coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(workplans): normalize legacy task identifiers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
tegwick 2026-08-21 23:51:36 +02:00
parent 429c91b3a2
commit 25ed9281bb
4 changed files with 19 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/archived/260702-NK-WP-0012-iam-profile-specification.md
View file

@ -42,7 +42,7 @@ coherent:
- it is the identity input `flex-auth` consumes for authorization
decisions (responsibility map: the identity layer owns the claim
contract — that contract is this profile);
- it is the thing **NK-WP-0011-T6** runs conformance checks against, so
- it is the thing **NK-WP-0011-T06** runs conformance checks against, so
this workplan **enables** NK-WP-0011.
## Why now / what exists
@ -60,7 +60,7 @@ the current architecture:
| No tenant claim | recursive `tenant:platform` vs tenant model (NK-WP-0006) needs tenant in the token |
| Only human/service identities | architecture distinguishes human / service / **agent** principals |
| Assurance is implicit | flex-auth decision envelopes require explicit assurance evidence |
| No executable conformance check | NK-WP-0011-T6 and every implementation need a runnable contract test |
| No executable conformance check | NK-WP-0011-T06 and every implementation need a runnable contract test |
## Scope
@ -150,7 +150,7 @@ priority: high
issuer/implementation against the profile: discovery document completeness,
PKCE enforcement, claim shape, JWKS and key-rotation tolerance, token
validation (issuer/audience/expiry/signature), and rejection of
local-development issuers in production. This is the artifact NK-WP-0011-T6
local-development issuers in production. This is the artifact NK-WP-0011-T06
consumes; it must run against both a key-cape and a Keycloak issuer.
```task
@ -201,7 +201,7 @@ interface/reference docs.
- **Depends on NK-WP-0006** for the recursive tenant model the claims encode.
- **Enables NK-WP-0011** — T6 (IAM Profile conformance) cannot pass without
the spec and the conformance check from this workplan. NK-WP-0012 should
land before NK-WP-0011-T6.
land before NK-WP-0011-T06.
- Coordinates with **flex-auth** (the consumed claim contract, T4) and with
**key-cape**/**Keycloak** as the implementations the conformance check
runs against — those repos implement, this workplan specifies and tests.