coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T02: complete caller ledger (93 entries, historical objects); unblock T21/T22 ledger dependency

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 696317@bnt-lap001
Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6
This commit is contained in:
tegwick 2026-10-23 00:15:14 +02:00
parent fa709f8098
commit 40ea96ca79
3 changed files with 705 additions and 577 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -250,7 +250,7 @@
| task | NK-WP-0048-T43 | progress | — | workplans/NK-WP-0048-security-case-types.md |
| task | NK-WP-0048-T44 | done | — | workplans/NK-WP-0048-security-case-types.md |
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T02 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |

1257
docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json → docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json
View file

File diff suppressed because it is too large Load diff

23
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -360,7 +360,7 @@ this completed task is not a full-estate recovery claim.
```task
id: NK-WP-0049-T02
status: progress
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T06]
@ -384,7 +384,7 @@ Send current native checks to T21 and historical revocation/rotation decisions t
T22. Do not reopen completed source repairs without a new finding.
2026-10-23 first slice (read-only, mechanical):
[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json).
[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json).
For all 93 inventory entries it records presence, sha256 drift against the
October15 inventory, the last commit, and references from Make, bootstrap or
console routes and from runbook/doc markdown. Candidate statuses:
@ -401,6 +401,21 @@ and consumers for the 17 unrouted and 5 drifted entries, plus the explicitly
named historical objects; (3) add native evidence or the exact missing proof and
the next task for all entries, and route checks to T21 and T22.
2026-10-23 slices 2 and 3 are complete. T02 is **done**. Every one of the 93
entries now records a disposition, owner, credential route, consumers, evidence
and next task: 59 current, 12 current diagnostic, 7 current
recovery/internal/repair, 11 retired, 3 owner-deferred greenfield bootstrap, 1
retire-candidate (`authentication-policy-rollout.py`, a completed one-shot that
should become a refusing entry point under T22), and 1 superseded once
NK-WP-0048 admits 1.3 (`vergabe-client-rollout.py`). The 5 drifted entries are
attributed to their reviewed commits. Historical objects: `sso/keycape-pi-token`
and `mfa/privacyidea-trigger-admin` are retired in source (no current reader),
but the objects were still present on 2026-10-15 and revocation is unproven.
They route to T22 and to NK-WP-0022's deletion approval. Lab init, factor
diagnostics, the LDAP group boundary and the resolver cutover appear as their
entry-point rows. Owner acceptance and native checks stay with T21/T22. The
four recovery tools still need a runbook home; T24 G3 covers that.
## Prepare the isolated full-service restore and acceptance packet
```task
@ -602,7 +617,7 @@ status: wait
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02]
blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers."
blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers."
state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4"
```
@ -628,7 +643,7 @@ status: wait
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02, NK-WP-0049-T21]
blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged."
blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged."
state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55"
```