coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T21: builder-mode caller disposition draft for founder acceptance

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:53:52 +01:00
parent 7e9bcdd4b7
commit 687ec01d9b
2 changed files with 45 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

43
docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md Normal file
View file

@ -0,0 +1,43 @@
# NK-WP-0049-T21 caller dispositions — builder-mode acceptance draft
**Status:** draft for founder acceptance, 2026-10-27. Nothing here is accepted until the founder says so.
**Source:** [T02 caller ledger](../2026-10-23-nk49-t02-caller-ledger/caller-ledger.json) (93 entries, complete
per-entry reconciliation). All rows are owned by net-kingdom. Two also name another owner: one is shared with key-cape, and the
backup-profile row's job belongs to railiance-platform.
## Proposed disposition by category
| Category | Rows | Proposed builder-mode disposition |
|---|---|---|
| current | 59 | Accept as current callers. 52 have no follow-up; their documented route is the acceptance. The other 7 are covered under **Follow-up elsewhere** below. |
| current diagnostic | 12 | Accept as read-only diagnostics. They prove no recovery and grant nothing. |
| retired | 11 | Accept retirement. Their refusing entry points are covered by `tests/test_retirement_and_bundle_boundaries.py`. |
| current (recovery tooling / internal / repair) | 6 | Accept. They were exercised by the actual T16–T20 owner runs, and the drill rows feed NK-WP-0049-T24 G3. |
| owner-deferred, greenfield only | 4 | Accept the deferral. These are `create-secrets.py`, privacyIDEA `bootstrap-admin*.py` and `authentication-policy-rollout.py`. None of them runs on the current estate, and any re-run needs its own owner decision. |
| superseded on 1.3 admission | 1 | Accept. `vergabe-client-rollout.py` retires when NK-WP-0048-T16 admits 1.3. |
## Follow-up already tracked elsewhere (no new task)
| Row | Live work record |
|---|---|
| `keycape-client.py` | NK-WP-0048-T16 (1.3 re-freeze) |
| `openbao-signin-diagnosis-rollout.py` | NK-WP-0051-T02 / KEY-WP-0041-T02 |
| `activate-onboarding-policy.py`, `deploy-onboarding-guard.py`, `enable-factor-confirmation.py` | NK-WP-0042 pilot reuse |
| `deploy-factor-recovery.py` | NK-WP-0042 step-up/recovery journey |
| `identity-backup-profile.json` | NK-WP-0049-T24 (second provider) |
| recovery inventory/fetch tools | NK-WP-0049-T24 G3 recurring drill |
## T21's named checks: builder-mode position
| Named in T21 | Position | Residual |
|---|---|---|
| Dedicated factor-diagnostic admission | Delivered as its own lane (NK-WP-0051 / KEY-WP-0041). It does not borrow KeyCape's reader. | Native acceptance stays in NK-WP-0051-T02. |
| Reserved LDAP group denial | `manage-group-members.sh` is a current, documented route. | A live native denial check of the reserved group is not re-run here. It goes into the T44 pre-production drill. |
| Resolver/cutover input provenance | `resolver_cutover.py` and the `*-lldap-resolver-live.sh` scripts are documented routes. NK-WP-0022 (finished) carried the cutover. | No new functional proof is claimed. Re-proof belongs in T44. |
| Bootstrap, root-output and isolation callers | Covered by T01 (secret output removed), the retirement tests and the T16–T20 isolated runs. | None. |
## What acceptance means
Acceptance means the founder, as owner, accepts each row's recorded disposition for the builder-mode estate. It does
not claim fresh native positive/negative checks for every current caller. Those checks are named above and assigned
to the T44 drill or the owning workplan. No write, cutover, credential change or new grant results from this record.