From 45a189a39167eef62709df0e857309f7ddc59029 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 00:27:02 +0200 Subject: [PATCH] Qualify dormant federation waits without inventing adoption demand Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091 --- .../NK-WP-0011-enterprise-federation-saml.md | 51 ++++++++++++++++--- 1 file changed, 43 insertions(+), 8 deletions(-) diff --git a/workplans/NK-WP-0011-enterprise-federation-saml.md b/workplans/NK-WP-0011-enterprise-federation-saml.md index 3de4481..a769650 100644 --- a/workplans/NK-WP-0011-enterprise-federation-saml.md +++ b/workplans/NK-WP-0011-enterprise-federation-saml.md @@ -138,8 +138,9 @@ id: NK-WP-0011-T02 state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487" status: wait priority: high -wait_kind: dependency blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence." +needs_human: true +decision_id: 8a5d1eb8-b665-4d25-9742-a15ecfc87c0c ``` **PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform @@ -156,8 +157,9 @@ id: NK-WP-0011-T03 state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908" status: wait priority: high -wait_kind: dependency blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment." +depends_on: + - NK-WP-0011-T02 ``` **Deploy expanded-mode Keycloak.** Build a custom image @@ -176,8 +178,9 @@ id: NK-WP-0011-T04 state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b" status: wait priority: high -wait_kind: dependency blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence." +depends_on: + - NK-WP-0011-T03 ``` **Upstream federation.** Configure identity brokering for Entra ID (OIDC), @@ -194,8 +197,9 @@ id: NK-WP-0011-T05 state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" status: wait priority: medium -wait_kind: dependency blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners." +depends_on: + - NK-WP-0011-T04 ``` **MFA / assurance source.** Decide and implement the assurance model: MFA @@ -213,8 +217,11 @@ id: NK-WP-0011-T06 state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446" status: wait priority: high -wait_kind: dependency blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent." +depends_on: + - NK-WP-0011-T03 + - NK-WP-0011-T04 + - NK-WP-0011-T05 ``` **IAM Profile conformance & downstream coexistence.** Run IAM Profile @@ -232,8 +239,11 @@ id: NK-WP-0011-T07 state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833" status: wait priority: high -wait_kind: dependency blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission." +depends_on: + - NK-WP-0011-T03 + - NK-WP-0011-T04 + - NK-WP-0011-T05 ``` **Recursive tenancy & authorization boundary.** Implement T1's reviewed @@ -252,8 +262,10 @@ id: NK-WP-0011-T08 state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" status: wait priority: medium -wait_kind: dependency blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent." +depends_on: + - NK-WP-0011-T02 + - NK-WP-0011-T03 ``` **Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative @@ -272,8 +284,11 @@ id: NK-WP-0011-T09 status: wait priority: medium state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e" -wait_kind: dependency blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent." +depends_on: + - NK-WP-0011-T03 + - NK-WP-0011-T07 + - NK-WP-0011-T08 ``` **Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write @@ -343,3 +358,23 @@ Local preparation is complete in owner deliverables, evidence gates, conformance limits and explicit resume criteria. New federation owner task IDs await trigger and owner acceptance; no deployment or issuer selection is implied by this packet. + +## Machine-readable wait reconciliation — 2026-10-03 + +T02 is the adoption admission root: owner/sponsor Bernd Worsch must confirm +all three accepted ADR-0009 triggers from real demand. The pending hub decision +`8a5d1eb8-b665-4d25-9742-a15ecfc87c0c` records that demand is currently absent; it neither asks +an agent to create demand nor grants a broker deployment. T02 also retains the +subsequent database-owner admission and backup/restore requirements. Once the +trigger exists, record actual owner task IDs before routing implementation. + +T03–T09 now encode their concrete predecessor deliverables in `depends_on`. +Every path reaches T02; no terminal historical infrastructure plan substitutes +for adoption. Existing per-task owner commitments/evidence remain in the +blocking reasons and admission requirements document. A deferred/declined +admission decision requires a deliberate retain/cancel review, not automatic +resume. All eight tasks remain wait; the workplan remains blocked. + +Knowledge receipt: emergent-security 0.2.6 / start / verified-files / +orientation-only; digest +`8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`.