From 716de2edfd7dced544dad9579c9f3a48c122cdd3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 16 Oct 2026 16:25:15 +0200 Subject: [PATCH] plan: project task ownership and preserve pre-existing staged brief Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2 --- .custodian-brief.md | 13 ++++- AGENTS.md | 3 ++ ...-bootstrap-secret-free-recovery-handoff.md | 47 ++++++++++--------- 3 files changed, 39 insertions(+), 24 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index ea9ccd0..8a5b338 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-10-15 17:24 UTC +**Last synced:** 2026-10-14 22:34 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -69,6 +69,17 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` - ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` *(wait: The next types follow once the first one is proven end to end.)* +### Show who a workload sign-in actually is +Progress: 3/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b` + +**Open tasks:** +- ! Account site shows both sessions `bdc8b414` + *(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)* +- ! Enroll the negative-login factor `afb5816f` + *(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)* +- ! Hand the OpenBao proof back to its owners `86fb4a6b` + *(wait: Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof.)* + ### Register Playwright human and agent consumers through governed identity delivery Progress: 1/3 done | workplan_id: `06ba98d5-609e-5aaa-9bf7-4c4f4460e377` diff --git a/AGENTS.md b/AGENTS.md index d080bee..0437eb5 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -231,6 +231,9 @@ To create a new workplan: ### Task refinement after substantial work (required) +Established by operator instruction on 2026-10-16; decision +`d90b2f1f-cdaf-43b1-99e7-71afb43672bb`. + At each substantive checkpoint and before session close, compare the completed work and new knowledge with the current task structure. If substantial work was completed while the workplan's task granularity stayed unchanged, **add completed diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index 47a3bc0..ba9ca3e 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -49,6 +49,7 @@ The verified backup job stays active while those separate tasks are completed. id: NK-WP-0049-T01 status: done priority: high +assignee: codex state_hub_task_id: "d7ca8d5f-c5ff-5cba-bd25-038cb53ffe4e" ``` @@ -75,7 +76,7 @@ Evidence and exact source manifest: Custodian id: NK-WP-0049-T04 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T01] state_hub_task_id: "04c4e8be-5bd8-5d5c-99b1-79d8ae758462" ``` @@ -97,7 +98,7 @@ and `admin-bootstrap.json`; October13 `sops-write-callers.json`. id: NK-WP-0049-T05 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T04] state_hub_task_id: "e8e38f42-609e-5c07-a8e6-e73c8eb4ae95" ``` @@ -122,7 +123,7 @@ Evidence: Custodian October13 `keycape-caller-reconciliation.json`, id: NK-WP-0049-T06 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T04, NK-WP-0049-T05] state_hub_task_id: "a5f50891-c5b2-513b-8670-e1915ee52015" ``` @@ -145,7 +146,7 @@ is claimed. id: NK-WP-0049-T07 status: done priority: high -owner: codex +assignee: codex state_hub_task_id: "2d7302a2-319a-5633-bf58-d51ccd25ebf6" ``` @@ -165,7 +166,7 @@ Evidence: October15 recovery `offsite-discovery-summary.json`, id: NK-WP-0049-T08 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T06, NK-WP-0049-T07] state_hub_task_id: "317ca173-c784-5329-9810-5e3d300604b8" ``` @@ -188,7 +189,7 @@ archive recovery is separately evidenced in T13. id: NK-WP-0049-T09 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T08] state_hub_task_id: "4a47eb2a-7e42-5ae7-9df1-f5ede746eca1" ``` @@ -212,7 +213,7 @@ approval decisions `40bfae40-6108-4e51-8613-073339f5345f` and id: NK-WP-0049-T10 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T08, NK-WP-0049-T09] state_hub_task_id: "0519444c-d559-5455-aa27-8c5dc8b832b0" ``` @@ -234,7 +235,7 @@ hardened-job execution is recorded in T14. id: NK-WP-0049-T11 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T08] state_hub_task_id: "d69af493-4026-56a8-a526-c267d90dce18" ``` @@ -256,7 +257,7 @@ and reuse-surface federation commit `662782e`. id: NK-WP-0049-T12 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T09, NK-WP-0049-T10] state_hub_task_id: "decb415a-8012-521c-9dbe-d73c6ff0bbfb" ``` @@ -277,7 +278,7 @@ No age private key was needed by the capture job. id: NK-WP-0049-T13 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T11, NK-WP-0049-T12] state_hub_task_id: "602d4921-cfac-5e5b-9993-4fbf67195c7d" ``` @@ -299,7 +300,7 @@ signatures are deliberately separate T16–T20 outcomes. id: NK-WP-0049-T14 status: done priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T10, NK-WP-0049-T13] state_hub_task_id: "eaf0708f-b3b7-5531-8172-95edf30c3a19" ``` @@ -322,7 +323,7 @@ this completed task is not a full-estate recovery claim. id: NK-WP-0049-T02 status: progress priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T06] state_hub_task_id: "479d6970-6516-50f5-9436-bb5b56d58aad" ``` @@ -346,7 +347,7 @@ T22. Do not reopen completed source repairs without a new finding. id: NK-WP-0049-T15 status: todo priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T08, NK-WP-0049-T13] state_hub_task_id: "1d1eb903-a4b0-5bc4-a421-0b842d7f68ae" ``` @@ -370,7 +371,7 @@ inputs for T16–T20, not an automatic production restore. id: NK-WP-0049-T16 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T15] blocking_reason: "Await the accepted isolated restore packet and independently supplied existing-user test credentials; no production restore is admitted by task refinement." state_hub_task_id: "b64d4d6a-e851-58d1-9929-f03343147de0" @@ -391,7 +392,7 @@ acceptance. Record only safe counts, identities and outcomes. id: NK-WP-0049-T17 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T15, NK-WP-0049-T16] blocking_reason: "Await the accepted isolated packet and restored-directory authentication proof from T16." state_hub_task_id: "b47f9975-d6d7-5bb8-93ce-886deb1dfa70" @@ -412,7 +413,7 @@ native Authelia acceptance. id: NK-WP-0049-T19 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T15, NK-WP-0049-T16] blocking_reason: "Await the accepted isolated packet, restored directory and owner-selected retained-token/MFA test inputs." state_hub_task_id: "6f8af1a7-2a3f-5fa8-8202-83103ebd55b2" @@ -433,7 +434,7 @@ row counts and disposable synthetic-token fixtures do not prove this outcome. id: NK-WP-0049-T20 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T15] blocking_reason: "Await the accepted isolated target/procedure and owner-admitted historical/new audit verification from T15." state_hub_task_id: "375fa8f9-b8a5-5048-97a7-ec141aa7c45d" @@ -454,7 +455,7 @@ pairs from T13 are a prerequisite, not audit-history verification. id: NK-WP-0049-T18 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T19] blocking_reason: "Await the accepted isolated packet, restored-directory proof and retained-token MFA proof for the selected authentication flow." state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125" @@ -475,7 +476,7 @@ production consumer to the isolated issuer or mint new client grants implicitly. id: NK-WP-0049-T21 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T02] blocking_reason: "Await the current-caller ledger and exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" @@ -498,7 +499,7 @@ before execution; record deferred actions separately rather than faking a pass. id: NK-WP-0049-T22 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T21] blocking_reason: "Await the caller/consumer ledger, current replacement-lane acceptance and explicit credential-owner dispositions; existing exposure-rotation deferral is unchanged." state_hub_task_id: "3ea6bf00-a87f-58ea-bdce-328c13a03a55" @@ -522,7 +523,7 @@ source retirement as provider revocation. id: NK-WP-0049-T23 status: todo priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T13] state_hub_task_id: "1ec537ee-dfee-5576-be36-a81bdba417d1" ``` @@ -546,7 +547,7 @@ alone do not close the actual outage-path proof. id: NK-WP-0049-T24 status: todo priority: medium -owner: codex +assignee: codex depends_on: [NK-WP-0049-T14] state_hub_task_id: "474f5a78-a643-59c6-bcf9-fc4a908dfcb0" ``` @@ -568,7 +569,7 @@ implementation to an entire disaster-recovery programme. id: NK-WP-0049-T03 status: wait priority: high -owner: codex +assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24] blocking_reason: "Await the separately tracked native service proofs, current/legacy caller acceptance and independent outage retrieval; full archive recovery and backup activation are already complete." state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"