diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8f27ac6..fd08e1d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -13,6 +13,7 @@ | workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | | workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md | | workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md | +| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md | | workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | | workplan | NK-WP-0011 | blocked | — | workplans/NK-WP-0011-enterprise-federation-saml.md | @@ -37,7 +38,7 @@ | workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md | | workplan | NK-WP-0040 | blocked | — | workplans/NK-WP-0040-execution-attribution-receipt.md | | workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md | -| workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md | | workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | | workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md | | workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | @@ -52,6 +53,13 @@ | task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | | task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | | task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | +| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md | +| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md | | task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | @@ -166,7 +174,7 @@ | task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | | task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md | | task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md | -| task | NK-WP-0042-T02 | wait | — | workplans/NK-WP-0042-workload-mfa-step-up.md | +| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md | | task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | | task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | | task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md | @@ -202,3 +210,5 @@ | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | | intake | NET-IN-0002 | open | — | intakes/intakes.md | +| intake | NET-IN-0003 | open | — | intakes/intakes.md | +| intake | NET-IN-0004 | open | — | intakes/intakes.md | diff --git a/intakes/intakes.md b/intakes/intakes.md index e48def5..c1f869d 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -133,4 +133,5 @@ description: > reconciliation returns proof. Finished INFD-WP-0005/0007 remain historical receipts and must not be reopened solely from stale declarations. No deployment, credentials or runtime conformity is authorized here. +state_hub_intake_id: "01a128ba-a62b-7887-a217-419a5958da8b" ``` diff --git a/workplans/NK-WP-0040-execution-attribution-receipt.md b/workplans/NK-WP-0040-execution-attribution-receipt.md index a787439..d375b5a 100644 --- a/workplans/NK-WP-0040-execution-attribution-receipt.md +++ b/workplans/NK-WP-0040-execution-attribution-receipt.md @@ -9,7 +9,7 @@ flavor: planning owner: claude-code topic_slug: netkingdom created: "2026-09-23" -updated: "2026-10-03" +updated: "2026-10-10" related: [RCLK-WP-0002] state_hub_workstream_id: "e2533f3a-aa43-59b3-bff3-8e64b6149487" --- @@ -60,8 +60,8 @@ schema, and validator are explicitly left to T02. ```task id: NK-WP-0040-T02 status: wait -blocked_on: message-from:audit-core -blocking_reason: "Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence." +blocked_on: message-from:railiance-master +blocking_reason: "Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance." priority: medium state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54" ``` @@ -94,3 +94,15 @@ readback, plus invalid/missing attribution cases; schema validation alone cannot establish end-to-end attribution. Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md). + +2026-10-10 consolidation review: AUDIT-WP-0014-T01 (October 4) accepts +audit-core evidence custody and publishes field/unknown/absence/envelope +requirements in audit-core/docs/cross-repo-evidence-admission.md. The custody +reply is delivered; a stranded message-from:audit-core qualifier is obsolete. +Railiance emitter agreement is still required: retain original request +4f1c67bc-8de2-483f-bcac-dbdf107ce95a and identify the exact component/source, +run-id/idempotency, tenant/scope and wire binding with the Railiance owner. +T02 remains wait. Its existing both-owner agreement gate still governs schema +implementation; draft preparation is not owner acceptance. AUDIT-WP-0014-T02 +consumes the eventual canonical schema/fixtures and emitter binding, and cannot +be used as evidence that either has already arrived. diff --git a/workplans/NK-WP-0042-workload-mfa-step-up.md b/workplans/NK-WP-0042-workload-mfa-step-up.md index e62c662..71856e4 100644 --- a/workplans/NK-WP-0042-workload-mfa-step-up.md +++ b/workplans/NK-WP-0042-workload-mfa-step-up.md @@ -4,12 +4,12 @@ type: workplan title: "Let workloads require MFA for all or part of their features" domain: infotech repo: net-kingdom -status: blocked +status: finished flavor: planning owner: claude-code topic_slug: netkingdom created: "2026-09-23" -updated: "2026-10-09" +updated: "2026-10-10" related: [NK-ADR-0016, NK-WP-0037] state_hub_workstream_id: "3f702215-704b-5788-8ca0-b8b9ba2dd3f8" --- @@ -56,10 +56,9 @@ explicitly. ```task id: NK-WP-0042-T02 -status: wait -needs_human: true -decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb -blocking_reason: "Founder decided the pilot (coulomb-social, MFA optional, no AAL2 switch-on); decision cef97ccd stays open for user-perspective acceptance in the attended U05-U08 session (USER-WP-0027-T04 / USER-WP-0028-T03)." +status: cancel +needs_human: false +closure_reason: "Duplicate attended acceptance consolidated into existing USER-WP-0027-T04 and USER-WP-0028-T03; decision cef97ccd remains open there. Demand-deferred workload-requested interoperability retained in residual NET-IN-0003." priority: medium state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf" ``` @@ -166,3 +165,29 @@ actual-user acceptance, coordinated with KEY-WP-0034 / USER-WP-0028 / VERGABE-WP-0019, without reopening their completed provider work. Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md). + +## 2026-10-10 — Consolidated planning closure + +This planning workplan is finished for its delivered contract proposal and +policy/pilot agreement; it does not claim a working arbitrary-client step-up +capability or accepted real-user MFA journey. T01 produced proposed IAM v0.4 +while v0.3 remains normative. The founder's October 9 decision explicitly +selected optional MFA on coulomb-social, issuer/provider-held MFA mechanics +and no current acr_values=aal2 switch-on (user-engine/docs/mfa-pilot-decision.md; +owner relay 60673e40). + +T02's remaining attended acceptance was already owned by live +USER-WP-0027-T04 and USER-WP-0028-T03 with the same decision cef97ccd. +user-engine/docs/mfa-attended-run.md now specifies the actual U05-U08 run +with tegwick, the approved client, the already-live management handoff, the +verification and evidence rules. USER-WP-0028 records founder approval of +tegwick/coulomb-social and the live handoff reply 7ee2459e on October 10. +T02 is cancelled only as a duplicate local acceptance gate: those existing +owners and decision remain open until observed acceptance. No MFA or browser +check has been marked complete. + +Future workload-requested step-up interoperability (no-factor refusal, +enrollment return, stale AAL1 and provider outage) remains demand-deferred +under NET-IN-0003, origin residual / origin_ref NK-WP-0042, rather than +disappearing into closure prose. Do not implement that residual without +promotion and a separately approved client policy/rollout.