coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049-T21: correct the factor-diagnostic row with source and live evidence

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:57:49 +01:00
parent 687ec01d9b
commit 84e7a7ea30
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md
View file

@ -31,7 +31,7 @@ backup-profile row's job belongs to railiance-platform.
| Named in T21 | Position | Residual |
|---|---|---|
| Dedicated factor-diagnostic admission | Delivered as its own lane (NK-WP-0051 / KEY-WP-0041). It does not borrow KeyCape's reader. | Native acceptance stays in NK-WP-0051-T02. |
| Dedicated factor-diagnostic admission | Source: `mfa_state.py` / `check-user-mfa-state.sh` accept only an owner-admitted private token file and never fetch KeyCape's reader. Live (2026-10-27, founder-run admin scan of Deployment/StatefulSet/DaemonSet/CronJob/Job/Pod specs): only `Deployment sso/keycape` and its pod `keycape-d66d674cd-9vgfw` reference `keycape-factor-read`. | **Deferred:** no admitted credential lane exists for the attended diagnostic (`sso-mfa/k8s/privacyidea/README.md:228-233`), so it is unavailable until its owner sets one up through credential routing. Not a T44 item. |
| Reserved LDAP group denial | `manage-group-members.sh` is a current, documented route. | A live native denial check of the reserved group is not re-run here. It goes into the T44 pre-production drill. |
| Resolver/cutover input provenance | `resolver_cutover.py` and the `*-lldap-resolver-live.sh` scripts are documented routes. NK-WP-0022 (finished) carried the cutover. | No new functional proof is claimed. Re-proof belongs in T44. |
| Bootstrap, root-output and isolation callers | Covered by T01 (secret output removed), the retirement tests and the T16–T20 isolated runs. | None. |

2
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -715,7 +715,7 @@ bootstrap receipts are not current authority. Propose exact write/cutover action
before execution; record deferred actions separately rather than faking a pass.
2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. T21 stays waiting until the founder accepts.
2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. Factor-diagnostic row corrected the same day: source shows the diagnostic takes only an owner-admitted private token and never KeyCape's reader; a founder-run admin scan shows only `sso/keycape` mounts `keycape-factor-read`; no admitted diagnostic lane exists, so that row is a deferral, not a T44 item. T21 stays waiting until the founder accepts.
## Resolve historical credential and configuration-preserving rotation dispositions
```task