17 commits

Author	SHA1	Message	Date
tegwick	70f408ca23	feat(identity): add PostgreSQL provenance and verify sealed SOPS custody ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa	2026-10-17 01:36:38 +02:00
tegwick	4f65e41ac5	fix(identity): retain group provenance and prepare sealed recovery custody ... Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa	2026-10-17 00:28:17 +02:00
tegwick	e861f63513	security: reserve platform IAM groups in service group operations ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2	2026-10-14 00:44:33 +02:00
tegwick	630ebfdd61	NK-WP-0048-T08: identity-provisioner service-access groups ensure/revoke ... POST /v1/groups/ensure and /v1/groups/revoke: reserved prefixes refused, no user creation, validate-before-mutate, read-back before success, delete only empty groups on request. The oidc-browser-relying-party type now names them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012	2026-10-08 22:58:36 +02:00
tegwick	6c4fcaf9ae	Record the human onboarding run and fix password-setup usability ... - NK-WP-0036 finished: native onboarding journey completed by the operator. - NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human prompt=login flow (auth_time precedes request registration). - identity-provisioner: read-only autocomplete=username field on the setup form (submitted value ignored) and an HTTPS sign-in link on completion. - NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 299762@bnt-lap001 Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e	2026-09-23 21:48:29 +02:00
tegwick	c8e07615c3	Surface redacted directory bind failures before native onboarding ... Map uncaught HTTPError from LLDAP login to a structured dependency_unavailable response, add /readyz as the provisioner-to-directory preflight, keep /healthz as process liveness, and run the contract in CI. Auth rejection is not retried during cooldown. NK-WP-0036-T05 remains in progress until the immutable image is published, pinned with /readyz, and one native login/create/password-setup journey is verified. Assistant: grok Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf	2026-09-14 04:46:29 +02:00
tegwick	a0cc947bf6	Support tenant-scoped directory lifecycle with isolation tests ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 12:20:02 +02:00
tegwick	48a75b1a54	Bind password setup grants to approved company welcome pages ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-12 02:43:31 +02:00
tegwick	52f9b200e8	Track and harden NK-WP-0025 residuals	2026-08-14 19:35:46 +02:00
tegwick	2a2d8ba055	Align provisioned identities with OIDC subjects	2026-08-14 18:53:37 +02:00
tegwick	0be8a03b99	Honor validated registration usernames	2026-08-10 13:23:45 +02:00
tegwick	12cdef5c7c	Make identity deletion replay safe	2026-07-29 23:34:46 +02:00
tegwick	26d0e52172	Add identity drift reconciliation	2026-07-29 23:29:36 +02:00
tegwick	80adc31c7c	Pin password helper image digest	2026-07-28 17:38:32 +02:00
tegwick	76270a239e	Add single-use identity password setup	2026-07-28 17:30:23 +02:00
tegwick	dbf7cfd862	Normalize mounted provisioner token	2026-07-28 01:04:15 +02:00
tegwick	ba07dd2acb	Add scoped LLDAP identity provisioner	2026-07-28 00:57:16 +02:00