143 commits

Author	SHA1	Message	Date
tegwick	39b04113e5	Record the live openbao-admin signInDiagnosis flag (NK-WP-0051-T02). ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52	2026-10-15 00:25:20 +02:00
tegwick	916bc7d5b8	Roll KeyCape to cdec9dd7 with the sign-in diagnosis page (NK-WP-0051-T02). ... Founder-run rollout: check-config valid, diff image-only, dry-run passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52	2026-10-15 00:09:12 +02:00
tegwick	cb634be39b	Record NK-WP-0051 owner implementations and fix the assurance source. ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52	2026-10-14 23:53:38 +02:00
tegwick	106d97f4a8	Write the sign-in diagnosis contract (NK-WP-0051-T01). ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52	2026-10-14 23:40:25 +02:00
tegwick	4dffe2fe7a	fix: preserve resolver configuration during attended password cutover ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 01:52:37 +02:00
tegwick	ab25dde80d	security: repair LDAP group callers and fail incomplete T07 acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 01:17:35 +02:00
tegwick	84c5dbeec8	security: retire unsafe legacy LDAP lifecycle callers ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 00:08:42 +02:00
tegwick	276b95f6ba	security: reject Playwright audience and delivery alias collisions ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 23:44:41 +02:00
tegwick	eba6e1fdbb	security: bind Playwright activation and recovery to exact issuer state ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 23:39:58 +02:00
tegwick	5dd74dfbdf	security: prepare scoped Playwright consumer registrations and owner delivery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 23:13:48 +02:00
tegwick	30f0d27840	security: preserve realm configuration and remove shell credential evaluation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 22:47:24 +02:00
tegwick	96feef46ab	security: replace retired MFA diagnostic credential discovery with scoped checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 22:24:35 +02:00
tegwick	8f808577d6	fix(security): constrain SOPS writes and custody argument handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 21:03:24 +02:00
tegwick	19a1c75d30	fix(security): make admin bootstrap private and non-overwriting ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 15:02:15 +02:00
tegwick	6ae4708ea0	fix(security): keep rotation credentials out of command output ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 12:54:10 +02:00
tegwick	681c5b0ea1	fix: decrypt SOPS through explicit custody into private output ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 12:08:35 +02:00
tegwick	4cf26a9bc8	fix: make custody input explicit and remove partial decryptions ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 10:53:30 +02:00
tegwick	b97f9f616f	fix: separate bootstrap encryption from private root custody ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 09:41:08 +02:00
tegwick	96eb40c695	Preserve October 10 owner decision source packets ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 18:46:21 +02:00
tegwick	7ceac4372d	Publish reviewed bounded JWT ready handoff and retained owner history ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 18:31:04 +02:00
tegwick	bf6a44db6d	Bound JWT private input and gate native effects on public health ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 17:30:10 +02:00
tegwick	dfc357eb8a	Publish reviewed KEY39 lifecycle source and preserve failed review history ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 15:33:14 +02:00
tegwick	98f09f4d4b	Record independent KEY39 lifecycle deadline review ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 14:21:04 +02:00
tegwick	bb9b9b556c	Select explicitly pinned security case type revisions without fallback ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 09:09:24 +02:00
tegwick	f6856cdb53	Record founder source acknowledgment for isolated Forgejo type 1.2 ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 08:56:45 +02:00
tegwick	584a964684	Prepare reviewed Forgejo type 1.2 source decision package ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 04:48:34 +02:00
tegwick	c26b018328	Prepare reviewed Forgejo consumer ESO scope and truthful recovery records ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 04:09:46 +02:00
tegwick	6180f87894	Retain accepted Staff doctrine handoff and proposed successor adoption ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 04:04:20 +02:00
tegwick	d8eabe675b	Review exact one-use catalogue exception and recovery limits ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 03:33:47 +02:00
tegwick	e3fffe3ab4	Review bounded Staff evidence doctrine without changing accepted canon ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 03:29:45 +02:00
tegwick	42aaf60062	Record exact conditional technical review of user readback rollout ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 02:44:21 +02:00
tegwick	81fa1769e0	Give changed draft publications new immutable revision identities ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 02:25:23 +02:00
tegwick	f4436dadd5	Preserve exact served security layer v0.7 revision artifacts ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 02:15:29 +02:00
tegwick	0e17d956ab	Accept security layer v0.8 from confirmed native review ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade	2026-10-11 01:53:56 +02:00
tegwick	1c2d0c2cf6	Follow the access-engine CLI rename: ./cmd/flex-auth -> ./cmd/access-engine ... FLEX-DEC-2026-020; the old path is a stub that exits 2. Runtime names unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8	2026-10-10 15:28:05 +02:00
tegwick	df15d6900d	NK-WP-0048-T02 done: SecurityCaseType inventory ... 36 of 37 CCRs are already workload-kv-read; browser and service OIDC clients and forge read identities follow. Ranking and recommendation recorded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012	2026-10-08 22:21:40 +02:00
tegwick	4f3ad6a73b	Bind completed owner cadence changes and remaining observer gates ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 23:00:28 +02:00
tegwick	f170350f69	Accept source cadence migrations and retain operational adoption gates ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 22:48:58 +02:00
tegwick	d1e5661369	Report bootstrap audit failures and track cadence adoption work ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 22:42:57 +02:00
tegwick	d4d97acd57	Establish remaining owner requirements and correct blocked plan gates ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 22:21:11 +02:00
tegwick	0f2e8734e5	Finish NK-WP-0045 with verified attended custody recovery ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:59:22 +02:00
tegwick	9c8655af30	Record activity projection compatibility blocker ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:55:12 +02:00
tegwick	7782619773	Bind tested custody repair and backup consumer refresh tasks ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:51:03 +02:00
tegwick	742b8a24e5	Record custody share diagnosis and owned repair blockers ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:49:24 +02:00
tegwick	3f9ef08135	Record persistent provider rejection and tested read-only share diagnosis ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:32:32 +02:00
tegwick	d9f890c58a	Fix custody recovery handoff for required public DAV upload header ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:21:20 +02:00
tegwick	c55e27762f	Record failed custody finish diagnosis and tested recovery helper repair ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 21:09:39 +02:00
tegwick	fa186baaff	Record completed owner recovery preparation and final sync receipts ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 20:51:21 +02:00
tegwick	0ba6eefb36	Record live audit proof and bounded custody recovery handoff ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 20:49:31 +02:00
tegwick	36f2afcb38	Accept live empty custody integration and isolated recovery evidence ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1029d-2c93-7500-a0e0-e3e089668b29	2026-10-03 20:35:46 +02:00