coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ops: record native tenant success and prepare attended identity repair

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-11 21:41:26 +02:00
parent 6f9cfe3dfd
commit 6a0773bcfa
6 changed files with 369 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

57
workplans/NK-WP-0036-restore-user-portal-client-registration.md
View file

@ -70,7 +70,7 @@ reached the platform form. See docs/evidence/2026-09-11-native-portal-repair.md.
```task
id: NK-WP-0036-T03
status: progress
status: done
priority: high
state_hub_task_id: "378b03b3-aedc-50c3-8de7-94064794582b"
```
@ -94,3 +94,58 @@ actual allowed/denied contract with authenticated consumer calls. Then reconcile
native demo tenant existence before retrying the operator form. RAPPS-WP-0014
retains actual tenant onboarding and product placement; this workplan does not
claim tenant existence or application readiness from component tests alone.
Completed: both owner suites and CI images passed, the Tenant Engine PDP and
User Engine runtime were independently promoted by immutable digest, nine live
policy/caller checks passed, and native demo-company readback returns not-found.
Remaining actual operator submission, administrator onboarding and application
placement remain live in RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04. This
integration repair is complete; the invited product pilot is not yet admitted.
Follow-through: the operator submitted the native form successfully at 19:03:18
UTC. Independent authority readback confirms demo-company active/version 1;
User Engine shows the first administrator as invited. Remaining ordinary members,
identity activation and product accounts are retained in RAPPS-WP-0014-T02.
## Reconcile the identity provisioner's rejected directory credential
```task
id: NK-WP-0036-T04
status: wait
priority: high
needs_human: true
intervention_note: "LLDAP rejects the provisioner's current admin login with 401 after reload. Prepared consumer-only reconciliation requires explicit operator acceptance and the current working LLDAP admin credential via hidden terminal input; never send it in chat."
```
A subsequent native Create login fails before directory identity creation, at
LLDAPProvisioner._login, HTTP 401. The existing identity-provisioner image
5b460f5c was restarted to reload its lldap-secrets reference; readiness passed
but contained provider authentication still returns 401. No provider credential
was changed and no rejected create was replayed. Native user records remain.
The non-printing, field-only attended repair and seven synthetic tests are
prepared at sso-mfa/k8s/lldap/identity-provisioner-reconcile.py. See
docs/identity-provisioner-bind-repair.md for exact scope, operator input,
metadata guard, candidate authentication, apply, reload and verification.
Live metadata inspect succeeds; live check/apply is pending current operator
custody and acceptance. The unresolved warden route is a pointer, not authority
to export another live Secret. Retain NK-WP-0033's separate incident residuals.
## Make dependency failure visible before another human onboarding attempt
```task
id: NK-WP-0036-T05
status: todo
priority: high
```
Cover the real provisioner-to-directory contract in a contained preflight,
return a redacted structured dependency failure instead of an uncaught HTTPError,
and make CI execute those contract tests. Keep process liveness distinct from
functional readiness. Publish and promote through a reviewed immutable image
lane, then verify provider login, user creation/linkage and password setup as a
single native onboarding journey. Preserve credential secrecy and avoid
unbounded password-check retries. Actual demo users and application admission
remain RAPPS-WP-0014 and VERGABE-WP-0019.