Resume user-engine integration rollout
This commit is contained in:
parent
20d4d8af04
commit
96266b9371
6 changed files with 115 additions and 27 deletions
|
|
@ -2,7 +2,7 @@
|
|||
# Custodian Brief — net-kingdom
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-08-12 11:25 UTC
|
||||
**Last synced:** 2026-08-13 12:48 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
|
@ -11,19 +11,19 @@
|
|||
Progress: 1/5 done | workplan_id: `1638183b-e2cb-4da2-92b8-d39592d62e86`
|
||||
|
||||
**Open tasks:**
|
||||
- ► T02 - Provide secure LLDAP self-registration orchestration `bc220e2b`
|
||||
- ► T03 - Integrate registration entry points and return flow `3ec4a9a0`
|
||||
- ► T04 - Apply optional MFA policy safely `cf2e4d05`
|
||||
- · T05 - Prove both cases end to end `5d13f9f6`
|
||||
- ! T02 - Provide secure LLDAP self-registration orchestration `bc220e2b`
|
||||
- ! T03 - Integrate registration entry points and return flow `3ec4a9a0`
|
||||
- ! T04 - Apply optional MFA policy safely `cf2e4d05`
|
||||
- ! T05 - Prove both cases end to end `5d13f9f6`
|
||||
|
||||
### Expand user-engine platform integrations beyond the Binky MVP
|
||||
Progress: 0/4 done | workplan_id: `9bd05700-a839-4014-8f88-8a78f2757721`
|
||||
|
||||
**Open tasks:**
|
||||
- ► T01 - Establish flex-auth production authorization `7dff0ac6`
|
||||
- ► T02 - Add invitation and verification mail delivery `9d5f272b`
|
||||
- ► T03 - Operate durable event delivery `17d6390b`
|
||||
- ► T04 - Run expanded integration failure matrix `4c54e8e4`
|
||||
- ! T01 - Establish flex-auth production authorization `7dff0ac6`
|
||||
- ! T02 - Add invitation and verification mail delivery `9d5f272b`
|
||||
- ! T03 - Operate durable event delivery `17d6390b`
|
||||
- ! T04 - Run expanded integration failure matrix `4c54e8e4`
|
||||
|
||||
### Cut over NetKingdom identity to railiance01 and retire CoulombCore
|
||||
Progress: 7/8 done | workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93`
|
||||
|
|
@ -32,10 +32,6 @@ Progress: 7/8 done | workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93`
|
|||
- ! T08 - Final deletion and closure `9f209f15`
|
||||
*(wait: Rollback retention gate remains in force through 2026-08-29; then verify restore/restart drill evidence and obtain separate explicit approval before deletion or closure.)*
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Missing thread_id:** 2 unread message(s) lack supersession chains.
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
|
|
|
|||
|
|
@ -64,9 +64,9 @@
|
|||
| task | NK-WP-0024-T03 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0024-T04 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md |
|
||||
| task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | todo | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T02 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T03 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T04 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| task | NK-WP-0025-T05 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md |
|
||||
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
|
||||
|
|
|
|||
|
|
@ -104,3 +104,21 @@ Public registration stays disabled until all of the following pass together:
|
|||
5. KeyCape fresh-login return flow and client allow-list checks;
|
||||
6. disposable-user live tests and cleanup on railiance01.
|
||||
|
||||
## Runtime configuration
|
||||
|
||||
The source implementation is fail closed and remains disabled unless all of
|
||||
these are configured together:
|
||||
|
||||
- `USER_ENGINE_PUBLIC_REGISTRATION=true`;
|
||||
- `USER_ENGINE_REGISTRATION_VERIFICATION_URL` and its OpenBao-backed
|
||||
`USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN`;
|
||||
- comma-separated `USER_ENGINE_REGISTRATION_CLIENTS` and
|
||||
`USER_ENGINE_REGISTRATION_TENANTS` allow-lists;
|
||||
- `USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS`, containing only the
|
||||
trusted HTTPS provider origins allowed to receive the browser.
|
||||
|
||||
After verification, user-engine completes the local user, provisions with
|
||||
the deterministic `public-registration-<registration-id>` idempotency key and
|
||||
only the `user` role, then links the returned subject under the configured
|
||||
KeyCape issuer. A setup URL outside the explicit HTTPS origin allow-list is
|
||||
rejected.
|
||||
|
|
|
|||
|
|
@ -62,6 +62,14 @@ spec:
|
|||
- {name: USER_ENGINE_OIDC_REDIRECT_URI, value: "https://users.92-205-62-239.nip.io/oidc/callback"}
|
||||
- {name: USER_ENGINE_OIDC_BACKEND_URL, value: "http://keycape.sso.svc.cluster.local:8080"}
|
||||
- {name: USER_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080"}
|
||||
- {name: USER_ENGINE_EVENT_URL, value: "http://audit-core.audit-core.svc.cluster.local:8080/v1/events"}
|
||||
- {name: USER_ENGINE_MAIL_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080/v1/send"}
|
||||
- name: USER_ENGINE_EVENT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef: {name: user-engine-delivery, key: event-token}
|
||||
- name: USER_ENGINE_MAIL_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef: {name: user-engine-delivery, key: mail-token}
|
||||
- {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "false"}
|
||||
- {name: USER_ENGINE_REGISTRATION_RATE_LIMIT, value: "10"}
|
||||
- {name: USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS, value: "60"}
|
||||
|
|
@ -151,6 +159,12 @@ spec:
|
|||
podSelector:
|
||||
matchLabels: {app.kubernetes.io/name: email-connect}
|
||||
ports: [{protocol: TCP, port: 8080}]
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels: {kubernetes.io/metadata.name: audit-core}
|
||||
podSelector:
|
||||
matchLabels: {app.kubernetes.io/name: audit-core}
|
||||
ports: [{protocol: TCP, port: 8080}]
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels: {kubernetes.io/metadata.name: kube-system}
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: active
|
|||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-07-30"
|
||||
updated: "2026-08-08"
|
||||
updated: "2026-08-13"
|
||||
depends_on:
|
||||
- NK-WP-0023
|
||||
- USER-WP-0021
|
||||
|
|
@ -20,6 +20,24 @@ state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721"
|
|||
|
||||
# NK-WP-0024 - Portal integration expansion
|
||||
|
||||
## 2026-08-13 completion review
|
||||
|
||||
This workplan was blocked at review time. On 2026-08-13 AUDIT-WP-0005
|
||||
finished: the PostgreSQL-backed `audit-core` workload is Ready with archive
|
||||
custody, OpenBao-backed sender/database lanes, restart/rollback evidence, and
|
||||
a live failure matrix (12 passed, 0 failed, 3 production-disruption skips).
|
||||
The workplan is active again.
|
||||
|
||||
The audit dependency recorded above is stale operationally: AUDIT-WP-0003
|
||||
finished only after cancelling its deployment tasks. Production custody and
|
||||
the live matrix moved to the now-finished AUDIT-WP-0005.
|
||||
|
||||
A consumer-side credential-isolation defect was found and fixed before
|
||||
activation. The previous user-engine `HTTPOutboxDeliveryAdapter` accepted one
|
||||
`USER_ENGINE_DELIVERY_TOKEN` for both receivers. audit-core and email-connect
|
||||
are separately scoped receivers and must not share a bearer credential; the
|
||||
adapter now accepts distinct event and mail tokens.
|
||||
|
||||
Track deferred integration breadth separately from the completed live MVP.
|
||||
Activate with the corresponding user-engine product-expansion tasks.
|
||||
|
||||
|
|
@ -36,7 +54,7 @@ gate; provider implementation status stays authoritative in the owning repos.
|
|||
|
||||
```task
|
||||
id: NK-WP-0024-T01
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d"
|
||||
```
|
||||
|
|
@ -61,7 +79,7 @@ runtime switch remains coupled to the event/mail activation gate below.
|
|||
|
||||
```task
|
||||
id: NK-WP-0024-T02
|
||||
status: progress
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea"
|
||||
```
|
||||
|
|
@ -79,7 +97,7 @@ entry; production is deliberately not pointed at a fabricated endpoint.
|
|||
|
||||
```task
|
||||
id: NK-WP-0024-T03
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5"
|
||||
```
|
||||
|
|
@ -97,7 +115,7 @@ cluster event receiver and scoped delivery credential.
|
|||
|
||||
```task
|
||||
id: NK-WP-0024-T04
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71"
|
||||
```
|
||||
|
|
@ -122,3 +140,19 @@ suppression, evidence ceilings, redaction) are in
|
|||
`email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must
|
||||
mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and
|
||||
mailbox challenges are not authorization.
|
||||
|
||||
2026-08-13 review: reopening gates are (1) split user-engine's event and mail
|
||||
bearer configuration, (2) finish and deploy AUDIT-WP-0005 with its OpenBao
|
||||
dynamic database and sender lanes, (3) mount both independently scoped sender
|
||||
credentials, roll out the current user-engine image, and (4) run the combined
|
||||
deployed failure matrix. Until then, marking any of T01-T04 done would claim a
|
||||
runtime cutover that has not occurred.
|
||||
|
||||
2026-08-13 resumed: user-engine now has distinct `USER_ENGINE_EVENT_TOKEN`
|
||||
and `USER_ENGINE_MAIL_TOKEN` inputs; adapter tests assert that audit-core and
|
||||
email-connect receive different Authorization headers and that mail delivery
|
||||
fails closed without its token. The full source suite passes 132 tests with 3
|
||||
external-provider skips. NetKingdom's runtime manifest now declares both
|
||||
cluster-local endpoints, separate Secret keys, and audit-core egress. The
|
||||
remaining gate is custody delivery of those two scoped values, image publish,
|
||||
rollout, and the combined live matrix.
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: active
|
|||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-08-09"
|
||||
updated: "2026-08-09"
|
||||
updated: "2026-08-13"
|
||||
depends_on:
|
||||
- NK-WP-0024
|
||||
- USER-WP-0022
|
||||
|
|
@ -19,6 +19,24 @@ state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86"
|
|||
|
||||
# NK-WP-0025 - public registration and application JIT provisioning
|
||||
|
||||
## 2026-08-13 completion review
|
||||
|
||||
This workplan was blocked at review time. Source-side registration,
|
||||
provider recovery, application JIT, registration entry points, and client MFA
|
||||
selection now exist, but the live user-engine still has
|
||||
`USER_ENGINE_PUBLIC_REGISTRATION=false` and no verification or delivery
|
||||
credentials. Case B and the negative matrix have therefore not run through
|
||||
the deployed path.
|
||||
|
||||
The durable audit receiver is now deployed and the user-engine event/mail
|
||||
credential split is implemented and tested. The remaining upstream gate in
|
||||
NK-WP-0024 is custody delivery plus activation of the fail-closed runtime.
|
||||
Then enable registration with the email-connect
|
||||
verification endpoint, the `coulomb-social` client/tenant allow-lists, and the
|
||||
identity-provisioner password-setup origin. Final closure requires disposable
|
||||
live users plus an attended MFA/isolation check; `tegwick` remains reserved
|
||||
for the attended positive acceptance test.
|
||||
|
||||
Provide two safe entry paths for ordinary users of NetKingdom-enabled
|
||||
applications, beginning with coulomb.social:
|
||||
|
||||
|
|
@ -59,7 +77,7 @@ attributes and are not account-link keys.
|
|||
|
||||
```task
|
||||
id: NK-WP-0025-T02
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14"
|
||||
```
|
||||
|
|
@ -88,11 +106,19 @@ client/tenant/username binding checks and deliberately stops before user or
|
|||
LLDAP creation. The remaining slice is resumable completion, baseline
|
||||
provisioning, provider-subject linking, and password-setup handoff.
|
||||
|
||||
The source happy path now completes those transitions: one user-engine user,
|
||||
one idempotent provisioning request with only the baseline `user` role, a
|
||||
KeyCape issuer/subject link, and an allow-listed HTTPS provider password-setup
|
||||
redirect. The full user-engine suite passes 126 tests with 3
|
||||
environment-dependent skips. Remaining before T02 completion: implement and
|
||||
deploy the verification issuer/mail receiver, add automated recovery for a
|
||||
provider failure after local completion, and run disposable live conformance.
|
||||
|
||||
## T03 - Integrate registration entry points and return flow
|
||||
|
||||
```task
|
||||
id: NK-WP-0025-T03
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
|
||||
```
|
||||
|
|
@ -111,7 +137,7 @@ redirects or client confusion.
|
|||
|
||||
```task
|
||||
id: NK-WP-0025-T04
|
||||
status: progress
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846"
|
||||
```
|
||||
|
|
@ -133,7 +159,7 @@ Other clients retain provider-driven mandatory MFA. Live rollout remains.
|
|||
|
||||
```task
|
||||
id: NK-WP-0025-T05
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b"
|
||||
```
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue