coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054-T04: KeyCape client scopes declared from key-cape source (a1ab8ff)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 308701@bnt-lap001
Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
tegwick 2026-10-28 09:53:35 +01:00
parent 81422e3d66
commit 49eb79e267
2 changed files with 18 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -208,6 +208,15 @@ feedback (`tools/posture-feedback`) with an evidence-freshness bound. It changes
**Done when:** a dated run reports conformant, non-conformant and unknown per identity,
with each owner named for every finding.
**2026-10-28 (KeyCape):** key-cape `a1ab8ff` (KEY-WP-0045) adds `keycape identity-facts`, a value-safe
JSON export of the client registry, directory bind, factor service and admin surfaces. Four of
the five KeyCape unknowns are now declared from source (scopes limited to registered scopes,
`token.go:355-363`); `rapp-qonto` stays `unknown` until the live view (reference config names it
`rapp-qonto-client`, `qonto:read`). Findings handed on: KeyCape's LLDAP bind is the directory
admin (scope of T05, KEY-WP-0045-T03); `approval-engine-operator` is withdrawn but registered
(SI-11, KEY-WP-0013-T02). The founder's live view streams the deployed config through the
exporter without writing it to disk; the exact command is in key-cape KEY-WP-0045-T02.
## Split the directory bind from the human admin
```task