From b5cb1520d862806de47f710d652692ce81045eff Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 14:00:35 +0100 Subject: [PATCH] Complete attended reset-role observation with verified receipt Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3 --- WORK-RECORDS.md | 2 +- .../current-roles.json | 52 +++++++++++++++++++ .../NK-WP-0054-service-identity-policy.md | 24 ++++++--- 3 files changed, 71 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-10-31-reset-authority/current-roles.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 2fc72a0..8ac6192 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -323,7 +323,7 @@ | task | NK-WP-0054-T10 | progress | — | workplans/NK-WP-0054-service-identity-policy.md | | task | NK-WP-0054-T11 | done | — | workplans/NK-WP-0054-service-identity-policy.md | | task | NK-WP-0054-T12 | done | — | workplans/NK-WP-0054-service-identity-policy.md | -| task | NK-WP-0054-T13 | wait | — | workplans/NK-WP-0054-service-identity-policy.md | +| task | NK-WP-0054-T13 | done | — | workplans/NK-WP-0054-service-identity-policy.md | | task | NK-WP-0055-T01 | done | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T02 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | task | NK-WP-0055-T03 | wait | — | workplans/NK-WP-0055-security-platform-production-readiness.md | diff --git a/docs/evidence/2026-10-31-reset-authority/current-roles.json b/docs/evidence/2026-10-31-reset-authority/current-roles.json new file mode 100644 index 0000000..0abb06c --- /dev/null +++ b/docs/evidence/2026-10-31-reset-authority/current-roles.json @@ -0,0 +1,52 @@ +{ + "schema": "netkingdom.reset-role-observation.v1", + "status": "current_reset_roles_observed", + "observed_at": "2026-10-31T12:57:44.913538+00:00", + "endpoint_sha256": "21b7c63da95eb01178305e49af9b3143295607b8ad68c522d1fa9545b7ef4d9f", + "selected_subject_sha256": "835958a092b4fcddf93eadb83dc2d21519ed1aeab570d04a3d798a4c0f24c0ba", + "human_admin_role_verified": true, + "bind": { + "builtin_roles": { + "lldap_admin": false, + "lldap_password_manager": false, + "lldap_strict_readonly": true + }, + "other_group_count": 0, + "matches_reviewed_service_name_filter": true, + "application_authority_assessed": false + }, + "selected_subject": { + "builtin_roles": { + "lldap_admin": false, + "lldap_password_manager": false, + "lldap_strict_readonly": false + }, + "other_group_count": 1, + "matches_reviewed_service_name_filter": false, + "application_authority_assessed": false + }, + "bind_has_multiple_builtin_roles": false, + "membership_changed": false, + "password_reset_attempted": false, + "grant_approved": false, + "application_access_verified": false, + "credential_values_recorded": false, + "sources": [ + { + "path": "sso-mfa/k8s/lldap/reset-authority-observe.py", + "sha256": "9f19c5551e2a93319c04c1b2fd0ddc0f7757fdff96ad18b81d7ee7bb393b75b9" + }, + { + "path": "sso-mfa/k8s/lldap/lldap_admin.py", + "sha256": "5e39e2eac53846a97cd25151c0a4af1ffc0230db881a6325efb66de6a51bfc36" + }, + { + "path": "identity-provisioner/provisioner.py", + "sha256": "a303a25d3b3876485c796a9ba0836ddaf0a0bec155b609790e028882ad983138" + }, + { + "path": "identity-provisioner/group_provenance.py", + "sha256": "405e08eaaab7c21d618dff4db5970607806f32ab6c461effb81c737e32182b10" + } + ] +} diff --git a/workplans/NK-WP-0054-service-identity-policy.md b/workplans/NK-WP-0054-service-identity-policy.md index e472c01..450ad0f 100644 --- a/workplans/NK-WP-0054-service-identity-policy.md +++ b/workplans/NK-WP-0054-service-identity-policy.md @@ -548,6 +548,7 @@ id: NK-WP-0054-T12 status: done priority: high assignee: codex +state_hub_task_id: "95675a19-b406-5425-aaf4-e5313d12aea4" ``` Completed 2026-10-31. `sso-mfa/k8s/lldap/reset-authority-observe.py` reuses the @@ -571,14 +572,11 @@ neither grants password-write authority nor proves reset or application access. ```task id: NK-WP-0054-T13 -status: wait +status: done priority: high assignee: codex -needs_human: true -wait_kind: human -blocked_on: message-from:founder -blocking_reason: "Prepared observer needs the human admin's private terminal sign-in; no current directory-role result has been supplied." -intervention_note: "Run reset-authority-observe.py for the fixed accepted account tegwick using the commands in coulomb-social/docs/release/native-password-reset-review-2026-10-30.md. Enter the human admin password only at its hidden prompt and return the credential-free JSON. No directory writes or reset are performed." +needs_human: false +state_hub_task_id: "278d5ba8-1c2a-58d9-a24e-2233af2c1aef" ``` T12 is complete. The next result is `netkingdom.reset-role-observation.v1` with @@ -590,3 +588,17 @@ accepted subject or widen access. Do not collect the password in chat or retriev it from custody. This human step supplies private authentication, not a new policy approval. The directory-admin route is conditional on the accepted subject's actual classification; every runtime grant/change remains separately reviewed. + + +Completed 2026-10-31 at12:57:44Z: founder ran the observer after correcting a +line-wrapped receipt path (the first attempt refused before authentication). +Independent private-file readback verifies mode0600/owner/single link, exact +endpoint and tegwick subject hashes, all four prepared source hashes and no +unexpected fields. Current roles: svc-authelia is strict-readonly with no other +groups; tegwick is in none of the three built-in privilege groups and has one +other group. No multiple-role ambiguity. Evidence: docs/evidence/2026-10-31- +reset-authority/current-roles.json and consumer reset-role-return-verification- +2026-10-31.json. T13 is done; no grant or reset was performed. T10 now prepares +the reviewed password-manager transition for this consumer, retaining explicit +non-admin service/application-account reach and directory-admin exclusion. The +accepted tegwick flow needs no new directory-admin recovery route on this evidence.