net-kingdom

Author	SHA1	Message	Date
tegwick	2ebc4f0ae8	NK-WP-0054-T05: identity-provisioner logs in as a configurable LLDAP user; svc-*/-admin names reserved LLDAP_ADMIN_USERNAME (default admin) lets the provisioner use svc-provisioner after the bind split; preferred usernames starting svc- or ending -admin are refused like admin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 308701@bnt-lap001 Assistant-Session: 5548e447-444c-4dcc-bed1-05c16eebfe56	2026-10-28 20:11:04 +01:00
tegwick	4f65e41ac5	fix(identity): retain group provenance and prepare sealed recovery custody Some checks failed CI Smoke / host-smoke (push) Successful in 1s Details CI Smoke / container-smoke (push) Successful in 2s Details Identity provider journey acceptance / provider (push) Failing after 20s Details Build and Publish identity-provisioner / build-and-push (push) Successful in 8s Details Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa	2026-10-17 00:28:17 +02:00
tegwick	c8e07615c3	Surface redacted directory bind failures before native onboarding All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 3s Details Identity provider journey acceptance / provider (push) Successful in 6s Details Build and Publish identity-provisioner / build-and-push (push) Successful in 10s Details Map uncaught HTTPError from LLDAP login to a structured dependency_unavailable response, add /readyz as the provisioner-to-directory preflight, keep /healthz as process liveness, and run the contract in CI. Auth rejection is not retried during cooldown. NK-WP-0036-T05 remains in progress until the immutable image is published, pinned with /readyz, and one native login/create/password-setup journey is verified. Assistant: grok Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf	2026-09-14 04:46:29 +02:00

3 commits