coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare guarded reset-role transition and native recovery proof

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
tegwick 2026-10-31 14:26:17 +01:00
parent 2387409d08
commit c07e6ebe34
8 changed files with 1027 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

75
workplans/NK-WP-0054-service-identity-policy.md
View file

@ -602,3 +602,78 @@ reset-authority/current-roles.json and consumer reset-role-return-verification-
the reviewed password-manager transition for this consumer, retaining explicit
non-admin service/application-account reach and directory-admin exclusion. The
accepted tegwick flow needs no new directory-admin recovery route on this evidence.
## Prepare and rehearse the guarded reset-role transition
```task
id: NK-WP-0054-T14
status: done
priority: high
assignee: codex
depends_on: [NK-WP-0054-T11, NK-WP-0054-T13]
```
Owner: Codex. Prepare the exact svc-authelia role replacement and read-only
recovery; validate the journal, crash recovery and pinned native transport.
Measure role refresh in a single running Authelia process and disclose retained
HTTP-token rights after membership rollback. Completion requires source-bound
validation and an executable reviewed proposal, not a live grant. This extracts
packet preparation from T10; its original operational acceptance remains open.
Completed 2026-10-31: controller and proposal prepared; 25 unit and four native
checks pass, zero failures/errors/skips, Ruff passes. Real process death after
either LDAP effect recovers read-only without grant replay. Same-process Authelia
rehearsal proves refusal/success/refusal across grant/rollback, with old/new
passwords and consumed challenges. Native token test proves the explicit rollback
limit: old HTTP token rights survive membership removal; fresh tokens lose them.
Evidence: docs/evidence/2026-10-31-reset-authority/transition-validation.json and
role-refresh.json; source and review in coulomb-social/docs/release/native-password-
reset-review-2026-10-30.md. Proposal digest:
sha256:753f50f139a0d090a8b64ba15174f2a7e8b0e639eb0dd01d17783476b5a3759f.
No production membership, password, declaration or runtime was changed.
## Admit and execute the reviewed reset-role transition
```task
id: NK-WP-0054-T15
status: wait
priority: high
assignee: codex
needs_human: true
depends_on: [NK-WP-0054-T14]
blocked_on: human
blocking_reason: Founder admission of the complete non-admin password-write scope and attended terminal execution are required.
```
Owner: founder for admission and private authentication; Codex verifies the
returned durable receipt. The earlier read-only observation authorizes no grant.
Review coulomb-social/docs/release/native-password-reset-review-2026-10-30.md.
Completion requires the exact proposal digest, native role postflight and private
receipt readback. A refused or interrupted operation stays open and follows the
reviewed recovery. Membership rollback does not invalidate pre-existing HTTP
tokens or undo productive password changes. No live token-revocation operation
is approved by this packet; its limitation is part of the admission question.
## Align the reset authority sources and verify productive recovery
```task
id: NK-WP-0054-T16
status: wait
priority: high
assignee: codex
depends_on: [NK-WP-0054-T15]
blocked_on: dependency
blocking_reason: Requires the reviewed T15 grant and its verified native receipt.
```
Owner: Codex prepares/verifies, founder supplies productive verdict and private
inputs. After T15's verified result, align the service identity declaration and
existing bind verification/repair expectations with the admitted role. Keep the
single Authelia consumer and current credential custody; never infer broader
human-admin authority. Verify the accepted tegwick reset, new/old password result,
consumed-link refusal, app access and MFA, then a fresh identity archive and
isolated restore of the same supported behavior. Retain only value-free receipts.
A proposed/source-only grant or fixture pass cannot close this task. It supplies
the remaining acceptance of T10 and therefore CSOC-WP-0015-T06; no completed T05
or historical October6 acceptance is reopened or counted twice.