From d042d7f4d295c1cf103313ba17a9d82aa651b5fc Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 28 Oct 2026 09:15:06 +0100 Subject: [PATCH] Workplan triage: NK-WP-0048/0050 blocked, NK-WP-0011 backlog, NK-WP-0053 pulled forward NK-WP-0053 drill and G1 review run now with the first admin MFA run instead of at the 2027-01-31 deadline; the quarterly repeat moves to disaster-control's restore-proof register once the workplan closes. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56 --- WORK-RECORDS.md | 6 +++--- docs/identity-restore-drill.md | 5 +++-- workplans/NK-WP-0011-enterprise-federation-saml.md | 7 +++++-- workplans/NK-WP-0048-security-case-types.md | 8 ++++++-- .../NK-WP-0050-playwright-consumer-registration.md | 8 ++++++-- .../NK-WP-0053-identity-restore-drill-cadence.md | 11 ++++++++--- 6 files changed, 31 insertions(+), 14 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 7ee3f0c..8d3f703 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -17,7 +17,7 @@ | workplan | NK-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md | | workplan | NET-WP-0020 | finished | — | workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md | | workplan | NK-WP-0009 | finished | — | workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md | -| workplan | NK-WP-0011 | active | — | workplans/NK-WP-0011-enterprise-federation-saml.md | +| workplan | NK-WP-0011 | backlog | — | workplans/NK-WP-0011-enterprise-federation-saml.md | | workplan | NK-WP-0021 | finished | — | workplans/NK-WP-0021-activity-core-ops-sso-operators.md | | workplan | NK-WP-0022 | finished | — | workplans/NK-WP-0022-railiance01-identity-cutover-and-coulombcore-retirement.md | | workplan | NK-WP-0023 | finished | — | workplans/NK-WP-0023-user-engine-portal-platform-integration.md | @@ -45,9 +45,9 @@ | workplan | NK-WP-0045 | finished | — | workplans/NK-WP-0045-root-grant-custody-record.md | | workplan | NK-WP-0046 | finished | — | workplans/NK-WP-0046-secrets-engine-openbao-client-registration.md | | workplan | NK-WP-0047 | finished | — | workplans/NK-WP-0047-platform-password-reset-mail.md | -| workplan | NK-WP-0048 | active | — | workplans/NK-WP-0048-security-case-types.md | +| workplan | NK-WP-0048 | blocked | — | workplans/NK-WP-0048-security-case-types.md | | workplan | NK-WP-0049 | finished | — | workplans/NK-WP-0049-bootstrap-secret-free-recovery-handoff.md | -| workplan | NK-WP-0050 | active | — | workplans/NK-WP-0050-playwright-consumer-registration.md | +| workplan | NK-WP-0050 | blocked | — | workplans/NK-WP-0050-playwright-consumer-registration.md | | workplan | NK-WP-0051 | finished | — | workplans/NK-WP-0051-sign-in-diagnosis.md | | workplan | NK-WP-0052 | finished | — | workplans/NK-WP-0052-wave2-resource-right-sizing.md | | workplan | NK-WP-0053 | active | — | workplans/NK-WP-0053-identity-restore-drill-cadence.md | diff --git a/docs/identity-restore-drill.md b/docs/identity-restore-drill.md index 80767f4..36bcaf0 100644 --- a/docs/identity-restore-drill.md +++ b/docs/identity-restore-drill.md @@ -2,8 +2,9 @@ Work record: `NK-WP-0053` (from `NK-WP-0049-T24` gap G3, founder decision `e4c288d9`, 2026-10-23). Cadence: quarterly, aligned with disaster-control -`BackupPolicy.md`. First drill due by **2027-01-31**, the end of the -single-provider risk acceptance. +`BackupPolicy.md`. First drill: the attended `admin` run of the week of 2026-10-28, well ahead of +**2027-01-31**, the end of the single-provider risk acceptance. Later drills are +scheduled through disaster-control's restore-proof register. The drill re-proves restores that have each been proven once (NK49-T16 LLDAP, T31 privacyIDEA token material, T20 audit). It uses the existing reviewed diff --git a/workplans/NK-WP-0011-enterprise-federation-saml.md b/workplans/NK-WP-0011-enterprise-federation-saml.md index f6dc921..480ed53 100644 --- a/workplans/NK-WP-0011-enterprise-federation-saml.md +++ b/workplans/NK-WP-0011-enterprise-federation-saml.md @@ -4,12 +4,12 @@ type: workplan title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker" domain: infotech repo: net-kingdom -status: active +status: backlog flavor: residual owner: worsch topic_slug: netkingdom created: "2026-05-20" -updated: "2026-10-03" +updated: "2026-10-28" state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07" depends_on: - NK-WP-0003 @@ -24,6 +24,9 @@ supersedes_tasks: # NK-WP-0011 — Enterprise Federation & SAML (Expanded-Mode Keycloak) +> **Backlog 2026-10-28** (founder triage): no task is in flight; SCOPE.md lists enterprise +> federation (C5) as backlog. Move to `ready` when an enterprise-IdP consumer is named. + > Extracted from NK-WP-0001 (T05–T08, the deferred Keycloak path) and > refined against where net-kingdom actually stands today: a deployed > KeyCape lightweight stack, an OpenBao runtime-secret authority, and a diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 4afb720..106173c 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -4,12 +4,12 @@ type: workplan title: "Establish SecurityCaseTypes so that known security cases are light" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: implementation owner: claude-code topic_slug: netkingdom created: "2026-10-08" -updated: "2026-10-17" +updated: "2026-10-28" depends_on: [] related_repos: - ops-mason @@ -22,6 +22,10 @@ state_hub_workstream_id: "e31f3f9d-0748-5137-b0a3-7b3ca46a66eb" # NK-WP-0048 - Establish SecurityCaseTypes so that known security cases are light +> **Blocked 2026-10-28** (founder triage): every in-progress task waits on the coordinator's r7 +> review after the F3 fix (T34 / RAPPS-WP-0016-T05) and on owner selections. Return to `active` +> when r7 or the F3 fix lands. + ## Why The founder's direction (2026-10-08): setting up a security integration of a diff --git a/workplans/NK-WP-0050-playwright-consumer-registration.md b/workplans/NK-WP-0050-playwright-consumer-registration.md index 00d4833..f208793 100644 --- a/workplans/NK-WP-0050-playwright-consumer-registration.md +++ b/workplans/NK-WP-0050-playwright-consumer-registration.md @@ -4,12 +4,12 @@ type: workplan title: "Register Playwright human and agent consumers through governed identity delivery" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: implementation owner: codex topic_slug: netkingdom created: "2026-10-13" -updated: "2026-10-13" +updated: "2026-10-28" depends_on: [] related: [CUST-WP-0080, RPF-WP-0056, RAPP-PLAYWRIGHT-WP-0004] state_hub_workstream_id: "06ba98d5-609e-5aaa-9bf7-4c4f4460e377" @@ -24,6 +24,10 @@ Initial eligibility of all identified platform humans and coding agents is already decided. Do not request another membership approval or reuse a shared admin identity, kubeconfig, SSH identity or existing OpenBao credential. +> **Blocked 2026-10-28** (founder triage): T02 waits on Platform custody/delivery and the real +> agent records, T03 on CUST-WP-0080-T05 acceptance. No NetKingdom-side step remains open. +> Return to `active` when Platform custody is in place. + ## Prepare exact registrations and preservation checks ```task diff --git a/workplans/NK-WP-0053-identity-restore-drill-cadence.md b/workplans/NK-WP-0053-identity-restore-drill-cadence.md index bef8434..4736223 100644 --- a/workplans/NK-WP-0053-identity-restore-drill-cadence.md +++ b/workplans/NK-WP-0053-identity-restore-drill-cadence.md @@ -9,7 +9,7 @@ flavor: implementation owner: claude topic_slug: netkingdom created: "2026-10-23" -updated: "2026-10-23" +updated: "2026-10-28" related: - NK-WP-0049 - disaster-control/BackupPolicy.md @@ -18,6 +18,11 @@ state_hub_workstream_id: "7c80ba09-8bd5-540e-8dd3-feb85e201ef3" # NK-WP-0053 — Quarterly isolated identity restore drill +> **2026-10-28** (founder triage): T02, T04 and T03 are finished now, not at the 2027-01-31 +> deadline. One attended `admin` run covers T02 and T04; T03 follows from its results. The +> workplan then closes. The quarterly repeat lives in disaster-control's restore-proof register +> (next due date recorded there), not in an active workplan. + Intake for gap G3 of `NK-WP-0049-T24`. On 2026-10-23 the founder resolved decision `e4c288d9` with the recommended split: G1 (a single off-host provider) is an accepted residual risk until 2027-01-31; G2 (off-host host-loss detection) is @@ -63,7 +68,7 @@ id: NK-WP-0053-T02 status: wait priority: medium depends_on: [NK-WP-0053-T01] -blocking_reason: "Attended owner run; the operator holds the backup age key. Due by 2027-01-31, the end of the G1 risk-acceptance window." +blocking_reason: "Attended founder run as admin this week (target 2026-11-01), combined with the first admin MFA run of T04 on a post-2026-10-25 generation. The operator holds the backup age key." state_hub_task_id: "8b2cdf5a-69e1-59c6-8e4e-e478f44f77fb" ``` @@ -112,7 +117,7 @@ post-2026-10-25 generation. id: NK-WP-0053-T03 status: wait priority: low -blocking_reason: "Founder review due 2027-01-31: renew the single-provider acceptance or open a second-provider intake." +blocking_reason: "Founder review right after the T02 run, using its results: renew the single-provider acceptance or open a second-provider intake. Not deferred to the 2027-01-31 deadline." state_hub_task_id: "0fa4add7-3d53-51af-a2a2-ea9c63a2d628" ```