Workplan triage: NK-WP-0048/0050 blocked, NK-WP-0011 backlog, NK-WP-0053 pulled forward
NK-WP-0053 drill and G1 review run now with the first admin MFA run instead of at the 2027-01-31 deadline; the quarterly repeat moves to disaster-control's restore-proof register once the workplan closes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56
This commit is contained in:
parent
95d39916f1
commit
d042d7f4d2
6 changed files with 31 additions and 14 deletions
|
|
@ -17,7 +17,7 @@
|
|||
| workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md |
|
||||
| workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md |
|
||||
| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0011 | backlog | — | workplans/NK-WP-0011-enterprise-federation-saml.md |
|
||||
| workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md |
|
||||
| workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md |
|
||||
| workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md |
|
||||
|
|
@ -45,9 +45,9 @@
|
|||
| workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md |
|
||||
| workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md |
|
||||
| workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md |
|
||||
| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0048 | blocked | — | workplans/NK-WP-0048-security-case-types.md |
|
||||
| workplan | NK-WP-0049 | finished | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md |
|
||||
| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0050 | blocked | — | workplans/NK-WP-0050-playwright-consumer-registration.md |
|
||||
| workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md |
|
||||
| workplan | NK-WP-0052 | finished | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md |
|
||||
| workplan | NK-WP-0053 | active | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md |
|
||||
|
|
|
|||
|
|
@ -2,8 +2,9 @@
|
|||
|
||||
Work record: `NK-WP-0053` (from `NK-WP-0049-T24` gap G3, founder decision
|
||||
`e4c288d9`, 2026-10-23). Cadence: quarterly, aligned with disaster-control
|
||||
`BackupPolicy.md`. First drill due by **2027-01-31**, the end of the
|
||||
single-provider risk acceptance.
|
||||
`BackupPolicy.md`. First drill: the attended `admin` run of the week of 2026-10-28, well ahead of
|
||||
**2027-01-31**, the end of the single-provider risk acceptance. Later drills are
|
||||
scheduled through disaster-control's restore-proof register.
|
||||
|
||||
The drill re-proves restores that have each been proven once (NK49-T16 LLDAP,
|
||||
T31 privacyIDEA token material, T20 audit). It uses the existing reviewed
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: backlog
|
||||
flavor: residual
|
||||
owner: worsch
|
||||
topic_slug: netkingdom
|
||||
created: "2026-05-20"
|
||||
updated: "2026-10-03"
|
||||
updated: "2026-10-28"
|
||||
state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07"
|
||||
depends_on:
|
||||
- NK-WP-0003
|
||||
|
|
@ -24,6 +24,9 @@ supersedes_tasks:
|
|||
|
||||
# NK-WP-0011 — Enterprise Federation & SAML (Expanded-Mode Keycloak)
|
||||
|
||||
> **Backlog 2026-10-28** (founder triage): no task is in flight; SCOPE.md lists enterprise
|
||||
> federation (C5) as backlog. Move to `ready` when an enterprise-IdP consumer is named.
|
||||
|
||||
> Extracted from NK-WP-0001 (T05–T08, the deferred Keycloak path) and
|
||||
> refined against where net-kingdom actually stands today: a deployed
|
||||
> KeyCape lightweight stack, an OpenBao runtime-secret authority, and a
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Establish SecurityCaseTypes so that known security cases are light"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-08"
|
||||
updated: "2026-10-17"
|
||||
updated: "2026-10-28"
|
||||
depends_on: []
|
||||
related_repos:
|
||||
- ops-mason
|
||||
|
|
@ -22,6 +22,10 @@ state_hub_workstream_id: "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb"
|
|||
|
||||
# NK-WP-0048 - Establish SecurityCaseTypes so that known security cases are light
|
||||
|
||||
> **Blocked 2026-10-28** (founder triage): every in-progress task waits on the coordinator's r7
|
||||
> review after the F3 fix (T34 / RAPPS-WP-0016-T05) and on owner selections. Return to `active`
|
||||
> when r7 or the F3 fix lands.
|
||||
|
||||
## Why
|
||||
|
||||
The founder's direction (2026-10-08): setting up a security integration of a
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Register Playwright human and agent consumers through governed identity delivery"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-13"
|
||||
updated: "2026-10-13"
|
||||
updated: "2026-10-28"
|
||||
depends_on: []
|
||||
related: [CUST-WP-0080, RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004]
|
||||
state_hub_workstream_id: "06ba98d5-609e-5aaa-9bf7-4c4f4460e377"
|
||||
|
|
@ -24,6 +24,10 @@ Initial eligibility of all identified platform humans and coding agents is
|
|||
already decided. Do not request another membership approval or reuse a shared
|
||||
admin identity, kubeconfig, SSH identity or existing OpenBao credential.
|
||||
|
||||
> **Blocked 2026-10-28** (founder triage): T02 waits on Platform custody/delivery and the real
|
||||
> agent records, T03 on CUST-WP-0080-T05 acceptance. No NetKingdom-side step remains open.
|
||||
> Return to `active` when Platform custody is in place.
|
||||
|
||||
## Prepare exact registrations and preservation checks
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: claude
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-23"
|
||||
updated: "2026-10-23"
|
||||
updated: "2026-10-28"
|
||||
related:
|
||||
- NK-WP-0049
|
||||
- disaster-control/BackupPolicy.md
|
||||
|
|
@ -18,6 +18,11 @@ state_hub_workstream_id: "7c80ba09-8bd5-540e-8dd3-feb85e201ef3"
|
|||
|
||||
# NK-WP-0053 — Quarterly isolated identity restore drill
|
||||
|
||||
> **2026-10-28** (founder triage): T02, T04 and T03 are finished now, not at the 2027-01-31
|
||||
> deadline. One attended `admin` run covers T02 and T04; T03 follows from its results. The
|
||||
> workplan then closes. The quarterly repeat lives in disaster-control's restore-proof register
|
||||
> (next due date recorded there), not in an active workplan.
|
||||
|
||||
Intake for gap G3 of `NK-WP-0049-T24`. On 2026-10-23 the founder resolved decision
|
||||
`e4c288d9` with the recommended split: G1 (a single off-host provider) is an
|
||||
accepted residual risk until 2027-01-31; G2 (off-host host-loss detection) is
|
||||
|
|
@ -63,7 +68,7 @@ id: NK-WP-0053-T02
|
|||
status: wait
|
||||
priority: medium
|
||||
depends_on: [NK-WP-0053-T01]
|
||||
blocking_reason: "Attended owner run; the operator holds the backup age key. Due by 2027-01-31, the end of the G1 risk-acceptance window."
|
||||
blocking_reason: "Attended founder run as admin this week (target 2026-11-01), combined with the first admin MFA run of T04 on a post-2026-10-25 generation. The operator holds the backup age key."
|
||||
state_hub_task_id: "8b2cdf5a-69e1-59c6-8e4e-e478f44f77fb"
|
||||
```
|
||||
|
||||
|
|
@ -112,7 +117,7 @@ post-2026-10-25 generation.
|
|||
id: NK-WP-0053-T03
|
||||
status: wait
|
||||
priority: low
|
||||
blocking_reason: "Founder review due 2027-01-31: renew the single-provider acceptance or open a second-provider intake."
|
||||
blocking_reason: "Founder review right after the T02 run, using its results: renew the single-provider acceptance or open a second-provider intake. Not deferred to the 2027-01-31 deadline."
|
||||
state_hub_task_id: "0fa4add7-3d53-51af-a2a2-ea9c63a2d628"
|
||||
```
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue