diff --git a/docs/platform-identity-security-architecture.md b/docs/platform-identity-security-architecture.md index 03f18d4..5410708 100644 --- a/docs/platform-identity-security-architecture.md +++ b/docs/platform-identity-security-architecture.md @@ -547,6 +547,6 @@ an explicit check: - Which tenant metadata is required before a service can register resources with flex-auth? - What precise per-tenant trigger and dual-issuer coexistence rule should - NK-WP-0011-T1 use for Keycloak expanded mode? + NK-WP-0011-T01 use for Keycloak expanded mode? - Does Topaz run centrally for the platform, per tenant, or per service for the first production deployment? diff --git a/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md b/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md index ca84994..d83a3d6 100644 --- a/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md +++ b/workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md @@ -66,7 +66,7 @@ Out of scope: ## Tasks ```task -id: NK-WP-0009-T1 +id: NK-WP-0009-T01 status: todo priority: high state_hub_task_id: "79150b07-f25d-4407-a118-e08b6e588d37" @@ -77,7 +77,7 @@ commands, manifests, verification, rollback, threat checks, and cross-repo ownership notes. ```task -id: NK-WP-0009-T2 +id: NK-WP-0009-T02 status: todo priority: high state_hub_task_id: "07647ba6-90e1-4569-947a-ebccce7a2d5e" @@ -89,7 +89,7 @@ flex-auth authorization, object-store STS exchange, and SDK consumer configuration. ```task -id: NK-WP-0009-T3 +id: NK-WP-0009-T03 status: todo priority: high state_hub_task_id: "0f34eda3-f1f3-4c49-9eba-36167b6c5ea9" @@ -101,7 +101,7 @@ Platform workplan and covering auth methods, secret engines, CSI/ESO integration, leases, unseal, backup, and break-glass. ```task -id: NK-WP-0009-T4 +id: NK-WP-0009-T04 status: todo priority: medium state_hub_task_id: "3c17d1ac-3232-43b4-b541-ea6538da2afb" @@ -112,7 +112,7 @@ automations", using ops-warden and ops-bridge as the reference implementation. ```task -id: NK-WP-0009-T5 +id: NK-WP-0009-T05 status: todo priority: medium state_hub_task_id: "aff82173-0b8e-4216-855a-887ac68b63e0" @@ -123,7 +123,7 @@ manifests, action vocabulary, claim envelopes, policy packages, decision envelopes, and delegated PDP options. ```task -id: NK-WP-0009-T6 +id: NK-WP-0009-T06 status: todo priority: medium state_hub_task_id: "df427aa3-233f-4479-aed9-706676f8e87d" diff --git a/workplans/NK-WP-0011-enterprise-federation-saml.md b/workplans/NK-WP-0011-enterprise-federation-saml.md index 5820cd4..2960674 100644 --- a/workplans/NK-WP-0011-enterprise-federation-saml.md +++ b/workplans/NK-WP-0011-enterprise-federation-saml.md @@ -113,7 +113,7 @@ Out of scope: ## Tasks ```task -id: NK-WP-0011-T1 +id: NK-WP-0011-T01 state_hub_task_id: 934f9223-2b6f-4d01-b49b-406b5b98b6e4 status: todo priority: high @@ -129,7 +129,7 @@ still target one IAM Profile contract; and the canonical hostname/issuer for the broker. Resolve or supersede D2 from NK-WP-0001. ```task -id: NK-WP-0011-T2 +id: NK-WP-0011-T02 state_hub_task_id: 7b514cda-41b3-492f-8731-5a131422059d status: todo priority: high @@ -142,7 +142,7 @@ Secret. Confirm the existing backup schedule covers the new database and run a restore drill for `keycloak_db` specifically. ```task -id: NK-WP-0011-T3 +id: NK-WP-0011-T03 state_hub_task_id: 8c29602e-ab9b-446a-8fee-5e2d8fbcb100 status: todo priority: high @@ -157,7 +157,7 @@ strictness + proxy headers configured for Traefik. Realm import is GitOps-friendly (realm JSON/CR in git). ```task -id: NK-WP-0011-T4 +id: NK-WP-0011-T04 state_hub_task_id: d62d7683-24b1-458c-9fd6-96e576b52a64 status: todo priority: high @@ -171,7 +171,7 @@ attribute/claim mappers and group→role mapping. Verify a federated login end-to-end for at least the Entra ID path. ```task -id: NK-WP-0011-T5 +id: NK-WP-0011-T05 state_hub_task_id: 85319768-5d81-460d-89dc-8de76b63e0dc status: todo priority: medium @@ -186,7 +186,7 @@ platform-root-sensitive clients. Ensure assurance evidence is carried in the IAM Profile token so flex-auth can gate privileged actions on it. ```task -id: NK-WP-0011-T6 +id: NK-WP-0011-T06 state_hub_task_id: 53801dc2-7bdb-4fa3-9fa0-c1450ef1003b status: todo priority: high @@ -201,7 +201,7 @@ Keycloak issuer per the T1 selection rule. Use the canonical `tools/iam-profile-conformance/`. Document per-tenant issuer selection. ```task -id: NK-WP-0011-T7 +id: NK-WP-0011-T07 state_hub_task_id: 981f79bd-63ee-4da0-8d7d-9af8e468715e status: todo priority: high @@ -216,7 +216,7 @@ Topaz remains the PDP; if a Keycloak Authorization Services adapter is used at all, document it as a delegated, non-canonical adapter. ```task -id: NK-WP-0011-T8 +id: NK-WP-0011-T08 state_hub_task_id: 13634760-7817-40c0-b7db-5e0f4196dbf0 status: todo priority: medium diff --git a/workplans/archived/260702-NK-WP-0012-iam-profile-specification.md b/workplans/archived/260702-NK-WP-0012-iam-profile-specification.md index 0898038..3159553 100644 --- a/workplans/archived/260702-NK-WP-0012-iam-profile-specification.md +++ b/workplans/archived/260702-NK-WP-0012-iam-profile-specification.md @@ -42,7 +42,7 @@ coherent: - it is the identity input `flex-auth` consumes for authorization decisions (responsibility map: the identity layer owns the claim contract — that contract is this profile); -- it is the thing **NK-WP-0011-T6** runs conformance checks against, so +- it is the thing **NK-WP-0011-T06** runs conformance checks against, so this workplan **enables** NK-WP-0011. ## Why now / what exists @@ -60,7 +60,7 @@ the current architecture: | No tenant claim | recursive `tenant:platform` vs tenant model (NK-WP-0006) needs tenant in the token | | Only human/service identities | architecture distinguishes human / service / **agent** principals | | Assurance is implicit | flex-auth decision envelopes require explicit assurance evidence | -| No executable conformance check | NK-WP-0011-T6 and every implementation need a runnable contract test | +| No executable conformance check | NK-WP-0011-T06 and every implementation need a runnable contract test | ## Scope @@ -150,7 +150,7 @@ priority: high issuer/implementation against the profile: discovery document completeness, PKCE enforcement, claim shape, JWKS and key-rotation tolerance, token validation (issuer/audience/expiry/signature), and rejection of -local-development issuers in production. This is the artifact NK-WP-0011-T6 +local-development issuers in production. This is the artifact NK-WP-0011-T06 consumes; it must run against both a key-cape and a Keycloak issuer. ```task @@ -201,7 +201,7 @@ interface/reference docs. - **Depends on NK-WP-0006** for the recursive tenant model the claims encode. - **Enables NK-WP-0011** — T6 (IAM Profile conformance) cannot pass without the spec and the conformance check from this workplan. NK-WP-0012 should - land before NK-WP-0011-T6. + land before NK-WP-0011-T06. - Coordinates with **flex-auth** (the consumed claim contract, T4) and with **key-cape**/**Keycloak** as the implementations the conformance check runs against — those repos implement, this workplan specifies and tests.