coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T10 done: unattended live journey passes at aal2
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Job sso/bounded-executor-journey-20261031-194719 (image 71da4a51, journey-read
role only, effects false) passed all eight steps to a signature-verified aal2
ID token with no person in the journey. Fail-closed half: synthetic broken
svc-authelia bind fails at authelia_first_factor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
This commit is contained in:
tegwick 2026-10-31 20:48:42 +01:00
parent d685df4d56
commit a020758448
4 changed files with 61 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -352,7 +352,7 @@
| task | NK-WP-0056-T07 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T08 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T09 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T10 | todo | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T10 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T11 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T12 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
| task | NK-WP-0056-T13 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |

14
docs/evidence/2026-10-31-nk56-t10-journey-only/README.md
View file

@ -33,3 +33,17 @@ rapp's `make journey`.
- Fix: before the first login, the executor polls OpenBao's unauthenticated `sys/health` for up to 30 s
(`operations.wait_reachable`). Only connection errors are retried, and any HTTP answer counts as reachable.
This applies to both CLI modes.
## Live run (2026-10-31): pass
The founder started `make journey` (rapp `9826a24`, image `sha256:71da4a51…`). It created Job
`sso/bounded-executor-journey-20261031-194719`:
- The executor waited for OpenBao and logged in with the journey-read role only.
- It read syn-journey and ran the journey against `https://kc.coulomb.social` in-cluster.
- It passed all eight steps to an `aal2` ID token (`pwd` + `otp`), with the signature verified and the username
matching, in about 6 s.
- `effects: false`. The Job reports `1 succeeded`.
`live-receipt.json` is the pod's value-free receipt. The runner's sha256 `c6390545…` equals `journey.py` in the repo.
No person took part in the journey.

38
docs/evidence/2026-10-31-nk56-t10-journey-only/live-receipt.json Normal file
View file

@ -0,0 +1,38 @@
{
"job": "sso/bounded-executor-journey-20261031-194719",
"image": "forgejo.coulomb.social/coulomb/bounded-executor@sha256:71da4a51e331cb82a5bde1e44025dc3b1b7ea4019dd9dbd64e7196cd3dd21471",
"started_by": "founder (make journey); no person in the journey",
"job_status": "1 succeeded",
"result": {
"effects": false,
"mode": "journey-only",
"outcome": "pass",
"journey": {
"binds_on_path": {"authelia_first_factor": "svc-authelia", "keycape_otp": "svc-privacyidea", "keycape_token": "svc-keycape"},
"claims": {"assurance_level": "aal2", "assurance_methods": ["pwd", "otp"], "assurance_source": "key-cape",
"kid": "key-1", "preferred_username_matches": true, "signature_verified": true},
"failed_step": null,
"finished_at": "2026-10-31T19:47:30Z",
"otp_time_step": 59782535,
"reason": null,
"result": "pass",
"run_id": "0a85f664-ac15-43c3-99d3-77d30da9880e",
"runner_sha256": "c639054597be7647a3ae88ac7da53490a43b38d9f4f95e24cf4e9f54b18f997c",
"schema": "netkingdom.synthetic-journey.receipt/v1",
"started_at": "2026-10-31T19:47:24Z",
"steps": [
{"elapsed_ms": 4, "name": "discovery", "ok": true},
{"elapsed_ms": 2, "name": "keycape_authorize", "ok": true},
{"elapsed_ms": 554, "name": "authelia_first_factor", "ok": true},
{"elapsed_ms": 176, "name": "authelia_authorization", "ok": true},
{"elapsed_ms": 538, "name": "keycape_callback", "ok": true},
{"elapsed_ms": 4688, "name": "keycape_otp", "ok": true},
{"elapsed_ms": 163, "name": "keycape_token", "ok": true},
{"elapsed_ms": 2, "name": "id_token", "ok": true}
],
"target": {"acr_values": "urn:netkingdom:aal2", "client_id": "nk-synthetic-journey",
"host_mapped": ["https://auth.coulomb.social", "https://kc.coulomb.social"],
"issuer": "https://kc.coulomb.social", "username": "syn-journey"}
}
}
}

10
workplans/NK-WP-0056-bounded-executor-path.md
View file

@ -395,7 +395,7 @@ partial run was removed with `lane.py teardown`. Next: T10 needs the executor id
```task
id: NK-WP-0056-T10
status: todo
status: done
priority: medium
assignee: claude-code
depends_on: [NK-WP-0056-T03, NK-WP-0056-T09]
@ -489,7 +489,13 @@ NetworkPolicy to a new pod about 3 s late. The executor now waits up to 30 s for
first login (`15c9cdb`). The image `sha256:71da4a51e331cb82a5bde1e44025dc3b1b7ea4019dd9dbd64e7196cd3dd21471` is
verified and pinned in the rapp.
Left for T10: a rerun of `make journey` against live (founder-run).
**Done 2026-10-31** ([evidence](../docs/evidence/2026-10-31-nk56-t10-journey-only/README.md)):
- The founder started `make journey`, which created Job `sso/bounded-executor-journey-20261031-194719`.
- It ran unattended against live with no person in the journey and passed all eight steps to an `aal2` ID token
(`pwd` + `otp`), with the signature verified. `effects: false`. The runner's hash equals the repo.
- The fail-closed half is the synthetic proof: a broken svc-authelia bind fails at `authelia_first_factor`.
- CCR-2026-0059 is now `verified`.
For T06, separately: the approval-engine and audit-core replies, and the token Secret.