From 73870c5d371a3b5cb778f03a2a1db98adcab0c38 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 24 Oct 2026 19:32:22 +0200 Subject: [PATCH] NK-WP-0054, NK-WP-0053-T04: record hub ids Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed --- workplans/NK-WP-0053-identity-restore-drill-cadence.md | 1 + workplans/NK-WP-0054-service-identity-policy.md | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/workplans/NK-WP-0053-identity-restore-drill-cadence.md b/workplans/NK-WP-0053-identity-restore-drill-cadence.md index e2053ad..2f6995c 100644 --- a/workplans/NK-WP-0053-identity-restore-drill-cadence.md +++ b/workplans/NK-WP-0053-identity-restore-drill-cadence.md @@ -82,6 +82,7 @@ status: todo priority: medium assignee: claude-code depends_on: [NK-WP-0053-T01] +state_hub_task_id: "20264166-3c88-52d0-a7b4-dd3831c7a685" ``` The drill document was written before the Authelia stage (`run-isolated-authelia.sh`) and diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index b296958..e8d5634 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -14,6 +14,7 @@ related: - NK-WP-0049 - NK-WP-0053 - NK-WP-0031 +state_hub_workstream_id: "36f61e43-f1f3-53fc-ad77-d1d797b3d5b1" --- # NK-WP-0054 — Service identity and privilege policy @@ -47,6 +48,7 @@ id: NK-WP-0054-T01 status: todo priority: high assignee: claude-code +state_hub_task_id: "422918a5-c695-5fe3-ba3c-2b370b2ef4dc" ``` Read-only inventory from repository manifests, ConfigMaps and owner-provided metadata. @@ -66,6 +68,7 @@ status: todo priority: high assignee: claude-code depends_on: [NK-WP-0054-T01] +state_hub_task_id: "5830e2eb-334a-52fa-9c55-a8c00d89c09f" ``` Write `canon/standards/service-identity-privilege_v0.1.md` as a proposed standard: @@ -87,6 +90,7 @@ priority: medium assignee: claude-code depends_on: [NK-WP-0054-T02] blocking_reason: "Needs the reviewed T02 standard." +state_hub_task_id: "a5c51d69-28ff-5458-83eb-10a35c8c5492" ``` A declaration schema in `canon/schemas/` and an offline validator in @@ -106,6 +110,7 @@ priority: medium assignee: claude-code depends_on: [NK-WP-0054-T03] blocking_reason: "Needs the validator and owner agreement on what read-only metadata each service owner can provide." +state_hub_task_id: "c8db4607-9306-572b-a3cb-c35ca5989ec7" ``` Compare declared against observed: for example, which DN each consumer's configuration @@ -128,6 +133,7 @@ needs_human: true decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca" depends_on: [NK-WP-0054-T01] blocking_reason: "Production change across LLDAP, Authelia, privacyIDEA and their Secrets; needs the founder's go and the platform owners. The founder runs live Secret and rollout steps." +state_hub_task_id: "c43d339a-fc8a-5526-885a-64693c930005" ``` Create `svc-authelia` and `svc-privacyidea` as read-only directory binds, switch the @@ -153,6 +159,7 @@ needs_human: true decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca" depends_on: [NK-WP-0054-T02] blocking_reason: "Founder decision per service: which dedicated admin account exists, its name and its custody." +state_hub_task_id: "8072b5cf-4161-58b9-8dfc-62fa102ccd16" ``` For each service decide whether a dedicated admin account exists and what it is called: @@ -173,6 +180,7 @@ assignee: claude-code needs_human: true decision_id: "9f0f7a87-7adb-44f6-8360-db6a80e3ceca" blocking_reason: "The founder confirms every TO CONFIRM row in docs/crisis-custody-list.md: share holders, copies of the age key, the crisis path to production, bundle location." +state_hub_task_id: "ae8524ff-12d8-59c2-b46b-88f3bfd44dd8" ``` Keep `docs/crisis-custody-list.md` current, and propose a non-secret machine-readable