coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(registrar): assign State Hub identifiers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb
This commit is contained in:
repo-manager 2026-08-23 14:08:12 +02:00
parent 7b2c9e8aa9
commit 9ae4e24305
3 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

11
WORK-RECORDS.md
View file

@ -25,6 +25,8 @@
| workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md |
| workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md |
| workplan | NK-WP-0031 | blocked | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| workplan | NK-WP-0032 | blocked | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| workplan | NK-WP-0033 | active | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
| task | ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
| task | ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@ -106,5 +108,14 @@
| task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T04 | wait | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md |
| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T03 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0032-T04 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md |
| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T02 | progress | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T03 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T04 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| task | NK-WP-0033-T05 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md |
| intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
| intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |

5
workplans/NK-WP-0032-openbao-operator-loopback-callback.md
View file

@ -14,6 +14,7 @@ related:
- RAILIANCE-WP-0027-T03
origin: routed
origin_ref: "State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca"
state_hub_workstream_id: "516ee5b9-685b-5986-88d2-bde66c2ba96c"
---
# NK-WP-0032 — OpenBao operator loopback callback
@ -30,6 +31,7 @@ weakening MFA or broadening the OpenBao policy.
id: NK-WP-0032-T01
status: done
priority: high
state_hub_task_id: "f231077e-7440-5f20-9045-afab90fa8286"
```
Add `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the
@ -47,6 +49,7 @@ syntax validation, and `git diff --check` pass.
id: NK-WP-0032-T02
status: done
priority: high
state_hub_task_id: "360bc410-d7ed-53b6-b5fc-2ce8b37b653f"
```
Patch only the code-defined non-secret client configuration, restart KeyCape,
@ -66,6 +69,7 @@ or Secret value was observed.
id: NK-WP-0032-T03
status: wait
priority: high
state_hub_task_id: "73b77110-2d4f-527e-98eb-2ec33897681e"
```
An attended platform-admin/root-sudo authority must apply the updated role
@ -79,6 +83,7 @@ query, browser storage, or role response body.
id: NK-WP-0032-T04
status: wait
priority: high
state_hub_task_id: "f62bda4a-7607-5c50-9e04-664cc1b829ac"
```
After T02 and T03 pass, perform one attended MFA login through

6
workplans/NK-WP-0033-keycape-secret-exposure-rotation.md
View file

@ -14,6 +14,7 @@ origin: routed
origin_ref: "State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0"
related:
- NK-WP-0032
state_hub_workstream_id: "63665674-6880-593e-96e6-bab3211b1352"
---
# NK-WP-0033 — KeyCape credential exposure containment and rotation
@ -35,6 +36,7 @@ conditions, and the authority stated by the owning execution path.
id: NK-WP-0033-T01
status: done
priority: high
state_hub_task_id: "28a655da-7cd6-58e2-8ca8-64d192de63a6"
```
Mark every credential class in the rendered bundle exposed, stop further
@ -54,6 +56,7 @@ or copied.
id: NK-WP-0033-T02
status: progress
priority: high
state_hub_task_id: "c5ca817c-d601-5172-a106-1546c0743635"
```
KeyCape and railiance-platform must name the authoritative provider, custody,
@ -79,6 +82,7 @@ unrelated routes do not authorize execution.
id: NK-WP-0033-T03
status: wait
priority: high
state_hub_task_id: "f0f6d6c3-9c45-56b7-9fd6-52fb0ea9054a"
```
After T02 review, implement or select an owner-controlled path that receives
@ -98,6 +102,7 @@ reviewed for this incident.
id: NK-WP-0033-T04
status: wait
priority: high
state_hub_task_id: "751cca48-2bc9-5d44-80a0-60478717e99e"
```
Under the separately approved authority/window, replace the signing material,
@ -112,6 +117,7 @@ evidence. This task is not authorized until T02 and T03 are done.
id: NK-WP-0033-T05
status: wait
priority: high
state_hub_task_id: "41e55d5c-ae28-5ee2-be25-b9a3758428f7"
```
Record only sanitized identifiers, public-key fingerprints, revisions,