coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Advance pre-cutover identity conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-28 16:48:47 +02:00
parent c639306c53
commit a58df4c3e6
5 changed files with 53 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md
View file

@ -168,7 +168,7 @@ certificates for `auth`, `login`, `lldap`, `pink`, and `pink-account`.
```task
id: NK-WP-0022-T05
status: wait
status: progress
priority: high
state_hub_task_id: "5b01e471-afd0-479d-8b35-66eef7820cf6"
```
@ -182,6 +182,21 @@ the platform-root and Binky tenant paths without exposing tokens.
Done when all critical human and service flows pass and rollback criteria are
machine-readable.
2026-07-28 progress: the portal starts a KeyCape authorization-code flow with
S256 PKCE, and KeyCape discovery/TLS is healthy at its canonical
`kc.coulomb.social` issuer. `rapp-qonto-client` obtains a token only for
`qonto:read`; a wrong secret returns 401 and excessive `qonto:write` returns
400 without a token. The Binky administrator was created and provisioned
through user-engine's deployed versioned API, producing a linked LLDAP
identity and `password_setup_required` state. This exposed and fixed newline
normalization for the portal's trusted proxy secret in user-engine
`0ef2ae5`; 105 tests pass and the fixed image is live.
Human acceptance remains open: LLDAP has no SMTP configuration, so its native
self-service reset cannot deliver the first-password handoff. No operator-set
password was substituted. A NetKingdom-owned password-setup or transactional
mail handoff plus Binky MFA enrollment and final claim/denial checks remain.
## T06 - Cut over remaining DNS with monitored rollback
```task

10
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -157,7 +157,7 @@ outage, suspension, restore, and browser/MFA matrix remains.
```task
id: NK-WP-0023-T07
status: wait
status: progress
priority: high
state_hub_task_id: "a574dcec-f7cd-417b-aeaa-5392a7428241"
```
@ -168,6 +168,14 @@ OIDC/PKCE + MFA, and verify the Binky-only tenant-admin token and lifecycle
controls. Publish only non-secret evidence to `KEY-WP-0004-T02/T07`, then
finish that workplan.
2026-07-28: the deployed versioned portal API created the Binky tenant-admin
user and membership and provisioned/linked its LLDAP identity. The provider
correctly reports `password_setup_required`. During this flow a newline in the
mounted trusted-proxy Secret proved HTTP-incompatible; user-engine `0ef2ae5`
normalizes runtime transport whitespace, has 105 passing tests, and is live.
LLDAP SMTP is not configured, so first-password handoff and MFA/claim
acceptance remain rather than falling back to an operator-set password.
## T08 - Document enterprise integration extension points
```task