coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0054, NK-WP-0053-T04: record hub ids

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
This commit is contained in:
tegwick 2026-10-24 19:32:22 +02:00
parent 034eacab9b
commit 73870c5d37
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
workplans/NK-WP-0053-identity-restore-drill-cadence.md
View file

@ -82,6 +82,7 @@ status: todo
priority: medium
assignee: claude-code
depends_on: [NK-WP-0053-T01]
state_hub_task_id: "20264166-3c88-52d0-a7b4-dd3831c7a685"
```
The drill document was written before the Authelia stage (`run-isolated-authelia.sh`) and

8
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -14,6 +14,7 @@ related:
- NK-WP-0049
- NK-WP-0053
- NK-WP-0031
state_hub_workstream_id: "36f61e43-f1f3-53fc-ad77-d1d797b3d5b1"
---
# NK-WP-0054 — Service identity and privilege policy
@ -47,6 +48,7 @@ id: NK-WP-0054-T01
status: todo
priority: high
assignee: claude-code
state_hub_task_id: "422918a5-c695-5fe3-ba3c-2b370b2ef4dc"
```
Read-only inventory from repository manifests, ConfigMaps and owner-provided metadata.
@ -66,6 +68,7 @@ status: todo
priority: high
assignee: claude-code
depends_on: [NK-WP-0054-T01]
state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f"
```
Write `canon/standards/service-identity-privilege_v0.1.md` as a proposed standard:
@ -87,6 +90,7 @@ priority: medium
assignee: claude-code
depends_on: [NK-WP-0054-T02]
blocking_reason: "Needs the reviewed T02 standard."
state_hub_task_id: "a5c51d69-28ff-5458-83eb-10a35c8c5492"
```
A declaration schema in `canon/schemas/` and an offline validator in
@ -106,6 +110,7 @@ priority: medium
assignee: claude-code
depends_on: [NK-WP-0054-T03]
blocking_reason: "Needs the validator and owner agreement on what read-only metadata each service owner can provide."
state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7"
```
Compare declared against observed: for example, which DN each consumer's configuration
@ -128,6 +133,7 @@ needs_human: true
decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca"
depends_on: [NK-WP-0054-T01]
blocking_reason: "Production change across LLDAP, Authelia, privacyIDEA and their Secrets; needs the founder's go and the platform owners. The founder runs live Secret and rollout steps."
state_hub_task_id: "c43d339a-fc8a-5526-885a-64693c930005"
```
Create `svc-authelia` and `svc-privacyidea` as read-only directory binds, switch the
@ -153,6 +159,7 @@ needs_human: true
decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca"
depends_on: [NK-WP-0054-T02]
blocking_reason: "Founder decision per service: which dedicated admin account exists, its name and its custody."
state_hub_task_id: "8072b5cf-4161-58b9-8dfc-62fa102ccd16"
```
For each service decide whether a dedicated admin account exists and what it is called:
@ -173,6 +180,7 @@ assignee: claude-code
needs_human: true
decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca"
blocking_reason: "The founder confirms every TO CONFIRM row in docs/crisis-custody-list.md: share holders, copies of the age key, the crisis path to production, bundle location."
state_hub_task_id: "ae8524ff-12d8-59c2-b46b-88f3bfd44dd8"
```
Keep `docs/crisis-custody-list.md` current, and propose a non-secret machine-readable