From 65b9d3f72951ca26e337ff25acece4a127e7a28a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 22:06:58 +0100 Subject: [PATCH] NK-WP-0055: production readiness workplan; NK-WP-0049 finished with residuals moved Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- WORK-RECORDS.md | 14 +- ...-bootstrap-secret-free-recovery-handoff.md | 13 +- ...-security-platform-production-readiness.md | 234 ++++++++++++++++++ 3 files changed, 253 insertions(+), 8 deletions(-) create mode 100644 workplans/NK-WP-0055-security-platform-production-readiness.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e47b402..7a66ff0 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -46,12 +46,13 @@ | workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | | workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | | workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | -| workplan | NK-WP-0049 | active | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| workplan | NK-WP-0049 | finished | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | | workplan | NK-WP-0052 | finished | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md | | workplan | NK-WP-0053 | active | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md | | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md | +| workplan | NK-WP-0055 | proposed | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -294,7 +295,7 @@ | task | NK-WP-0049-T41 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T42 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T43 | cancel | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T44 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T44 | cancel | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md | @@ -317,6 +318,15 @@ | task | NK-WP-0054-T06 | wait | — | workplans/NK-WP-0054-service-identity-policy.md | | task | NK-WP-0054-T07 | todo | — | workplans/NK-WP-0054-service-identity-policy.md | | task | NK-WP-0054-T08 | done | — | workplans/NK-WP-0054-service-identity-policy.md | +| task | NK-WP-0055-T01 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T02 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T03 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T04 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T05 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T06 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T07 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T08 | todo | — | workplans/NK-WP-0055-security-platform-production-readiness.md | +| task | NK-WP-0055-T09 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 1721a90..e708826 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -4,7 +4,7 @@ type: workplan title: "Remove bootstrap secret output and verify separated recovery custody" domain: infotech repo: net-kingdom -status: active +status: finished owner: codex topic_slug: netkingdom created: "2026-10-12" @@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery or newly granted authority. The earlier dated narrative remains in Git at `cc2dd01`; its evidence references are carried into the tasks below. -**Current position, 2026-10-27:** 42 tasks done; 1 cancelled (T43, phase B paused); 1 waiting (T44, pre-production joint drill). T03 closed the G08 handoff in builder mode (founder decision, option A). The workplan stays `active` only for T44. +**Closed 2026-10-27 (finished, builder mode):** 42 tasks done; 2 cancelled (T43 phase B paused, T44 moved). All production-readiness residuals live in [NK-WP-0055](NK-WP-0055-security-platform-production-readiness.md). -**Next actions:** run T44 before the estate is declared production. +**Next actions:** none here; continue in NK-WP-0055. **Closure:** T03 assembles owner acceptance after its named dependencies pass. Passing archive recovery does not prove existing-user authentication, retained @@ -1648,11 +1648,10 @@ task does not run phase B and does not replace T18's live consumer login or owne ```task id: NK-WP-0049-T44 -status: wait +status: cancel priority: medium assignee: claude-code depends_on: [NK-WP-0049-T18, NK-WP-0049-T21] -blocking_reason: "Builder-mode residual of T18. Run before the estate is declared production: build the phase B module from the retained T43 design, rehearse it, then a founder-signed window." state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9" ``` @@ -1662,6 +1661,8 @@ state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9" (secrets-engine-openbao) passes native positive/negative login, plus one browser/PKCE client; this closes key-cape K1 and railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources. Also re-prove reserved-LDAP-group denial and the resolver cutover functionally (from T21). + +2026-10-27: moved, not dropped. The founder closed NK-WP-0049 in builder mode, and this drill now lives in [NK-WP-0055](NK-WP-0055-security-platform-production-readiness.md): T02 (build and rehearse), T03 (live consumer and PKCE login) and T04 (reserved-group denial and resolver re-proof). ## Accept remaining recovery and caller evidence and close the G08 handoff ```task @@ -1690,7 +1691,7 @@ not call a deferred rotation or an untested full-estate restore complete. 2026-10-27 closure (founder-accepted, builder mode): T03 is **done**. Dependencies T02 and T15–T38 are done except T43 (cancelled: phase B paused, design retained in T44). G08 handoff evidence: archive recovery and backup activation (T04–T14, T23–T26); isolated owner recoveries of LLDAP (T16), Authelia (T17), existing-token MFA (T19), privacyIDEA audit continuity (T20), KeyCape issuer side (T18, receipt `16d72f7c…1651`, key-cape acceptance `fc9f09a`) and OpenBao (RPF-WP-0064, receipt `4e048dee…579d`, railiance-platform acceptance `5658150`); caller ledger (T02) and accepted dispositions (T21); historical objects deleted and verified absent (T22). -Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 stays `active` only for T44. +Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 closed 2026-10-27; residuals moved to NK-WP-0055. ## Evidence locations and refinement history “Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom. diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md new file mode 100644 index 0000000..7771c83 --- /dev/null +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -0,0 +1,234 @@ +--- +id: NK-WP-0055 +type: workplan +title: "Reach and prove security platform production readiness" +domain: infotech +repo: net-kingdom +status: proposed +owner: claude-code +topic_slug: netkingdom +created: "2026-10-27" +updated: "2026-10-27" +flavor: implementation +depends_on: [] +related: + - NK-WP-0049 + - CUST-WP-0073 + - RPF-WP-0064 + - RPF-WP-0036 +--- + +The estate is in **builder mode**. This workplan holds the work that has to pass before +NetKingdom's security platform is declared production-ready. Builder-mode workplans can +close with named residuals, and those residuals land here instead of keeping their source +plans open. Nothing in this plan needs to run before the founder decides to move toward +production. + +## Definition of production readiness + +The security platform is production-ready when every area of the +[Production Readiness Checks](../docs/platform-identity-security-architecture.md#production-readiness-checks) +table has its check recorded as **met**, with evidence, or as an **accepted exception** +with an owner and a review date. A check counts only if it was observed on the estate +that serves production traffic. Fixtures, rehearsals and builder-mode acceptances do not +count. The areas are: + +1. Platform root custody +2. MFA and identity +3. Bootstrap and recovery +4. OpenBao runtime secrets +5. Secret rotation +6. flex-auth policy state +7. Topaz runtime +8. Tenant onboarding +9. Audit sink +10. Break-glass + +For **Bootstrap and recovery**, this plan adds three requirements, drawn from NK-WP-0049: + +- **Joint restore:** the restored identity services and OpenBao work together for a real + login. +- **Recurring drill:** restores are re-proved on a schedule, not just once. +- **Credential cleanup:** the remaining bootstrap-era credentials are rotated or revoked. + +Readiness does not mean HA. HA is a separate decision, and the current estate runs on one +node. + +## Assess every readiness area against current evidence + +```task +id: NK-WP-0055-T01 +status: todo +priority: medium +assignee: claude-code +``` + +**Done when:** a readiness ledger +(`docs/evidence/-production-readiness-ledger.md`) lists all ten areas, each with: + +- a status: met, partial, open, or accepted exception; +- the evidence or the exact missing proof; +- the owner repository; +- the task that carries the gap. + +Gaps that the tasks below don't cover get new tasks in this plan, or a pointer to an +existing owner workplan. The assessment is read-only. + +## Build and rehearse the joint-restore drill (from NK-WP-0049-T43/T44) + +```task +id: NK-WP-0055-T02 +status: wait +priority: medium +assignee: claude-code +blocking_reason: "Starts when the founder schedules the move toward production." +``` + +Start from the design retained in NK-WP-0049-T43: + +- the secrets-engine inherited-pipe runner (`65a3dbe`), with the founder's optimizations + 1, 3, 4 and 5; +- the railiance-platform phase B network (`5658150`: `rpf64-nk49-pb`, `10.249.64.0/28`; + the rehearsal variant uses `-rh-`); +- the client secret `keycape-secrets-engine-openbao-client` (key `client-secret`), read + from archive member `resources/sso/secret/keycape-secrets-engine-openbao-client.json`. + +The work: + +- a new reviewed phase B module, with its verifier and tests; +- a single-member, non-echoing decrypt wrapper; +- the owners' adapter and runner changes; +- a synthetic-client rehearsal on the throwaway network; +- the value-free OpenBao `/jwks` trust probe. + +Do not edit the pinned NK-WP-0049 T38/T40 sources. + +**Done when:** the module, wrapper, adapter and runner are reviewed to T38 depth and the +synthetic rehearsal passes. + +## Run the joint restore with a live consumer and a PKCE client + +```task +id: NK-WP-0055-T03 +status: wait +priority: medium +assignee: claude-code +depends_on: [NK-WP-0055-T02] +blocking_reason: "Needs T02 and a founder-signed window. The letsencrypt-prod reissue for kc.coulomb.social needs a fresh duplicate-certificate check, or at least 7 days since the last issuance." +``` + +**Done when:** + +- restored KeyCape and restored OpenBao are joined on the isolated network; +- `secrets-engine-openbao` passes the native positive and negative login checks; +- one browser authorization-code/PKCE client passes as well; +- the verifier has independently checked the receipt. + +This closes NK-WP-0049 residuals key-cape K1 and railiance-platform R1/R2. The founder +explicitly accepts the unseal window length when signing. + +## Re-prove the reserved-group denial and the resolver cutover (from NK-WP-0049-T21) + +```task +id: NK-WP-0055-T04 +status: wait +priority: medium +assignee: claude-code +depends_on: [NK-WP-0055-T02] +blocking_reason: "Runs in the joint-restore drill environment or as its own owner-admitted live check." +``` + +**Done when:** + +- the deployed reserved LDAP group is natively denied, both in a positive and a negative + case; +- the privacyIDEA LLDAP resolver/cutover inputs have provenance and a functional proof on + the target estate. + +## Admit a credential lane for the attended factor diagnostic + +```task +id: NK-WP-0055-T05 +status: todo +priority: low +assignee: claude-code +``` + +The diagnostic (`mfa_state.py`, `check-user-mfa-state.sh`) has no admitted credential. It +must not borrow KeyCape's `keycape-factor-read`. Live, only `sso/keycape` mounts that +secret, verified 2026-10-27. + +**Done when:** the owner has an admitted delivery and execution arrangement, found through +`warden route`, and one attended diagnostic run passes. The alternative is an accepted +decision that the diagnostic is not needed for production. + +## Rotate or revoke the bootstrap-era and exposed credentials + +```task +id: NK-WP-0055-T06 +status: wait +priority: high +assignee: claude-code +blocking_reason: "Founder rotation deferral CUST-WP-0073-T05 / decision 1591daa1 is in force until the founder lifts it." +``` + +This includes the privacyIDEA credentials behind the deleted `sso/keycape-pi-token` and +`mfa/privacyidea-trigger-admin`. The architecture requires rotating bootstrap-era +credentials before live workloads rely on the platform. + +**Done when:** each affected credential has verified revocation or rotation, with +signing and client-secret preservation proven, or an accepted exception. Execution belongs +to the credential owners. This task tracks it and does not duplicate CUST-WP-0073. + +## Make restore assurance recurring + +```task +id: NK-WP-0055-T07 +status: todo +priority: medium +assignee: claude-code +``` + +Carries NK-WP-0049-T24 G3 and railiance-platform R6 (RPF-WP-0036-T03). + +**Done when:** a scheduled drill re-proves the isolated identity and OpenBao restores on +the current backup generation. It must include: + +- image-lineage proof (R5); +- the audit-device mount (R8); +- a reconciliation procedure for changes made after the archive was taken (K2). + +Drill results land in the readiness ledger. + +## Decide durable custody for receipts kept outside Git + +```task +id: NK-WP-0055-T08 +status: todo +priority: low +assignee: claude-code +``` + +The T18 KeyCape receipt (`16d72f7c…1651`) and the OpenBao restore receipt +(`4e048dee…579d`) exist only on the founder workstation, because the secret scanners flag +their public digests. + +**Done when:** an accepted custody location with a second copy holds them, still bound by +their recorded hashes, or the founder accepts single-copy custody as an exception. + +## Close readiness and declare production + +```task +id: NK-WP-0055-T09 +status: wait +priority: high +assignee: claude-code +depends_on: [NK-WP-0055-T01, NK-WP-0055-T03, NK-WP-0055-T04, NK-WP-0055-T05, NK-WP-0055-T06, NK-WP-0055-T07, NK-WP-0055-T08] +blocking_reason: "Every readiness area must be met or an accepted exception." +``` + +**Done when:** + +- the readiness ledger shows every area as met or as an accepted exception; +- the founder records the production declaration as a decision; +- SCOPE.md's capability table is updated to match.