coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Surface redacted directory bind failures before native onboarding
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Identity provider journey acceptance / provider (push) Successful in 6s
Details
Build and Publish identity-provisioner / build-and-push (push) Successful in 10s
Details

Browse source 
Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.

NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.

Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
This commit is contained in:
tegwick 2026-09-14 04:46:29 +02:00
parent d90e3b27f2
commit c8e07615c3
9 changed files with 554 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/identity-provisioner-bind-repair.md
View file

@ -70,7 +70,10 @@ User Engine's display name is not necessarily its directory username: the
current provider derives a name from email unless preferred_username is sent.
Keep the requested demo login-name mapping explicit before provisioning.
Follow-up remains necessary for credential custody/publication and a functional
provisioner preflight: the current /healthz confirms process health while the
directory connection is broken. The HTTP handler also fails to catch the
upstream HTTPError. These are tracked in NK-WP-0036-T05.
NK-WP-0036-T05 adds `/readyz` as a contained provisioner-to-directory preflight
(one login plus one directory read), maps bind failures to a redacted
`dependency_unavailable` JSON body, and keeps `/healthz` as process liveness.
Auth rejection is not retried during a cooldown so kube probes cannot hammer a
rejected password. Synthetic contract tests run in identity-journeys CI.
Promotion still requires the immutable image digest, switching readiness to
`/readyz`, and a native onboarding journey; see the T05 workplan note.