From eb8d7b2edcb86802ec830d44e3af27d1f6cee759 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 12:15:50 +0200 Subject: [PATCH] NK-WP-0048-T05: done; oidc-browser-relying-party 1.0 acknowledged (memo r4) The founder accepted memo r4 in informed-decision. Its hub write-back is off in production, so hub decision e418263e was resolved from the founder's report. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 469893@bnt-lap001 Assistant-Session: 49296f15-2171-4137-b972-2443bab95edb --- .../oidc-browser-relying-party/README.md | 6 ++++-- .../oidc-browser-relying-party/type.yaml | 2 +- workplans/NK-WP-0048-security-case-types.md | 10 +++++++--- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/security-case-types/oidc-browser-relying-party/README.md b/security-case-types/oidc-browser-relying-party/README.md index 6d7f4b7..f5bae4f 100644 --- a/security-case-types/oidc-browser-relying-party/README.md +++ b/security-case-types/oidc-browser-relying-party/README.md @@ -6,8 +6,10 @@ registration, the LLDAP groups that gate sign-in, and, for confidential clients, the client secret, minted straight into OpenBao custody and readable only by KeyCape and the consuming service. -Canon: `canon/standards/security-case-types_v0.1.md`. Status: **proposed**; it -awaits acknowledgment through informed-decision (NK-WP-0048-T05). +Canon: `canon/standards/security-case-types_v0.1.md`. Status: **acknowledged** +(2026-10-09, informed-decision memo `nk-wp-0048-t05-oidc-browser-relying-party-r4`, +hub decision `e418263e`). It becomes `implemented` once its first case, Forgejo, +is live and verified (NK-WP-0048-T06). ## Purpose diff --git a/security-case-types/oidc-browser-relying-party/type.yaml b/security-case-types/oidc-browser-relying-party/type.yaml index efc8c8d..8bdd672 100644 --- a/security-case-types/oidc-browser-relying-party/type.yaml +++ b/security-case-types/oidc-browser-relying-party/type.yaml @@ -3,7 +3,7 @@ kind: SecurityCaseType spec: id: oidc-browser-relying-party version: "1.0" - status: proposed + status: acknowledged title: "Browser OIDC relying party for an internal service" purpose: >- Let an internal web service sign its human users in through NetKingdom diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 6903883..c41e672 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -172,10 +172,8 @@ review them in MASON-WP-0010-T01 and WARDEN-WP-0044-T01 before acknowledgment ```task id: NK-WP-0048-T05 -status: wait +status: done depends_on: [NK-WP-0048-T04, MASON-WP-0010-T01, WARDEN-WP-0044-T01] -needs_human: true -blocking_reason: "A new SecurityCaseType is acknowledged as an informed-decision by the founder." priority: high state_hub_task_id: "3d987d3d-0797-538b-86e4-51185a327ae2" ``` @@ -316,6 +314,12 @@ Prerequisites for T06 are now: lane `keycape-client-secret-generate` (railiance-platform), and a founder-approved rollout of an identity-provisioner image containing 630ebfd. +2026-10-09: done. The founder queued r4 (`pending`, `queued`), returned r3 as +superseded and accepted r4 in informed-decision. informed-decision's hub +write-back is off in production (`INFD_HUB_WRITEBACK` unset), so net-kingdom +resolved hub decision `e418263e` from the founder's report, naming memo r4 in +the rationale. The type is `acknowledged`; it becomes `implemented` with T06. + ```task id: NK-WP-0048-T06 status: wait