From 40ea96ca797909fd2845384064798af48892bfbe Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 23 Oct 2026 00:15:14 +0200 Subject: [PATCH] NK-WP-0049-T02: complete caller ledger (93 entries, historical objects); unblock T21/T22 ledger dependency Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 696317@bnt-lap001 Assistant-Session: bab9e511-0915-45b3-926a-2fab552edff6 --- WORK-RECORDS.md | 2 +- .../{ledger-draft.json => caller-ledger.json} | 1257 +++++++++-------- ...-bootstrap-secret-free-recovery-handoff.md | 23 +- 3 files changed, 705 insertions(+), 577 deletions(-) rename docs/evidence/2026-10-23-nk49-t02-caller-ledger/{ledger-draft.json => caller-ledger.json} (64%) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index afa899e..d20d86b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -250,7 +250,7 @@ | task | NK-WP-0048-T43 | progress | — | workplans/NK-WP-0048-security-case-types.md | | task | NK-WP-0048-T44 | done | — | workplans/NK-WP-0048-security-case-types.md | | task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T02 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T02 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | diff --git a/docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json similarity index 64% rename from docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json rename to docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json index 196afa8..4147a5c 100644 --- a/docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json +++ b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json @@ -1,23 +1,21 @@ { - "schema": "nk49.t02-caller-ledger-draft.v1", + "schema": "nk49.t02-caller-ledger.v1", "generated": "2026-10-23", "source_inventory": "docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json", "source_inventory_sha256": "d6a1a575e2690a242db76d6d5de60f48648211f2cf62c156f22486e1e0bbf28d", - "status": "mechanical first pass (read-only); candidate_status is not an owner disposition", + "status": "complete per-entry ledger (read-only source reconciliation); owner acceptance of dispositions and native checks remain with T21/T22", "method": "presence + sha256 drift vs inventory; basename referenced from Makefile/*.mk/bootstrap scripts/console = active route; else basename referenced from runbooks/docs/sso-mfa markdown = documented operator route", - "pending_columns": [ - "owner", - "credential_route", - "consumers", - "native_evidence", - "next_task" - ], + "pending_columns": [], "summary": { - "current (active route)": 28, - "current (documented operator route)": 26, - "unrouted: owner disposition needed": 17, - "retired (refusing entry point)": 11, - "current diagnostic, unrouted": 11 + "current": 59, + "retire-candidate": 1, + "retired": 11, + "owner-deferred (greenfield bootstrap only)": 3, + "current, superseded on 1.3 admission": 1, + "current diagnostic": 12, + "current (internal)": 1, + "current (repair)": 1, + "current (recovery tooling)": 4 }, "drifted": 5, "entries": [ @@ -32,17 +30,18 @@ "(root)" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none directly; dispatches the routes below", + "consumers": "operators, pre-commit recipe", + "native_evidence": "drift = staged work-record/receiver build targets (bde143e, 4c7f32a); no credential path changed", + "next_task": "none", "documented_in": [ "docs/NetkingdomRuntimeArchitecture.md", "docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", "docs/security-bootstrap-retrospective.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/apply-service-secrets.py", @@ -53,14 +52,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/bootstrap/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/creds-apply.sh", @@ -74,14 +74,15 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "sso-mfa/bootstrap/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/creds-bootstrap-agent.sh", @@ -95,15 +96,16 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/smooth-bootstrap-guide.md", "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/creds-rotate.sh", @@ -116,14 +118,15 @@ "Makefile" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/security-bootstrap-age-custody.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/creds-status.sh", @@ -136,12 +139,13 @@ "Makefile" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/creds-verify.sh", @@ -155,12 +159,13 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/decrypt-secrets.sh", @@ -173,14 +178,15 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/security-bootstrap-age-custody.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/emergency-bundle.sh", @@ -194,12 +200,13 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/encrypt-secrets.sh", @@ -212,14 +219,15 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/security-bootstrap-age-custody.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/gen-secrets.sh", @@ -234,11 +242,11 @@ "sso-mfa/bootstrap/encrypt-secrets.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "sso-mfa/WORKPLAN.md", "sso-mfa/bootstrap/README.md", @@ -247,7 +255,8 @@ "sso-mfa/k8s/lldap/README.md", "sso-mfa/k8s/postgresql/README.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/openbao-init-unseal.sh", @@ -261,14 +270,15 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/openbao-unseal-custody-models.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/openbao-lab.py", @@ -281,12 +291,13 @@ "sso-mfa/bootstrap/openbao-init-unseal.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/pack-bundle.sh", @@ -300,15 +311,16 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "sso-mfa/WORKPLAN.md", "sso-mfa/bootstrap/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/rotation-env.py", @@ -321,12 +333,13 @@ "sso-mfa/bootstrap/creds-rotate.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/sops-custody-unlock.sh", @@ -339,16 +352,17 @@ "Makefile" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "operator-held SOPS/age custody key, per-invocation only (make sops-custody-run)", + "consumers": "make sops-custody-*, creds-*", + "native_evidence": "drift = 4f65e41 sealed recovery custody; covered by T37 SOPS compatibility proof", + "next_task": "none", "documented_in": [ "docs/bootstrap-recovery-ceremony.md", "docs/disaster-recovery-storage-share.md", "docs/security-bootstrap-age-custody.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/sops-private.py", @@ -361,12 +375,13 @@ "Makefile" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "operator-held SOPS/age custody key, per-invocation only (make sops-custody-run)", + "consumers": "sealed recovery custody (T34/T37)", + "native_evidence": "drift = 4f65e41; T37 verified actual SOPS read/write custody", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/bootstrap/sops-write.py", @@ -379,12 +394,13 @@ "Makefile" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/authelia/create-secrets.sh", @@ -403,11 +419,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -417,7 +433,8 @@ "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/authelia/README.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/approval-clients-rollout.py", @@ -428,14 +445,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/keycape-approval-clients-rollout.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/authentication-policy-rollout.py", @@ -446,12 +464,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)", + "consumers": "none after initial activation; later changes use the authenticated policy journey", + "native_evidence": "one-shot migration of two baseline registrations, completed", + "next_task": "NK-WP-0049-T22: convert to refusing entry point", + "documented_in": [], + "disposition": "retire-candidate" }, { "path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh", @@ -464,15 +483,16 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/create-pi-token.sh", @@ -483,17 +503,18 @@ "inventory_classification": "retired entry point; refuses before credential/cluster access", "referenced_by": [], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-age-custody.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/create-secrets.py", @@ -504,12 +525,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "private operator inputs; never replaces an existing Secret", + "consumers": "greenfield C0 bootstrap", + "native_evidence": "refuses replacement; no live re-run on the current estate", + "next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision", + "documented_in": [], + "disposition": "owner-deferred (greenfield bootstrap only)" }, { "path": "sso-mfa/k8s/keycape/create-secrets.sh", @@ -528,11 +550,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -542,7 +564,8 @@ "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/authelia/README.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/exercise-approval-clients.py", @@ -553,14 +576,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/keycape-approval-clients-rollout.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/keycape-client.py", @@ -571,15 +595,16 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)", + "consumers": "register-client adapter (NK-WP-0048), per-client helpers", + "native_evidence": "drift = 8790dd1/916ba4b sealed checker snapshot; coordinator-reviewed with NK48 adapter set", + "next_task": "NK-WP-0048-T16 (1.3 re-freeze)", "documented_in": [ "docs/playwright-registration.md", "sso-mfa/k8s/keycape/bind-env-adapter.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/openbao-client-config.py", @@ -590,17 +615,18 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/keycape-upstream-issuer-pin.md", "sso-mfa/k8s/keycape/README.md", "sso-mfa/k8s/keycape/bind-env-adapter.md", "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py", @@ -611,14 +637,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/keycape/openbao-negative-node-route.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/openbao-negative-session.py", @@ -629,14 +656,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/keycape/openbao-negative-node-route.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py", @@ -647,12 +675,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom + key-cape", + "credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)", + "consumers": "KeyCape openbao-admin registration", + "native_evidence": "owned by NK-WP-0051-T02 / KEY-WP-0041-T02", + "next_task": "NK-WP-0051-T02", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/patch-openbao-client.sh", @@ -665,15 +694,16 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/playwright-activation.py", @@ -684,14 +714,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/playwright-registration.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/playwright-registration.py", @@ -702,14 +733,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/playwright-registration.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/portal-client-rollout.py", @@ -720,14 +752,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/keycape/bind-env-adapter.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/refresh-pi-token-live.sh", @@ -740,15 +773,16 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/register-coulomb-social.py", @@ -759,12 +793,13 @@ "inventory_classification": "retired entry point; refuses before credential/cluster access", "referenced_by": [], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", + "documented_in": [], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/register-coulomb-social.sh", @@ -775,14 +810,15 @@ "inventory_classification": "retired entry point; refuses before credential/cluster access", "referenced_by": [], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/keycape/register-user-engine-portal.py", @@ -793,14 +829,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/keycape/bind-env-adapter.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py", @@ -811,14 +848,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/vergabe-client-rollout.py", @@ -829,12 +867,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace sso (lane keycape-attended-case-change)", + "consumers": "Vergabe demo client registration", + "native_evidence": "generalized by keycape-client.py; fixture test_vergabe_client_rollout.py", + "next_task": "retire after NK-WP-0048-T16 admits 1.3", + "documented_in": [], + "disposition": "current, superseded on 1.3 admission" }, { "path": "sso-mfa/k8s/keycape/verify-openbao-client.sh", @@ -847,17 +886,18 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", "docs/smooth-bootstrap-guide.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/keycape/verify-user-engine-portal.py", @@ -868,14 +908,15 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/evidence/2026-09-11-native-portal-repair.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/lldap/bootstrap-users.sh", @@ -886,18 +927,19 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/intakes/activity-core-ops-sso-operators.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md", "sso-mfa/k8s/lldap/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/lldap/break-glass.sh", @@ -910,16 +952,17 @@ "Makefile" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/legacy-lldap-lifecycle-retirement.md", "sso-mfa/WORKPLAN.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/lldap/create-secrets.sh", @@ -938,11 +981,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -952,7 +995,8 @@ "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/authelia/README.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/lldap/create-user.sh", @@ -965,11 +1009,11 @@ "Makefile" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/NetkingdomRuntimeArchitecture.md", "docs/attended-procedure-inventory.md", @@ -977,7 +1021,8 @@ "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", "docs/security-bootstrap-retrospective.md", "docs/user-engine-netkingdom-integration-assessment.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh", @@ -990,18 +1035,19 @@ "Makefile" ], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/NetkingdomRuntimeArchitecture.md", "docs/attended-procedure-inventory.md", "docs/legacy-lldap-lifecycle-retirement.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", "docs/security-bootstrap-retrospective.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/lldap/identity-provisioner-reconcile.py", @@ -1012,15 +1058,16 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/evidence/2026-09-11-native-portal-repair.md", "docs/identity-provisioner-bind-repair.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/lldap/lldap_admin.py", @@ -1031,15 +1078,16 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/sign-in-diagnosis.md", "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/lldap/manage-group-members.sh", @@ -1050,16 +1098,17 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md", "sso-mfa/k8s/lldap/OPERATOR-GROUPS.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/postgresql/create-secrets.sh", @@ -1078,11 +1127,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -1092,7 +1141,8 @@ "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/authelia/README.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/activate-onboarding-policy.py", @@ -1103,12 +1153,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "privacyIDEA enrollment policy (portal, Vergabe)", + "native_evidence": "delivered NK-WP-0042 scoped enrollment", + "next_task": "NK-WP-0042 pilot reuse", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py", @@ -1119,12 +1170,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "stdin JSON, in-pod only", + "consumers": "called only by bootstrap-admin.py", + "native_evidence": "insert-only DB writes", + "next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision", + "documented_in": [], + "disposition": "owner-deferred (greenfield bootstrap only)" }, { "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py", @@ -1135,12 +1187,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "one private bootstrap credential over stdin", + "consumers": "greenfield privacyIDEA", + "native_evidence": "insert-only; never updates existing credentials", + "next_task": "none on the current estate (greenfield only); any re-run needs its own owner decision", + "documented_in": [], + "disposition": "owner-deferred (greenfield bootstrap only)" }, { "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh", @@ -1154,17 +1207,18 @@ "sso-mfa/bootstrap/creds-bootstrap-agent.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-age-custody.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh", @@ -1175,17 +1229,18 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/attended-procedure-standard.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh", @@ -1196,16 +1251,17 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/smooth-bootstrap-guide.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/create-secrets.sh", @@ -1224,11 +1280,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -1238,7 +1294,8 @@ "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/authelia/README.md", "sso-mfa/k8s/keycape/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/deploy-factor-recovery.py", @@ -1249,12 +1306,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "private P04 factor-recovery service", + "native_evidence": "delivered; recovery journey acceptance open", + "next_task": "NK-WP-0042 step-up/recovery journey", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/deploy-onboarding-guard.py", @@ -1265,12 +1323,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "privacyIDEA enrollment hook", + "native_evidence": "delivered NK-WP-0042", + "next_task": "NK-WP-0042 pilot reuse", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/enable-factor-confirmation.py", @@ -1281,12 +1340,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "new TOTP enrollments", + "native_evidence": "delivered NK-WP-0042", + "next_task": "NK-WP-0042 pilot reuse", + "documented_in": [], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/enckey-bootstrap.sh", @@ -1301,18 +1361,19 @@ "sso-mfa/bootstrap/gen-secrets.sh" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/WORKPLAN.md", "sso-mfa/bootstrap/README.md", "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/enckey-restore.sh", @@ -1323,14 +1384,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/key-custody-remote.py", @@ -1341,12 +1403,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "in-pod key transport", + "consumers": "called only by key-custody.py (tests/test_privacyidea_key_custody.py)", + "native_evidence": "T31 token-material proof", + "next_task": "NK-WP-0049-T19", + "documented_in": [], + "disposition": "current (internal)" }, { "path": "sso-mfa/k8s/privacyidea/key-custody.py", @@ -1357,14 +1420,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/keycape-scope-probe.py", @@ -1375,12 +1439,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "realm-visibility probe for KeyCape scope", + "native_evidence": "inert probe; emits no key", + "next_task": "none", + "documented_in": [], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/privacyidea/mfa_state.py", @@ -1391,12 +1456,13 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", + "documented_in": [], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/privacyidea/pi_api.py", @@ -1407,14 +1473,15 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py", @@ -1425,12 +1492,13 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "attended operator kube session, namespace mfa; provider admin via existing in-pod custody", + "consumers": "realm/resolver repair; library for bootstrap-realm.sh", + "native_evidence": "preserves established policy", + "next_task": "NK-WP-0049-T19 (isolated MFA adapter)", + "documented_in": [], + "disposition": "current (repair)" }, { "path": "sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh", @@ -1441,16 +1509,17 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/attended-procedure-standard.md", "docs/keycape-exposure-resolver-reconciliation.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh", @@ -1464,11 +1533,11 @@ "tools/security-bootstrap-console/security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", @@ -1476,7 +1545,8 @@ "docs/smooth-bootstrap-guide.md", "docs/verify-t06.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/resolver_cutover.py", @@ -1487,15 +1557,16 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/keycape-exposure-resolver-reconciliation.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh", @@ -1506,15 +1577,16 @@ "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/keycape-exposure-resolver-reconciliation.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/privacyidea/verify_mfa.py", @@ -1525,12 +1597,13 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", + "documented_in": [], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/user-engine/verify-operability.sh", @@ -1541,15 +1614,16 @@ "inventory_classification": "retired entry point; refuses before credential/cluster access", "referenced_by": [], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "sso-mfa/k8s/user-engine/README.md" - ] + ], + "disposition": "retired" }, { "path": "sso-mfa/k8s/verify-identity-cutover-dependencies.sh", @@ -1560,15 +1634,16 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t02.sh", @@ -1579,16 +1654,17 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "sso-mfa/k8s/FOUNDATIONS-HISTORICAL.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t03.sh", @@ -1599,16 +1675,17 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "sso-mfa/k8s/postgresql/README.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t04.sh", @@ -1619,18 +1696,19 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "docs/verify-t06.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t05.sh", @@ -1641,18 +1719,19 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "docs/verify-t06.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/backup/DR-RUNBOOK.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t06.sh", @@ -1665,11 +1744,11 @@ "tools/security-bootstrap-console/README.md" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/attended-procedure-standard.md", @@ -1677,7 +1756,8 @@ "docs/verify-t06.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/privacyidea/README.md" - ] + ], + "disposition": "current" }, { "path": "sso-mfa/k8s/verify-t07.sh", @@ -1688,18 +1768,19 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "sso-mfa/WORKPLAN.md", "sso-mfa/k8s/keycape/README.md", "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "sso-mfa/k8s/verify-t08.sh", @@ -1710,16 +1791,17 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/attended-procedure-inventory.md", "docs/verification-audit-2026-09-05.md", "sso-mfa/WORKPLAN.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "tools/bootstrap-recovery/inventory-scaleway.py", @@ -1730,12 +1812,13 @@ "inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "existing scoped runtime delivery; admitted cluster read", + "consumers": "T06 offsite discovery", + "native_evidence": "offsite-discovery-summary.json (2026-10-15)", + "next_task": "document in recovery runbook; NK-WP-0049-T24 G3 drill", + "documented_in": [], + "disposition": "current (recovery tooling)" }, { "path": "tools/bootstrap-recovery/inventory-storage-share.py", @@ -1746,12 +1829,13 @@ "inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)", + "consumers": "T06 offsite discovery", + "native_evidence": "offsite-discovery-summary.json", + "next_task": "document in recovery runbook; T24 G3", + "documented_in": [], + "disposition": "current (recovery tooling)" }, { "path": "tools/bootstrap-recovery/verify-bundle.py", @@ -1762,14 +1846,15 @@ "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", "referenced_by": [], "candidate_status": "current diagnostic, unrouted", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "status-only; explicit private input where needed", + "consumers": "operators on demand", + "native_evidence": "structural observation only; proves no recovery", + "next_task": "none", "documented_in": [ "docs/bootstrap-recovery-ceremony.md" - ] + ], + "disposition": "current diagnostic" }, { "path": "tools/security-bootstrap-console/security_bootstrap_console.py", @@ -1784,11 +1869,11 @@ "tools/security-bootstrap-console/tests/test_security_bootstrap_console.py" ], "candidate_status": "current (active route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per Make/bootstrap route", + "consumers": "operators via Make/bootstrap", + "native_evidence": "active route reference (see referenced_by)", + "next_task": "none", "documented_in": [ "docs/NetkingdomRuntimeArchitecture.md", "docs/openbao-attended-ceremony-runbook.md", @@ -1797,7 +1882,8 @@ "docs/security-bootstrap-retrospective.md", "docs/smooth-bootstrap-guide.md", "docs/tutorials/openbao-operating-path.md" - ] + ], + "disposition": "current" }, { "path": "tools/sync-user-engine-delivery-secret.sh", @@ -1808,14 +1894,15 @@ "inventory_classification": "retired entry point; refuses before credential/cluster access", "referenced_by": [], "candidate_status": "retired (refusing entry point)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "none (refuses before credential/cluster access)", + "consumers": "none", + "native_evidence": "refusal covered by tests/test_retirement_and_bundle_boundaries.py", + "next_task": "none", "documented_in": [ "sso-mfa/k8s/user-engine/README.md" - ] + ], + "disposition": "retired" }, { "path": "tools/bootstrap-recovery/fetch-privacyidea-backup.py", @@ -1826,12 +1913,13 @@ "inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)", + "consumers": "isolated PI database drill", + "native_evidence": "privacyidea-transfer-r1.json", + "next_task": "document in recovery runbook; T24 G3", + "documented_in": [], + "disposition": "current (recovery tooling)" }, { "path": "tools/bootstrap-recovery/check-privacyidea-database.py", @@ -1842,14 +1930,15 @@ "inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom", + "credential_route": "per documented attended procedure (docs/attended-procedure-inventory.md)", + "consumers": "operators via documented runbook", + "native_evidence": "documented route (see documented_in); native acceptance per owning task", + "next_task": "none", "documented_in": [ "docs/bootstrap-recovery-ceremony.md" - ] + ], + "disposition": "current" }, { "path": "tools/bootstrap-recovery/prepare-identity-coverage.py", @@ -1860,12 +1949,13 @@ "inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability", "referenced_by": [], "candidate_status": "unrouted: owner disposition needed", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, - "documented_in": [] + "owner": "net-kingdom", + "credential_route": "read-only workload/PVC metadata", + "consumers": "identity-backup-profile.json proposal", + "native_evidence": "994d11c coverage proposal", + "next_task": "none", + "documented_in": [], + "disposition": "current (recovery tooling)" }, { "path": "tools/bootstrap-recovery/identity-backup-profile.json", @@ -1876,14 +1966,37 @@ "inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability", "referenced_by": [], "candidate_status": "current (documented operator route)", - "owner": null, - "credential_route": null, - "consumers": null, - "native_evidence": null, - "next_task": null, + "owner": "net-kingdom (profile) / railiance-platform (job)", + "credential_route": "Platform attended Backup-account lane (railiance-platform owner custody)", + "consumers": "daily identity backup job (T14)", + "native_evidence": "drift = a17aa7e admitted host + live provider scope; T14 activation evidence", + "next_task": "NK-WP-0049-T24 (second provider)", "documented_in": [ "docs/bootstrap-recovery-ceremony.md" - ] + ], + "disposition": "current" + } + ], + "historical_objects": [ + { + "object": "sso/keycape-pi-token", + "uid": "1d459ab6-8b42-454d-9220-0fa2ffe4e819", + "created": "2026-03-25", + "present_2026_10_15": true, + "current_source_readers": "none (check-user-mfa-state.sh retired the read; tests assert no output leak)", + "revocation_proven": false, + "disposition": "retired in source; object retained; revocation/deletion owner-deferred", + "next_task": "NK-WP-0049-T22 + NK-WP-0022 deletion approval" + }, + { + "object": "mfa/privacyidea-trigger-admin", + "uid": "d1c643be-672d-4d13-8e46-3a58cb37ae39", + "created": "2026-03-25", + "present_2026_10_15": true, + "current_source_readers": "none found in repo source", + "revocation_proven": false, + "disposition": "retired in source; object retained; revocation/deletion owner-deferred", + "next_task": "NK-WP-0049-T22 + NK-WP-0022 deletion approval" } ] } \ No newline at end of file diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index d322cda..3400d0c 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -360,7 +360,7 @@ this completed task is not a full-estate recovery claim. ```task id: NK-WP-0049-T02 -status: progress +status: done priority: high assignee: codex depends_on: [NK-WP-0049-T06] @@ -384,7 +384,7 @@ Send current native checks to T21 and historical revocation/rotation decisions t T22. Do not reopen completed source repairs without a new finding. 2026-10-23 first slice (read-only, mechanical): -[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json). +[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/caller-ledger.json). For all 93 inventory entries it records presence, sha256 drift against the October15 inventory, the last commit, and references from Make, bootstrap or console routes and from runbook/doc markdown. Candidate statuses: @@ -401,6 +401,21 @@ and consumers for the 17 unrouted and 5 drifted entries, plus the explicitly named historical objects; (3) add native evidence or the exact missing proof and the next task for all entries, and route checks to T21 and T22. +2026-10-23 slices 2 and 3 are complete. T02 is **done**. Every one of the 93 +entries now records a disposition, owner, credential route, consumers, evidence +and next task: 59 current, 12 current diagnostic, 7 current +recovery/internal/repair, 11 retired, 3 owner-deferred greenfield bootstrap, 1 +retire-candidate (`authentication-policy-rollout.py`, a completed one-shot that +should become a refusing entry point under T22), and 1 superseded once +NK-WP-0048 admits 1.3 (`vergabe-client-rollout.py`). The 5 drifted entries are +attributed to their reviewed commits. Historical objects: `sso/keycape-pi-token` +and `mfa/privacyidea-trigger-admin` are retired in source (no current reader), +but the objects were still present on 2026-10-15 and revocation is unproven. +They route to T22 and to NK-WP-0022's deletion approval. Lab init, factor +diagnostics, the LDAP group boundary and the resolver cutover appear as their +entry-point rows. Owner acceptance and native checks stay with T21/T22. The +four recovery tools still need a runbook home; T24 G3 covers that. + ## Prepare the isolated full-service restore and acceptance packet ```task @@ -602,7 +617,7 @@ status: wait priority: high assignee: codex depends_on: [NK-WP-0049-T02] -blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." +blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" ``` @@ -628,7 +643,7 @@ status: wait priority: high assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T21] -blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." +blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" ```