From 47c42f33fb8550c9c40ee0771525ab4a7cfbcc32 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 20:01:30 +0200 Subject: [PATCH] Adopt live flex-auth digests, record rename answers and NK-WP-0033 ruling - runtime.yaml: declare the live flex-auth tenant-engine/user-engine digests confirmed by flex-auth, and mark the file reference-only (do not apply): live is ahead of it beyond the digests, including caller-auth enforce. - NK-WP-0039: T02 answered (package coordinate unchanged), T03 narrowed, new T04 to retire or reconcile the stale reference manifest. - NK-WP-0033: record the operator's predecessor-disposition ruling. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e --- WORK-RECORDS.md | 4 ++ sso-mfa/k8s/tenant-engine/runtime.yaml | 9 +++- ...P-0033-keycape-secret-exposure-rotation.md | 14 +++++- ...ex-auth-access-engine-coordinate-intake.md | 46 +++++++++++++++++-- 4 files changed, 65 insertions(+), 8 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b080cb3..6b49636 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -32,6 +32,7 @@ | workplan | NK-WP-0036 | active | — | workplans/NK-WP-0036-restore-user-portal-client-registration.md | | workplan | NK-WP-0037 | active | — | workplans/NK-WP-0037-vergabe-company-welcome.md | | workplan | NK-WP-0038 | finished | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| workplan | NK-WP-0039 | active | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -141,6 +142,9 @@ | task | NK-WP-0037-T02 | progress | — | workplans/NK-WP-0037-vergabe-company-welcome.md | | task | NK-WP-0038-T01 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | | task | NK-WP-0038-T02 | done | — | workplans/NK-WP-0038-tenant-scoped-identity-lifecycle.md | +| task | NK-WP-0039-T01 | done | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T02 | wait | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | +| task | NK-WP-0039-T03 | wait | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/sso-mfa/k8s/tenant-engine/runtime.yaml b/sso-mfa/k8s/tenant-engine/runtime.yaml index cab93de..a21f6dd 100644 --- a/sso-mfa/k8s/tenant-engine/runtime.yaml +++ b/sso-mfa/k8s/tenant-engine/runtime.yaml @@ -1,3 +1,8 @@ +# REFERENCE ONLY - DO NOT APPLY. Not the runtime source of truth (ADR-0015). +# flex-auth-* Deployments are owned by flex-auth (values/.yaml) and +# tenant-engine by its own repository. Live differs from this file beyond the +# flex-auth image digests (caller-auth enforce args, tenant-engine image, PVC, +# strategy, egress). Applying it would drop caller-auth enforcement. NK-WP-0039. apiVersion: v1 kind: Namespace metadata: {name: flex-auth, labels: {net-kingdom/component: flex-auth}} @@ -19,7 +24,7 @@ spec: securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}} containers: - name: flex-auth - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/tenant-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/tenant-engine/policy_package.md"] ports: [{name: http, containerPort: 8080}] securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true} @@ -45,7 +50,7 @@ spec: securityContext: {runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}} containers: - name: flex-auth - image: forgejo.coulomb.social/coulomb/flex-auth@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4 + image: forgejo.coulomb.social/coulomb/flex-auth@sha256:138aa3471c46bca6e814691fa1e6520aedda3dffd743e6b09141ab433afdb64b args: ["serve", "--addr", "0.0.0.0:8080", "--registry", "/opt/flex-auth/examples/user-engine/registry_snapshot.json", "--policy", "/opt/flex-auth/examples/user-engine/policy_package.md"] ports: [{name: http, containerPort: 8080}] securityContext: {allowPrivilegeEscalation: false, capabilities: {drop: ["ALL"]}, readOnlyRootFilesystem: true} diff --git a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md index 3440197..e642814 100644 --- a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md +++ b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md @@ -10,7 +10,7 @@ owner: codex topic_slug: net-kingdom planning_priority: P0 created: "2026-08-23" -updated: "2026-08-23" +updated: "2026-09-23" origin: routed origin_ref: "State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0" related: @@ -219,3 +219,15 @@ is why each partial fix appeared to change nothing. Remaining before T05 can close: a green receipt from the repaired script, and a ruling on whether a predecessor disposition observed but not receipted is an acceptable close for this incident. + +### Operator ruling 2026-09-23 — predecessor disposition + +The operator (Bernd Worsch) accepted the two recorded observations from +2026-08-27 as the disposition of the exposed LLDAP predecessor: the WebUI +lockout, and the `--check` run that passed `predecessor-denial`. A receipt +cannot be produced because the value is unrecoverable. The incident closes +once `reconcile-lldap-resolver-live.sh --check` emits a green receipt, and +nothing else is required. + +The custody gap (rotation does not retain the outgoing value) is a +rotation-runbook fix. It is not a reason to reopen this incident. diff --git a/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md b/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md index 665eb09..11a9776 100644 --- a/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md +++ b/workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md @@ -11,6 +11,7 @@ topic_slug: netkingdom created: "2026-09-23" updated: "2026-09-23" related: [FLEX-WP-0020, FLEX-DEC-2026-013, NK-WP-0026] +state_hub_workstream_id: "284a8ac2-61dc-5bee-b74a-0a62d9808edb" --- Intake for the flex-auth handoff request (hub message `3bc95c76`, surface @@ -29,6 +30,7 @@ rollout. id: NK-WP-0039-T01 status: done priority: high +state_hub_task_id: "adfaa07d-dd15-50a6-a781-7cee2772fc90" ``` Read-only check on railiance01 (node `92.205.62.239`) on 2026-09-23. The @@ -57,16 +59,20 @@ the live ones. | `flex-auth-tenant-engine` | `c25fc34a…` | `05a03a87…` | | `flex-auth-user-engine` | `1f529037…` | `138aa347…` | -Which side is current has not been established. Reconciling them is a -separate decision with flex-auth. Re-applying the declared file as it stands -would replace the running images. +Resolved 2026-09-23 (flex-auth reply `28d9c6ca`): live is correct. `05a03a87` +was promoted 2026-09-11 for NK-WP-0036-T03 (flex-auth evidence +`docs/evidence/2026-09-11-user-portal-tenant-policy.md`); `138aa347` has been +live since 2026-08-19 (FLEX-WP-0015-T02). flex-auth's source of truth is +`values/.yaml` in flex-auth. `runtime.yaml` now declares the live +digests. See T04 for the rest of the drift. ## Confirm the image-pull path survives the rename ```task id: NK-WP-0039-T02 -status: wait +status: done priority: high +state_hub_task_id: "73e98d7a-bff6-5111-93b1-f36938ab624f" ``` The image path is `coulomb/flex-auth`, which is also the repository name. @@ -77,7 +83,11 @@ Before the rename lands, flex-auth confirms one of these: - the package moves, and flex-auth names the new coordinate and the cut-over window. -Waiting on flex-auth under FLEX-WP-0020. +Answered 2026-09-23 (flex-auth `28d9c6ca`): the package stays resolvable as +`coulomb/flex-auth`. Forgejo packages are scoped to the owner, not the +repository, and FLEX-WP-0020 keeps the package coordinate. There is no new +coordinate and no cut-over window. FLEX-WP-0020 T09 verifies publication and +pulls after the rename. The image pins do not change because of the rename. ## Update repository-coordinate references once access-engine resolves @@ -85,6 +95,7 @@ Waiting on flex-auth under FLEX-WP-0020. id: NK-WP-0039-T03 status: wait priority: medium +state_hub_task_id: "6e62919d-117d-57ab-b55b-1b437a105402" ``` Once flex-auth announces that `coulomb/access-engine` resolves, update @@ -93,3 +104,28 @@ changes, update the two image pins in `sso-mfa/k8s/tenant-engine/runtime.yaml` in the same change as the digest reconciliation from T01. Applying that live needs the founder's go-ahead. Leave runtime names and historical records unchanged. + +After T02, no in-repo coordinate reference needs to change: the image pins +stay, and NK-WP-0026 is a historical record. This task waits only for +flex-auth's announcement that `access-engine` resolves, which confirms that +nothing else moved. + +## Retire or reconcile the stale flex-auth/tenant-engine reference manifest + +```task +id: NK-WP-0039-T04 +status: todo +priority: high +``` + +A read-only `kubectl diff` of `sso-mfa/k8s/tenant-engine/runtime.yaml` +against railiance01 on 2026-09-23 showed live ahead of the file beyond the +digests. flex-auth runs with `--caller-auth-mode enforce` and caller +bindings. tenant-engine runs image `a8e8086f…` (file: `2249e8c6…`) with a +different strategy, PVC mount and env. The egress rules also differ. No script +applies the file. It now carries a DO-NOT-APPLY header, because applying it +would drop caller-auth enforcement. + +Decide with flex-auth and tenant-engine whether NetKingdom keeps a reference +copy. The recommendation is to replace it with pointers to the owners' +declarations (ADR-0015) rather than reconcile it field by field.