From 9ae4e24305f30c32059d6da5459171c8c07931c7 Mon Sep 17 00:00:00 2001 From: repo-manager Date: Sun, 23 Aug 2026 14:08:12 +0200 Subject: [PATCH] chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb --- WORK-RECORDS.md | 11 +++++++++++ .../NK-WP-0032-openbao-operator-loopback-callback.md | 5 +++++ .../NK-WP-0033-keycape-secret-exposure-rotation.md | 6 ++++++ 3 files changed, 22 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index cac7283..177e313 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -25,6 +25,8 @@ | workplan | NK-WP-0029 | finished | — | workplans/NK-WP-0029-scope-and-intent-reconciliation.md | | workplan | NK-WP-0030 | finished | — | workplans/NK-WP-0030-deterministic-security-scenario-composition.md | | workplan | NK-WP-0031 | blocked | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| workplan | NK-WP-0032 | blocked | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| workplan | NK-WP-0033 | active | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | | task | ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -106,5 +108,14 @@ | task | NK-WP-0031-T03 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | | task | NK-WP-0031-T04 | wait | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | | task | NK-WP-0031-T05 | done | — | workplans/NK-WP-0031-deterministic-posture-feedback.md | +| task | NK-WP-0032-T01 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T02 | done | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T03 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0032-T04 | wait | — | workplans/NK-WP-0032-openbao-operator-loopback-callback.md | +| task | NK-WP-0033-T01 | done | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T02 | progress | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T03 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T04 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | +| task | NK-WP-0033-T05 | wait | — | workplans/NK-WP-0033-keycape-secret-exposure-rotation.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | diff --git a/workplans/NK-WP-0032-openbao-operator-loopback-callback.md b/workplans/NK-WP-0032-openbao-operator-loopback-callback.md index 1ff33b4..8d54615 100644 --- a/workplans/NK-WP-0032-openbao-operator-loopback-callback.md +++ b/workplans/NK-WP-0032-openbao-operator-loopback-callback.md @@ -14,6 +14,7 @@ related: - RAILIANCE-WP-0027-T03 origin: routed origin_ref: "State Hub message 5e56b413-d8ec-4718-b432-2debc40498ca" +state_hub_workstream_id: "516ee5b9-685b-5986-88d2-bde66c2ba96c" --- # NK-WP-0032 — OpenBao operator loopback callback @@ -30,6 +31,7 @@ weakening MFA or broadening the OpenBao policy. id: NK-WP-0032-T01 status: done priority: high +state_hub_task_id: "f231077e-7440-5f20-9045-afab90fa8286" ``` Add `http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback` to the @@ -47,6 +49,7 @@ syntax validation, and `git diff --check` pass. id: NK-WP-0032-T02 status: done priority: high +state_hub_task_id: "360bc410-d7ed-53b6-b5fc-2ce8b37b653f" ``` Patch only the code-defined non-secret client configuration, restart KeyCape, @@ -66,6 +69,7 @@ or Secret value was observed. id: NK-WP-0032-T03 status: wait priority: high +state_hub_task_id: "73b77110-2d4f-527e-98eb-2ec33897681e" ``` An attended platform-admin/root-sudo authority must apply the updated role @@ -79,6 +83,7 @@ query, browser storage, or role response body. id: NK-WP-0032-T04 status: wait priority: high +state_hub_task_id: "f62bda4a-7607-5c50-9e04-664cc1b829ac" ``` After T02 and T03 pass, perform one attended MFA login through diff --git a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md index 680e131..8149a05 100644 --- a/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md +++ b/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md @@ -14,6 +14,7 @@ origin: routed origin_ref: "State Hub message 8cc44a39-683c-4fab-80dd-b2275d0728e0" related: - NK-WP-0032 +state_hub_workstream_id: "63665674-6880-593e-96e6-bab3211b1352" --- # NK-WP-0033 — KeyCape credential exposure containment and rotation @@ -35,6 +36,7 @@ conditions, and the authority stated by the owning execution path. id: NK-WP-0033-T01 status: done priority: high +state_hub_task_id: "28a655da-7cd6-58e2-8ca8-64d192de63a6" ``` Mark every credential class in the rendered bundle exposed, stop further @@ -54,6 +56,7 @@ or copied. id: NK-WP-0033-T02 status: progress priority: high +state_hub_task_id: "c5ca817c-d601-5172-a106-1546c0743635" ``` KeyCape and railiance-platform must name the authoritative provider, custody, @@ -79,6 +82,7 @@ unrelated routes do not authorize execution. id: NK-WP-0033-T03 status: wait priority: high +state_hub_task_id: "f0f6d6c3-9c45-56b7-9fd6-52fb0ea9054a" ``` After T02 review, implement or select an owner-controlled path that receives @@ -98,6 +102,7 @@ reviewed for this incident. id: NK-WP-0033-T04 status: wait priority: high +state_hub_task_id: "751cca48-2bc9-5d44-80a0-60478717e99e" ``` Under the separately approved authority/window, replace the signing material, @@ -112,6 +117,7 @@ evidence. This task is not authorized until T02 and T03 are done. id: NK-WP-0033-T05 status: wait priority: high +state_hub_task_id: "41e55d5c-ae28-5ee2-be25-b9a3758428f7" ``` Record only sanitized identifiers, public-key fingerprints, revisions,