coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Retain reviewed security workplan consolidation and bindings

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
tegwick 2026-10-11 18:46:21 +02:00
parent 7ceac4372d
commit 8964affdea
4 changed files with 59 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

14
WORK-RECORDS.md
View file

@ -13,6 +13,7 @@
| workplan | NK-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
| workplan | NK-WP-ADHOC-2026-10-03 | finished | — | workplans/ADHOC-2026-10-03.md |
| workplan | NK-WP-ADHOC-2026-10-10 | finished | — | workplans/ADHOC-2026-10-10.md |
| workplan | NK-WP-ADHOC-2026-10-11 | finished | — | workplans/ADHOC-2026-10-11.md |
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
| workplan | NK-WP-0011 | blocked | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
@ -37,7 +38,7 @@
| workplan | NK-WP-0039 | finished | — | workplans/NK-WP-0039-flex-auth-access-engine-coordinate-intake.md |
| workplan | NK-WP-0040 | blocked | — | workplans/NK-WP-0040-execution-attribution-receipt.md |
| workplan | NK-WP-0041 | finished | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
| workplan | NK-WP-0042 | blocked | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
| workplan | NK-WP-0042 | finished | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
| workplan | NK-WP-0043 | finished | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
| workplan | NK-WP-0044 | finished | — | workplans/NK-WP-0044-runbook-packs-for-runbook-tutorials.md |
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
@ -52,6 +53,13 @@
| task | NK-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
| task | NK-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md |
| task | NK-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
| task | NK-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T04 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T05 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T06 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NK-WP-ADHOC-2026-10-11-T07 | done | — | workplans/ADHOC-2026-10-11.md |
| task | NET-WP-0020-T01 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T02 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
| task | NET-WP-0020-T03 | done | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
@ -166,7 +174,7 @@
| task | NK-WP-0041-T02 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
| task | NK-WP-0041-T03 | done | — | workplans/NK-WP-0041-onboarding-journey-usability.md |
| task | NK-WP-0042-T01 | done | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
| task | NK-WP-0042-T02 | wait | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
| task | NK-WP-0042-T02 | cancel | — | workplans/NK-WP-0042-workload-mfa-step-up.md |
| task | NK-WP-0043-T01 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
| task | NK-WP-0043-T02 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
| task | NK-WP-0043-T03 | done | — | workplans/NK-WP-0043-cadence-assessment-and-operating-guidance.md |
@ -202,3 +210,5 @@
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NET-IN-0001 | open | — | intakes/intakes.md |
| intake | NET-IN-0002 | open | — | intakes/intakes.md |
| intake | NET-IN-0003 | open | — | intakes/intakes.md |
| intake | NET-IN-0004 | open | — | intakes/intakes.md |

1
intakes/intakes.md
View file

@ -133,4 +133,5 @@ description: >
reconciliation returns proof. Finished INFD-WP-0005/0007 remain historical
receipts and must not be reopened solely from stale declarations.
No deployment, credentials or runtime conformity is authorized here.
state_hub_intake_id: "01a128ba-a62b-7887-a217-419a5958da8b"
```

18
workplans/NK-WP-0040-execution-attribution-receipt.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: claude-code
topic_slug: netkingdom
created: "2026-09-23"
updated: "2026-10-03"
updated: "2026-10-10"
related: [RCLK-WP-0002]
state_hub_workstream_id: "e2533f3a-aa43-59b3-bff3-8e64b6149487"
---
@ -60,8 +60,8 @@ schema, and validator are explicitly left to T02.
```task
id: NK-WP-0040-T02
status: wait
blocked_on: message-from:audit-core
blocking_reason: "Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence."
blocked_on: message-from:railiance-master
blocking_reason: "Audit-core accepted evidence custody and published field/admission requirements in AUDIT-WP-0014-T01. Still needs Railiance owner confirmation of exact emitter and wire binding before canonical schema/validator implementation, followed by actual emission/readback and attribution/clock/unknown-case acceptance."
priority: medium
state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"
```
@ -94,3 +94,15 @@ readback, plus invalid/missing attribution cases; schema validation alone
cannot establish end-to-end attribution.
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
2026-10-10 consolidation review: AUDIT-WP-0014-T01 (October 4) accepts
audit-core evidence custody and publishes field/unknown/absence/envelope
requirements in audit-core/docs/cross-repo-evidence-admission.md. The custody
reply is delivered; a stranded message-from:audit-core qualifier is obsolete.
Railiance emitter agreement is still required: retain original request
4f1c67bc-8de2-483f-bcac-dbdf107ce95a and identify the exact component/source,
run-id/idempotency, tenant/scope and wire binding with the Railiance owner.
T02 remains wait. Its existing both-owner agreement gate still governs schema
implementation; draft preparation is not owner acceptance. AUDIT-WP-0014-T02
consumes the eventual canonical schema/fixtures and emitter binding, and cannot
be used as evidence that either has already arrived.

37
workplans/NK-WP-0042-workload-mfa-step-up.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Let workloads require MFA for all or part of their features"
domain: infotech
repo: net-kingdom
status: blocked
status: finished
flavor: planning
owner: claude-code
topic_slug: netkingdom
created: "2026-09-23"
updated: "2026-10-09"
updated: "2026-10-10"
related: [NK-ADR-0016, NK-WP-0037]
state_hub_workstream_id: "3f702215-704b-5788-8ca0-b8b9ba2dd3f8"
---
@ -56,10 +56,9 @@ explicitly.
```task
id: NK-WP-0042-T02
status: wait
needs_human: true
decision_id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
blocking_reason: "Founder decided the pilot (coulomb-social, MFA optional, no AAL2 switch-on); decision cef97ccd stays open for user-perspective acceptance in the attended U05-U08 session (USER-WP-0027-T04 / USER-WP-0028-T03)."
status: cancel
needs_human: false
closure_reason: "Duplicate attended acceptance consolidated into existing USER-WP-0027-T04 and USER-WP-0028-T03; decision cef97ccd remains open there. Demand-deferred workload-requested interoperability retained in residual NET-IN-0003."
priority: medium
state_hub_task_id: "4e51585d-2b57-56d4-84c1-314041d26bcf"
```
@ -166,3 +165,29 @@ actual-user acceptance, coordinated with KEY-WP-0034 / USER-WP-0028 /
VERGABE-WP-0019, without reopening their completed provider work.
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
## 2026-10-10 — Consolidated planning closure
This planning workplan is finished for its delivered contract proposal and
policy/pilot agreement; it does not claim a working arbitrary-client step-up
capability or accepted real-user MFA journey. T01 produced proposed IAM v0.4
while v0.3 remains normative. The founder's October 9 decision explicitly
selected optional MFA on coulomb-social, issuer/provider-held MFA mechanics
and no current acr_values=aal2 switch-on (user-engine/docs/mfa-pilot-decision.md;
owner relay 60673e40).
T02's remaining attended acceptance was already owned by live
USER-WP-0027-T04 and USER-WP-0028-T03 with the same decision cef97ccd.
user-engine/docs/mfa-attended-run.md now specifies the actual U05-U08 run
with tegwick, the approved client, the already-live management handoff, the
verification and evidence rules. USER-WP-0028 records founder approval of
tegwick/coulomb-social and the live handoff reply 7ee2459e on October 10.
T02 is cancelled only as a duplicate local acceptance gate: those existing
owners and decision remain open until observed acceptance. No MFA or browser
check has been marked complete.
Future workload-requested step-up interoperability (no-factor refusal,
enrollment return, stale AAL1 and provider outage) remains demand-deferred
under NET-IN-0003, origin residual / origin_ref NK-WP-0042, rather than
disappearing into closure prose. Do not implement that residual without
promotion and a separately approved client policy/rollout.