diff --git a/docs/architecture/expanded-mode-admission-requirements.md b/docs/architecture/expanded-mode-admission-requirements.md new file mode 100644 index 0000000..1ee087b --- /dev/null +++ b/docs/architecture/expanded-mode-admission-requirements.md @@ -0,0 +1,58 @@ +# Expanded-mode federation admission requirements + +Work: NK-WP-0011. Authority: accepted ADR-0009, decisions 1–8 and ADR-0015. +This packet defines evidence required to start implementation. It does not +admit a tenant, assign an issuer, or authorize a deployment. + +## Adoption trigger + +All three fields must be supplied together, with an owner-attributed reference: + +| Required fact | Acceptance | +| --- | --- | +| Named tenant | Existing canonical tenant identifier, confirmed by tenant-engine | +| Upstream IdP owner | Named responsible organization/person and supported upstream protocol | +| Federation need | Concrete login requirement that the lightweight issuer cannot meet | + +No qualifying trigger is recorded in the reviewed workplan. User count and +interest in Keycloak do not satisfy ADR-0009. Until the trigger exists, T02–T09 +remain waiting and the plan remains blocked. + +## Owner delivery requirements + +After the trigger is accepted, obtain owner workplan/task references and dated, +non-secret receipts for these deliverables. An owner name without acceptance +and evidence is not delivery. + +| NK task | Dependency owner | Required deliverable and acceptance evidence | +| --- | --- | --- | +| T02 | railiance-platform + rapp-postgres | Named database consumer and selected catalog placement; isolation, governed credential route and exact ESO references; backup scope/retention and isolated database restore proof | +| T03 | ADR-0015 package/runtime owner + railiance-platform | Explicit package ownership, immutable hostname/issuer, pinned image, declaration and reviewed rollout/rollback; exact workload identity/ESO role with least-privilege denied-operation evidence | +| T04 | Upstream IdP owner + package owner + user-engine | Non-secret upstream metadata and governed secret references; tenant-scoped versioned claim/group mappings; pending JIT projection; ambiguity denial; federated login proof preserving issuer/subject account binding | +| T05 | key-cape/package owner + access-engine | Per-IdP assurance trust mapping; AAL1 default; reviewed privileged step-up flow and assurance enforcement receipts; coordinate NK-WP-0042 and retain accepted IAM v0.3 until v0.4 acceptance | +| T06 | package owner + key-cape + tenant-engine | One active issuer per tenant and discovery configuration; dedicated test-client admission; conformance result and coexistence/subject-binding evidence | +| T07 | tenant-engine + access-engine + package owner | Canonical tenant/tier/issuer ownership, reserved platform boundary, subject-role vs tenant-capability separation; live role freshness for privileged decisions; tenant-admin cross-boundary denial evidence | +| T08 | railiance-platform + package owner + audit-core | Protected export custody, off-host backup and isolated restore receipts; disabled-by-default break-glass with alert proof; owner-bound audit emission/retention/correlation contract and observed receipt | +| T09 | tenant-engine + package/runtime owner | Tier from canonical IAM capability, immutable realm/issuer, preserved subjects/federated links; owner-executed isolated migration/login/rollback drill and per-tier database/credential/backup evidence | + +NetKingdom retains architecture and conformance ownership. Deployment YAML, +provider configuration, database credentials and live operator work belong to +their respective owners. No new owner task ID is invented before acceptance. + +## Conformance evidence limits + +The existing executable suite is documented as IAM v0.2. Accepted v0.3 is +additive and preserves v0.2 conformance; the existing checks cover the shared +baseline, not every v0.3 tenant-capability carrying/freshness obligation. +Record the suite/source version and separately prove tenant-role sourcing and +privileged live freshness. Fixture passes are not live issuer acceptance. + +## Resume and close + +Resume when the trigger and package/runtime owner are recorded. Replace each +owner dependency with its accepted task reference and receipt; leave downstream +tasks waiting until their prerequisites arrive. Finish only after the workplan's +live login, isolation, recovery, audit and upgrade acceptance criteria pass. + +Review: 2026-10-03. This admission packet is local contract preparation; T02–T09 +implementation has not started. diff --git a/docs/evidence/2026-10-03-open-dependency-reconciliation.md b/docs/evidence/2026-10-03-open-dependency-reconciliation.md new file mode 100644 index 0000000..b8fe2d2 --- /dev/null +++ b/docs/evidence/2026-10-03-open-dependency-reconciliation.md @@ -0,0 +1,46 @@ +# Remaining NetKingdom dependency review + +Review date: 2026-10-03. NK-WP-0045 remains finished with all six tasks done. +Two read-only subagent reviews checked remaining plan requirements against +owner source; no live changes or credential retrieval were performed. + +| Plan/task | Finding and next evidence needed | +| --- | --- | +| NK-WP-0011 T02–T09 | Correct active/todo to blocked/wait under accepted ADR-0009. No named tenant, upstream IdP owner and unmet federation need is recorded. Non-secret admission packet prepared; runtime implementation stays unstarted. | +| NK-WP-0027 T02/T03 | Repo-manager must accept the reef provider carrier/schema; railiance-infra must author bounds/conditions/evidence. Current reef-railiance declaration lacks posture_provider. Mechanical join remains dependent on that accepted shape. | +| NK-WP-0027 T06 | First InfoTechCanon's disclosure/provenance ruling, then ops-warden mapping/tests. Public exists in the workload declaration but not the current maturity mapping; it cannot be aliased to synthetic. | +| NK-WP-0031 T04 | audit-core tenancy declaration still lacks authoritative structured owner/freshness/replacement metadata for WH-ENG-20260822-AUDIT-E2-03. Use explicit current as-of on revalidation; unrelated restore evidence does not renew E2. | +| NK-WP-0035 T04 | Upstream publication is already bound (candidate0.2.0, bundle b08b4d95fc4b0bd3). Correct the stale publication blocker to owner migration, incompatibility disposition and observed delivery/handoff. | +| NK-WP-0040 T02 | No agreed execution-attribution emitter/holder/schema or actual owner receipt found. Local validation follows owner contract agreement, with observed readback and invalid/unknown/clock cases. | +| NK-WP-0042 T02 | Accepted pilot journey and actual-user enrollment/return/recovery acceptance remain independent of the completed root-custody approval. Keep wait; IAM v0.4 remains proposed. | + +## Reuse and delivery limits + +AUDIT-WP-0009 T04/T05/T06 already implement heartbeat/cadence/reconciliation. +The residual cadence request is source admission/mapping and observed results, +not duplicate feature implementation. APPROVAL-WP-0002-T04 remains waiting for +live admission/drain/reconciliation evidence; its cadence.yaml still needs the +owner schema envelope. QONTO-WP-0005 T01/T02/T03 implement local declarations +and heartbeat/reconciliation, but their completion does not establish envelope +migration or observer acceptance. local-identity records its bootstrap-tool +incompatibility and missing observer feed; preserve that disposition without +claiming profile-wide adoption. Then obtain King's Guard handoff acceptance. + +Existing federation reuse includes the PostgreSQL consumer admission tooling, +the IAM conformance suite and access-engine normalized claims. Default +platform-pg already has four catalogued consumers; explicit placement/capacity +admission is required. No Keycloak consumer or assigned broker owner task was +found. KEY-WP-0023's migration checks do not prove browser login/MFA or unchanged +subject: the documented transform preserves the canonical ID as an attribute +while changing sub. Do not use those receipts to close the new isolation drill. + +Owner task references are recorded only where found. Missing assignments are +requirements, not invented task IDs. Each external dependency needs an +owner-attributed artifact and acceptance evidence before a NetKingdom wait +task can progress. Existing blocked plans stay blocked. + +Security orientation: package0.2.4, digest +025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3, +start withheld/orientation-only because informed-decision changed. Reviewed +local SECURITY-COMPANION, accepted ADRs and current informed-decision README +directly; orientation is not an authorization or live readiness claim. diff --git a/workplans/NK-WP-0011-enterprise-federation-saml.md b/workplans/NK-WP-0011-enterprise-federation-saml.md index 4137a5c..3de4481 100644 --- a/workplans/NK-WP-0011-enterprise-federation-saml.md +++ b/workplans/NK-WP-0011-enterprise-federation-saml.md @@ -4,12 +4,12 @@ type: workplan title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker" domain: infotech repo: net-kingdom -status: active +status: blocked flavor: implementation owner: worsch topic_slug: netkingdom created: "2026-05-20" -updated: "2026-09-28" +updated: "2026-10-03" state_hub_workstream_id: "1075448f-d533-5f9e-94b7-c3adfe151a07" depends_on: - NK-WP-0003 @@ -136,8 +136,10 @@ for the broker. Resolve or supersede D2 from NK-WP-0001. ```task id: NK-WP-0011-T02 state_hub_task_id: "2fe6f100-3a5d-563e-b033-7d7b846ae487" -status: todo +status: wait priority: high +wait_kind: dependency +blocking_reason: "ADR-0009 adoption trigger absent; then railiance-platform/rapp-postgres must admit the database consumer and return backup/restore evidence." ``` **PostgreSQL `keycloak_db` on the existing operator.** Have railiance-platform @@ -152,8 +154,10 @@ run a restore drill for `keycloak_db` specifically. ```task id: NK-WP-0011-T03 state_hub_task_id: "32d1411b-10a4-5a8b-8f43-99ac46d83908" -status: todo +status: wait priority: high +wait_kind: dependency +blocking_reason: "ADR-0009 adoption trigger and named package/runtime owner absent; requires T02 database admission and governed OpenBao/ESO role plus immutable issuer assignment." ``` **Deploy expanded-mode Keycloak.** Build a custom image @@ -170,8 +174,10 @@ GitOps-friendly (realm JSON/CR in git). ```task id: NK-WP-0011-T04 state_hub_task_id: "6697a994-7343-5ea8-8b37-bc3b921e5a9b" -status: todo +status: wait priority: high +wait_kind: dependency +blocking_reason: "Named tenant/upstream IdP owner/federation need absent; requires admitted broker and owner-reviewed tenant-scoped claim mappings plus actual login evidence." ``` **Upstream federation.** Configure identity brokering for Entra ID (OIDC), @@ -186,8 +192,10 @@ end-to-end for at least the Entra ID path. ```task id: NK-WP-0011-T05 state_hub_task_id: "d845380d-3dbc-5e59-8f2b-5a4d1b32d89d" -status: todo +status: wait priority: medium +wait_kind: dependency +blocking_reason: "Adoption trigger absent; requires per-IdP assurance trust mapping and reviewed privileged step-up delivery from issuer/package and access-engine owners." ``` **MFA / assurance source.** Decide and implement the assurance model: MFA @@ -203,8 +211,10 @@ the IAM Profile token so flex-auth can gate privileged actions on it. ```task id: NK-WP-0011-T06 state_hub_task_id: "9cb7fd93-c16e-5102-83ce-195b3aa87446" -status: todo +status: wait priority: high +wait_kind: dependency +blocking_reason: "Requires admitted live broker, canonical tenant issuer selection and dedicated test-client conformance/coexistence evidence; adoption trigger absent." ``` **IAM Profile conformance & downstream coexistence.** Run IAM Profile @@ -220,8 +230,10 @@ Keycloak issuer per the T1 selection rule. Use the canonical ```task id: NK-WP-0011-T07 state_hub_task_id: "38998c68-29bf-50d2-8c8d-0c75184d5833" -status: todo +status: wait priority: high +wait_kind: dependency +blocking_reason: "Requires tenant-engine tier/issuer ownership and access-engine boundary/freshness enforcement evidence after adoption trigger and broker admission." ``` **Recursive tenancy & authorization boundary.** Implement T1's reviewed @@ -238,8 +250,10 @@ used at all, document it as a delegated, non-canonical adapter. ```task id: NK-WP-0011-T08 state_hub_task_id: "e5f44ddc-9645-5f61-b84c-da5ab9cccb6d" -status: todo +status: wait priority: medium +wait_kind: dependency +blocking_reason: "Requires admitted database/broker, named recovery and audit owners, off-host restore and observed audit/break-glass receipts; adoption trigger absent." ``` **Backups, DR, break-glass, monitoring, audit.** Only sanitized declarative @@ -255,9 +269,11 @@ production-readiness checklist. ```task id: NK-WP-0011-T09 -status: todo +status: wait priority: medium state_hub_task_id: "d9dc4292-6b66-5797-9ff9-a1a4a556278e" +wait_kind: dependency +blocking_reason: "Requires named tenant and admitted package owner, canonical tier contract and isolated subject/issuer-preserving upgrade/rollback drill; adoption trigger absent." ``` **Shared-realm to dedicated-instance upgrade (ADR-0009, decision 3).** Write @@ -316,3 +332,14 @@ the platform operator path. Resource placement, packaging and runtime execution belong to their owners, not this canon repository. Evidence and cross-plan priorities: [estate review](../history/2026-09-28-open-workplan-infrastructure-review.md). + +## Dependency reconciliation — 2026-10-03 + +Accepted ADR-0009 decision1 prohibits starting T02–T09 without the named +tenant, upstream IdP owner and concrete unmet federation need. None is +recorded in this plan. Corrected active/todo to blocked/wait; T01 remains done. +Local preparation is complete in +[expanded-mode admission requirements](../docs/architecture/expanded-mode-admission-requirements.md): +owner deliverables, evidence gates, conformance limits and explicit resume criteria. +New federation owner task IDs await trigger and owner acceptance; no deployment +or issuer selection is implied by this packet. diff --git a/workplans/NK-WP-0027-reef-placement-reconciliation.md b/workplans/NK-WP-0027-reef-placement-reconciliation.md index ff60045..cb0af4d 100644 --- a/workplans/NK-WP-0027-reef-placement-reconciliation.md +++ b/workplans/NK-WP-0027-reef-placement-reconciliation.md @@ -10,7 +10,7 @@ owner: net-kingdom topic_slug: netkingdom planning_priority: P1 created: "2026-08-19" -updated: "2026-09-28" +updated: "2026-10-03" state_hub_workstream_id: "965ad365-6b81-50a1-a2a3-2d0c1fcce0b4" --- @@ -93,7 +93,7 @@ the critical path. id: NK-WP-0027-T02 status: wait blocked_on: message-from:repo-manager -blocking_reason: "Proposal to repo-manager: extend Decision 5.5 provider declaration to substrate providers." +blocking_reason: "Requires repo-manager acceptance of the reef provider carrier/schema, then railiance-infra authored ceilings, conditions and evidence in the authoritative reef declaration." priority: medium state_hub_task_id: "5b35b646-a525-55da-852a-6005613d42ea" ``` @@ -204,8 +204,8 @@ windows; tests cover missing identity and a valid operational workload. ```task id: NK-WP-0027-T06 status: wait -blocked_on: message-from:ops-warden -blocking_reason: "DataClassification vocabulary mismatch between rapp-policy-nexus (public) and ops-warden dataclass_floor must be resolved with those owners." +blocked_on: message-from:info-tech-canon +blocking_reason: "Requires InfoTechCanon ruling on public disclosure classification versus synthetic provenance, then ops-warden authoritative dataclass_floor mapping and tests; no public-to-synthetic alias." priority: high state_hub_task_id: "bf8b3e1d-7ee0-5ad0-8705-5a580a9fb546" ``` diff --git a/workplans/NK-WP-0031-deterministic-posture-feedback.md b/workplans/NK-WP-0031-deterministic-posture-feedback.md index 7785445..b216cfe 100644 --- a/workplans/NK-WP-0031-deterministic-posture-feedback.md +++ b/workplans/NK-WP-0031-deterministic-posture-feedback.md @@ -10,7 +10,7 @@ owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-08-23" -updated: "2026-09-28" +updated: "2026-10-03" state_hub_workstream_id: "9d7b04f9-3803-5613-b7a5-8bd606c77f5a" --- @@ -77,7 +77,7 @@ portable source identity. id: NK-WP-0031-T04 status: wait blocked_on: message-from:audit-core -blocking_reason: "audit-core must add authoritative owner and E2 freshness metadata for WH-ENG-20260822-AUDIT-E2-03; NetKingdom must not parse it from prose." +blocking_reason: "audit-core tenancy.yaml must publish structured authoritative owner, observation/expiry and replacement-action metadata for WH-ENG-20260822-AUDIT-E2-03. Re-evaluate with explicit current as-of; later recovery prose does not renew E2." priority: high state_hub_task_id: "7d2029d2-db8d-526e-ab73-a0751becb193" ``` diff --git a/workplans/NK-WP-0035-emission-cadence-security-profile.md b/workplans/NK-WP-0035-emission-cadence-security-profile.md index d1a7415..6c47e48 100644 --- a/workplans/NK-WP-0035-emission-cadence-security-profile.md +++ b/workplans/NK-WP-0035-emission-cadence-security-profile.md @@ -10,7 +10,7 @@ owner: codex topic_slug: netkingdom planning_priority: P1 created: "2026-09-04" -updated: "2026-09-28" +updated: "2026-10-03" related: - GH-DEC-2026-004 - canon/standards/security-layer-model_v0.7.md @@ -89,8 +89,8 @@ Python compilation and `git diff --check` pass. ```task id: NK-WP-0035-T04 status: wait -blocked_on: message-from:info-tech-canon -blocking_reason: "Needs info-tech-canon's versioned contract and schema; cannot be completed by copying the draft." +blocked_on: message-from:approval-engine +blocking_reason: "InfoTechCanon publication is delivered and bound. Waiting on Approval Engine/Qonto owner envelope migration, local-identity incompatibility disposition, actual audit-core observer evidence and Kings Guard handoff." priority: high state_hub_task_id: "e3fbc8b8-00d5-57ce-ba0c-19b58044c950" ``` diff --git a/workplans/NK-WP-0040-execution-attribution-receipt.md b/workplans/NK-WP-0040-execution-attribution-receipt.md index c667c52..a787439 100644 --- a/workplans/NK-WP-0040-execution-attribution-receipt.md +++ b/workplans/NK-WP-0040-execution-attribution-receipt.md @@ -9,7 +9,7 @@ flavor: planning owner: claude-code topic_slug: netkingdom created: "2026-09-23" -updated: "2026-09-28" +updated: "2026-10-03" related: [RCLK-WP-0002] state_hub_workstream_id: "e2533f3a-aa43-59b3-bff3-8e64b6149487" --- @@ -61,7 +61,7 @@ schema, and validator are explicitly left to T02. id: NK-WP-0040-T02 status: wait blocked_on: message-from:audit-core -blocking_reason: "Agree with audit-core who emits, who holds and how the execution-attribution receipt is validated." +blocking_reason: "Requires audit-core/Railiance owner agreement on emitter, evidence holder and receipt fields before local schema/validator implementation; then actual emission/readback and invalid attribution/clock/unknown-case evidence." priority: medium state_hub_task_id: "963120c1-7c72-5806-942b-6f49e4c66e54" ```