diff --git a/.custodian-brief.md b/.custodian-brief.md index 68e4d26..143b0c2 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,11 +2,18 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-10-14 21:39 UTC +**Last synced:** 2026-10-14 21:54 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams +### Publish the NetKingdom emission-cadence security profile +Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` + +**Open tasks:** +- ! Bind and hand off the published contract `e3fbc8b8` + *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)* + ### Reconcile reef placement and security-zone canon dependencies Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` @@ -18,13 +25,6 @@ Progress: 3/6 done | workplan_id: `965ad365-6b81-50a1-a2a3-2d0c1fcce0b4` - ! T06 — Resolve the `DataClassification` mismatch `bf8b3e1d` *(wait: Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias.)* -### Publish the NetKingdom emission-cadence security profile -Progress: 4/5 done | workplan_id: `04685f94-1991-5e62-80d2-5669913e99fc` - -**Open tasks:** -- ! Bind and hand off the published contract `e3fbc8b8` - *(wait: Approval Engine and Qonto owner declarations now pass the published schema and supplied-inventory profile; local-identity incompatibility is retained. Requires actual sender cadence mappings, lifecycle delivery/readback/reconciliation and Kings Guard operational feed evidence.)* - ### Implement deterministic posture and evidence feedback Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` @@ -32,20 +32,25 @@ Progress: 4/5 done | workplan_id: `9d7b04f9-3803-5613-b7a5-8bd606c77f5a` - ! Obtain audit-core freshness adoption `7d2029d2` *(wait: audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2.)* -### Show who a workload sign-in actually is -Progress: 0/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b` +### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker +Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` **Open tasks:** -- ! KeyCape shows the principal before the callback `a78219bb` - *(wait: After T01. key-cape implements the pre-redirect page and the uid log line. NetKingdom does not edit the issuer.)* -- ! Account site shows both sessions `bdc8b414` - *(wait: After T01. user-engine renders the account-site uid and the Authelia uid as two lines. NetKingdom does not edit the account page.)* -- ! Enroll the negative-login factor `afb5816f` - *(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)* -- ! Hand the OpenBao proof back to its owners `86fb4a6b` - *(wait: After T01. ops-mason and railiance-platform own the caller proof and the UI role choice. NetKingdom does not change OpenBao.)* -- · Write the diagnosis contract `c969161a` -- · Preview directory groups for a uid `65f85a11` +- ! Admit the database consumer `2fe6f100` + *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* +- ! Package the broker deployment `32d1411b` + *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* +- ! Integrate an upstream identity provider `6697a994` + *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* +- ! Define federated assurance `d845380d` + *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* +- ! Verify IAM conformance and coexistence `9cb7fd93` + *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* +- ! Enforce tenant and platform boundaries `38998c68` + *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* +- ! Prove recovery and audit delivery `e5f44ddc` + *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* +- … and 1 more open tasks ### Establish SecurityCaseTypes so that known security cases are light Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` @@ -56,6 +61,19 @@ Progress: 7/9 done | workplan_id: `e31f3f9d-0748-5137-b0a3-7b3ca46a66eb` - ! T06 — First KnownSecurityCase: Forgejo `c3c9c3ae` *(wait: The next types follow once the first one is proven end to end.)* +### Show who a workload sign-in actually is +Progress: 2/6 done | workplan_id: `c1771c07-4466-5aa2-ad43-df63a471946b` + +**Open tasks:** +- ! KeyCape shows the principal before the callback `a78219bb` + *(wait: Implemented in key-cape af3b1b0 (KEY-WP-0041). Waits for KEY-WP-0041-T02: image build, live signInDiagnosis flag on the OpenBao client, digest.)* +- ! Account site shows both sessions `bdc8b414` + *(wait: Implemented in user-engine 80f5870 (USER-WP-0039). Waits for USER-WP-0039-T02: deploy and a mismatched-session check.)* +- ! Enroll the negative-login factor `afb5816f` + *(wait: After T04 names the fixture uid. Founder enrolls its one-time password at https://pink-account.coulomb.social/, realm coulomb.)* +- ! Hand the OpenBao proof back to its owners `86fb4a6b` + *(wait: Implemented in ops-mason fca5591 (MASON-WP-0012) and railiance-platform 0f0282a (RPF-WP-0057). Waits for CCR-2026-0045 apply, overlay deploy, and the MASON-WP-0012-T04 live proof.)* + ### Define an execution-attribution receipt for Railiance runs Progress: 1/2 done | workplan_id: `e2533f3a-aa43-59b3-bff3-8e64b6149487` @@ -79,26 +97,6 @@ Progress: 1/3 done | workplan_id: `17d315f0-829e-57c7-85cc-3a7914152804` *(wait: Source caller reconciliation and exact owner-scoped isolated recovery ceremony are required; no live bootstrap or root retrieval is authorized by this source receipt.)* - ► Reconcile other legacy custody callers and root-output boundaries `479d6970` -### Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker -Progress: 1/9 done | workplan_id: `1075448f-d533-5f9e-94b7-c3adfe151a07` - -**Open tasks:** -- ! Admit the database consumer `2fe6f100` - *(wait: ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence.)* -- ! Package the broker deployment `32d1411b` - *(wait: ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment.)* -- ! Integrate an upstream identity provider `6697a994` - *(wait: Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence.)* -- ! Define federated assurance `d845380d` - *(wait: Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners.)* -- ! Verify IAM conformance and coexistence `9cb7fd93` - *(wait: Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent.)* -- ! Enforce tenant and platform boundaries `38998c68` - *(wait: Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission.)* -- ! Prove recovery and audit delivery `e5f44ddc` - *(wait: Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent.)* -- … and 1 more open tasks - ### Cut over NetKingdom identity to railiance01 and retire CoulombCore Progress: 7/8 done | workplan_id: `d76ddccc-00c8-548a-b141-2cd660fa38da` diff --git a/docs/sign-in-diagnosis.md b/docs/sign-in-diagnosis.md index f9a54f2..e7d0dfc 100644 --- a/docs/sign-in-diagnosis.md +++ b/docs/sign-in-diagnosis.md @@ -62,7 +62,7 @@ OpenBao groups refusal. | Item | Value | | --- | --- | -| key-cape page and log line | source `af3b1b0` (flag `signInDiagnosis`); image digest pending KEY-WP-0041-T02 | +| key-cape page and log line | live 2026-10-15: `forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010` (source `8c6c071`, includes `af3b1b0`). `signInDiagnosis` not yet set on the live OpenBao client | | user-engine two-session lines | source `80f5870`; image digest pending USER-WP-0039-T02 | | ops-mason receipt, fresh-browser login, `capabilities-self` proof | ops-mason `fca5591` (MASON-WP-0012); live proof pending MASON-WP-0012-T04 | | `sys/capabilities-self` grant and UI workload-role select | railiance-platform `0f0282a` (RPF-WP-0057); CCR-2026-0045 approval/apply and overlay deploy pending RPF-WP-0057-T02/T04 | diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index 808c879..5bebf09 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -54,7 +54,7 @@ spec: # key-cape@1164f65: explicit railiance-admins group maps to # railiance-admin; retains the 8be8065 split-horizon discovery fix. # Rollback: sha256:61b5f222a35c6ee1dc0273ea581bdad3d8d98e58b2c37327ac169639252e8ef5 - image: forgejo.coulomb.social/coulomb/key-cape@sha256:6f79a2af1c695d39480173fad013facd84d21e7732860366af519302a2c496b8 + image: forgejo.coulomb.social/coulomb/key-cape@sha256:cdec9dd7c515f7e0a6169fc3fa560ee2cc47bf40d899755dec808c362f5ce010 imagePullPolicy: IfNotPresent ports: diff --git a/workplans/NK-WP-0051-sign-in-diagnosis.md b/workplans/NK-WP-0051-sign-in-diagnosis.md index 29fb3f5..c3d4066 100644 --- a/workplans/NK-WP-0051-sign-in-diagnosis.md +++ b/workplans/NK-WP-0051-sign-in-diagnosis.md @@ -99,7 +99,7 @@ id: NK-WP-0051-T02 status: wait depends_on: [NK-WP-0051-T01] blocked_on: message-from:key-cape -blocking_reason: "Implemented in key-cape af3b1b0 (KEY-WP-0041). Waits for KEY-WP-0041-T02: image build, live signInDiagnosis flag on the OpenBao client, digest." +blocking_reason: "Implemented in key-cape af3b1b0 (KEY-WP-0041). Image cdec9dd7 live 2026-10-15. Waits for KEY-WP-0041-T02: live signInDiagnosis flag on the OpenBao client in sso/keycape-config." priority: high state_hub_task_id: "a78219bb-2355-5a2e-8750-0b32a57f87bc" ```