diff --git a/docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json new file mode 100644 index 0000000..196afa8 --- /dev/null +++ b/docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json @@ -0,0 +1,1889 @@ +{ + "schema": "nk49.t02-caller-ledger-draft.v1", + "generated": "2026-10-23", + "source_inventory": "docs/evidence/2026-10-15-bootstrap-recovery/caller-source-inventory.json", + "source_inventory_sha256": "d6a1a575e2690a242db76d6d5de60f48648211f2cf62c156f22486e1e0bbf28d", + "status": "mechanical first pass (read-only); candidate_status is not an owner disposition", + "method": "presence + sha256 drift vs inventory; basename referenced from Makefile/*.mk/bootstrap scripts/console = active route; else basename referenced from runbooks/docs/sso-mfa markdown = documented operator route", + "pending_columns": [ + "owner", + "credential_route", + "consumers", + "native_evidence", + "next_task" + ], + "summary": { + "current (active route)": 28, + "current (documented operator route)": 26, + "unrouted: owner disposition needed": 17, + "retired (refusing entry point)": 11, + "current diagnostic, unrouted": 11 + }, + "drifted": 5, + "entries": [ + { + "path": "Makefile", + "inventory_sha256": "5d2114f6141bb8504c5c780044302126c07958a5732afdb0d0c0218a4f84210e", + "present": true, + "drifted": true, + "last_change": "bde143e 2026-10-19", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "(root)" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/NetkingdomRuntimeArchitecture.md", + "docs/adr/ADR-0015-netkingdom-railiance-workload-packaging-and-relational-platform.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md" + ] + }, + { + "path": "sso-mfa/bootstrap/apply-service-secrets.py", + "inventory_sha256": "ea9c3418ed00527b9019ab9893f1f3c9fe29d0697f1f0c879e28fdbae373889b", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/bootstrap/README.md" + ] + }, + { + "path": "sso-mfa/bootstrap/creds-apply.sh", + "inventory_sha256": "a70dba396484b2a353a39349c3d3719f7b6695b9f0e35025ef79e3db0ec2ff53", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/bootstrap/README.md" + ] + }, + { + "path": "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "inventory_sha256": "cc27c4f3969c292a913a0ae325cd0d4ec2665f9fffbbd1eb1c5f73b08e398a32", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/smooth-bootstrap-guide.md", + "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" + ] + }, + { + "path": "sso-mfa/bootstrap/creds-rotate.sh", + "inventory_sha256": "09b387d3555ce2beaeb8d7f000c2d52a1ffea274c793f30bce80a8f3ef5dc2f8", + "present": true, + "drifted": false, + "last_change": "b01a30b 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/security-bootstrap-age-custody.md" + ] + }, + { + "path": "sso-mfa/bootstrap/creds-status.sh", + "inventory_sha256": "f0fe0b885fd22f4789baa86cc2438272700aff8634cfa6b27d55c2c860c9f36d", + "present": true, + "drifted": false, + "last_change": "7d4bb16 2026-10-13", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/creds-verify.sh", + "inventory_sha256": "101b12948c862f21a668b49b3a82efae691ba885d5c8fd7a94a10e095c16a24a", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/decrypt-secrets.sh", + "inventory_sha256": "1572c170ceb9eff9ff408409acb82650ac911edb02961cde48806c68fa80ce76", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/security-bootstrap-age-custody.md" + ] + }, + { + "path": "sso-mfa/bootstrap/emergency-bundle.sh", + "inventory_sha256": "c1a0e9853dae6b71537ecb708b05ce967eacf797334192156485ca943dc8c71e", + "present": true, + "drifted": false, + "last_change": "b97f9f6 2026-10-12", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/encrypt-secrets.sh", + "inventory_sha256": "5b4774488e09a22b409079021e7cd10632c7cf6cf9db6f98cd85e3878d34d435", + "present": true, + "drifted": false, + "last_change": "4cf26a9 2026-10-12", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/security-bootstrap-age-custody.md" + ] + }, + { + "path": "sso-mfa/bootstrap/gen-secrets.sh", + "inventory_sha256": "b4a910cca93427c0e70e1f4c7646fc94d9b885aeae65a10a01cf8e11548ce03d", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/encrypt-secrets.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md", + "sso-mfa/k8s/lldap/README.md", + "sso-mfa/k8s/postgresql/README.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/bootstrap/openbao-init-unseal.sh", + "inventory_sha256": "49485948a8d44576e293b6f709f1bb444e36bed3310c843d47393c3c8d4c1d0b", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "lab-only custody adapter; explicit target; production forbidden", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/openbao-unseal-custody-models.md" + ] + }, + { + "path": "sso-mfa/bootstrap/openbao-lab.py", + "inventory_sha256": "0c14e38f86e189f6123b99e036e4423ebb31266d90f4c4423d3619c2060c3bc7", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "lab-only custody adapter; explicit target; production forbidden", + "referenced_by": [ + "sso-mfa/bootstrap/openbao-init-unseal.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/pack-bundle.sh", + "inventory_sha256": "53abc7af3dcda6cfa9f52e9c10d352b66defa2cbfa7cd71b07c483c6f4a60f66", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md" + ] + }, + { + "path": "sso-mfa/bootstrap/rotation-env.py", + "inventory_sha256": "bab079a51b8e7ad0199676e76e473a13e70f46e0495d8c942502c952236ec893", + "present": true, + "drifted": false, + "last_change": "6ae4708 2026-10-12", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "sso-mfa/bootstrap/creds-rotate.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/sops-custody-unlock.sh", + "inventory_sha256": "8a6c02ace974b489d23869a9e99d3305896f4bdc4c430164df09bb4ce1710959", + "present": true, + "drifted": true, + "last_change": "4f65e41 2026-10-17", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/bootstrap-recovery-ceremony.md", + "docs/disaster-recovery-storage-share.md", + "docs/security-bootstrap-age-custody.md" + ] + }, + { + "path": "sso-mfa/bootstrap/sops-private.py", + "inventory_sha256": "113d17ee4cd7ad405e73cc51e1823dc02bd2e618e7fa67c1b624f0226e334ec6", + "present": true, + "drifted": true, + "last_change": "4f65e41 2026-10-17", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/bootstrap/sops-write.py", + "inventory_sha256": "5a785e9c8e6a40ca9120a668d93992ea5c3115566ada21933536cc2d931f1ddf", + "present": true, + "drifted": false, + "last_change": "8f80857 2026-10-13", + "inventory_classification": "private custody/local operation; explicit input; owner procedure required", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/authelia/create-secrets.sh", + "inventory_sha256": "137e137d973993e3938dbfe656b036e8d4d9643f84b5e8ca7ab30fbc5810ea1c", + "present": true, + "drifted": false, + "last_change": "b01a30b 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/creds-rotate.sh", + "sso-mfa/bootstrap/gen-secrets.sh", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/approval-clients-rollout.py", + "inventory_sha256": "488d5cc59e081993dd2b5fc6d9e46bbddcaec4f5170b8f7a5ad0aae3a211a790", + "present": true, + "drifted": false, + "last_change": "303a584 2026-09-09", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/keycape-approval-clients-rollout.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/authentication-policy-rollout.py", + "inventory_sha256": "2c1bd23fded4855bae1eb3a08dbc4510d7f60f2bc4d625d60e471ab78f6f0251", + "present": true, + "drifted": false, + "last_change": "a549617 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/keycape/configure-openbao-oidc.sh", + "inventory_sha256": "bf214ac511fbd2269935f3270c6d4491c729d834e8138b9d7404aecf23c0825f", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/create-pi-token.sh", + "inventory_sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152", + "present": true, + "drifted": false, + "last_change": "7d4bb16 2026-10-13", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-age-custody.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/create-secrets.py", + "inventory_sha256": "5da672fff36eb94101741ad99e2a1a96ae81fea15ed1871304c40e63ce27c787", + "present": true, + "drifted": false, + "last_change": "7d4bb16 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/keycape/create-secrets.sh", + "inventory_sha256": "f5131160d91641a59c3163a17a8dd4f9b97d228eb8a5e0d8ad04cc2f7ff51644", + "present": true, + "drifted": false, + "last_change": "7d4bb16 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/creds-rotate.sh", + "sso-mfa/bootstrap/gen-secrets.sh", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/exercise-approval-clients.py", + "inventory_sha256": "e2d3dd741ac52af28dce752344227a4443b78fedd4cfcc06ba902e679dfc9351", + "present": true, + "drifted": false, + "last_change": "303a584 2026-09-09", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/keycape-approval-clients-rollout.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/keycape-client.py", + "inventory_sha256": "e31ee2883fad4f93635700608ad98e05984c9e0453515dd7710c897ca856b8c8", + "present": true, + "drifted": true, + "last_change": "8790dd1 2026-10-16", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/playwright-registration.md", + "sso-mfa/k8s/keycape/bind-env-adapter.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/openbao-client-config.py", + "inventory_sha256": "1b908b4c36134212d78f9fbe7a2a201eb3ced06d31bb1dcea4a59d80689d84b1", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/keycape-upstream-issuer-pin.md", + "sso-mfa/k8s/keycape/README.md", + "sso-mfa/k8s/keycape/bind-env-adapter.md", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/openbao-negative-node-wrapper.py", + "inventory_sha256": "76ac013d1a676a0dfa58aea1ce87b0c3e72483ccd21f586a22c5475e9132f6c1", + "present": true, + "drifted": false, + "last_change": "7ceac43 2026-10-11", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/keycape/openbao-negative-node-route.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/openbao-negative-session.py", + "inventory_sha256": "24b7b803e4eb7e6e7c0700a069dad0ec315ee7eb5538a88b9e56147f8fab5cdd", + "present": true, + "drifted": false, + "last_change": "7ceac43 2026-10-11", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/keycape/openbao-negative-node-route.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/openbao-signin-diagnosis-rollout.py", + "inventory_sha256": "a57b957d6eed9e8fb09d2a7aa7405a39deeafd9aaf57a9e6dc907afabd380371", + "present": true, + "drifted": false, + "last_change": "c7ad8a5 2026-10-15", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/keycape/patch-openbao-client.sh", + "inventory_sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/playwright-activation.py", + "inventory_sha256": "5ac683b3324b00e6253f6040f4c73057027b1f98f7071160a6153794ba522757", + "present": true, + "drifted": false, + "last_change": "276b95f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/playwright-registration.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/playwright-registration.py", + "inventory_sha256": "bf2d6b83d93629df8ddaf6c31d6c7408ae3866969d63895714df0e08a570da99", + "present": true, + "drifted": false, + "last_change": "276b95f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/playwright-registration.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/portal-client-rollout.py", + "inventory_sha256": "158e1d36eb881cdd0a2eda91b472adea5e8fde5061e00d26dda368580aeb871f", + "present": true, + "drifted": false, + "last_change": "dc42b03 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/keycape/bind-env-adapter.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/refresh-pi-token-live.sh", + "inventory_sha256": "2f750aea638c06eb11dfe7afcf7b3d6117ba9e964cbf2a48bb12590054178152", + "present": true, + "drifted": false, + "last_change": "7d4bb16 2026-10-13", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/register-coulomb-social.py", + "inventory_sha256": "b40ff4bdba71b797f8f393e79cb3c9d73b790045a0f7df6ecea35803369793c7", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/keycape/register-coulomb-social.sh", + "inventory_sha256": "cfd0dbd0528e799ee59d8aa4cd1cefc2189227cbc92d251f2a67bb25212aecad", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/register-user-engine-portal.py", + "inventory_sha256": "67173edc44f5457e7b6a3e0fb2321b398159cfce5dea8ead01eabf835fb38d76", + "present": true, + "drifted": false, + "last_change": "dc42b03 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/keycape/bind-env-adapter.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/secrets-engine-openbao-client-rollout.py", + "inventory_sha256": "8b834e5f0353a5e11797637420609e06e7bf7de47777c7e78b774f74d4a6afbd", + "present": true, + "drifted": false, + "last_change": "a1e7302 2026-10-06", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/vergabe-client-rollout.py", + "inventory_sha256": "8cee6cc5ff3e3e8617304055263d04b393d0e005c34d9af12cb7e8bc685bac1a", + "present": true, + "drifted": false, + "last_change": "48a75b1 2026-09-12", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/keycape/verify-openbao-client.sh", + "inventory_sha256": "6f8e75ad16f0d35f776d1a8da85842dc1174085a730f0189a7f5a36a0d7db83f", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [ + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/keycape/verify-user-engine-portal.py", + "inventory_sha256": "ccd5106395bd5d7b4f3dbbcbad449e3793aff217d4429b5d5af9e52ab9a58103", + "present": true, + "drifted": false, + "last_change": "6cd89f0 2026-09-11", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/evidence/2026-09-11-native-portal-repair.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/bootstrap-users.sh", + "inventory_sha256": "309da1de430638e4ed0b9bfe11b7bbb472a6bfe364cdfb6c69499c6fb78b66d6", + "present": true, + "drifted": false, + "last_change": "ab25dde 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/intakes/activity-core-ops-sso-operators.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md", + "sso-mfa/k8s/lldap/README.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/break-glass.sh", + "inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294", + "present": true, + "drifted": false, + "last_change": "84c5dbe 2026-10-14", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/legacy-lldap-lifecycle-retirement.md", + "sso-mfa/WORKPLAN.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/create-secrets.sh", + "inventory_sha256": "fb2ee3b5af858297d20f8bc8821ee13a86d6ebc9235756b9ed9a8e85a54d84a1", + "present": true, + "drifted": false, + "last_change": "b01a30b 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/creds-rotate.sh", + "sso-mfa/bootstrap/gen-secrets.sh", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/create-user.sh", + "inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294", + "present": true, + "drifted": false, + "last_change": "84c5dbe 2026-10-14", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/NetkingdomRuntimeArchitecture.md", + "docs/attended-procedure-inventory.md", + "docs/legacy-lldap-lifecycle-retirement.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/user-engine-netkingdom-integration-assessment.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/dry-run-nonroot-user.sh", + "inventory_sha256": "a30cc22a990d368b9066e2e8b7aaef1c993c1c8a86e191ad2afb0e5c4d4f3294", + "present": true, + "drifted": false, + "last_change": "84c5dbe 2026-10-14", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [ + "Makefile" + ], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/NetkingdomRuntimeArchitecture.md", + "docs/attended-procedure-inventory.md", + "docs/legacy-lldap-lifecycle-retirement.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/identity-provisioner-reconcile.py", + "inventory_sha256": "e124b94c3a5749d4e3fdfc5fd054acfb295594beac24cd399a7b24a8617683d6", + "present": true, + "drifted": false, + "last_change": "6a0773b 2026-09-11", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/evidence/2026-09-11-native-portal-repair.md", + "docs/identity-provisioner-bind-repair.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/lldap_admin.py", + "inventory_sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36", + "present": true, + "drifted": false, + "last_change": "2cc09ce 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/sign-in-diagnosis.md", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" + ] + }, + { + "path": "sso-mfa/k8s/lldap/manage-group-members.sh", + "inventory_sha256": "3c85e4e882ad003a4dc513d9085d136531511273db8adf27e1fcf5e749ae04d1", + "present": true, + "drifted": false, + "last_change": "ab25dde 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md", + "sso-mfa/k8s/lldap/OPERATOR-GROUPS.md" + ] + }, + { + "path": "sso-mfa/k8s/postgresql/create-secrets.sh", + "inventory_sha256": "801ae8a404f0a8fd2bb349003091ab6a509df2533bc1a0f456dd7d5940d917e9", + "present": true, + "drifted": false, + "last_change": "b01a30b 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/creds-rotate.sh", + "sso-mfa/bootstrap/gen-secrets.sh", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/activate-onboarding-policy.py", + "inventory_sha256": "edd6d3d4507e11e1632002e56f948bb2e81465132500627b5ddc7fa0f06203d1", + "present": true, + "drifted": false, + "last_change": "a549617 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/bootstrap-admin-remote.py", + "inventory_sha256": "c83c3a5c9a753a8afec90c35ce5ddbfc15f7b8aff437065f428109d9c5774b89", + "present": true, + "drifted": false, + "last_change": "19a1c75 2026-10-12", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.py", + "inventory_sha256": "b81b5c3806dbdf03ea7cac37884cc368de0f0ef7880ac326b67af3a291c35890", + "present": true, + "drifted": false, + "last_change": "19a1c75 2026-10-12", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/bootstrap-admin.sh", + "inventory_sha256": "1a11738c1790cc6b5f23ed40f02971591eb76afa486be89d5535b0027aca6989", + "present": true, + "drifted": false, + "last_change": "19a1c75 2026-10-12", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-age-custody.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/bootstrap-realm.sh", + "inventory_sha256": "d3dc530d378ce826f4875c4cf066a6f7f916c3abd5492eb5ee237a8c98b7957b", + "present": true, + "drifted": false, + "last_change": "30f0d27 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/attended-procedure-standard.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/check-user-mfa-state.sh", + "inventory_sha256": "18901decfdc974ba5a6e871b7a4fe8022be59c73123774a31c57303fd5f657be", + "present": true, + "drifted": false, + "last_change": "96feef4 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/create-secrets.sh", + "inventory_sha256": "6644b37f2a0ba09b67e135516204950474bd8fa28a243f62e29b898d00c08d91", + "present": true, + "drifted": false, + "last_change": "b01a30b 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/creds-rotate.sh", + "sso-mfa/bootstrap/gen-secrets.sh", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/authelia/README.md", + "sso-mfa/k8s/keycape/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/deploy-factor-recovery.py", + "inventory_sha256": "9a46aa7a1fdf7c202981f2529bc138dcdd952fbefab1d18a88ac65176936a389", + "present": true, + "drifted": false, + "last_change": "a549617 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/deploy-onboarding-guard.py", + "inventory_sha256": "95a3195d01775ea1d800aaa37131d440acc92f2a50215a108c0b63a3441cce94", + "present": true, + "drifted": false, + "last_change": "a549617 2026-09-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/enable-factor-confirmation.py", + "inventory_sha256": "f71e22d6a7a99f4293fb688567ec11c6826a543223b27168e0577e8a6070581e", + "present": true, + "drifted": false, + "last_change": "ce69533 2026-09-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/enckey-bootstrap.sh", + "inventory_sha256": "e47b86ae422f043145525b3deaa4c57ce6ee92974db090695be7fafbe7b61a2e", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "sso-mfa/bootstrap/creds-apply.sh", + "sso-mfa/bootstrap/creds-bootstrap-agent.sh", + "sso-mfa/bootstrap/gen-secrets.sh" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/bootstrap/README.md", + "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/enckey-restore.sh", + "inventory_sha256": "fb31831c1492006ad5f32e16f2ce47baf6e20d0cb56a592432da0698052bf362", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/key-custody-remote.py", + "inventory_sha256": "27b2b885c81923d85054e3999c5613e104fe627779b2b50398ed9bed5088f47e", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/key-custody.py", + "inventory_sha256": "e43d21694cb9c99bd02257a4f225973e992c9af4b0e71788929f949b9752f08a", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/privacyidea/KEY-RECOVERY.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/keycape-scope-probe.py", + "inventory_sha256": "847b8d7c72c11deab15b3d16964e2619011e21d219b1d82c25f0346493abbbef", + "present": true, + "drifted": false, + "last_change": "54a47dd 2026-09-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/mfa_state.py", + "inventory_sha256": "3f0c2e404d7df41af7f8e1fe66a4a6d392338391456ef298c7dd0219ad3d58dc", + "present": true, + "drifted": false, + "last_change": "96feef4 2026-10-13", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/pi_api.py", + "inventory_sha256": "01bbf3a2c1f8c423f864dc4bd2145c5c89f938fa9e8b0ffbbecf6d674484896b", + "present": true, + "drifted": false, + "last_change": "4dffe2f 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/realm_bootstrap.py", + "inventory_sha256": "2885086fdc4fd64b58496f90e82c75eefc7171017004e0804defaaabf791b3a9", + "present": true, + "drifted": false, + "last_change": "30f0d27 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/privacyidea/reconcile-lldap-resolver-live.sh", + "inventory_sha256": "89f5b279cde441ef8a7c63436e63c6242527d36949aba4bad2134c890a9e0b04", + "present": true, + "drifted": false, + "last_change": "4dffe2f 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/attended-procedure-standard.md", + "docs/keycape-exposure-resolver-reconciliation.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/repair-realm-live.sh", + "inventory_sha256": "2684a6caca848f5d9e74191af4ca2864adba92fe3ee410a4236045d1743b99e6", + "present": true, + "drifted": false, + "last_change": "30f0d27 2026-10-13", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "docs/verify-t06.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/resolver_cutover.py", + "inventory_sha256": "6ed2df95671897f073a3dc8fee62b780cdff87b08d617d5a337e1fbba206e10a", + "present": true, + "drifted": false, + "last_change": "4dffe2f 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/keycape-exposure-resolver-reconciliation.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/update-lldap-resolver-live.sh", + "inventory_sha256": "ffa7c551dbcc6ab74d2cfc0853fd0647dd026259b1541f99e4a84dcbac16588c", + "present": true, + "drifted": false, + "last_change": "4dffe2f 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/keycape-exposure-resolver-reconciliation.md" + ] + }, + { + "path": "sso-mfa/k8s/privacyidea/verify_mfa.py", + "inventory_sha256": "118d0052433edb85dd53e3c988943392f59d0aa00641d45f8ff3676a15f8af19", + "present": true, + "drifted": false, + "last_change": "4e07d60 2026-09-05", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "sso-mfa/k8s/user-engine/verify-operability.sh", + "inventory_sha256": "2e1cbde1d2aa2ce9f27685baf93137d5f13d33a77421a2fba1649f874f2b7f48", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "sso-mfa/k8s/user-engine/README.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-identity-cutover-dependencies.sh", + "inventory_sha256": "96da30c4eca28615685ff384bbc7d00d81c7562e8e572a3ad54c3cc6fdd297ca", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/railiance01-coulombcore-cutover-inventory-2026-07-28.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t02.sh", + "inventory_sha256": "7a9fe613fc83841397f2e3b0b4c26c5464d7b903d5e56a83ec786e2289719b24", + "present": true, + "drifted": false, + "last_change": "8e7229a 2026-07-29", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "sso-mfa/k8s/FOUNDATIONS-HISTORICAL.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t03.sh", + "inventory_sha256": "7b3a888ae20394b761d7cd9cf1bc81f273813794a3002202951b061bd6c27963", + "present": true, + "drifted": false, + "last_change": "6d25d08 2026-03-20", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "sso-mfa/k8s/postgresql/README.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t04.sh", + "inventory_sha256": "74128536919f79f17bffc107678718848c4ca095de06140cdc453e68953aabd1", + "present": true, + "drifted": false, + "last_change": "1cbe00f 2026-10-13", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "docs/verify-t06.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t05.sh", + "inventory_sha256": "bb226bad1e5fb60a5d6f87fa67ecee2d6af84d6d6a84fa02d9839d8bca58a197", + "present": true, + "drifted": false, + "last_change": "0754dc3 2026-03-19", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "docs/verify-t06.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/backup/DR-RUNBOOK.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t06.sh", + "inventory_sha256": "717317c1d51f7c3361f3b711d79cae52019c36cd6c397e5fa61f07eaad3632e2", + "present": true, + "drifted": false, + "last_change": "4e07d60 2026-09-05", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [ + "tools/security-bootstrap-console/README.md" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/attended-procedure-standard.md", + "docs/verification-audit-2026-09-05.md", + "docs/verify-t06.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/privacyidea/README.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t07.sh", + "inventory_sha256": "026406ff1fec9e4bf542741c08002c45ea8a94a4ce5a50980665b601485882df", + "present": true, + "drifted": false, + "last_change": "ab25dde 2026-10-14", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "sso-mfa/WORKPLAN.md", + "sso-mfa/k8s/keycape/README.md", + "sso-mfa/k8s/lldap/GROUP-MAINTENANCE.md" + ] + }, + { + "path": "sso-mfa/k8s/verify-t08.sh", + "inventory_sha256": "7efe14c0d71f2c846434d19f8d05702d69d3c40a617a700b08fe13b3764d0650", + "present": true, + "drifted": false, + "last_change": "c054241 2026-03-25", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/attended-procedure-inventory.md", + "docs/verification-audit-2026-09-05.md", + "sso-mfa/WORKPLAN.md" + ] + }, + { + "path": "tools/bootstrap-recovery/inventory-scaleway.py", + "inventory_sha256": "a219df205708fa4ed44b763a418585d63c820c25434bc0fd14e805eb5c2f79d3", + "present": true, + "drifted": false, + "last_change": "c262470 2026-10-15", + "inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "tools/bootstrap-recovery/inventory-storage-share.py", + "inventory_sha256": "673f9b17fb2f3fef6fcdb5c50a2bcca69e3df3157a9e5582a2d995c6b87640b5", + "present": true, + "drifted": false, + "last_change": "a1939a7 2026-10-16", + "inventory_classification": "read-only bounded owner backup metadata; existing caller/custody only; no age key or backup content read", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "tools/bootstrap-recovery/verify-bundle.py", + "inventory_sha256": "885b05a2011e711228e42e316bda70bbe0d97d481383d61aa8469d0f10452370", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "diagnostic; structural observations do not prove recovery or revoke credentials", + "referenced_by": [], + "candidate_status": "current diagnostic, unrouted", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/bootstrap-recovery-ceremony.md" + ] + }, + { + "path": "tools/security-bootstrap-console/security_bootstrap_console.py", + "inventory_sha256": "e9419ab1de0725b12b06fc29098c49584cb8acf47ec0ca09d552915f964a2c48", + "present": true, + "drifted": false, + "last_change": "84c5dbe 2026-10-14", + "inventory_classification": "owner-scoped adapter/caller; source presence supplies no live approval or acceptance", + "referenced_by": [ + "Makefile", + "tools/security-bootstrap-console/README.md", + "tools/security-bootstrap-console/tests/test_security_bootstrap_console.py" + ], + "candidate_status": "current (active route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/NetkingdomRuntimeArchitecture.md", + "docs/openbao-attended-ceremony-runbook.md", + "docs/openbao-unseal-custody-models.md", + "docs/security-bootstrap-rebuild-risk-and-rehearsal.md", + "docs/security-bootstrap-retrospective.md", + "docs/smooth-bootstrap-guide.md", + "docs/tutorials/openbao-operating-path.md" + ] + }, + { + "path": "tools/sync-user-engine-delivery-secret.sh", + "inventory_sha256": "7c0fb6b066e4ad8b103e75551beecd5de65a4bbb22570d95b42e5da6395e2dfc", + "present": true, + "drifted": false, + "last_change": "d9557ba 2026-10-15", + "inventory_classification": "retired entry point; refuses before credential/cluster access", + "referenced_by": [], + "candidate_status": "retired (refusing entry point)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "sso-mfa/k8s/user-engine/README.md" + ] + }, + { + "path": "tools/bootstrap-recovery/fetch-privacyidea-backup.py", + "inventory_sha256": "233160e1206643a5cf7ad05141d733f0a75aff651190e27f77515a124ff0a59f", + "present": true, + "drifted": false, + "last_change": "a1939a7 2026-10-16", + "inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "tools/bootstrap-recovery/check-privacyidea-database.py", + "inventory_sha256": "90f454c87998d7f5d625e3c6656c3418f8f56275dc1879a9d19ed605431b94a4", + "present": true, + "drifted": false, + "last_change": "a1939a7 2026-10-16", + "inventory_classification": "bounded off-host transfer / isolated database drill; actual recovery acceptance requires operator execution", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/bootstrap-recovery-ceremony.md" + ] + }, + { + "path": "tools/bootstrap-recovery/prepare-identity-coverage.py", + "inventory_sha256": "cd5f3067d28b4c7cc93ed08b8cf3869218bdecf7c54b5dffed22d697de71dbb1", + "present": true, + "drifted": false, + "last_change": "dca9992 2026-10-16", + "inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability", + "referenced_by": [], + "candidate_status": "unrouted: owner disposition needed", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [] + }, + { + "path": "tools/bootstrap-recovery/identity-backup-profile.json", + "inventory_sha256": "176c1f2f9111c2c51503212deb162274609d5e53bfe03d7319e19e44c5e09500", + "present": true, + "drifted": true, + "last_change": "a17aa7e 2026-10-16", + "inventory_classification": "missing identity backup coverage proposal and metadata-only preparation; no live capture/grant/delivery capability", + "referenced_by": [], + "candidate_status": "current (documented operator route)", + "owner": null, + "credential_route": null, + "consumers": null, + "native_evidence": null, + "next_task": null, + "documented_in": [ + "docs/bootstrap-recovery-ceremony.md" + ] + } + ] +} \ No newline at end of file diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 98cf03e..dcfb219 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -383,6 +383,24 @@ root-output/isolation boundaries. Secret presence is not credential validity. Send current native checks to T21 and historical revocation/rotation decisions to T22. Do not reopen completed source repairs without a new finding. +2026-10-23 first slice (read-only, mechanical): +[ledger draft](../docs/evidence/2026-10-23-nk49-t02-caller-ledger/ledger-draft.json). +For all 93 inventory entries it records presence, sha256 drift against the +October15 inventory, the last commit, and references from Make, bootstrap or +console routes and from runbook/doc markdown. Candidate statuses: +- 28 have an active Make/bootstrap route. +- 26 have a documented operator route. +- 11 are retired, refusing entry points. +- 11 are unrouted diagnostics. +- 17 are unrouted and need an owner disposition: privacyIDEA bootstrap/policy + helpers, four KeyCape rollout helpers and the four bootstrap-recovery tools. +5 entries have drifted since the inventory (Makefile, sops-custody-unlock, +sops-private, keycape-client, identity-backup-profile). These are candidates +only, not owner dispositions. Next slices: (2) fill in owner, credential route +and consumers for the 17 unrouted and 5 drifted entries, plus the explicitly +named historical objects; (3) add native evidence or the exact missing proof and +the next task for all entries, and route checks to T21 and T22. + ## Prepare the isolated full-service restore and acceptance packet ```task