diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 522bc3f..e47b402 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -253,7 +253,7 @@ | task | NK-WP-0048-T44 | done | — | workplans/NK-WP-0048-security-case-types.md | | task | NK-WP-0049-T01 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T02 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T03 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T03 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T04 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T05 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T06 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | @@ -271,7 +271,7 @@ | task | NK-WP-0049-T18 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T19 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T20 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| task | NK-WP-0049-T21 | wait | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | +| task | NK-WP-0049-T21 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T22 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T23 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | | task | NK-WP-0049-T24 | done | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | diff --git a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md index c86e1e0..1721a90 100644 --- a/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md +++ b/workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md @@ -28,9 +28,9 @@ These are retrospective task records of evidenced work, not additional delivery or newly granted authority. The earlier dated narrative remains in Git at `cc2dd01`; its evidence references are carried into the tasks below. -**Current position, 2026-10-27:** 40 tasks done; 1 cancelled (T43, phase B paused); 0 in progress; 3 waiting (T21, T44, T03). Builder mode (founder decision 2026-10-27, option A): T15 and T18 are accepted on the owner acceptances and isolated-restore evidence, and the joint live consumer login moves to the pre-production drill T44. Actual isolated recovery has passed for LLDAP (T16), Authelia (T17), privacyIDEA audit continuity (T20), existing-token MFA (T19), KeyCape issuer side (T18) and OpenBao (RPF-WP-0064). +**Current position, 2026-10-27:** 42 tasks done; 1 cancelled (T43, phase B paused); 1 waiting (T44, pre-production joint drill). T03 closed the G08 handoff in builder mode (founder decision, option A). The workplan stays `active` only for T44. -**Next actions:** close the T02 ledger's caller dispositions (T21), then T03. T22 is done (historical objects deleted 2026-10-27). T44 runs before production. +**Next actions:** run T44 before the estate is declared production. **Closure:** T03 assembles owner acceptance after its named dependencies pass. Passing archive recovery does not prove existing-user authentication, retained @@ -692,11 +692,10 @@ no consumer continuity), and owner acceptance; MFA stays T19. ```task id: NK-WP-0049-T21 -status: wait +status: done priority: high assignee: codex depends_on: [NK-WP-0049-T02] -blocking_reason: "Caller ledger delivered by T02 (2026-10-23). Await exact per-caller owner admission/test inputs; the backup credential grants do not admit unrelated callers." state_hub_task_id: "77aa42be-7a39-5d93-8042-03d78b4094b4" ``` @@ -716,6 +715,8 @@ before execution; record deferred actions separately rather than faking a pass. 2026-10-27: builder-mode disposition draft prepared for founder acceptance: [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md). It accepts the T02 ledger rows by category, points follow-up rows to their existing workplans, and assigns the reserved-LDAP-group denial and resolver re-proof to T44. Factor-diagnostic row corrected the same day: source shows the diagnostic takes only an owner-admitted private token and never KeyCape's reader; a founder-run admin scan shows only `sso/keycape` mounts `keycape-factor-read`; no admitted diagnostic lane exists, so that row is a deferral, not a T44 item. T21 stays waiting until the founder accepts. + +2026-10-27: founder accepted the [T21 caller dispositions](../docs/evidence/2026-10-27-nk49-t21-caller-dispositions.md) for the builder-mode estate. T21 is **done**. Reserved-LDAP-group denial and resolver re-proof move to T44; the attended factor diagnostic stays deferred until an owner-admitted credential lane exists; follow-up rows remain in NK-WP-0042, NK-WP-0048, NK-WP-0051 and T24. ## Resolve historical credential and configuration-preserving rotation dispositions ```task @@ -1650,7 +1651,7 @@ id: NK-WP-0049-T44 status: wait priority: medium assignee: claude-code -depends_on: [NK-WP-0049-T18] +depends_on: [NK-WP-0049-T18, NK-WP-0049-T21] blocking_reason: "Builder-mode residual of T18. Run before the estate is declared production: build the phase B module from the retained T43 design, rehearse it, then a founder-signed window." state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9" ``` @@ -1659,17 +1660,16 @@ state_hub_task_id: "0cde15c4-9918-574f-b522-34e620168bc9" **Done when:** restored KeyCape and restored OpenBao are joined on the isolated phase B network and a real consumer (secrets-engine-openbao) passes native positive/negative login, plus one browser/PKCE client; this closes key-cape K1 and -railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources. +railiance-platform R1/R2. Start from the T43 design notes; do not edit the pinned T38/T40 sources. Also re-prove reserved-LDAP-group denial and the resolver cutover functionally (from T21). ## Accept remaining recovery and caller evidence and close the G08 handoff ```task id: NK-WP-0049-T03 -status: wait +status: done priority: high assignee: codex depends_on: [NK-WP-0049-T02, NK-WP-0049-T16, NK-WP-0049-T17, NK-WP-0049-T18, NK-WP-0049-T19, NK-WP-0049-T20, NK-WP-0049-T21, NK-WP-0049-T22, NK-WP-0049-T23, NK-WP-0049-T24, NK-WP-0049-T26] -blocking_reason: "T15, T18 and T22 done 2026-10-27 (builder mode; T18 residual in T44). Await T21 caller disposition acceptance." state_hub_task_id: "d68cd4d3-1ba3-530e-88f9-26ebb8dd6eac" ``` @@ -1687,6 +1687,10 @@ and G08 has an exact evidence/handoff record. Record actionable residuals as liv work records before workplan closure. Preserve historical IDs and receipts; do not call a deferred rotation or an untested full-estate restore complete. + +2026-10-27 closure (founder-accepted, builder mode): T03 is **done**. Dependencies T02 and T15–T38 are done except T43 (cancelled: phase B paused, design retained in T44). +G08 handoff evidence: archive recovery and backup activation (T04–T14, T23–T26); isolated owner recoveries of LLDAP (T16), Authelia (T17), existing-token MFA (T19), privacyIDEA audit continuity (T20), KeyCape issuer side (T18, receipt `16d72f7c…1651`, key-cape acceptance `fc9f09a`) and OpenBao (RPF-WP-0064, receipt `4e048dee…579d`, railiance-platform acceptance `5658150`); caller ledger (T02) and accepted dispositions (T21); historical objects deleted and verified absent (T22). +Live residuals (not claimed complete): T44 pre-production joint drill (restored KeyCape plus OpenBao live consumer login, browser/PKCE client, reserved-group denial, resolver re-proof); attended factor-diagnostic credential lane (owner-deferred); privacyIDEA credential revocation and exposure rotation under CUST-WP-0073-T05 / decision `1591daa1`. NK-WP-0049 stays `active` only for T44. ## Evidence locations and refinement history “Live” above means `docs/evidence/2026-10-16-identity-backup-live/` in NetKingdom.