33 commits

Author	SHA1	Message	Date
tegwick	4f65e41ac5	fix(identity): retain group provenance and prepare sealed recovery custody ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa	2026-10-17 00:28:17 +02:00
tegwick	5fcd5952ad	feat(recovery): add isolated KeyCape restore and loss cleanup proof ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa	2026-10-16 23:35:54 +02:00
tegwick	1ab5d53bd7	Prepare isolated privacyIDEA token and audit recovery checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 21:00:36 +02:00
tegwick	d5484bb90a	Prepare native isolated directory recovery and offline service images ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 20:33:57 +02:00
tegwick	fbdd62b7ed	Fix private recovery prompts on nonseekable terminals ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 19:56:06 +02:00
tegwick	1764f40b43	Prepare independent outage recovery and Storage Share documentation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 17:59:18 +02:00
tegwick	17a8fa1495	feat(recovery): verify scoped delivery and create first full offsite bundle ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 09:21:55 +02:00
tegwick	72c598e7de	fix(recovery): distinguish malformed paths from outside-folder denial ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 07:48:36 +02:00
tegwick	a17aa7edc1	fix(recovery): bind admitted host and record live provider scope approval ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 07:44:36 +02:00
tegwick	994d11c869	feat(recovery): prepare full identity backup and bootstrap handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 01:37:11 +02:00
tegwick	dca999222f	Record off-host database recovery and prepare identity backup coverage ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 00:32:50 +02:00
tegwick	a1939a7d06	Prepare bounded off-host privacyIDEA recovery drill ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-16 00:09:13 +02:00
tegwick	c262470089	Inventory off-host recovery assets through existing bounded backup routes ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-15 23:58:41 +02:00
tegwick	d9557ba90e	Harden remaining bootstrap custody callers and prepare isolated recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2	2026-10-15 22:57:14 +02:00
tegwick	2cc09ceb05	Preview one uid's directory groups for sign-in diagnosis (NK-WP-0051-T04). ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52	2026-10-14 23:41:32 +02:00
tegwick	4dffe2fe7a	fix: preserve resolver configuration during attended password cutover ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 01:52:37 +02:00
tegwick	ab25dde80d	security: repair LDAP group callers and fail incomplete T07 acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 01:17:35 +02:00
tegwick	84c5dbeec8	security: retire unsafe legacy LDAP lifecycle callers ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 00:08:42 +02:00
tegwick	5dd74dfbdf	security: prepare scoped Playwright consumer registrations and owner delivery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 23:13:48 +02:00
tegwick	30f0d27840	security: preserve realm configuration and remove shell credential evaluation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 22:47:24 +02:00
tegwick	96feef46ab	security: replace retired MFA diagnostic credential discovery with scoped checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 22:24:35 +02:00
tegwick	1cbe00fd78	security: preserve privacyIDEA key custody and restore the actual PVC ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 21:46:41 +02:00
tegwick	8f808577d6	fix(security): constrain SOPS writes and custody argument handoff ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 21:03:24 +02:00
tegwick	b01a30bd49	fix(security): make service Secret updates private and conditional ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 20:20:42 +02:00
tegwick	7d4bb1653e	fix(security): reconcile KeyCape bootstrap with scoped factor custody ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-13 19:46:53 +02:00
tegwick	19a1c75d30	fix(security): make admin bootstrap private and non-overwriting ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 15:02:15 +02:00
tegwick	6ae4708ea0	fix(security): keep rotation credentials out of command output ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 12:54:10 +02:00
tegwick	681c5b0ea1	fix: decrypt SOPS through explicit custody into private output ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 12:08:35 +02:00
tegwick	4cf26a9bc8	fix: make custody input explicit and remove partial decryptions ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 10:53:30 +02:00
tegwick	b97f9f616f	fix: separate bootstrap encryption from private root custody ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c	2026-10-12 09:41:08 +02:00
tegwick	4e07d60ff1	Validate cadence contract and require functional MFA verification ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd	2026-09-05 01:28:05 +02:00
tegwick	4a915ce6c7	NK-WP-0026 finished: user-engine caller identity verified live against railiance01 ... T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:01:12 +02:00
tegwick	29ae3e70c6	Activate expanded portal integration gate	2026-08-09 02:00:58 +02:00