NK-WP-0049: option A (builder mode); T15 and T18 accepted, phase B paused into T44
T18 acceptance includes the CA-bundle check: the pinned OpenBao image trusts the exact ISRG Root X1 anchor of the KeyCape chain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
parent
81f8f03730
commit
86e1107279
2 changed files with 37 additions and 11 deletions
|
|
@ -265,10 +265,10 @@
|
|||
| task | NK-WP-0049-T12 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T13 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T14 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | progress | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T15 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T16 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T17 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T18 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T19 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
|
|
@ -293,6 +293,8 @@
|
|||
| task | NK-WP-0049-T40 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T41 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T42 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T43 | cancel | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0049-T44 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| task | NK-WP-0050-T01 | done | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T02 | progress | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| task | NK-WP-0050-T03 | wait | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: active
|
|||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-12"
|
||||
updated: "2026-10-24"
|
||||
updated: "2026-10-27"
|
||||
flavor: implementation
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "17d315f0-829e-57c7-85cc-3a7914152804"
|
||||
|
|
@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery
|
|||
or newly granted authority. The earlier dated narrative remains in Git at
|
||||
`cc2dd01`; its evidence references are carried into the tasks below.
|
||||
|
||||
**Current position, 2026-10-24:** 37 tasks done; 1 in progress; 0 ready to start (`todo`); 5 waiting on explicit prerequisites. These are task counts, not an effort-based completion percentage. Assignees are also written in task descriptions because the current Forge projector does not populate the dedicated Hub assignee field. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20) and existing-token MFA (T19), all on the independently retrieved generation. What remains is the live consumer login (T18, via the phase B plan in T43), the T15 service-owner acceptance, caller admission (T21), credential dispositions (T22) and final acceptance (T03).
|
||||
**Current position, 2026-10-27:** 39 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 4 waiting (T21, T22, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064).
|
||||
|
||||
**Next actions:** answer the T43 decision (network owner, TLS identity, consumer secret custody, consumer scope) so the phase B module can be built and reviewed; obtain service-owner acceptance of the restore packet (T15); work through the T02 ledger with each caller owner (T21, T22). After owner admission, run the individual native service and caller checks. A task's owner is accountable for the result; another repository's approval or credential grant still requires its own owner path.
|
||||
**Next actions:** close the T02 ledger's caller dispositions (T21) and the two historical credential objects (T22), then T03. T44 runs before production.
|
||||
|
||||
**Closure:** T03 assembles owner acceptance after its named dependencies pass.
|
||||
Passing archive recovery does not prove existing-user authentication, retained
|
||||
|
|
@ -411,7 +411,7 @@ four recovery tools still need a runbook home; T24 G3 covers that.
|
|||
|
||||
```task
|
||||
id: NK-WP-0049-T15
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T08, NK-WP-0049-T13, NK-WP-0049-T27, NK-WP-0049-T28, NK-WP-0049-T29, NK-WP-0049-T30]
|
||||
|
|
@ -451,6 +451,9 @@ its `current` rows, and the two historical Secrets are excluded from restore
|
|||
scope. Still owner-held: a named disposable target and route, archive/runtime
|
||||
image lineage, private existing-user/MFA inputs, and service-owner acceptance.
|
||||
|
||||
|
||||
2026-10-27 founder decision (option A, builder mode): T15 is **done**. Owner acceptances: key-cape `fc9f09a` (`docs/nk49-isolated-restore-owner-acceptance-2026-10-27.md`, issuer-side restore accepted with residuals K1 browser/PKCE clients not exercised, K2 post-archive changes, K3 one-key check tied to current release, K4 receipt outside Git); railiance-platform `5658150` (RPF-WP-0064, OpenBao phase A accepted for builder mode, residuals R1–R8); founder for the NetKingdom-owned LLDAP, Authelia and privacyIDEA lanes on the T16, T17, T19 and T20 owner runs. Residuals that need a joint live run go to T44.
|
||||
|
||||
## Prove restored LLDAP directory and existing-user authentication
|
||||
|
||||
```task
|
||||
|
|
@ -636,11 +639,10 @@ are separate and are not claimed.
|
|||
|
||||
```task
|
||||
id: NK-WP-0049-T18
|
||||
status: wait
|
||||
status: done
|
||||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T15, NK-WP-0049-T16, NK-WP-0049-T19, NK-WP-0049-T32, NK-WP-0049-T33, NK-WP-0049-T40]
|
||||
blocking_reason: "T33/T40 done. Issuer-side attempt verified 2026-10-23 (receipt 16d72f7c); original OpenBao restored in isolation 2026-10-24 (RPF-WP-0064, receipt 4e048dee). T19 retained-factor MFA passed 2026-10-24. Await the live consumer login: RPF-WP-0064 phase B network plus the SECRETS-WP-0015-T04 consumer run, each founder-admitted."
|
||||
state_hub_task_id: "141dd773-c1fa-56c1-a852-bbe2372e5125"
|
||||
```
|
||||
|
||||
|
|
@ -683,6 +685,9 @@ founder-admitted. MFA remains T19.
|
|||
Still open for T18: selected current consumer acceptance against restored dependencies (the receipt claims
|
||||
no consumer continuity), and owner acceptance; MFA stays T19.
|
||||
|
||||
|
||||
2026-10-27 founder decision (option A, builder mode): T18 is **done** with a named residual. Accepted on the verified issuer-side receipt `16d72f7c…1651`, key-cape owner acceptance `fc9f09a`, the restored OpenBao configuration (receipt `4e048dee…579d`) and the 2026-10-10 live consumer proof of the same registration. CA-bundle check 2026-10-27 (claude-code, local, `--network none`): the pinned OpenBao image `quay.io/openbao/openbao@sha256:436eaf97…c115` bundle `/etc/ssl/certs/ca-certificates.crt` (145 certs, sha256 `61efbd6d…d1d9`) contains ISRG Root X1 (DER sha256 `96bcec06…08c6`, not after 2035-06-04); its PEM sha256 is `22b557a2…43d1`, exactly the anchor recorded for the T18 KeyCape chain. With no CA fields in the `keycape-services` source config, restored OpenBao would trust the KeyCape `/jwks` chain; the restored config's CA-field absence remains inferred (railiance-platform R1). Residual, carried to T44: restored KeyCape and restored OpenBao have not been exercised together by a real consumer login, and browser/PKCE clients were not exercised. This is not production consumer validity.
|
||||
|
||||
## Verify current caller and provider admission at their actual boundaries
|
||||
|
||||
```task
|
||||
|
|
@ -1591,13 +1596,12 @@ call outside the namespace are not exercised.
|
|||
|
||||
```task
|
||||
id: NK-WP-0049-T43
|
||||
status: wait
|
||||
status: cancel
|
||||
priority: high
|
||||
assignee: claude-code
|
||||
needs_human: true
|
||||
decision_id: "e4db6c9f-d464-4185-b5a1-ea71e21d1b42"
|
||||
depends_on: [NK-WP-0049-T18]
|
||||
blocking_reason: "Founder accepted the inherited-pipe custody design 2026-10-27 with four optimizations (random negative-test token; non-echoing unlogged decrypt wrapper; value-free /jwks trust probe before the ceremony; synthetic-secret rehearsal on a throwaway network). Open: NetKingdom names the exact backup field and decrypt command; railiance-platform shows jwks_ca_pem and oidc_discovery_ca_pem presence and runs the probe; subnet and container names to agree; longer unseal window acceptance is still the founder's decision at window signing; cert reissue is planned for no earlier than 2026-10-30T16:23Z (the founder's shell as ops-mason-builder cannot list cert-manager objects cluster-wide or in sso, so the count stays unproven and is not needed after that date). Then build and review the phase B module; a new founder-signed window is needed.""
|
||||
state_hub_task_id: "485468fd-d56e-54d1-9bc7-97220c0c4a38"
|
||||
```
|
||||
|
||||
|
|
@ -1627,6 +1631,26 @@ secrets-engine (`65a3dbe`, reply 5aeaadc9): new reviewed runner taking the clien
|
|||
workplans, and the NK49 phase B module, verifier and tests are reviewed to T38 depth. This
|
||||
task does not run phase B and does not replace T18's live consumer login or owner acceptance.
|
||||
|
||||
|
||||
2026-10-27 founder decision (option A): phase B is paused, not built. The accepted design is retained for T44: secrets-engine inherited-pipe runner (`65a3dbe`) with optimizations 1, 3, 4 and 5; railiance-platform network names (`5658150`: `rpf64-nk49-pb`, `10.249.64.0/28`, rehearsal `-rh-`); client secret `keycape-secrets-engine-openbao-client` key `client-secret` in archive member `resources/sso/secret/keycape-secrets-engine-openbao-client.json`; cert reissue not before 2026-10-30T16:23Z. No module, window or signature was produced.
|
||||
|
||||
## Pre-production joint restore drill with a live consumer login
|
||||
|
||||
```task
|
||||
id: NK-WP-0049-T44
|
||||
status: wait
|
||||
priority: medium
|
||||
assignee: claude-code
|
||||
depends_on: [NK-WP-0049-T18]
|
||||
blocking_reason: "Builder-mode residual of T18. Run before the estate is declared production: build the phase B module from the retained T43 design, rehearse it, then a founder-signed window."
|
||||
```
|
||||
|
||||
**Accountable worker:** claude-code. Signatures, windows and secret inputs stay with the founder and owners.
|
||||
|
||||
**Done when:** restored KeyCape and restored OpenBao are joined on the isolated phase B network and a real consumer
|
||||
(secrets-engine-openbao) passes native positive/negative login, plus one browser/PKCE client; this closes key-cape K1 and
|
||||
railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources.
|
||||
|
||||
## Accept remaining recovery and caller evidence and close the G08 handoff
|
||||
|
||||
```task
|
||||
|
|
@ -1635,7 +1659,7 @@ status: wait
|
|||
priority: high
|
||||
assignee: codex
|
||||
depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26]
|
||||
blocking_reason: "Await the separately tracked native service proofs, current/legacy caller dispositions and residual-scope decisions; archive recovery, backup activation, independent outage retrieval and guide publication are complete."
|
||||
blocking_reason: "T15 and T18 accepted 2026-10-27 (builder mode, residual in T44). Await T21 caller dispositions and T22 historical-credential dispositions."
|
||||
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue