coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0049: T21 accepted; T03 closes the G08 handoff in builder mode, T44 remains
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4515@bnt-lap001
Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354
This commit is contained in:
tegwick 2026-10-27 21:58:57 +01:00
parent 84e7a7ea30
commit ac6dc720e6
2 changed files with 14 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -253,7 +253,7 @@
| task | NK-WP-0048-T44 | done | — | workplans/NK-WP-0048-security-case-types.md |
| task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T02 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T03 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
@ -271,7 +271,7 @@
| task | NK-WP-0049-T18 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T19 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T21 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T22 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
| task | NK-WP-0049-T24 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |

20
workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md
View file

@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery
or newly granted authority. The earlier dated narrative remains in Git at
`cc2dd01`; its evidence references are carried into the tasks below.
**Current position, 2026-10-27:** 40 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 3 waiting (T21, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064).
**Current position, 2026-10-27:** 42 tasks done; 1 cancelled (T43, phase B paused); 1 waiting (T44, pre-production joint drill). T03 closed the G08 handoff in builder mode (founder decision, option A). The workplan stays `active` only for T44.
**Next actions:** close the T02 ledger's caller dispositions (T21), then T03. T22 is done (historical objects deleted 2026-10-27). T44 runs before production.
**Next actions:** run T44 before the estate is declared production.
**Closure:** T03 assembles owner acceptance after its named dependencies pass.
Passing archive recovery does not prove existing-user authentication, retained
@ -692,11 +692,10 @@ no consumer continuity), and owner acceptance; MFA stays T19.
```task
id: NK-WP-0049-T21
status: wait
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02]
blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers."
state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4"
```
@ -716,6 +715,8 @@ before execution; record deferred actions separately rather than faking a pass.
2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. Factor-diagnostic row corrected the same day: source shows the diagnostic takes only an owner-admitted private token and never KeyCape's reader; a founder-run admin scan shows only `sso/keycape` mounts `keycape-factor-read`; no admitted diagnostic lane exists, so that row is a deferral, not a T44 item. T21 stays waiting until the founder accepts.
2026-10-27: founder accepted the [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md) for the builder-mode estate. T21 is **done**. Reserved-LDAP-group denial and resolver re-proof move to T44; the attended factor diagnostic stays deferred until an owner-admitted credential lane exists; follow-up rows remain in NK-WP-0042, NK-WP-0048, NK-WP-0051 and T24.
## Resolve historical credential and configuration-preserving rotation dispositions
```task
@ -1650,7 +1651,7 @@ id: NK-WP-0049-T44
status: wait
priority: medium
assignee: claude-code
depends_on: [NK-WP-0049-T18]
depends_on: [NK-WP-0049-T18, NK-WP-0049-T21]
blocking_reason: "Builder-mode residual of T18. Run before the estate is declared production: build the phase B module from the retained T43 design, rehearse it, then a founder-signed window."
state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9"
```
@ -1659,17 +1660,16 @@ state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9"
**Done when:** restored KeyCape and restored OpenBao are joined on the isolated phase B network and a real consumer
(secrets-engine-openbao) passes native positive/negative login, plus one browser/PKCE client; this closes key-cape K1 and
railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources.
railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources. Also re-prove reserved-LDAP-group denial and the resolver cutover functionally (from T21).
## Accept remaining recovery and caller evidence and close the G08 handoff
```task
id: NK-WP-0049-T03
status: wait
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26]
blocking_reason: "T15, T18 and T22 done 2026-10-27 (builder mode; T18 residual in T44). Await T21 caller disposition acceptance."
state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac"
```
@ -1687,6 +1687,10 @@ and G08 has an exact evidence/handoff record. Record actionable residuals as liv
work records before workplan closure. Preserve historical IDs and receipts; do
not call a deferred rotation or an untested full-estate restore complete.
2026-10-27 closure (founder-accepted, builder mode): T03 is **done**. Dependencies T02 and T15–T38 are done except T43 (cancelled: phase B paused, design retained in T44).
G08 handoff evidence: archive recovery and backup activation (T04–T14, T23–T26); isolated owner recoveries of LLDAP (T16), Authelia (T17), existing-token MFA (T19), privacyIDEA audit continuity (T20), KeyCape issuer side (T18, receipt `16d72f7c…1651`, key-cape acceptance `fc9f09a`) and OpenBao (RPF-WP-0064, receipt `4e048dee…579d`, railiance-platform acceptance `5658150`); caller ledger (T02) and accepted dispositions (T21); historical objects deleted and verified absent (T22).
Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 stays `active` only for T44.
## Evidence locations and refinement history
“Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom.