From d4267ff9b6c419f2e37896a5602f69d0854e2f4a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 27 Oct 2026 23:30:39 +0100 Subject: [PATCH] NK-WP-0055-T11: record identity-provider intake packages Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4515@bnt-lap001 Assistant-Session: 0bf96127-6e04-41be-bfda-d11717c3f354 --- workplans/NK-WP-0055-security-platform-production-readiness.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/workplans/NK-WP-0055-security-platform-production-readiness.md b/workplans/NK-WP-0055-security-platform-production-readiness.md index fdbfb4a..8654742 100644 --- a/workplans/NK-WP-0055-security-platform-production-readiness.md +++ b/workplans/NK-WP-0055-security-platform-production-readiness.md @@ -272,6 +272,8 @@ AUDIT-WP-0015-T01's offsite chain head. 2026-10-27 owner scoping (proposed workplans, unpushed in the owner repos): audit-core AUDIT-WP-0017 (`ead0f09`: intake package per sender, correlation field, quarterly restore drill, offsite chain head); railiance-platform RPF-WP-0066 (`87a488c`: file audit device plus async sidecar shipper, snapshots, live conformance); railiance-cluster RCLUSTER-WP-0021 (`3ed1ac1`: k3s audit policy, node buffer, shipper, founder-run restart); access-engine FLEX-WP-0031-T10/T11 and FLEX-WP-0039 (`7cbd4e5`). NetKingdom's part: the [Audit Correlation Contract v0.1](../canon/standards/audit-correlation_v0.1.md) (proposed) and the four identity-provider intake packages (still to draft). Noted: audit-core lists six access-engine pins, the registry has nine. + +2026-10-27 identity-provider intake: KeyCape package and propagation task in key-cape KEY-WP-0044 (`9adfb0b`; KeyCape emits stdout JSON only, `/token` failures, client-auth failures, revoke and introspect are unaudited today, issuance lacks subject/tenant). Authelia, LLDAP and privacyIDEA packages in [docs/audit-core-intake-identity-providers.md](../docs/audit-core-intake-identity-providers.md) (`ccd0b15`, draft): Authelia via a read-only SQLite sidecar plus JSON logs; LLDAP text logs, image must be pinned first; privacyIDEA signed `pidea_audit` export with signatures intact. Open decision for audit-core and the founder: signed privacyIDEA rows carry raw usernames and IPs, and pseudonymising them breaks the signature. ## Record live conformance receipts ```task