Establish remaining owner requirements and correct blocked plan gates
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29
This commit is contained in:
parent
d03eb2ba0a
commit
d4d97acd57
7 changed files with 152 additions and 21 deletions
58
docs/architecture/expanded-mode-admission-requirements.md
Normal file
58
docs/architecture/expanded-mode-admission-requirements.md
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
# Expanded-mode federation admission requirements
|
||||
|
||||
Work: NK-WP-0011. Authority: accepted ADR-0009, decisions 1–8 and ADR-0015.
|
||||
This packet defines evidence required to start implementation. It does not
|
||||
admit a tenant, assign an issuer, or authorize a deployment.
|
||||
|
||||
## Adoption trigger
|
||||
|
||||
All three fields must be supplied together, with an owner-attributed reference:
|
||||
|
||||
| Required fact | Acceptance |
|
||||
| --- | --- |
|
||||
| Named tenant | Existing canonical tenant identifier, confirmed by tenant-engine |
|
||||
| Upstream IdP owner | Named responsible organization/person and supported upstream protocol |
|
||||
| Federation need | Concrete login requirement that the lightweight issuer cannot meet |
|
||||
|
||||
No qualifying trigger is recorded in the reviewed workplan. User count and
|
||||
interest in Keycloak do not satisfy ADR-0009. Until the trigger exists, T02–T09
|
||||
remain waiting and the plan remains blocked.
|
||||
|
||||
## Owner delivery requirements
|
||||
|
||||
After the trigger is accepted, obtain owner workplan/task references and dated,
|
||||
non-secret receipts for these deliverables. An owner name without acceptance
|
||||
and evidence is not delivery.
|
||||
|
||||
| NK task | Dependency owner | Required deliverable and acceptance evidence |
|
||||
| --- | --- | --- |
|
||||
| T02 | railiance-platform + rapp-postgres | Named database consumer and selected catalog placement; isolation, governed credential route and exact ESO references; backup scope/retention and isolated database restore proof |
|
||||
| T03 | ADR-0015 package/runtime owner + railiance-platform | Explicit package ownership, immutable hostname/issuer, pinned image, declaration and reviewed rollout/rollback; exact workload identity/ESO role with least-privilege denied-operation evidence |
|
||||
| T04 | Upstream IdP owner + package owner + user-engine | Non-secret upstream metadata and governed secret references; tenant-scoped versioned claim/group mappings; pending JIT projection; ambiguity denial; federated login proof preserving issuer/subject account binding |
|
||||
| T05 | key-cape/package owner + access-engine | Per-IdP assurance trust mapping; AAL1 default; reviewed privileged step-up flow and assurance enforcement receipts; coordinate NK-WP-0042 and retain accepted IAM v0.3 until v0.4 acceptance |
|
||||
| T06 | package owner + key-cape + tenant-engine | One active issuer per tenant and discovery configuration; dedicated test-client admission; conformance result and coexistence/subject-binding evidence |
|
||||
| T07 | tenant-engine + access-engine + package owner | Canonical tenant/tier/issuer ownership, reserved platform boundary, subject-role vs tenant-capability separation; live role freshness for privileged decisions; tenant-admin cross-boundary denial evidence |
|
||||
| T08 | railiance-platform + package owner + audit-core | Protected export custody, off-host backup and isolated restore receipts; disabled-by-default break-glass with alert proof; owner-bound audit emission/retention/correlation contract and observed receipt |
|
||||
| T09 | tenant-engine + package/runtime owner | Tier from canonical IAM capability, immutable realm/issuer, preserved subjects/federated links; owner-executed isolated migration/login/rollback drill and per-tier database/credential/backup evidence |
|
||||
|
||||
NetKingdom retains architecture and conformance ownership. Deployment YAML,
|
||||
provider configuration, database credentials and live operator work belong to
|
||||
their respective owners. No new owner task ID is invented before acceptance.
|
||||
|
||||
## Conformance evidence limits
|
||||
|
||||
The existing executable suite is documented as IAM v0.2. Accepted v0.3 is
|
||||
additive and preserves v0.2 conformance; the existing checks cover the shared
|
||||
baseline, not every v0.3 tenant-capability carrying/freshness obligation.
|
||||
Record the suite/source version and separately prove tenant-role sourcing and
|
||||
privileged live freshness. Fixture passes are not live issuer acceptance.
|
||||
|
||||
## Resume and close
|
||||
|
||||
Resume when the trigger and package/runtime owner are recorded. Replace each
|
||||
owner dependency with its accepted task reference and receipt; leave downstream
|
||||
tasks waiting until their prerequisites arrive. Finish only after the workplan's
|
||||
live login, isolation, recovery, audit and upgrade acceptance criteria pass.
|
||||
|
||||
Review: 2026-10-03. This admission packet is local contract preparation; T02–T09
|
||||
implementation has not started.
|
||||
46
docs/evidence/2026-10-03-open-dependency-reconciliation.md
Normal file
46
docs/evidence/2026-10-03-open-dependency-reconciliation.md
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# Remaining NetKingdom dependency review
|
||||
|
||||
Review date: 2026-10-03. NK-WP-0045 remains finished with all six tasks done.
|
||||
Two read-only subagent reviews checked remaining plan requirements against
|
||||
owner source; no live changes or credential retrieval were performed.
|
||||
|
||||
| Plan/task | Finding and next evidence needed |
|
||||
| --- | --- |
|
||||
| NK-WP-0011 T02–T09 | Correct active/todo to blocked/wait under accepted ADR-0009. No named tenant, upstream IdP owner and unmet federation need is recorded. Non-secret admission packet prepared; runtime implementation stays unstarted. |
|
||||
| NK-WP-0027 T02/T03 | Repo-manager must accept the reef provider carrier/schema; railiance-infra must author bounds/conditions/evidence. Current reef-railiance declaration lacks posture_provider. Mechanical join remains dependent on that accepted shape. |
|
||||
| NK-WP-0027 T06 | First InfoTechCanon's disclosure/provenance ruling, then ops-warden mapping/tests. Public exists in the workload declaration but not the current maturity mapping; it cannot be aliased to synthetic. |
|
||||
| NK-WP-0031 T04 | audit-core tenancy declaration still lacks authoritative structured owner/freshness/replacement metadata for WH-ENG-20260822-AUDIT-E2-03. Use explicit current as-of on revalidation; unrelated restore evidence does not renew E2. |
|
||||
| NK-WP-0035 T04 | Upstream publication is already bound (candidate0.2.0, bundle b08b4d95fc4b0bd3). Correct the stale publication blocker to owner migration, incompatibility disposition and observed delivery/handoff. |
|
||||
| NK-WP-0040 T02 | No agreed execution-attribution emitter/holder/schema or actual owner receipt found. Local validation follows owner contract agreement, with observed readback and invalid/unknown/clock cases. |
|
||||
| NK-WP-0042 T02 | Accepted pilot journey and actual-user enrollment/return/recovery acceptance remain independent of the completed root-custody approval. Keep wait; IAM v0.4 remains proposed. |
|
||||
|
||||
## Reuse and delivery limits
|
||||
|
||||
AUDIT-WP-0009 T04/T05/T06 already implement heartbeat/cadence/reconciliation.
|
||||
The residual cadence request is source admission/mapping and observed results,
|
||||
not duplicate feature implementation. APPROVAL-WP-0002-T04 remains waiting for
|
||||
live admission/drain/reconciliation evidence; its cadence.yaml still needs the
|
||||
owner schema envelope. QONTO-WP-0005 T01/T02/T03 implement local declarations
|
||||
and heartbeat/reconciliation, but their completion does not establish envelope
|
||||
migration or observer acceptance. local-identity records its bootstrap-tool
|
||||
incompatibility and missing observer feed; preserve that disposition without
|
||||
claiming profile-wide adoption. Then obtain King's Guard handoff acceptance.
|
||||
|
||||
Existing federation reuse includes the PostgreSQL consumer admission tooling,
|
||||
the IAM conformance suite and access-engine normalized claims. Default
|
||||
platform-pg already has four catalogued consumers; explicit placement/capacity
|
||||
admission is required. No Keycloak consumer or assigned broker owner task was
|
||||
found. KEY-WP-0023's migration checks do not prove browser login/MFA or unchanged
|
||||
subject: the documented transform preserves the canonical ID as an attribute
|
||||
while changing sub. Do not use those receipts to close the new isolation drill.
|
||||
|
||||
Owner task references are recorded only where found. Missing assignments are
|
||||
requirements, not invented task IDs. Each external dependency needs an
|
||||
owner-attributed artifact and acceptance evidence before a NetKingdom wait
|
||||
task can progress. Existing blocked plans stay blocked.
|
||||
|
||||
Security orientation: package0.2.4, digest
|
||||
025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3,
|
||||
start withheld/orientation-only because informed-decision changed. Reviewed
|
||||
local SECURITY-COMPANION, accepted ADRs and current informed-decision README
|
||||
directly; orientation is not an authorization or live readiness claim.
|
||||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
|
||||
domain: infotech
|
||||
repo: net-kingdom
|
||||
status: active
|
||||
status: blocked
|
||||
flavor: implementation
|
||||
owner: worsch
|
||||
topic_slug: netkingdom
|
||||
created: "2026-05-20"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07"
|
||||
depends_on:
|
||||
- NK-WP-0003
|
||||
|
|
@ -136,8 +136,10 @@ for the broker. Resolve or supersede D2 from NK-WP-0001.
|
|||
```task
|
||||
id: NK-WP-0011-T02
|
||||
state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
wait_kind: dependency
|
||||
blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence."
|
||||
```
|
||||
|
||||
**PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform
|
||||
|
|
@ -152,8 +154,10 @@ run a restore drill for `keycloak_db` specifically.
|
|||
```task
|
||||
id: NK-WP-0011-T03
|
||||
state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
wait_kind: dependency
|
||||
blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment."
|
||||
```
|
||||
|
||||
**Deploy expanded-mode Keycloak.** Build a custom image
|
||||
|
|
@ -170,8 +174,10 @@ GitOps-friendly (realm JSON/CR in git).
|
|||
```task
|
||||
id: NK-WP-0011-T04
|
||||
state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence."
|
||||
```
|
||||
|
||||
**Upstream federation.** Configure identity brokering for Entra ID (OIDC),
|
||||
|
|
@ -186,8 +192,10 @@ end-to-end for at least the Entra ID path.
|
|||
```task
|
||||
id: NK-WP-0011-T05
|
||||
state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: medium
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners."
|
||||
```
|
||||
|
||||
**MFA / assurance source.** Decide and implement the assurance model: MFA
|
||||
|
|
@ -203,8 +211,10 @@ the IAM Profile token so flex-auth can gate privileged actions on it.
|
|||
```task
|
||||
id: NK-WP-0011-T06
|
||||
state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent."
|
||||
```
|
||||
|
||||
**IAM Profile conformance & downstream coexistence.** Run IAM Profile
|
||||
|
|
@ -220,8 +230,10 @@ Keycloak issuer per the T1 selection rule. Use the canonical
|
|||
```task
|
||||
id: NK-WP-0011-T07
|
||||
state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission."
|
||||
```
|
||||
|
||||
**Recursive tenancy & authorization boundary.** Implement T1's reviewed
|
||||
|
|
@ -238,8 +250,10 @@ used at all, document it as a delegated, non-canonical adapter.
|
|||
```task
|
||||
id: NK-WP-0011-T08
|
||||
state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d"
|
||||
status: todo
|
||||
status: wait
|
||||
priority: medium
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent."
|
||||
```
|
||||
|
||||
**Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative
|
||||
|
|
@ -255,9 +269,11 @@ production-readiness checklist.
|
|||
|
||||
```task
|
||||
id: NK-WP-0011-T09
|
||||
status: todo
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e"
|
||||
wait_kind: dependency
|
||||
blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent."
|
||||
```
|
||||
|
||||
**Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write
|
||||
|
|
@ -316,3 +332,14 @@ the platform operator path. Resource placement, packaging and runtime
|
|||
execution belong to their owners, not this canon repository.
|
||||
|
||||
Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md).
|
||||
|
||||
## Dependency reconciliation — 2026-10-03
|
||||
|
||||
Accepted ADR-0009 decision1 prohibits starting T02–T09 without the named
|
||||
tenant, upstream IdP owner and concrete unmet federation need. None is
|
||||
recorded in this plan. Corrected active/todo to blocked/wait; T01 remains done.
|
||||
Local preparation is complete in
|
||||
[expanded-mode admission requirements](../docs/architecture/expanded-mode-admission-requirements.md):
|
||||
owner deliverables, evidence gates, conformance limits and explicit resume criteria.
|
||||
New federation owner task IDs await trigger and owner acceptance; no deployment
|
||||
or issuer selection is implied by this packet.
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ owner: net-kingdom
|
|||
topic_slug: netkingdom
|
||||
planning_priority: P1
|
||||
created: "2026-08-19"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4"
|
||||
---
|
||||
|
||||
|
|
@ -93,7 +93,7 @@ the critical path.
|
|||
id: NK-WP-0027-T02
|
||||
status: wait
|
||||
blocked_on: message-from:repo-manager
|
||||
blocking_reason: "Proposal to repo-manager: extend Decision 5.5 provider declaration to substrate providers."
|
||||
blocking_reason: "Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration."
|
||||
priority: medium
|
||||
state_hub_task_id: "5b35b646-a525-55da-852a-6005613d42ea"
|
||||
```
|
||||
|
|
@ -204,8 +204,8 @@ windows; tests cover missing identity and a valid operational workload.
|
|||
```task
|
||||
id: NK-WP-0027-T06
|
||||
status: wait
|
||||
blocked_on: message-from:ops-warden
|
||||
blocking_reason: "DataClassification vocabulary mismatch between rapp-policy-nexus (public) and ops-warden dataclass_floor must be resolved with those owners."
|
||||
blocked_on: message-from:info-tech-canon
|
||||
blocking_reason: "Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias."
|
||||
priority: high
|
||||
state_hub_task_id: "bf8b3e1d-7ee0-5ad0-8705-5a580a9fb546"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ owner: codex
|
|||
topic_slug: netkingdom
|
||||
planning_priority: P1
|
||||
created: "2026-08-23"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "9d7b04f9-3803-5613-b7a5-8bd606c77f5a"
|
||||
---
|
||||
|
||||
|
|
@ -77,7 +77,7 @@ portable source identity.
|
|||
id: NK-WP-0031-T04
|
||||
status: wait
|
||||
blocked_on: message-from:audit-core
|
||||
blocking_reason: "audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose."
|
||||
blocking_reason: "audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2."
|
||||
priority: high
|
||||
state_hub_task_id: "7d2029d2-db8d-526e-ab73-a0751becb193"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ owner: codex
|
|||
topic_slug: netkingdom
|
||||
planning_priority: P1
|
||||
created: "2026-09-04"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
related:
|
||||
- GH-DEC-2026-004
|
||||
- canon/standards/security-layer-model_v0.7.md
|
||||
|
|
@ -89,8 +89,8 @@ Python compilation and `git diff --check` pass.
|
|||
```task
|
||||
id: NK-WP-0035-T04
|
||||
status: wait
|
||||
blocked_on: message-from:info-tech-canon
|
||||
blocking_reason: "Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft."
|
||||
blocked_on: message-from:approval-engine
|
||||
blocking_reason: "InfoTechCanon publication is delivered and bound. Waiting on Approval Engine/Qonto owner envelope migration, local-identity incompatibility disposition, actual audit-core observer evidence and Kings Guard handoff."
|
||||
priority: high
|
||||
state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: planning
|
|||
owner: claude-code
|
||||
topic_slug: netkingdom
|
||||
created: "2026-09-23"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
related: [RCLK-WP-0002]
|
||||
state_hub_workstream_id: "e2533f3a-aa43-59b3-bff3-8e64b6149487"
|
||||
---
|
||||
|
|
@ -61,7 +61,7 @@ schema, and validator are explicitly left to T02.
|
|||
id: NK-WP-0040-T02
|
||||
status: wait
|
||||
blocked_on: message-from:audit-core
|
||||
blocking_reason: "Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated."
|
||||
blocking_reason: "Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence."
|
||||
priority: medium
|
||||
state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54"
|
||||
```
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue