From 6cb43c0cc55212363a5406b02db046e2384a7c40 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 00:42:06 +0200 Subject: [PATCH] docs(security): record verified source delivery and native preparation Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa --- workplans/NK-WP-0048-security-case-types.md | 21 ++++++++++++++- ...-bootstrap-secret-free-recovery-handoff.md | 26 ++++++++++++++++--- 2 files changed, 42 insertions(+), 5 deletions(-) diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index a8495da..aee0473 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -690,7 +690,7 @@ Native admission and all other-owner acceptance remain open. ```task id: NK-WP-0048-T14 -status: todo +status: progress depends_on: [NK-WP-0048-T20] priority: high state_hub_task_id: "fce95440-a25b-5f27-8ef3-a3d182099113" @@ -975,3 +975,22 @@ no native owner assent, production rollout, protected session/evidence callbacks ordinary type admission or consumer login proof. LLDAP has no conditional membership mutation or generation token here: exact readback cannot exclude ABA or a concurrent external writer, so T14 remains open. + +2026-10-17 verified source follow-through: source commit `4f65e41` passed normal +local scanning and all 65 canonical provisioner tests. The actual disposable +LLDAP receipt passed all 14 oracles; independent verification on the pinned +daemon found both exact names and the run label absent. Source integration +includes the ADR-0015 documentation correction; the journal remains local-only. + +T14 source preparation is underway. Twenty-three pinned public sources identify +NetKingdom implementation/reconciliation, Platform custody/database governance +and rapp-postgres consumer provisioning; the inspected runtime binding does not +assign identity-provisioner a package. The existing User Engine runtime token +and pod route are not a protected-case caller lane. The native proposal preserves +the same journal seam on a dedicated CNPG consumer and requires authoritative +scope binding, admitted role/lease/placement/recovery and all LDAP writers fenced. +The declared exclusive maintenance window is not mechanical exclusion of WebUI, +helper or lifecycle writers. Capacity placement and EUR cost/risk remain owner +decisions. No package, database, credential, rollout or owner assent was created. +Custodian evidence: group-provenance-r1/native-storage-proposal-r1; final source, +projection and cleanup review: resume-integration-r1/publication-verification.json. diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 359415e..0b2f4da 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -28,8 +28,8 @@ These are retrospective task records of evidenced work, not additional delivery or newly granted authority. The earlier dated narrative remains in Git at `cc2dd01`; its evidence references are carried into the tasks below. -**Current position, source refinement 2026-10-17:** 24 tasks done; 2 in -progress; 3 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based +**Current position, source refinement 2026-10-17:** 24 tasks done; 4 in +progress; 1 ready to start (`todo`); 7 waiting on explicit prerequisites. These are task counts, not an effort-based completion percentage. Assignees are also written in task descriptions because the current Forge projector does not populate the dedicated Hub assignee field. The outage-retrieval tool and restore-packet draft are now prepared; independent outage retrieval and Storage Share publication are accepted; @@ -1042,7 +1042,7 @@ attempt readiness; actual recovery/consumer acceptance remains T18 and MFA T19. ```task id: NK-WP-0049-T35 -status: todo +status: progress priority: high assignee: codex depends_on: [NK-WP-0049-T34] @@ -1075,7 +1075,7 @@ completion. This delivers preparation/disposition, not actual TLS recovery. ```task id: NK-WP-0049-T36 -status: todo +status: progress priority: high assignee: codex depends_on: [NK-WP-0049-T34] @@ -1166,3 +1166,21 @@ make original TLS recovery ownership and selected original admission metadata li work. T33 retains final attempt readiness and its original Hub UUID. This adds no actual recovery, MFA, native authority or owner assent. Source task counts above refer to this file; projection has not been claimed for this proposed refinement. + +2026-10-17 verified source follow-through: source commit `4f65e41` passed normal +local scanning and 111 canonical focused checks. The initial T34 source-only +preparation now has an exact integrated source revision; existing real-SOPS +compatibility remains partly skipped and actual owner-held execution remains T18. + +T35/T36 source preparation is underway, with 17 pinned public-source references. +railiance-cluster owns the ingress/cert-manager/cluster-backup substrate; the +inspected same-host encrypted backup source establishes no independent original +kc-tls/trust recovery or accepted reissue. Draft owner questions remain unsent; +no private TLS input was requested. The historically deployed +secrets-engine-openbao registration is a defensible proposed consumer: its +7 October issuer and 10 October consumer proofs predate the reviewed archive. +The exact selector proposal is retained without current assent or private archive +validation. No token exchange, OpenBao login, client secret retrieval, new grant +or production redirect occurred. Keep incomplete admission refused before custody. +Custodian evidence: recovery-attempt-r1/t35-t36-source-next; final source/projection +review: resume-integration-r1/publication-verification.json.