4.39 rejects KeyCape's in-cluster http back-channel token call
(invalid X-Forwarded-Proto 'http'). Operator restored the pre-upgrade DB
and the 4.38 digest; incident recorded in NK-WP-0041-T02.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
Operator rollout 2026-09-24 from the floating 4.38 tag. Schema migrated
15 -> 29; first start hit a transient LDAP dial error and restarted clean.
Verified: health 200, discovery 200, '+' username now a clean not-found,
KeyCape checks unchanged. Rollback: sha256:46021dc2... plus
backups/db.sqlite3.pre-4.39.28.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
Operator-applied 2026-09-24; healthz/readyz 200, username field and
sign-in URL live. Rollback: sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
- NK-WP-0036 finished: native onboarding journey completed by the operator.
- NK-WP-0037-T02 waits on key-cape: Authelia 4.38 rejects every human
prompt=login flow (auth_time precedes request registration).
- identity-provisioner: read-only autocomplete=username field on the setup
form (submitted value ignored) and an HTTPS sign-in link on completion.
- NK-WP-0041 tracks the fixes and routes Authelia/user-engine findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
- runtime.yaml: declare the live flex-auth tenant-engine/user-engine digests
confirmed by flex-auth, and mark the file reference-only (do not apply):
live is ahead of it beyond the digests, including caller-auth enforce.
- NK-WP-0039: T02 answered (package coordinate unchanged), T03 narrowed,
new T04 to retire or reconcile the stale reference manifest.
- NK-WP-0033: record the operator's predecessor-disposition ruling.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
deployment.yaml advanced past the one-shot rollout (P05/P06), so the helper
correctly refused it with prior_image_drift and existing_candidate_env. The
fixture now reconstructs the pre-rollout state, and a new test asserts the
helper refuses the current declaration.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
The name was retired on 2026-09-15. Remove both public UI callbacks from
the code-defined client (openbao-client-config.py, create-secrets.sh), stop
probing them in verify-openbao-client.sh, and fail verification in
openbao-client-config.py and verify-t07.sh if either is registered again.
The CLI and operator-tunneled 127.0.0.1:18200 callbacks remain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
The role's policies, callbacks and bound claims are declared centrally by
railiance-platform (openbao/auth/netkingdom-platform-admin-role.json).
Rerunning the script would have dropped the live operator-custody policy
and re-added the retired bao.coulomb.social callbacks. The script now only
configures the OIDC mounts and fails if the declared role is missing.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 299762@bnt-lap001
Assistant-Session: d3d3cea1-869c-44f1-be2a-3d6d3550e72e
Promote CI image sha256:3317a2610ef9958b77cb258dce54d69d13dfabbc55ffaad673e018f997a6467c
with /readyz readiness and Recreate rollout. Live /healthz stays process
liveness; /readyz returned directory ready. Native onboarding remains for T05.
Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
Map uncaught HTTPError from LLDAP login to a structured
dependency_unavailable response, add /readyz as the provisioner-to-directory
preflight, keep /healthz as process liveness, and run the contract in CI.
Auth rejection is not retried during cooldown.
NK-WP-0036-T05 remains in progress until the immutable image is published,
pinned with /readyz, and one native login/create/password-setup journey is
verified.
Assistant: grok
Assistant-Session: 01a09dc6-3f0e-78f1-a884-c8c703c24ddf
reconcile-lldap-resolver-live.sh had never completed a run. Four defects,
found by running it on 2026-08-27:
1. request() set Content-Type: application/json on every call, including
bodyless GETs. Werkzeug 3.x rejects those in front of privacyIDEA, so
every GET returned an HTML 400 while POSTs succeeded — the resolver
write landed and the lookup immediately after it did not.
bootstrap-realm.sh already fixed this in pi_api and said why; this
script was written later and did not inherit it.
2. GET /user/ returns result.value as a list of user objects, not a dict
carrying "users". With the 400 fixed, the lookup finally reached the
parse and raised AttributeError past the except clause, so the run
died as a traceback instead of a receipt. Both shapes now accepted,
and the except clause catches parse errors so a failed run still
names the phase it died in.
3. A resolver write replaces the whole object, so TIMEOUT,
CACHE_TIMEOUT and SIZELIMIT were dropped by every --apply. A resolver
with them unset still resolves users, but the WebUI refuses to save
or test it — so the script silently un-repaired a resolver an
operator had fixed by hand. Now sent, defaulting to the verified
5/120/500 and overridable per run. Same omission fixed in
bootstrap-realm.sh, which created the resolver that way originally.
4. The predecessor prompt could not be left empty, so an operator who
had lost the exposed credential had to type a placeholder — which
also fails the bind and was recorded as a PASSING denial proof.
--predecessor-unavailable skips the bind and records NOT-PROVEN.
--note carries operator context into the receipt line itself, so the
claim and its caveat travel together.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3377672@bnt-lap001
Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166
T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth
token per decision (verified in the running container); flex-auth-user-engine
138aa347 serves with caller-auth enforce. Probes: valid 200
decision:d9aef25f08e17b84, missing token 401, wrong-system 403.
Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned
against, while the cluster ran c501aeb2. Re-applying it would have rolled the
portal back to an image that cannot authenticate to a PDP now in enforce.
kubectl diff is now empty.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
