From 27c3edfb1c70e196fd770da5bee99eee7b1dfee0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 6 Oct 2026 19:33:58 +0200 Subject: [PATCH] Register reset-mail workplan identifiers and index Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680 --- WORK-RECORDS.md | 6 +++++- workplans/NK-WP-0047-platform-password-reset-mail.md | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index f8a7ff9..69c5f7b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -41,6 +41,7 @@ | workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | | workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | | workplan | NK-WP-0046 | active | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| workplan | NK-WP-0047 | active | — | workplans/NK-WP-0047-platform-password-reset-mail.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -180,8 +181,11 @@ | task | NK-WP-0045-T05 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0045-T06 | done | — | workplans/NK-WP-0045-root-grant-custody-record.md | | task | NK-WP-0046-T01 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | -| task | NK-WP-0046-T02 | todo | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0046-T02 | done | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | | task | NK-WP-0046-T03 | wait | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | +| task | NK-WP-0047-T01 | done | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T02 | wait | — | workplans/NK-WP-0047-platform-password-reset-mail.md | +| task | NK-WP-0047-T03 | wait | — | workplans/NK-WP-0047-platform-password-reset-mail.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/workplans/NK-WP-0047-platform-password-reset-mail.md b/workplans/NK-WP-0047-platform-password-reset-mail.md index 3d605ac..4d3e8d4 100644 --- a/workplans/NK-WP-0047-platform-password-reset-mail.md +++ b/workplans/NK-WP-0047-platform-password-reset-mail.md @@ -9,6 +9,7 @@ owner: codex topic_slug: net-kingdom created: "2026-10-06" updated: "2026-10-06" +state_hub_workstream_id: "53b7c429-e780-5dfe-9ad4-88dd0490ecb8" --- # Scope @@ -28,6 +29,7 @@ Native validation and live SecretSynced/inbox proof remain pending. id: NK-WP-0047-T01 status: done priority: high +state_hub_task_id: "3cdce5c1-4313-5cc8-98db-df289f01ae97" ``` Review branch changes only Authelia notifier to IONOS TLS platform sender, adds password-file mount and sso-only SecretStore/ExternalSecret/serviceaccount. Existing authentication secrets, identity config, images and replicas remain. SMTP startup check enabled; rollback procedure documented. @@ -38,6 +40,7 @@ Review branch changes only Authelia notifier to IONOS TLS platform sender, adds id: NK-WP-0047-T02 status: wait priority: high +state_hub_task_id: "662c58dd-fa16-5a5a-9ae7-645a1048277a" ``` Depends on RPF-WP-0052/CCR-2026-0035 and founder exact go. Apply admission resources with server dry-run/diff, wait store/projection Ready without reading Secret values; native Authelia config validation, existing-config drift check, headroom/SQLite recovery preflight, reviewed rollout. Preserve issued identity/custody state; do not reconstruct old auth Secrets. @@ -48,6 +51,7 @@ Depends on RPF-WP-0052/CCR-2026-0035 and founder exact go. Apply admission resou id: NK-WP-0047-T03 status: wait priority: high +state_hub_task_id: "0dd88024-d2ce-5e31-b8ab-1c6091516105" ``` User starts a fresh reset, receives email and completes password change privately then app login. Record accepted/received/authenticated separately, no links/tokens/passwords in evidence. Rollback notifier config/mount on runtime failure, leave mailbox/version/password unchanged.