113 commits

Author	SHA1	Message	Date
tegwick	4a915ce6c7	NK-WP-0026 finished: user-engine caller identity verified live against railiance01 ... T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:01:12 +02:00
tegwick	f4f885289e	docs: point user-engine apply home at rapp-user-engine	2026-08-18 12:39:24 +02:00
tegwick	ded2398bb3	Finish public registration and JIT acceptance	2026-08-14 19:15:06 +02:00
tegwick	2a2d8ba055	Align provisioned identities with OIDC subjects	2026-08-14 18:53:37 +02:00
tegwick	94f27cb546	Complete live registration acceptance	2026-08-14 17:39:08 +02:00
tegwick	c56465e32d	Enable public registration and prove event delivery	2026-08-14 00:42:14 +02:00
tegwick	dbbccc1a80	Deploy scoped user-engine delivery lanes	2026-08-13 17:34:29 +02:00
tegwick	96266b9371	Resume user-engine integration rollout	2026-08-13 14:56:53 +02:00
tegwick	20d4d8af04	Allow user-engine egress to email-connect; record T04 hand-back. ... NetworkPolicy egress to email-connect:8080 for transactional invitation send; NK-WP-0024 note points at EMAIL-WP-0004 failure evidence.	2026-08-12 13:32:11 +02:00
tegwick	4511a43f7a	Wire user-engine authorization runtime	2026-08-10 19:15:18 +02:00
tegwick	dfdd3163b7	Deploy registration-aware identity provisioner	2026-08-10 15:49:34 +02:00
tegwick	83508915db	Register app.coulomb.social OIDC redirect for coulomb-social ... Parallel public host while apex stays Bubble; keep apex redirect for later.	2026-08-09 23:20:30 +02:00
tegwick	0e3a24d888	Deploy KeyCape client MFA override for coulomb-social ... Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration.	2026-08-09 22:42:51 +02:00
tegwick	0165ac8d14	Deploy user-engine flex-auth policy service	2026-08-09 02:21:41 +02:00
tegwick	27656916db	Add KeyCape client registration for coulomb.social ... Idempotent patch of sso/keycape-config with public PKCE client and redirect URIs for local :8008 and production coulomb.social callbacks.	2026-08-09 01:50:52 +02:00
tegwick	62b1ea3d59	Deploy tenant authority for user portal	2026-08-09 01:39:57 +02:00
tegwick	03cc0c5a91	Deploy expanded user-engine portal	2026-08-08 23:18:29 +02:00
tegwick	0ec6f8c75d	Move identity secret stores to local OpenBao	2026-08-03 21:37:17 +02:00
tegwick	39b71d6d96	Complete user-engine runtime custody	2026-07-30 00:40:43 +02:00
tegwick	f854969a01	Move portal workloads to registry digests	2026-07-30 00:25:16 +02:00
tegwick	52b57c99f7	Add user-engine backup and rollback verification	2026-07-30 00:00:14 +02:00
tegwick	12ac63f32c	Deploy identity drift reconciliation	2026-07-29 23:41:42 +02:00
tegwick	487012e961	Complete identity seams and email login	2026-07-29 23:14:09 +02:00
tegwick	7171587611	Label authenticator entries by user and realm	2026-07-29 22:05:08 +02:00
tegwick	8e7229ae68	Allow user-engine OIDC exchange with KeyCape	2026-07-29 21:40:52 +02:00
tegwick	2fdf21c379	Deploy platform-root claim mapping	2026-07-29 21:31:54 +02:00
tegwick	d2c59fbf5e	Keep provisioner DNS egress in network policy	2026-07-28 17:51:13 +02:00
tegwick	816c5c3773	Deploy reusable password setup handoff	2026-07-28 17:45:09 +02:00
tegwick	76270a239e	Add single-use identity password setup	2026-07-28 17:30:23 +02:00
tegwick	a58df4c3e6	Advance pre-cutover identity conformance	2026-07-28 16:48:47 +02:00
tegwick	43045cbaf5	Verify railiance01 identity dependencies	2026-07-28 12:59:12 +02:00
tegwick	2d13ea84b2	Make Authelia certificate lifecycle explicit	2026-07-28 02:16:07 +02:00
tegwick	8156525a82	Add login alias and record CoulombCore DNS inventory	2026-07-28 01:57:22 +02:00
tegwick	5b8f52749e	Deploy identity administration lifecycle images	2026-07-28 01:30:39 +02:00
tegwick	c9295d278a	Roll forward normalized provisioning images	2026-07-28 01:06:34 +02:00
tegwick	609a718348	Deploy current user-engine provisioning image	2026-07-28 01:00:28 +02:00
tegwick	ba07dd2acb	Add scoped LLDAP identity provisioner	2026-07-28 00:57:16 +02:00
tegwick	9a486c3531	Deploy KeyCape-backed portal login edge	2026-07-28 00:39:22 +02:00
tegwick	49f727c54c	Deploy internal user-engine portal foundation	2026-07-27 23:24:36 +02:00
tegwick	11a14648c4	Register rapp-qonto KeyCape client	2026-07-27 20:17:56 +02:00
tegwick	a9aec541ec	Implement NK-WP-0021 activity-core ops SSO least-privilege. ... Seed LLDAP activity-core-operators, add membership runbook and helper, restrict Authelia access on activity/temporal.coulomb.social to that group (member one_factor + domain deny fallback), apply live, and verify via Authelia check-policy plus unauthenticated edge redirects.	2026-07-22 15:47:26 +02:00
tegwick	85a781b7a4	NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof ... T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 — caught and fixed 'bao operator unseal -' not reading stdin (now 'bao write sys/unseal key=-'); init and reseal-replay paths proven. T3: attended-ceremony selectable — runbook, non-secret ceremony-record template + validator, and a lab/production deployment profile that blocks sops-held-automation in console selection, gates, and the init script. T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza prepared in railiance-platform). Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken check-secrets Make target (unescaped $). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 22:08:33 +02:00
tegwick	951ba07c30	adhoc: creds-bootstrap-agent dry-run no longer dies without age key ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 14:08:33 +02:00
tegwick	67b4677cea	NET-WP-0020-T02: wire OpenBao init/unseal as Phase 7b in creds-bootstrap-agent (operator-reviewed) ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 13:32:58 +02:00
tegwick	60142241a3	NET-WP-0020-T02: SOPS-held OpenBao init/unseal automation helper ... Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 11:01:34 +02:00
tegwick	3875d546bc	Expose OIDC auth mounts to unauthenticated OpenBao UI listing ... Set listing_visibility=unauth on netkingdom and keycape during OIDC configure so the browser login mask can select KeyCape instead of falling back to token.	2026-06-19 21:04:31 +02:00
tegwick	efbdab4652	feat(keycape): add netkingdom OIDC mount and bao.coulomb.social callbacks ... Configure OpenBao auth for both netkingdom and keycape mounts with browser redirect URIs; update verify scripts and runtime architecture notes.	2026-06-18 01:23:02 +02:00
tegwick	3ab326b597	Clarifications on sops	2026-06-14 19:51:05 +02:00
tegwick	92bf7d1d1c	NET-WP-0019: implement T05 (OIDC claims helper + integration in script/console) and T06 (add dry-run to runbook_payloads for web-ui exposure; cross-link update in 0018 T07). Update workplan notes.	2026-06-03 07:10:56 +02:00
tegwick	23af9b0a84	NET-WP-0019: fix arg parsing in orchestrator for --cleanup-only early, fix delegate path in console cleanup command.	2026-06-03 02:21:22 +02:00