212 commits

Author	SHA1	Message	Date
tegwick	f2e578cf3e	feat(privacyidea): add guarded resolver reconciliation helper ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:43:39 +02:00
tegwick	edee5c28ab	docs: record downstream rotation follow-up ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c	2026-08-23 14:42:59 +02:00
tegwick	c956ceba19	fix(authelia): load rotated client verifier from secret file ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:39:32 +02:00
tegwick	c24d67bb85	docs(security): map KeyCape rotation dependencies ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:17:42 +02:00
repo-manager	9ae4e24305	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:08:12 +02:00
tegwick	9264a8a613	docs(security): open KeyCape exposure rotation incident ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 14:05:07 +02:00
tegwick	61aeafef71	feat(NK-WP-0032): admit OpenBao operator loopback callback ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:01:57 +02:00
repo-manager	d542335f99	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 13:26:15 +02:00
tegwick	7f4e4e9f57	feat(orchestration): compose KeyCape C1 and C2b ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 13:24:55 +02:00
tegwick	cfc9e7d0cb	feat(posture): add deterministic feedback proposals ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 13:16:34 +02:00
repo-manager	dc8da422f8	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 12:42:14 +02:00
tegwick	d96aab2321	feat(orchestration): compose security scenarios ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 12:40:52 +02:00
repo-manager	ad46cc89fc	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 12:02:15 +02:00
tegwick	6204184930	docs(scope): reconcile capability with intent ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 11:58:39 +02:00
repo-manager	2c8a296c3a	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 11:28:30 +02:00
tegwick	3491c294a2	docs(canon): advance audit-core posture to evidenced E2 ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-23 10:45:04 +02:00
tegwick	a286b91652	docs(workplan): align managed workload declaration wording ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-22 14:55:10 +02:00
repo-manager	db2ef631c6	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-22 14:54:45 +02:00
tegwick	bee22db620	docs(canon): reconcile workload and tenant grouping semantics ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb	2026-08-22 14:53:31 +02:00
tegwick	25ed9281bb	fix(workplans): normalize legacy task identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d	2026-08-21 23:51:36 +02:00
tegwick	9e041e3662	tenancy-posture draft-9: enforcement stance is not a seventh axis; reefs are canon's defect ... Answers zone-engine ZONE-WP-0001-T01. Decision 5.6 — enforcement stance is a sibling standard, not an axis. The six ladders are monotone and the whole current/target/guard machinery depends on it; enforcement stance is not (ADR-0006 is the finding that the top rung is wrong for the SSH lane). And this framework is descriptive: an accurately declared exempt would be conformant and exempt. Membership is declared, stance belongs to the control owner. Zone membership rides tenancy.yaml under a reserved zones: key so the estate keeps one declaration surface; the schema permits it, unconstrained. Decisions 8.4.1/8.4.2 — 'substrate location is not evidence' stated once instead of three repo-local slogans, and the reef/P/V gap recorded as this document's defect rather than zone-engine's scope. NK-WP-0027 takes it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:06:20 +02:00
tegwick	4a915ce6c7	NK-WP-0026 finished: user-engine caller identity verified live against railiance01 ... T02 done. Deployed user-engine digest c501aeb2 reads the projected flex-auth token per decision (verified in the running container); flex-auth-user-engine 138aa347 serves with caller-auth enforce. Probes: valid 200 decision:d9aef25f08e17b84, missing token 401, wrong-system 403. Closes manifest drift: runtime.yaml pinned e3b5f65b, the digest T01 warned against, while the cluster ran c501aeb2. Re-applying it would have rolled the portal back to an image that cannot authenticate to a PDP now in enforce. kubectl diff is now empty. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:01:12 +02:00
tegwick	6f755d2615	Finish audit sender custody residual	2026-08-14 19:59:14 +02:00
tegwick	797a941dd3	Remove duplicate ad-hoc State Hub binding	2026-08-14 19:50:46 +02:00
tegwick	52f9b200e8	Track and harden NK-WP-0025 residuals	2026-08-14 19:35:46 +02:00
tegwick	ded2398bb3	Finish public registration and JIT acceptance	2026-08-14 19:15:06 +02:00
custodian-sync	84869f548f	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-14: - NK-WP-0025-T05: progress → wait	2026-08-14 17:40:20 +02:00
tegwick	94f27cb546	Complete live registration acceptance	2026-08-14 17:39:08 +02:00
tegwick	c56465e32d	Enable public registration and prove event delivery	2026-08-14 00:42:14 +02:00
tegwick	dbbccc1a80	Deploy scoped user-engine delivery lanes	2026-08-13 17:34:29 +02:00
custodian-sync	67ef59c8a4	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-13: - NK-WP-0024-T04: wait → progress	2026-08-13 14:58:04 +02:00
custodian-sync	b9f5fbd2f0	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-13: - NK-WP-0024-T03: wait → progress	2026-08-13 14:58:04 +02:00
custodian-sync	956bc44f44	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-13: - NK-WP-0024-T02: wait → progress	2026-08-13 14:58:04 +02:00
custodian-sync	685c439796	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-13: - NK-WP-0024-T01: wait → progress	2026-08-13 14:58:04 +02:00
tegwick	96266b9371	Resume user-engine integration rollout	2026-08-13 14:56:53 +02:00
tegwick	20d4d8af04	Allow user-engine egress to email-connect; record T04 hand-back. ... NetworkPolicy egress to email-connect:8080 for transactional invitation send; NK-WP-0024 note points at EMAIL-WP-0004 failure evidence.	2026-08-12 13:32:11 +02:00
tegwick	0e3a24d888	Deploy KeyCape client MFA override for coulomb-social ... Register coulomb-social with mfaRequired: false, roll key-cape image that honors client policy, and track NK-WP-0025 public registration orchestration.	2026-08-09 22:42:51 +02:00
tegwick	0165ac8d14	Deploy user-engine flex-auth policy service	2026-08-09 02:21:41 +02:00
tegwick	29ae3e70c6	Activate expanded portal integration gate	2026-08-09 02:00:58 +02:00
tegwick	d975086ef0	Complete reversible identity retirement	2026-07-30 09:28:05 +02:00
tegwick	5959fc0537	Close portal integration MVP and narrow identity cutover	2026-07-30 00:52:52 +02:00
tegwick	39b71d6d96	Complete user-engine runtime custody	2026-07-30 00:40:43 +02:00
tegwick	f854969a01	Move portal workloads to registry digests	2026-07-30 00:25:16 +02:00
tegwick	52b57c99f7	Add user-engine backup and rollback verification	2026-07-30 00:00:14 +02:00
tegwick	12ac63f32c	Deploy identity drift reconciliation	2026-07-29 23:41:42 +02:00
tegwick	487012e961	Complete identity seams and email login	2026-07-29 23:14:09 +02:00
tegwick	6aadcd2a1a	Complete Binky and identity conformance gates	2026-07-29 22:14:19 +02:00
tegwick	00d3a9b508	Record OIDC network policy correction	2026-07-29 21:41:20 +02:00
tegwick	3710894120	Record platform-root claim correction	2026-07-29 21:33:31 +02:00
tegwick	8905c4f493	Record password setup conformance	2026-07-28 17:55:39 +02:00