coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile infrastructure workplans and retire stale flex-auth references

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e77d-47a4-7771-8e34-7339c7fac0e4
This commit is contained in:
tegwick 2026-09-28 12:40:03 +02:00
parent 019e8f21a7
commit 9383b94019
12 changed files with 494 additions and 149 deletions
Download patch file Download diff file Expand all files Collapse all files

29
workplans/NK-WP-0032-openbao-operator-loopback-callback.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Admit the operator-tunneled OpenBao browser callback"
domain: infotech
repo: net-kingdom
status: blocked
status: finished
flavor: implementation
owner: codex
topic_slug: net-kingdom
created: "2026-08-23"
updated: "2026-08-23"
updated: "2026-09-28"
related:
- RMASTER-WP-0020-T09
- RAILIANCE-WP-0027-T03
@ -68,7 +68,7 @@ or Secret value was observed.
```task
id: NK-WP-0032-T03
status: wait
status: done
priority: high
state_hub_task_id: "73b77110-2d4f-527e-98eb-2ec33897681e"
```
@ -82,7 +82,7 @@ query, browser storage, or role response body.
```task
id: NK-WP-0032-T04
status: wait
status: done
priority: high
state_hub_task_id: "f62bda4a-7607-5c50-9e04-664cc1b829ac"
```
@ -91,3 +91,24 @@ After T02 and T03 pass, perform one attended MFA login through
`http://127.0.0.1:18200` and return only the success/failure outcome. This task
does not authorize public Ingress retraction; Railiance Platform retains that
separate guarded hold point.
## Infrastructure review — 2026-09-28
T03 and T04 are complete from existing owner evidence; no new attended login
or role write is needed for this reconciliation. Railiance Platform
`docs/evidence/2026-09-15-openbao-loopback-callback-already-present.json`
proves the exact callback already present, Warden exit 0 and session revocation.
`docs/evidence/2026-09-15-openbao-public-listener-retract.json` records successful
operator loopback MFA, private HTTP 200, gateway readiness and public Ingress
retraction. `RPF-WP-0025` closure on September 22 records the handoff to
Railiance Master. These receipts discharge the original role and login gates.
Today the gateway and OpenBao are ready, their Services are ClusterIP, and the
openbao namespace has no Ingress. The September 24 callback-prune receipt
retired the public callbacks; current NetKingdom client source also forbids
their return. T01's bounded rollback requirement is historical, not an
instruction to restore public callbacks. DNS withdrawal remains the
railiance-infra owner residual described by RPF-WP-0025; this review does not
claim it is complete or authorize a listener change.
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).