From 6aadcd2a1a2219a0f3d6fd5db9bb128e77dc1b8f Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 29 Jul 2026 22:14:19 +0200 Subject: [PATCH] Complete Binky and identity conformance gates --- ...ce01-identity-cutover-and-coulombcore-retirement.md | 10 +++++++++- ...-WP-0023-user-engine-portal-platform-integration.md | 7 ++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md index 0700dbb..ca4819c 100644 --- a/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md +++ b/workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md @@ -168,7 +168,7 @@ certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`. ```task id: NK-WP-0022-T05 -status: progress +status: done priority: high state_hub_task_id: "5b01e471-afd0-479d-8b35-66eef7820cf6" ``` @@ -201,6 +201,14 @@ login, replay denial, and cleanup without emitting credentials. Human acceptance remains open only for Binky's user-chosen password, MFA enrollment, and final claim/denial checks; no operator-set password was substituted. +2026-07-29 complete: platform-root completed password + OTP login and opened +the portal and OpenBao paths. Binky then completed reusable password setup, +TOTP enrollment, and a fresh authorization-code login after the KeyCape +rollout. The session verified the canonical issuer/audience, Binky tenant and +groups, tenant-admin role, AAL2 `pwd` + `otp`, and denial for platform and +Coulomb administration. Together with the prior qonto positive/negative +client tests and TLS/discovery evidence, pre-cutover conformance passes. + ## T06 - Cut over remaining DNS with monitored rollback ```task diff --git a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md index 018e863..16af5e6 100644 --- a/workplans/NK-WP-0023-user-engine-portal-platform-integration.md +++ b/workplans/NK-WP-0023-user-engine-portal-platform-integration.md @@ -181,7 +181,7 @@ outage, suspension, restore, and browser/MFA matrix remains. ```task id: NK-WP-0023-T07 -status: progress +status: done priority: high state_hub_task_id: "a574dcec-f7cd-417b-aeaa-5392a7428241" ``` @@ -200,6 +200,11 @@ normalizes runtime transport whitespace, has 105 passing tests, and is live. LLDAP SMTP is not configured, so first-password handoff and MFA/claim acceptance remain rather than falling back to an operator-set password. +2026-07-29 complete: the reusable portal issued the password handoff, the +Binky user selected the password and enrolled TOTP, and a fresh login produced +Binky-only groups, roles `user` + `tenant-admin`, and AAL2 `pwd` + `otp`. +Administration of both `tenant:platform` and `tenant:coulomb` was denied. + ## T08 - Document enterprise integration extension points ```task