coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete attended reset-role observation with verified receipt
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
tegwick 2026-10-31 14:00:35 +01:00
parent 989d5d4f5d
commit b5cb1520d8
3 changed files with 71 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -323,7 +323,7 @@
| task | NK-WP-0054-T10 | progress | — | workplans/NK-WP-0054-service-identity-policy.md |
| task | NK-WP-0054-T11 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
| task | NK-WP-0054-T12 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
| task | NK-WP-0054-T13 | wait | — | workplans/NK-WP-0054-service-identity-policy.md |
| task | NK-WP-0054-T13 | done | — | workplans/NK-WP-0054-service-identity-policy.md |
| task | NK-WP-0055-T01 | done | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
| task | NK-WP-0055-T02 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
| task | NK-WP-0055-T03 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md |

52
docs/evidence/2026-10-31-reset-authority/current-roles.json Normal file
View file

@ -0,0 +1,52 @@
{
"schema": "netkingdom.reset-role-observation.v1",
"status": "current_reset_roles_observed",
"observed_at": "2026-10-31T12:57:44.913538+00:00",
"endpoint_sha256": "21b7c63da95eb01178305e49af9b3143295607b8ad68c522d1fa9545b7ef4d9f",
"selected_subject_sha256": "835958a092b4fcddf93eadb83dc2d21519ed1aeab570d04a3d798a4c0f24c0ba",
"human_admin_role_verified": true,
"bind": {
"builtin_roles": {
"lldap_admin": false,
"lldap_password_manager": false,
"lldap_strict_readonly": true
},
"other_group_count": 0,
"matches_reviewed_service_name_filter": true,
"application_authority_assessed": false
},
"selected_subject": {
"builtin_roles": {
"lldap_admin": false,
"lldap_password_manager": false,
"lldap_strict_readonly": false
},
"other_group_count": 1,
"matches_reviewed_service_name_filter": false,
"application_authority_assessed": false
},
"bind_has_multiple_builtin_roles": false,
"membership_changed": false,
"password_reset_attempted": false,
"grant_approved": false,
"application_access_verified": false,
"credential_values_recorded": false,
"sources": [
{
"path": "sso-mfa/k8s/lldap/reset-authority-observe.py",
"sha256": "9f19c5551e2a93319c04c1b2fd0ddc0f7757fdff96ad18b81d7ee7bb393b75b9"
},
{
"path": "sso-mfa/k8s/lldap/lldap_admin.py",
"sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36"
},
{
"path": "identity-provisioner/provisioner.py",
"sha256": "a303a25d3b3876485c796a9ba0836ddaf0a0bec155b609790e028882ad983138"
},
{
"path": "identity-provisioner/group_provenance.py",
"sha256": "405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10"
}
]
}

24
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -548,6 +548,7 @@ id: NK-WP-0054-T12
status: done
priority: high
assignee: codex
state_hub_task_id: "95675a19-b406-5425-aaf4-e5313d12aea4"
```
Completed 2026-10-31. `sso-mfa/k8s/lldap/reset-authority-observe.py` reuses the
@ -571,14 +572,11 @@ neither grants password-write authority nor proves reset or application access.
```task
id: NK-WP-0054-T13
status: wait
status: done
priority: high
assignee: codex
needs_human: true
wait_kind: human
blocked_on: message-from:founder
blocking_reason: "Prepared observer needs the human admin's private terminal sign-in; no current directory-role result has been supplied."
intervention_note: "Run reset-authority-observe.py for the fixed accepted account tegwick using the commands in coulomb-social/docs/release/native-password-reset-review-2026-10-30.md. Enter the human admin password only at its hidden prompt and return the credential-free JSON. No directory writes or reset are performed."
needs_human: false
state_hub_task_id: "278d5ba8-1c2a-58d9-a24e-2233af2c1aef"
```
T12 is complete. The next result is `netkingdom.reset-role-observation.v1` with
@ -590,3 +588,17 @@ accepted subject or widen access. Do not collect the password in chat or retriev
it from custody. This human step supplies private authentication, not a new policy
approval. The directory-admin route is conditional on the accepted subject's
actual classification; every runtime grant/change remains separately reviewed.
Completed 2026-10-31 at12:57:44Z: founder ran the observer after correcting a
line-wrapped receipt path (the first attempt refused before authentication).
Independent private-file readback verifies mode0600/owner/single link, exact
endpoint and tegwick subject hashes, all four prepared source hashes and no
unexpected fields. Current roles: svc-authelia is strict-readonly with no other
groups; tegwick is in none of the three built-in privilege groups and has one
other group. No multiple-role ambiguity. Evidence: docs/evidence/2026-10-31-
reset-authority/current-roles.json and consumer reset-role-return-verification-
2026-10-31.json. T13 is done; no grant or reset was performed. T10 now prepares
the reviewed password-manager transition for this consumer, retaining explicit
non-admin service/application-account reach and directory-admin exclusion. The
accepted tegwick flow needs no new directory-admin recovery route on this evidence.