coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
335 commits 1 branch 0 tags 3.2 MiB
Commit graph

162 commits

Author SHA1 Message Date
tegwick
a58df4c3e6 Advance pre-cutover identity conformance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 16:48:47 +02:00
tegwick
43045cbaf5 Verify railiance01 identity dependencies
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 12:59:12 +02:00
tegwick
9497529ed2 Reconcile identity state onto railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 12:11:45 +02:00
tegwick
f0bbd0bfce Complete CoulombCore identity backup gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 09:26:16 +02:00
tegwick
ae986c723a Record CoulombCore cutover inventory
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 02:52:14 +02:00
tegwick
8156525a82 Add login alias and record CoulombCore DNS inventory
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 01:57:22 +02:00
tegwick
44eec293fa Record identity lifecycle enforcement
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 01:33:04 +02:00
custodian-sync
8e9a4cdb28 chore(consistency): sync task status from DB [auto]
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Updated by fix-consistency on 2026-07-28:
  - NK-WP-0023-T06: progress → wait
 2026-07-28 01:15:07 +02:00
tegwick
4f3e10f6f0 Record deployed provisioner evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 01:13:23 +02:00
custodian-sync
a2bd03c68b chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-28:
  - NK-WP-0023-T03: wait → progress
 2026-07-28 00:42:21 +02:00
tegwick
9a486c3531 Deploy KeyCape-backed portal login edge
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-28 00:39:22 +02:00
custodian-sync
1d9b7f5772 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - NK-WP-0023-T05: wait → progress
 2026-07-27 23:26:13 +02:00
custodian-sync
67f5996687 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - NK-WP-0023-T02: wait → progress
 2026-07-27 23:26:13 +02:00
tegwick
49f727c54c Deploy internal user-engine portal foundation
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 23:24:36 +02:00
custodian-sync
b83f75af82 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-27:
  - NK-WP-0023-T02: progress → wait
 2026-07-27 22:50:04 +02:00
tegwick
9d1ae01b75 Define user-engine portal integration boundary
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
2026-07-27 22:48:58 +02:00
custodian-sync
b2dcf7b5ee chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-07-27:
  - workplan status: ready → active
 2026-07-27 22:33:00 +02:00
custodian-sync
806db522a3 chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-07-27:
  - workplan status: backlog → active
 2026-07-27 22:33:00 +02:00
tegwick
e47e94dbe8 Register portal integration sequence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 22:32:27 +02:00
custodian-sync
eb4fc59b46 chore(consistency): renormalize lifecycle state [auto] 
Updated by fix-consistency on 2026-07-27:
  - workplan status: backlog → active
 2026-07-27 22:30:36 +02:00
tegwick
abc92a1197 Sequence identity portal before stack cutover
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 22:30:02 +02:00
tegwick
71b1a7b028 Register identity cutover workplan
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 21:41:00 +02:00
tegwick
428762648f Correct identity cutover workplan ID
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 21:39:45 +02:00
tegwick
6b367a0f3f Plan identity stack cutover to railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-27 21:37:52 +02:00
tegwick
a9aec541ec Implement NK-WP-0021 activity-core ops SSO least-privilege.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Seed LLDAP activity-core-operators, add membership runbook and helper,
restrict Authelia access on activity/temporal.coulomb.social to that
group (member one_factor + domain deny fallback), apply live, and verify
via Authelia check-policy plus unauthenticated edge redirects.
 2026-07-22 15:47:26 +02:00
tegwick
3580e43e5f Add NK-WP-0021 for activity-core ops SSO least-privilege. 
Promote NK-IN-0001/0002 after scope/intent review into a single ready
workplan (LLDAP operator group, membership runbook, Authelia domain rules,
live verification). Hub workstream and tasks registered via fix-consistency.
 2026-07-22 15:21:22 +02:00
tegwick
bb7daf0f83 CUST-WP-0055 T07: add archive workplan terminology grandfather note
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details
2026-07-08 20:26:36 +02:00
tegwick
db12130c22 Postpone NK-WP-0009 and NK-WP-0011 to backlog 
Move security pattern tutorials and enterprise federation SAML workplans
from proposed to backlog status.
 2026-07-08 12:31:39 +02:00
tegwick
85a781b7a4 NET-WP-0020 finished: attended-ceremony + auto-unseal-transit profiles, greenfield init/unseal proof 
T2: greenfield live proof against a fresh uninitialized OpenBao 2.5.5 —
caught and fixed 'bao operator unseal -' not reading stdin (now
'bao write sys/unseal key=-'); init and reseal-replay paths proven.
T3: attended-ceremony selectable — runbook, non-secret ceremony-record
template + validator, and a lab/production deployment profile that blocks
sops-held-automation in console selection, gates, and the init script.
T4: console gate + evidence flags for auto-unseal-transit (Helm seal stanza
prepared in railiance-platform).
Also: SCOPE.md refreshed to current repo state; adhoc fix for the broken
check-secrets Make target (unescaped $).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 22:08:33 +02:00
tegwick
60b9d7037d chore(consistency): commit ADHOC-2026-07-02 task-id writeback 2026-07-02 19:13:29 +02:00
tegwick
951ba07c30 adhoc: creds-bootstrap-agent dry-run no longer dies without age key 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 14:08:33 +02:00
tegwick
67b4677cea NET-WP-0020-T02: wire OpenBao init/unseal as Phase 7b in creds-bootstrap-agent (operator-reviewed) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 13:32:58 +02:00
tegwick
60142241a3 NET-WP-0020-T02: SOPS-held OpenBao init/unseal automation helper 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 11:01:34 +02:00
tegwick
a770a6a11d Archive closed workplans to workplans/archived/ (ADR-001) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 00:25:42 +02:00
tegwick
9a7d10f840 Repo hygiene: fill stack-and-commands, normalize workplan statuses 
- Fill .claude/rules/stack-and-commands.md (was an empty TODO template)
- Normalize workplan frontmatter statuses to canonical vocabulary
  (completed/done -> finished) per ADR-001
- Repair glued frontmatter delimiter in NK-WP-0001 (superseded_by line)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 00:21:49 +02:00
tegwick
93e465525f Normalize agent instructions and workplan frontmatter (STATE-WP-0067) 
- Align agent files with on-disk workplan prefixes (infer from workplan ids)
- Set workplan domain to registered domain_slug; add topic_slug where applicable
- Repair frontmatter delimiter formatting; migrate legacy task status literals
- Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates
 2026-06-22 23:16:27 +02:00
tegwick
30c647ff5b Updated and fixed workplan 2026-06-22 18:42:46 +02:00
tegwick
8a05dd0db7 docs(NET-WP-0020): mark T5 done after live SSH engine and host CA apply 2026-06-18 01:18:57 +02:00
tegwick
5a5eb482d4 docs(NET-WP-0020): T5 automation ready; operator apply is next gate 
Update workplan T5 to progress and assessment next-actions for live cluster
apply before WP-0008 warden sign smoke.
 2026-06-18 01:06:43 +02:00
tegwick
6336c28626 docs: persist OpenBao/SSH/bootstrap state assessment in history 
Capture live vs greenfield tracks, unseal custody models, console S6
interpretation, repo ownership, and ordered next actions before NET-WP-0020 T5.
 2026-06-18 01:01:50 +02:00
tegwick
f625dd0681 feat: OpenBao unseal custody models — automation-first with blocked alternatives 
Document three init/unseal custody paths; default sops-held-automation for
fast rebuild cycles. Security bootstrap console lists models, blocks planned
attended-ceremony and auto-unseal-transit with hints, and gates init ceremony
on implemented selection. NET-WP-0020 tracks downstream SSH automation.
 2026-06-18 00:51:48 +02:00
tegwick
3ab326b597 Clarifications on sops 2026-06-14 19:51:05 +02:00
tegwick
443b585010 finished workplan 2026-06-05 13:10:37 +02:00
tegwick
cc0cb03c1d NET-WP-0018: fix archive prefix to 260604 (two-digit year 26 per convention and existing archived/ files like 260603-*) 2026-06-04 02:07:50 +02:00
tegwick
280294b9c3 NET-WP-0018: archive finished workplan to archived/ (per ADR-001 / AGENTS.md convention) 
- All tasks (T01-T09) complete, frontmatter status: finished, hub workstream finished.
- Move: workplans/NET-WP-0018-...md -> workplans/archived/20240604-NET-WP-0018-...
- Frontmatter id unchanged.
- Followed by statehub sync.
- T09 completion + 9/9 done.
 2026-06-04 01:58:22 +02:00
tegwick
9f82709b6d NET-WP-0018: mark workplan frontmatter status: finished (all 9 tasks done per T09) 
- Updated per convention (ADR-001 / AGENTS.md): after implementation complete, set status finished.
- Brief + hub workstream already set to finished by prior fix-consistency (C-13).
- This keeps file as source of truth.
- Followed by statehub sync.
 2026-06-04 00:57:55 +02:00
tegwick
875e50d573 NET-WP-0018 T09: Assess scratch-rebuild risk and define rehearsal plan 
- Created docs/security-bootstrap-rebuild-risk-and-rehearsal.md (risk table 12+ items classified likelihood/impact/etc; UE adapters #1 HIGH per assessment 7 gaps; non-destructive rehearsal plan: scripted dry (creds-init --dry + 0019 orchestrator + make/console validate + T07/T08) then ns-isolated then parallel; rollback via cleanup/lock-offboard; prove via validators/evidence/status/tests; recs + coverage gaps documented; refs T02/T03/T05/T07/T08/0019/assessment/contract)
- Updated workplan T09 status:done + detailed 2026-06-04 completion note (reviews all prior T0x + live console/evidence/metadata exercised in T09; pragmatic infra used; 9/9 closes 0018)
- Frontmatter updated date
- No destructive; all per session protocol + pragmatic audit (file source per ADR-001)
- T07 tests + T08 validate-keycape + validate-onboarding-dry-run exercised OK as part of review

Refs: workstream 800f9f16-..., task a9e60fd5-...; will POST /progress/ + fix-consistency
 2026-06-04 00:50:18 +02:00
tegwick
4232e62a50 feat(NET-WP-0018-T08): integrate validations into the UI state model 
- Extended computed validation pattern into main gates:
  - Added keycape_openbao_client_deployed() (invokes verify-openbao-client.sh for live check).
  - Updated 'KeyCape OpenBao client deployed' gate in build_gates to 'done' if metadata or validator succeeds (T08: UI now proves via validation not just manual flag).
- Added validate-keycape-client subparser, dispatch (prints source+live status), and make target.
- Updated printed available actions list to include it.
- Updated T08 workplan section: status done + detailed 2026-06-03 implementation note (extended from 0019 note; covers one key target as example, pattern for others like LLDAP/privacyIDEA/Authelia using existing verify-*.sh).
- T07 tests + console-test cover; console status gates now reflect more validator output.
- Pragmatic: progress log with task_id, file notes, commit.
- Brief/fix next (expect 8/9 done).

This fulfills T08: more gates compute from validators (ok/fail) rather than manual only; live setup can satisfy checks via the integrated commands.
 2026-06-04 00:25:45 +02:00
tegwick
a3eeda726a chore(NET-WP-0018-T04): close T04 as fulfilled 
- Updated workplan T04 status to done + completion note.
- Explained coverage: the 2026-06-03 note already documented that the persisted user-engine/net-kingdom integration assessment largely fulfills T04 (deep review of INTENT/SCOPE/boundaries for UE + NK + key-cape + railiance + OpenBao + state-hub; 7 gaps; recs for T07/T08).
- Work folded into T02 (UE section in arch doc), T03 (gap matrix row + refs), T07 (tests note), and cross-refs elsewhere.
- Why 'left out' of recent execution: medium priority vs. high-prio sequential deps (T02 arch -> T03 retrospective -> T05 guide -> T06 align -> T07 tests). Core review work was already done earlier (assessment persist + 0019 cross-links). No new unclear ownerships found requiring action now.
- Brief/fix next to reflect 7/9 done (T04 closed; open T08/T09).
 2026-06-04 00:20:22 +02:00
tegwick
e20b322a2e feat(NET-WP-0018-T07): add automated tests for bootstrap UI sections and runbooks 
- Created tools/security-bootstrap-console/tests/test_security_bootstrap_console.py (pytest-based, 8 tests covering templates (incl. 0019 dry-run fields), runbook_payloads (T06 entry), audit_core_posture, etc. per layered spec + 0019 note)
- Makefile: added security-bootstrap-console-test (pytest), security-bootstrap-scripts-syntax (bash -n for key sh scripts like dry-run-nonroot-user.sh); integrated into .PHONY and bootstrap lists
- Updated workplan T07 status done + detailed note with pragmatic refs
- Tests pass (python -m pytest)
- Commit + will sync/fix/progress
- Covers console UI, validators, 0019 polish artifacts (orchestrator, cmds, claims, evidence) as required for T07

T07 complete. 6/9 now.
 2026-06-03 17:28:21 +02:00