
id: NK-WP-0009-T04
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "3c17d1ac-3232-43b4-b541-ea6538da2afb"
|
||||
|
|
@ -112,7 +112,7 @@ automations", using ops-warden and ops-bridge as the reference
|
|||
implementation.
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T5
|
||||
id: NK-WP-0009-T05
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "aff82173-0b8e-4216-855a-887ac68b63e0"
|
||||
|
|
@ -123,7 +123,7 @@ manifests, action vocabulary, claim envelopes, policy packages,
|
|||
decision envelopes, and delegated PDP options.
|
||||
|
||||
```task
|
||||
id: NK-WP-0009-T6
|
||||
id: NK-WP-0009-T06
|
||||
status: todo
|
||||
priority: medium
|
||||
state_hub_task_id: "df427aa3-233f-4479-aed9-706676f8e87d"
|
||||
|
|
|
|||
|
|
@ -113,7 +113,7 @@ Out of scope:
|
|||
## Tasks
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T1
|
||||
id: NK-WP-0011-T01
|
||||
state_hub_task_id: 934f9223-2b6f-4d01-b49b-406b5b98b6e4
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -129,7 +129,7 @@ still target one IAM Profile contract; and the canonical hostname/issuer
|
|||
for the broker. Resolve or supersede D2 from NK-WP-0001.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T2
|
||||
id: NK-WP-0011-T02
|
||||
state_hub_task_id: 7b514cda-41b3-492f-8731-5a131422059d
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -142,7 +142,7 @@ Secret. Confirm the existing backup schedule covers the new database and
|
|||
run a restore drill for `keycloak_db` specifically.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T3
|
||||
id: NK-WP-0011-T03
|
||||
state_hub_task_id: 8c29602e-ab9b-446a-8fee-5e2d8fbcb100
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -157,7 +157,7 @@ strictness + proxy headers configured for Traefik. Realm import is
|
|||
GitOps-friendly (realm JSON/CR in git).
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T4
|
||||
id: NK-WP-0011-T04
|
||||
state_hub_task_id: d62d7683-24b1-458c-9fd6-96e576b52a64
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -171,7 +171,7 @@ attribute/claim mappers and group→role mapping. Verify a federated login
|
|||
end-to-end for at least the Entra ID path.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T5
|
||||
id: NK-WP-0011-T05
|
||||
state_hub_task_id: 85319768-5d81-460d-89dc-8de76b63e0dc
|
||||
status: todo
|
||||
priority: medium
|
||||
|
|
@ -186,7 +186,7 @@ platform-root-sensitive clients. Ensure assurance evidence is carried in
|
|||
the IAM Profile token so flex-auth can gate privileged actions on it.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T6
|
||||
id: NK-WP-0011-T06
|
||||
state_hub_task_id: 53801dc2-7bdb-4fa3-9fa0-c1450ef1003b
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -201,7 +201,7 @@ Keycloak issuer per the T1 selection rule. Use the canonical
|
|||
`tools/iam-profile-conformance/`. Document per-tenant issuer selection.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T7
|
||||
id: NK-WP-0011-T07
|
||||
state_hub_task_id: 981f79bd-63ee-4da0-8d7d-9af8e468715e
|
||||
status: todo
|
||||
priority: high
|
||||
|
|
@ -216,7 +216,7 @@ Topaz remains the PDP; if a Keycloak Authorization Services adapter is
|
|||
used at all, document it as a delegated, non-canonical adapter.
|
||||
|
||||
```task
|
||||
id: NK-WP-0011-T8
|
||||
id: NK-WP-0011-T08
|
||||
state_hub_task_id: 13634760-7817-40c0-b7db-5e0f4196dbf0
|
||||
status: todo
|
||||
priority: medium
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ coherent:
|
|||
- it is the identity input `flex-auth` consumes for authorization
|
||||
decisions (responsibility map: the identity layer owns the claim
|
||||
contract — that contract is this profile);
|
||||
- it is the thing **NK-WP-0011-T6** runs conformance checks against, so
|
||||
- it is the thing **NK-WP-0011-T06** runs conformance checks against, so
|
||||
this workplan **enables** NK-WP-0011.
|
||||
|
||||
## Why now / what exists
|
||||
|
|
@ -60,7 +60,7 @@ the current architecture:
|
|||
| No tenant claim | recursive `tenant:platform` vs tenant model (NK-WP-0006) needs tenant in the token |
|
||||
| Only human/service identities | architecture distinguishes human / service / **agent** principals |
|
||||
| Assurance is implicit | flex-auth decision envelopes require explicit assurance evidence |
|
||||
| No executable conformance check | NK-WP-0011-T6 and every implementation need a runnable contract test |
|
||||
| No executable conformance check | NK-WP-0011-T06 and every implementation need a runnable contract test |
|
||||
|
||||
## Scope
|
||||
|
||||
|
|
@ -150,7 +150,7 @@ priority: high
|
|||
issuer/implementation against the profile: discovery document completeness,
|
||||
PKCE enforcement, claim shape, JWKS and key-rotation tolerance, token
|
||||
validation (issuer/audience/expiry/signature), and rejection of
|
||||
local-development issuers in production. This is the artifact NK-WP-0011-T6
|
||||
local-development issuers in production. This is the artifact NK-WP-0011-T06
|
||||
consumes; it must run against both a key-cape and a Keycloak issuer.
|
||||
|
||||
```task
|
||||
|
|
@ -201,7 +201,7 @@ interface/reference docs.
|
|||
- **Depends on NK-WP-0006** for the recursive tenant model the claims encode.
|
||||
- **Enables NK-WP-0011** — T6 (IAM Profile conformance) cannot pass without
|
||||
the spec and the conformance check from this workplan. NK-WP-0012 should
|
||||
land before NK-WP-0011-T6.
|
||||
land before NK-WP-0011-T06.
|
||||
- Coordinates with **flex-auth** (the consumed claim contract, T4) and with
|
||||
**key-cape**/**Keycloak** as the implementations the conformance check
|
||||
runs against — those repos implement, this workplan specifies and tests.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue