coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete Binky and identity conformance gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-29 22:14:19 +02:00
parent 7171587611
commit 6aadcd2a1a
2 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
View file

@ -168,7 +168,7 @@ certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`.
```task
id: NK-WP-0022-T05
status: progress
status: done
priority: high
state_hub_task_id: "5b01e471-afd0-479d-8b35-66eef7820cf6"
```
@ -201,6 +201,14 @@ login, replay denial, and cleanup without emitting credentials. Human
acceptance remains open only for Binky's user-chosen password, MFA enrollment,
and final claim/denial checks; no operator-set password was substituted.
2026-07-29 complete: platform-root completed password + OTP login and opened
the portal and OpenBao paths. Binky then completed reusable password setup,
TOTP enrollment, and a fresh authorization-code login after the KeyCape
rollout. The session verified the canonical issuer/audience, Binky tenant and
groups, tenant-admin role, AAL2 `pwd` + `otp`, and denial for platform and
Coulomb administration. Together with the prior qonto positive/negative
client tests and TLS/discovery evidence, pre-cutover conformance passes.
## T06 - Cut over remaining DNS with monitored rollback
```task

7
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -181,7 +181,7 @@ outage, suspension, restore, and browser/MFA matrix remains.
```task
id: NK-WP-0023-T07
status: progress
status: done
priority: high
state_hub_task_id: "a574dcec-f7cd-417b-aeaa-5392a7428241"
```
@ -200,6 +200,11 @@ normalizes runtime transport whitespace, has 105 passing tests, and is live.
LLDAP SMTP is not configured, so first-password handoff and MFA/claim
acceptance remain rather than falling back to an operator-set password.
2026-07-29 complete: the reusable portal issued the password handoff, the
Binky user selected the password and enrolled TOTP, and a fresh login produced
Binky-only groups, roles `user` + `tenant-admin`, and AAL2 `pwd` + `otp`.
Administration of both `tenant:platform` and `tenant:coulomb` was denied.
## T08 - Document enterprise integration extension points
```task