coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T04: custody client secret reconciled with live; re-sealed custody

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 673304@bnt-lap001
Assistant-Session: 959b12c7-cf2e-440b-a60d-91229cc9e96e
This commit is contained in:
tegwick 2026-10-30 22:01:30 +01:00
parent b19f7f6493
commit 5a52dc8a23
13 changed files with 10 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/evidence/2026-10-30-nk54-bind-split/README.md
View file

@ -31,8 +31,9 @@ UTC, agent (Claude Code) guiding. All receipts are value-free (`values_recorded:
(intended), and the custody client secret **not** matching the live `keycape_client_secret_hash`.
The KeyCape-Authelia client secret was changed after the March custody seal without updating custody.
Step 6 used a one-off helper that calls the same `publish()` path for `ldap_password` only (uid,
resourceVersion and full-data test, readback) and skips only the client-secret check. Follow-up:
reconcile custody with the live client secret (founder-run).
resourceVersion and full-data test, readback) and skips only the client-secret check. Reconciled the
same evening with `sso-mfa/bootstrap/reconcile-keycape-client-secret.py` (founder-run, value-free:
live pair agreed, custody updated and re-checked, re-sealed).
4. Rollouts of identity-provisioner, KeyCape and LLDAP use `Recreate`: each had a short outage of
about 30 s.