Roll KeyCape to cdec9dd7 with the sign-in diagnosis page (NK-WP-0051-T02).
Founder-run rollout: check-config valid, diff image-only, dry-run passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
parent
cb634be39b
commit
916bc7d5b8
4 changed files with 41 additions and 43 deletions
|
|
@ -2,11 +2,18 @@
|
|||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-14 21:39 UTC
|
||||
**Last synced:** 2026-10-14 21:54 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Bind and hand off the published contract `e3fbc8b8`
|
||||
*(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
|
||||
|
||||
### Reconcile reef placement and security-zone canon dependencies
|
||||
Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
|
||||
|
||||
|
|
@ -18,13 +25,6 @@ Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4`
|
|||
- ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d`
|
||||
*(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)*
|
||||
|
||||
### Publish the NetKingdom emission-cadence security profile
|
||||
Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Bind and hand off the published contract `e3fbc8b8`
|
||||
*(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)*
|
||||
|
||||
### Implement deterministic posture and evidence feedback
|
||||
Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
|
||||
|
||||
|
|
@ -32,20 +32,25 @@ Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a`
|
|||
- ! Obtain audit-core freshness adoption `7d2029d2`
|
||||
*(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)*
|
||||
|
||||
### Show who a workload sign-in actually is
|
||||
Progress: 0/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! KeyCape shows the principal before the callback `a78219bb`
|
||||
*(wait: After T01. key-cape implements the pre-redirect page and the uid log line. NetKingdom does not edit the issuer.)*
|
||||
- ! Account site shows both sessions `bdc8b414`
|
||||
*(wait: After T01. user-engine renders the account-site uid and the Authelia uid as two lines. NetKingdom does not edit the account page.)*
|
||||
- ! Enroll the negative-login factor `afb5816f`
|
||||
*(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)*
|
||||
- ! Hand the OpenBao proof back to its owners `86fb4a6b`
|
||||
*(wait: After T01. ops-mason and railiance-platform own the caller proof and the UI role choice. NetKingdom does not change OpenBao.)*
|
||||
- · Write the diagnosis contract `c969161a`
|
||||
- · Preview directory groups for a uid `65f85a11`
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
### Establish SecurityCaseTypes so that known security cases are light
|
||||
Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
||||
|
|
@ -56,6 +61,19 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb`
|
|||
- ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae`
|
||||
*(wait: The next types follow once the first one is proven end to end.)*
|
||||
|
||||
### Show who a workload sign-in actually is
|
||||
Progress: 2/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b`
|
||||
|
||||
**Open tasks:**
|
||||
- ! KeyCape shows the principal before the callback `a78219bb`
|
||||
*(wait: Implemented in key-cape af3b1b0 (KEY-WP-0041). Waits for KEY-WP-0041-T02: image build, live signInDiagnosis flag on the OpenBao client, digest.)*
|
||||
- ! Account site shows both sessions `bdc8b414`
|
||||
*(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)*
|
||||
- ! Enroll the negative-login factor `afb5816f`
|
||||
*(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)*
|
||||
- ! Hand the OpenBao proof back to its owners `86fb4a6b`
|
||||
*(wait: Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof.)*
|
||||
|
||||
### Define an execution-attribution receipt for Railiance runs
|
||||
Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487`
|
||||
|
||||
|
|
@ -79,26 +97,6 @@ Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804`
|
|||
*(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)*
|
||||
- ► Reconcile other legacy custody callers and root-output boundaries `479d6970`
|
||||
|
||||
### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker
|
||||
Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Admit the database consumer `2fe6f100`
|
||||
*(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)*
|
||||
- ! Package the broker deployment `32d1411b`
|
||||
*(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)*
|
||||
- ! Integrate an upstream identity provider `6697a994`
|
||||
*(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)*
|
||||
- ! Define federated assurance `d845380d`
|
||||
*(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)*
|
||||
- ! Verify IAM conformance and coexistence `9cb7fd93`
|
||||
*(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)*
|
||||
- ! Enforce tenant and platform boundaries `38998c68`
|
||||
*(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)*
|
||||
- ! Prove recovery and audit delivery `e5f44ddc`
|
||||
*(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)*
|
||||
- … and 1 more open tasks
|
||||
|
||||
### Cut over NetKingdom identity to railiance01 and retire CoulombCore
|
||||
Progress: 7/8 done | workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da`
|
||||
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@ OpenBao groups refusal.
|
|||
|
||||
| Item | Value |
|
||||
| --- | --- |
|
||||
| key-cape page and log line | source `af3b1b0` (flag `signInDiagnosis`); image digest pending KEY-WP-0041-T02 |
|
||||
| key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis` not yet set on the live OpenBao client |
|
||||
| user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 |
|
||||
| ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 |
|
||||
| `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 |
|
||||
|
|
|
|||
|
|
@ -54,7 +54,7 @@ spec:
|
|||
# key-cape@1164f65: explicit railiance-admins group maps to
|
||||
# railiance-admin; retains the 8be8065 split-horizon discovery fix.
|
||||
# Rollback: sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5
|
||||
image: forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8
|
||||
image: forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
ports:
|
||||
|
|
|
|||
|
|
@ -99,7 +99,7 @@ id: NK-WP-0051-T02
|
|||
status: wait
|
||||
depends_on: [NK-WP-0051-T01]
|
||||
blocked_on: message-from:key-cape
|
||||
blocking_reason: "Implemented in key-cape af3b1b0 (KEY-WP-0041). Waits for KEY-WP-0041-T02: image build, live signInDiagnosis flag on the OpenBao client, digest."
|
||||
blocking_reason: "Implemented in key-cape af3b1b0 (KEY-WP-0041). Image cdec9dd7 live 2026-10-15. Waits for KEY-WP-0041-T02: live signInDiagnosis flag on the OpenBao client in sso/keycape-config."
|
||||
priority: high
|
||||
state_hub_task_id: "a78219bb-2355-5a2e-8750-0b32a57f87bc"
|
||||
```
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue