coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close SI-X4: OpenBao platform-admin binds aal2 (founder-applied, RPF-WP-0065-T04)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 23:23:06 +01:00
parent 6d4acb0ca9
commit a60091775f
3 changed files with 10 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/evidence/2026-10-27-production-readiness-ledger.md
View file

@ -16,7 +16,7 @@ Builder-mode acceptances count as **partial**. The definition is in
| # | Area | Status | Gap carried by |
|---|---|---|---|
| 1 | Platform root custody | partial (single-holder custody: accepted exception) | T13, NK-WP-0054-T07 |
| 2 | MFA and identity | partial | RPF-WP-0065-T04 (SI-X4), NK-WP-0054-T04/T05/T06, T12 |
| 2 | MFA and identity | partial (SI-X4 closed 2026-10-27) | NK-WP-0054-T04/T05/T06, T12 |
| 3 | Bootstrap and recovery | partial | T02–T04, T07 (NK-WP-0053), T08 |
| 4 | OpenBao runtime secrets | partial (manual Shamir unseal approved) | T07 (RPF-WP-0036-T03), T12 |
| 5 | Secret rotation | partial | T06, T15, RPF-WP-0035, RPF-WP-0055-T01 |
@ -64,8 +64,8 @@ Each exception is reviewed at the production declaration (T09).
- The retained-MFA restore is proven (NK-WP-0049-T19).
**Missing.**
- The `aal2` binding on OpenBao `platform-admin` is not applied. SI-X4 is still open in
`tools/service-identity/declarations/openbao.yaml` and RPF-WP-0065-T04 is waiting.
- ~~The `aal2` binding on OpenBao `platform-admin` is not applied.~~ Applied and verified by the founder on
2026-10-27 (RPF-WP-0065-T04); SI-X4 is closed and the account checks conformant.
- No recorded `tools/iam-profile-conformance/` run against the live issuer (NK-WP-0054-T04
is waiting).
- The bind account is still the human `admin` (NK-WP-0054-T05/T06).