From 96266b937101d33cf0816fa6ed0c3e5637bd21d3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 13 Aug 2026 14:56:53 +0200 Subject: [PATCH] Resume user-engine integration rollout --- .custodian-brief.md | 22 ++++------ WORK-RECORDS.md | 8 ++-- ...lic-registration-orchestration-contract.md | 18 ++++++++ sso-mfa/k8s/user-engine/runtime.yaml | 14 ++++++ ...ser-engine-portal-integration-expansion.md | 44 ++++++++++++++++--- ...c-self-registration-and-application-jit.md | 36 ++++++++++++--- 6 files changed, 115 insertions(+), 27 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 52df87c..bf66a83 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — net-kingdom **Domain:** infotech -**Last synced:** 2026-08-12 11:25 UTC +**Last synced:** 2026-08-13 12:48 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -11,19 +11,19 @@ Progress: 1/5 done | workplan_id: `1638183b-e2cb-4da2-92b8-d39592d62e86` **Open tasks:** -- ► T02 - Provide secure LLDAP self-registration orchestration `bc220e2b` -- ► T03 - Integrate registration entry points and return flow `3ec4a9a0` -- ► T04 - Apply optional MFA policy safely `cf2e4d05` -- · T05 - Prove both cases end to end `5d13f9f6` +- ! T02 - Provide secure LLDAP self-registration orchestration `bc220e2b` +- ! T03 - Integrate registration entry points and return flow `3ec4a9a0` +- ! T04 - Apply optional MFA policy safely `cf2e4d05` +- ! T05 - Prove both cases end to end `5d13f9f6` ### Expand user-engine platform integrations beyond the Binky MVP Progress: 0/4 done | workplan_id: `9bd05700-a839-4014-8f88-8a78f2757721` **Open tasks:** -- ► T01 - Establish flex-auth production authorization `7dff0ac6` -- ► T02 - Add invitation and verification mail delivery `9d5f272b` -- ► T03 - Operate durable event delivery `17d6390b` -- ► T04 - Run expanded integration failure matrix `4c54e8e4` +- ! T01 - Establish flex-auth production authorization `7dff0ac6` +- ! T02 - Add invitation and verification mail delivery `9d5f272b` +- ! T03 - Operate durable event delivery `17d6390b` +- ! T04 - Run expanded integration failure matrix `4c54e8e4` ### Cut over NetKingdom identity to railiance01 and retire CoulombCore Progress: 7/8 done | workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93` @@ -32,10 +32,6 @@ Progress: 7/8 done | workplan_id: `3dadddeb-4cec-48e2-9c2c-788b26dd6e93` - ! T08 - Final deletion and closure `9f209f15` *(wait: Rollback retention gate remains in force through 2026-08-29; then verify restore/restart drill evidence and obtain separate explicit approval before deletion or closure.)* -## Inbox Hygiene - -**Missing thread_id:** 2 unread message(s) lack supersession chains. - --- ## MCP Orientation (when available) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8ced6ee..60ac7cb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -64,9 +64,9 @@ | task | NK-WP-0024-T03 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | | task | NK-WP-0024-T04 | progress | — | workplans/NK-WP-0024-user-engine-portal-integration-expansion.md | | task | NK-WP-0025-T01 | done | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | -| task | NK-WP-0025-T02 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | -| task | NK-WP-0025-T03 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | -| task | NK-WP-0025-T04 | progress | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | -| task | NK-WP-0025-T05 | todo | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T02 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T03 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T04 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | +| task | NK-WP-0025-T05 | wait | — | workplans/NK-WP-0025-public-self-registration-and-application-jit.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | diff --git a/docs/public-registration-orchestration-contract.md b/docs/public-registration-orchestration-contract.md index 2975d43..ea114ed 100644 --- a/docs/public-registration-orchestration-contract.md +++ b/docs/public-registration-orchestration-contract.md @@ -104,3 +104,21 @@ Public registration stays disabled until all of the following pass together: 5. KeyCape fresh-login return flow and client allow-list checks; 6. disposable-user live tests and cleanup on railiance01. +## Runtime configuration + +The source implementation is fail closed and remains disabled unless all of +these are configured together: + +- `USER_ENGINE_PUBLIC_REGISTRATION=true`; +- `USER_ENGINE_REGISTRATION_VERIFICATION_URL` and its OpenBao-backed + `USER_ENGINE_REGISTRATION_VERIFICATION_TOKEN`; +- comma-separated `USER_ENGINE_REGISTRATION_CLIENTS` and + `USER_ENGINE_REGISTRATION_TENANTS` allow-lists; +- `USER_ENGINE_REGISTRATION_PASSWORD_SETUP_ORIGINS`, containing only the + trusted HTTPS provider origins allowed to receive the browser. + +After verification, user-engine completes the local user, provisions with +the deterministic `public-registration-` idempotency key and +only the `user` role, then links the returned subject under the configured +KeyCape issuer. A setup URL outside the explicit HTTPS origin allow-list is +rejected. diff --git a/sso-mfa/k8s/user-engine/runtime.yaml b/sso-mfa/k8s/user-engine/runtime.yaml index 765308a..2d5f38b 100644 --- a/sso-mfa/k8s/user-engine/runtime.yaml +++ b/sso-mfa/k8s/user-engine/runtime.yaml @@ -62,6 +62,14 @@ spec: - {name: USER_ENGINE_OIDC_REDIRECT_URI, value: "https://users.92-205-62-239.nip.io/oidc/callback"} - {name: USER_ENGINE_OIDC_BACKEND_URL, value: "http://keycape.sso.svc.cluster.local:8080"} - {name: USER_ENGINE_FLEX_AUTH_URL, value: "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080"} + - {name: USER_ENGINE_EVENT_URL, value: "http://audit-core.audit-core.svc.cluster.local:8080/v1/events"} + - {name: USER_ENGINE_MAIL_URL, value: "http://email-connect.email-connect.svc.cluster.local:8080/v1/send"} + - name: USER_ENGINE_EVENT_TOKEN + valueFrom: + secretKeyRef: {name: user-engine-delivery, key: event-token} + - name: USER_ENGINE_MAIL_TOKEN + valueFrom: + secretKeyRef: {name: user-engine-delivery, key: mail-token} - {name: USER_ENGINE_PUBLIC_REGISTRATION, value: "false"} - {name: USER_ENGINE_REGISTRATION_RATE_LIMIT, value: "10"} - {name: USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS, value: "60"} @@ -151,6 +159,12 @@ spec: podSelector: matchLabels: {app.kubernetes.io/name: email-connect} ports: [{protocol: TCP, port: 8080}] + - to: + - namespaceSelector: + matchLabels: {kubernetes.io/metadata.name: audit-core} + podSelector: + matchLabels: {app.kubernetes.io/name: audit-core} + ports: [{protocol: TCP, port: 8080}] - to: - namespaceSelector: matchLabels: {kubernetes.io/metadata.name: kube-system} diff --git a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md index 05b0508..2787454 100644 --- a/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md +++ b/workplans/NK-WP-0024-user-engine-portal-integration-expansion.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-07-30" -updated: "2026-08-08" +updated: "2026-08-13" depends_on: - NK-WP-0023 - USER-WP-0021 @@ -20,6 +20,24 @@ state_hub_workstream_id: "9bd05700-a839-4014-8f88-8a78f2757721" # NK-WP-0024 - Portal integration expansion +## 2026-08-13 completion review + +This workplan was blocked at review time. On 2026-08-13 AUDIT-WP-0005 +finished: the PostgreSQL-backed `audit-core` workload is Ready with archive +custody, OpenBao-backed sender/database lanes, restart/rollback evidence, and +a live failure matrix (12 passed, 0 failed, 3 production-disruption skips). +The workplan is active again. + +The audit dependency recorded above is stale operationally: AUDIT-WP-0003 +finished only after cancelling its deployment tasks. Production custody and +the live matrix moved to the now-finished AUDIT-WP-0005. + +A consumer-side credential-isolation defect was found and fixed before +activation. The previous user-engine `HTTPOutboxDeliveryAdapter` accepted one +`USER_ENGINE_DELIVERY_TOKEN` for both receivers. audit-core and email-connect +are separately scoped receivers and must not share a bearer credential; the +adapter now accepts distinct event and mail tokens. + Track deferred integration breadth separately from the completed live MVP. Activate with the corresponding user-engine product-expansion tasks. @@ -36,7 +54,7 @@ gate; provider implementation status stays authoritative in the owning repos. ```task id: NK-WP-0024-T01 -status: progress +status: wait priority: high state_hub_task_id: "7dff0ac6-c5eb-486c-83db-a1400f30f77d" ``` @@ -61,7 +79,7 @@ runtime switch remains coupled to the event/mail activation gate below. ```task id: NK-WP-0024-T02 -status: progress +status: wait priority: medium state_hub_task_id: "9d5f272b-115c-404d-8387-7f987cee65ea" ``` @@ -79,7 +97,7 @@ entry; production is deliberately not pointed at a fabricated endpoint. ```task id: NK-WP-0024-T03 -status: progress +status: wait priority: high state_hub_task_id: "17d6390b-05a8-436c-879b-4e0331d85be5" ``` @@ -97,7 +115,7 @@ cluster event receiver and scoped delivery credential. ```task id: NK-WP-0024-T04 -status: progress +status: wait priority: high state_hub_task_id: "4c54e8e4-19d9-4470-bb43-3d43cf27af71" ``` @@ -122,3 +140,19 @@ suppression, evidence ceilings, redaction) are in `email-connect/docs/EMAIL-WP-0004-T04-failure-evidence.md`. user-engine must mount only `EMAIL_CONNECT_INGEST_TOKEN` (not SMTP). Provider acceptance and mailbox challenges are not authorization. + +2026-08-13 review: reopening gates are (1) split user-engine's event and mail +bearer configuration, (2) finish and deploy AUDIT-WP-0005 with its OpenBao +dynamic database and sender lanes, (3) mount both independently scoped sender +credentials, roll out the current user-engine image, and (4) run the combined +deployed failure matrix. Until then, marking any of T01-T04 done would claim a +runtime cutover that has not occurred. + +2026-08-13 resumed: user-engine now has distinct `USER_ENGINE_EVENT_TOKEN` +and `USER_ENGINE_MAIL_TOKEN` inputs; adapter tests assert that audit-core and +email-connect receive different Authorization headers and that mail delivery +fails closed without its token. The full source suite passes 132 tests with 3 +external-provider skips. NetKingdom's runtime manifest now declares both +cluster-local endpoints, separate Secret keys, and audit-core egress. The +remaining gate is custody delivery of those two scoped values, image publish, +rollout, and the combined live matrix. diff --git a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md index 58244ec..60dfe90 100644 --- a/workplans/NK-WP-0025-public-self-registration-and-application-jit.md +++ b/workplans/NK-WP-0025-public-self-registration-and-application-jit.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-08-09" -updated: "2026-08-09" +updated: "2026-08-13" depends_on: - NK-WP-0024 - USER-WP-0022 @@ -19,6 +19,24 @@ state_hub_workstream_id: "1638183b-e2cb-4da2-92b8-d39592d62e86" # NK-WP-0025 - public registration and application JIT provisioning +## 2026-08-13 completion review + +This workplan was blocked at review time. Source-side registration, +provider recovery, application JIT, registration entry points, and client MFA +selection now exist, but the live user-engine still has +`USER_ENGINE_PUBLIC_REGISTRATION=false` and no verification or delivery +credentials. Case B and the negative matrix have therefore not run through +the deployed path. + +The durable audit receiver is now deployed and the user-engine event/mail +credential split is implemented and tested. The remaining upstream gate in +NK-WP-0024 is custody delivery plus activation of the fail-closed runtime. +Then enable registration with the email-connect +verification endpoint, the `coulomb-social` client/tenant allow-lists, and the +identity-provisioner password-setup origin. Final closure requires disposable +live users plus an attended MFA/isolation check; `tegwick` remains reserved +for the attended positive acceptance test. + Provide two safe entry paths for ordinary users of NetKingdom-enabled applications, beginning with coulomb.social: @@ -59,7 +77,7 @@ attributes and are not account-link keys. ```task id: NK-WP-0025-T02 -status: progress +status: wait priority: high state_hub_task_id: "bc220e2b-4cd1-4dcf-b107-12ef3595fe14" ``` @@ -88,11 +106,19 @@ client/tenant/username binding checks and deliberately stops before user or LLDAP creation. The remaining slice is resumable completion, baseline provisioning, provider-subject linking, and password-setup handoff. +The source happy path now completes those transitions: one user-engine user, +one idempotent provisioning request with only the baseline `user` role, a +KeyCape issuer/subject link, and an allow-listed HTTPS provider password-setup +redirect. The full user-engine suite passes 126 tests with 3 +environment-dependent skips. Remaining before T02 completion: implement and +deploy the verification issuer/mail receiver, add automated recovery for a +provider failure after local completion, and run disposable live conformance. + ## T03 - Integrate registration entry points and return flow ```task id: NK-WP-0025-T03 -status: progress +status: wait priority: high state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb" ``` @@ -111,7 +137,7 @@ redirects or client confusion. ```task id: NK-WP-0025-T04 -status: progress +status: wait priority: high state_hub_task_id: "cf2e4d05-fd07-4bc3-92ff-b2a5ade97846" ``` @@ -133,7 +159,7 @@ Other clients retain provider-driven mandatory MFA. Live rollout remains. ```task id: NK-WP-0025-T05 -status: todo +status: wait priority: high state_hub_task_id: "5d13f9f6-16b1-44c9-8e1d-4630cfe60a7b" ```