fix(workplans): adopt ADR-007 derived identifiers for unregistered records
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-25 20:14:28 +02:00
parent 623e9d24ba
commit 82452d655f
8 changed files with 46 additions and 46 deletions

View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-08-14"
updated: "2026-08-14"
state_hub_workstream_id: "f65863fd-1010-4d1e-a8ec-571b9f302d2a"
state_hub_workstream_id: "a5097121-1461-59f8-81fa-e6ecef527337"
---
# ADHOC-2026-08-14 - NK-WP-0025 residual closeout
@ -20,7 +20,7 @@ state_hub_workstream_id: "f65863fd-1010-4d1e-a8ec-571b9f302d2a"
id: ADHOC-2026-08-14-T01
status: done
priority: medium
state_hub_task_id: "9ee6b15b-efd0-41d1-b38e-ea0061feef69"
state_hub_task_id: "9eaad1fd-695c-5df3-aec2-012e4a4bc8c8"
```
Update the owning smoke evidence and close or narrow CSOC-IN-0001 and
@ -33,7 +33,7 @@ repeat-login, collision, redirect, and assurance evidence.
id: ADHOC-2026-08-14-T02
status: done
priority: medium
state_hub_task_id: "ec3a0cd4-7c65-49c4-b2a4-b45031d49213"
state_hub_task_id: "31319b1b-8b55-59fe-b3d7-4486f1928b4c"
```
Add focused regression coverage for the canonical LDAP-DN OIDC subject and
@ -45,7 +45,7 @@ the reverse normalization used by directory lifecycle and password setup.
id: ADHOC-2026-08-14-T03
status: done
priority: high
state_hub_task_id: "fcd35bde-b458-4226-964f-b2c6d6125c03"
state_hub_task_id: "90250faf-0022-5553-b832-a51f775166a8"
```
Move the live `user-engine` sender registry from its manually minted Secret to

View file

@ -12,7 +12,7 @@ created: "2026-07-22"
updated: "2026-07-22"
origin: "intake:019f88ff-c5f1-7433-9d13-4ffe37dfef00+019f88ff-cc9e-76b4-8ce3-eb354aabefe7"
origin_ref: "ACTIVITY-WP-0025-T06"
state_hub_workstream_id: "3e40e29a-a13a-47b6-9575-4fdc7024af6a"
state_hub_workstream_id: "eba95b9e-372c-5efd-b69a-870f11582149"
---
# NK-WP-0021 — Activity-core ops/Temporal UI least-privilege SSO
@ -115,7 +115,7 @@ Source design: `activity-core/docs/ops-sso-access.md`. File intakes:
id: NK-WP-0021-T01
status: done
priority: high
state_hub_task_id: "50d59099-d3df-4087-93ef-9a4e537807b8"
state_hub_task_id: "4b4a93fc-ad63-59ae-9658-ad59c2a2bfbb"
```
Extend LLDAP group seeding so the operator group is created the same way as
@ -142,7 +142,7 @@ platform groups:
id: NK-WP-0021-T02
status: done
priority: high
state_hub_task_id: "e8d6dae5-257f-4862-98de-ab4cef6cc722"
state_hub_task_id: "032d6d66-20bc-52e8-8490-aa3a77275ad0"
```
Document least-privilege membership for founders/operators only:
@ -170,7 +170,7 @@ activity-core internals.
id: NK-WP-0021-T03
status: done
priority: high
state_hub_task_id: "71bfd7ea-1637-4c1a-ac3b-dc8dca38b82f"
state_hub_task_id: "17543b91-39aa-5b03-971c-b696f8f36489"
```
Implement access control in the live Authelia ConfigMap:
@ -205,7 +205,7 @@ of unrelated hosts (auth portal, KeyCape, LLDAP admin, etc.).
id: NK-WP-0021-T04
status: done
priority: high
state_hub_task_id: "f74a2a59-f126-45e3-832a-5574bd0feb6f"
state_hub_task_id: "0bbdf44c-283a-57be-8bd4-4b8b42b39803"
```
Roll out and prove least privilege on the live railiance01 SSO stack:
@ -238,7 +238,7 @@ Roll out and prove least privilege on the live railiance01 SSO stack:
id: NK-WP-0021-T05
status: done
priority: medium
state_hub_task_id: "a1acd507-9532-45ea-bb08-387b11a96868"
state_hub_task_id: "327c4a7c-94a6-50cd-8f36-7a452428a70d"
```
- Keep intake source file statuses in sync (`promoted` / closed) after hub

View file

@ -13,7 +13,7 @@ depends_on:
- USER-WP-0020
- NK-WP-0023
- KEY-WP-0004
state_hub_workstream_id: "3dadddeb-4cec-48e2-9c2c-788b26dd6e93"
state_hub_workstream_id: "d76ddccc-00c8-548a-b141-2cd660fa38da"
---
# NK-WP-0022 - railiance01 identity cutover and CoulombCore retirement
@ -40,7 +40,7 @@ before state migration or retirement begins.
id: NK-WP-0022-T01
status: done
priority: high
state_hub_task_id: "fe55a2c2-8613-4190-a0b9-07eff4a58146"
state_hub_task_id: "244ef874-8ee4-5969-bcbf-42a7cb47f246"
```
Capture secret-free inventories of deployments, image digests, configuration
@ -83,7 +83,7 @@ non-identity cutovers. Inventory contract complete.
id: NK-WP-0022-T02
status: done
priority: high
state_hub_task_id: "fdc7b492-855f-471e-a7df-ee67a291d7a1"
state_hub_task_id: "12658d0f-eee9-5553-92b6-956ccde094bf"
```
Create fresh, encrypted backups for CoulombCore LLDAP, Authelia,
@ -112,7 +112,7 @@ counts. The pod and transient restore log were removed automatically.
id: NK-WP-0022-T03
status: done
priority: high
state_hub_task_id: "737b2210-92c7-45c2-a37a-76951e459c83"
state_hub_task_id: "642cec3f-fd96-5c05-a37a-8696ed118811"
```
Under a bounded write freeze, compare and migrate the authoritative
@ -149,7 +149,7 @@ CoulombCore writers remain frozen against divergence.
id: NK-WP-0022-T04
status: done
priority: high
state_hub_task_id: "33591ee3-586e-4ac6-82e6-0ab4642cea5e"
state_hub_task_id: "8aab3b5d-ec9e-5bc0-a884-ee418e78d5f4"
```
Reconcile KeyCape, Authelia, LLDAP, and privacyIDEA configuration and secret
@ -176,7 +176,7 @@ certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`.
id: NK-WP-0022-T05
status: done
priority: high
state_hub_task_id: "5b01e471-afd0-479d-8b35-66eef7820cf6"
state_hub_task_id: "a66acc29-33a7-5c20-8816-c3acedd6595d"
```
Using TLS-preserving direct resolution to railiance01, verify health,
@ -221,7 +221,7 @@ client tests and TLS/discovery evidence, pre-cutover conformance passes.
id: NK-WP-0022-T06
status: done
priority: high
state_hub_task_id: "00bfa48b-28de-4b8e-b3da-715c797beae5"
state_hub_task_id: "fc9ed5fb-fd5c-5b04-990b-5a5b7f32fa0f"
```
Lower TTL where needed and move `auth.coulomb.social`,
@ -264,7 +264,7 @@ The observation gate therefore passes without fallback traffic.
id: NK-WP-0022-T07
status: done
priority: high
state_hub_task_id: "75d160e6-ed58-4b89-b870-4a755e1ca5ce"
state_hub_task_id: "2a6d4c0b-2565-5bf5-9c04-1b63e992ce99"
```
After T01-T06, scale the old KeyCape, Authelia, LLDAP, and privacyIDEA
@ -300,7 +300,7 @@ window begins 2026-07-30; no retained state may be deleted under this task.
id: NK-WP-0022-T08
status: wait
priority: medium
state_hub_task_id: "9f209f15-64a9-4324-bfa9-3ff21c52fc19"
state_hub_task_id: "42a3b4c0-3481-5cfa-bdc2-66d05e751829"
```
After explicit approval, expiry of the rollback retention window, and one

View file

@ -12,7 +12,7 @@ updated: "2026-07-30"
depends_on:
- USER-WP-0020
- KEY-WP-0004
state_hub_workstream_id: "c652e4ba-6520-4b30-966f-4fb5659439db"
state_hub_workstream_id: "fdb3deee-06c3-5d12-91ce-9c50b2ac0618"
---
# NK-WP-0023 - user-engine portal platform integration
@ -27,7 +27,7 @@ as the first acceptance case.
id: NK-WP-0023-T01
status: done
priority: high
state_hub_task_id: "8d96aa5e-9801-4d76-9140-d6076a4f2942"
state_hub_task_id: "05d69347-ec34-59b7-a107-80db015ef0e6"
```
Ratify lifecycle sequencing and compensation across user-engine, LLDAP,
@ -43,7 +43,7 @@ now so later enterprise directories do not require a domain rewrite.
id: NK-WP-0023-T02
status: done
priority: high
state_hub_task_id: "89fe51aa-f351-4763-a358-3eec79f28350"
state_hub_task_id: "22113719-905b-54df-9ecb-0a0c456e0d35"
```
Implement idempotent create/link/suspend/reactivate/deprovision operations for
@ -77,7 +77,7 @@ and accepted the repeated deletion. The probe identity was removed.
id: NK-WP-0023-T03
status: done
priority: high
state_hub_task_id: "76289890-6e6e-45ea-90dc-d3d58eee8b62"
state_hub_task_id: "5721c5f9-6161-522c-a439-95f2613b5460"
```
Register the portal OIDC client with authorization code + PKCE, configure
@ -140,7 +140,7 @@ errors, so future users may enter either `bernd.worsch` or the full email.
id: NK-WP-0023-T04
status: done
priority: high
state_hub_task_id: "6ce33c92-031a-4f23-8ee2-108451b394fe"
state_hub_task_id: "efad8829-5d75-5ea1-9564-1618b1846525"
```
Define and implement flex-auth resources/actions for self, tenant-admin, and
@ -155,7 +155,7 @@ delivery with replay and dead-letter evidence.
id: NK-WP-0023-T05
status: done
priority: high
state_hub_task_id: "4ef00e05-1259-4c76-a8ef-ec40b5facd1c"
state_hub_task_id: "0c454447-c14f-586b-835b-4f00d43943d0"
```
Package the portal as a managed platform workload on the default
@ -226,7 +226,7 @@ value entered recorded output. All T05 acceptance criteria are complete.
id: NK-WP-0023-T06
status: done
priority: high
state_hub_task_id: "96a7cd2b-6cab-47ab-a899-44bc0f6da58c"
state_hub_task_id: "f5f0d5d0-09fa-59de-b83f-7a6d4ff736a8"
```
Run end-to-end conformance for registration, login, MFA, tenant creation,
@ -256,7 +256,7 @@ and the remaining browser/provider-outage matrix keep T06 open.
id: NK-WP-0023-T07
status: done
priority: high
state_hub_task_id: "a574dcec-f7cd-417b-aeaa-5392a7428241"
state_hub_task_id: "04664946-c38d-50e8-bc3f-5533801494d8"
```
Use the production portal to onboard
@ -284,7 +284,7 @@ Administration of both `tenant:platform` and `tenant:coulomb` was denied.
id: NK-WP-0023-T08
status: done
priority: medium
state_hub_task_id: "7ef8e1f5-1a0e-4a34-9535-708e3146ae72"
state_hub_task_id: "83a00e26-aab9-51f1-afb4-cb5d354ab436"
```
Document later adapters for customer IdPs/directories, SAML/OIDC federation,

View file

@ -15,7 +15,7 @@ depends_on:
- FLEX-WP-0009
- AUDIT-WP-0003
- EMAIL-WP-0004
state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721"
state_hub_workstream_id: "635a73d4-b3cb-5c38-af22-56a6a66beb0e"
---
# NK-WP-0024 - Portal integration expansion
@ -56,7 +56,7 @@ gate; provider implementation status stays authoritative in the owning repos.
id: NK-WP-0024-T01
status: done
priority: high
state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
state_hub_task_id: "4bad414d-b0c1-52df-914f-cdc602192124"
```
Define self, tenant-admin, and platform-admin resource/action vocabulary,
@ -87,7 +87,7 @@ valid.
id: NK-WP-0024-T02
status: done
priority: medium
state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
state_hub_task_id: "88098a55-f2ca-5636-9a98-ae8a98cdeaf4"
```
Deliver invitation and verification messages through approved custody and
@ -105,7 +105,7 @@ entry; production is deliberately not pointed at a fabricated endpoint.
id: NK-WP-0024-T03
status: done
priority: high
state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
state_hub_task_id: "59d3a6b5-7b9a-52a5-adc1-dd9fe74e3eba"
```
Connect the user-engine transactional outbox to the platform event lane with
@ -123,7 +123,7 @@ cluster event receiver and scoped delivery credential.
id: NK-WP-0024-T04
status: done
priority: high
state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
state_hub_task_id: "68eb8659-acd9-5188-bd12-b67fb18c6144"
```
Prove flex-auth denial/unavailability, mail failure, identity-provider outage,

View file

@ -14,7 +14,7 @@ depends_on:
- USER-WP-0022
- KEY-WP-0008
- CSOC-WP-0003
state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86"
state_hub_workstream_id: "2412a251-d6b5-5f05-8082-3eb7697c51dc"
---
# NK-WP-0025 - public registration and application JIT provisioning
@ -58,7 +58,7 @@ unverified email-only local account.
id: NK-WP-0025-T01
status: done
priority: high
state_hub_task_id: "523d5894-6ab6-4097-a28c-0f77880744b1"
state_hub_task_id: "f6fba00e-1fb6-59be-9b9a-242aed991892"
```
Record the source-of-truth split, stable key `(issuer, subject)`, optional
@ -79,7 +79,7 @@ attributes and are not account-link keys.
id: NK-WP-0025-T02
status: done
priority: high
state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
state_hub_task_id: "b0d7ac51-54ae-508b-b62d-8ac8dff34497"
```
Expose a NetKingdom registration service behind user-engine. Validate and
@ -120,7 +120,7 @@ provider failure after local completion, and run disposable live conformance.
id: NK-WP-0025-T03
status: done
priority: high
state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
state_hub_task_id: "ed93741b-8bb7-5b37-b5c5-a06e7f826735"
```
Publish a NetKingdom registration URL and allow applications to provide
@ -148,7 +148,7 @@ request. The fresh OIDC flow remains provider-owned after password setup.
id: NK-WP-0025-T04
status: done
priority: high
state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
state_hub_task_id: "2b9a60cc-44a2-5874-8e7e-21db96da88f0"
```
Replace global mandatory MFA for this consumer with the KeyCape policy from
@ -176,7 +176,7 @@ Client and tenant allow-list negatives also fail before mail issuance.
id: NK-WP-0025-T05
status: done
priority: high
state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
state_hub_task_id: "68bf6fe7-7b68-5189-ad1c-4ba5e0d0ad6e"
```
Test an existing LLDAP identity with no coulomb.social profile, a completely

View file

@ -9,7 +9,7 @@ owner: codex
topic_slug: netkingdom
created: "2026-08-18"
updated: "2026-08-19"
state_hub_workstream_id: "3a9b7b04-d283-4101-8b6a-31624c6d5de6"
state_hub_workstream_id: "3e8965aa-494a-5dcf-a11d-b768c196c548"
---
# NK-WP-0026 — user-engine caller identity rollout
@ -18,7 +18,7 @@ state_hub_workstream_id: "3a9b7b04-d283-4101-8b6a-31624c6d5de6"
id: NK-WP-0026-T01
status: done
priority: high
state_hub_task_id: "8da592be-cbc7-49a4-bb2e-1c04e5c80336"
state_hub_task_id: "294eb50e-2d54-59f1-a793-d10e53e33020"
```
Declare a non-automounted `user-engine` ServiceAccount and a one-hour projected
@ -30,7 +30,7 @@ flex-auth user-engine instance on port 8080.
id: NK-WP-0026-T02
status: done
priority: high
state_hub_task_id: "9dbaf763-31fc-4538-93a2-5df4bb9fa6ae"
state_hub_task_id: "d24461e9-c378-58ac-97ed-60ad6e563d47"
```
Both sides promoted and probed. Verified live on railiance01, 2026-08-19, by

View file

@ -10,7 +10,7 @@ topic_slug: netkingdom
planning_priority: P1
created: "2026-08-19"
updated: "2026-08-22"
state_hub_workstream_id: "a30a33e4-f980-4934-9efb-d61a75e6ae81"
state_hub_workstream_id: "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4"
---
# NK-WP-0027 — Reefs, placement, and security-zone canon dependencies
@ -74,7 +74,7 @@ already accepted by `ADR-0006` without encoding it as a false zone fact.
id: NK-WP-0027-T01
status: done
priority: medium
state_hub_task_id: "a1dfa4ec-f946-425e-8183-782eef7763c4"
state_hub_task_id: "d88714a4-0bcb-567e-8542-d5b4c556b8ec"
```
**Establish the boundary between a reef and the `P` ladder in canon text.** Say
@ -92,7 +92,7 @@ the critical path.
id: NK-WP-0027-T02
status: wait
priority: medium
state_hub_task_id: "601a0c5f-3f77-419f-9731-25e247424b31"
state_hub_task_id: "5b35b646-a525-55da-852a-6005613d42ea"
```
**Extend Decision 5.5's provider declaration to substrate providers, and agree
@ -125,7 +125,7 @@ reef-vocabulary decision on its behalf.
id: NK-WP-0027-T03
status: wait
priority: low
state_hub_task_id: "b53bfb83-1df9-4548-a62f-628cb55ece4d"
state_hub_task_id: "e3f0bb0f-0c85-5cb9-a5ab-75f668cd3447"
```
**Join reef ceilings to consumer `V` declarations mechanically.** Waits on T02.