coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Commit graph

  • e6252bc0e4 NK-WP-0056-T21 done: request phase presents the approval through informed-decision main tegwick 2026-11-01 00:39:17 +01:00
  • 45feaa13cc NK-WP-0056-T20 done: oidc-service-client 0.2 with the owner reviews; memo r2 tegwick 2026-11-01 00:34:17 +01:00
  • 1e17b39212 State Hub ids written back (NK-WP-0056-T20, T21) tegwick 2026-10-31 23:22:04 +01:00
  • 620f558f18 NK-WP-0056-T18 done (image c67cb044 pinned); T20 type r2 and T21 memo submission from owner reviews tegwick 2026-10-31 23:20:22 +01:00
  • 7bd6033b16 NK-WP-0056-T18: accept audit-core 202/200, distinct 409; progress note tegwick 2026-10-31 23:04:44 +01:00
  • b71f509ce0 NK-WP-0056-T18 (part): executor's own approval client and request phase tegwick 2026-10-31 23:02:19 +01:00
  • 5d5f15df55 NK-WP-0056-T14 done: SecurityCaseType oidc-service-client 0.1 (proposed) tegwick 2026-10-31 21:30:21 +01:00
  • 8cecf8949a State Hub ids written back (NK-WP-0056-T18, T19) tegwick 2026-10-31 21:22:07 +01:00
  • 7b0a885137 NK-WP-0056: split T14 into T14 (service-client case type), T18 (executor approval client), T19 (real-service exercise) tegwick 2026-10-31 21:20:40 +01:00
  • b76456134c Decision services alignment review: approval-engine, informed-decision, State Hub decisions tegwick 2026-10-31 21:15:52 +01:00
  • 96c859f77c NK-WP-0056-T17 done: founder aal2 approval path does not exist yet tegwick 2026-10-31 20:57:35 +01:00
  • f8223452a0 State Hub ids written back (NK-WP-0056-T14..T17) tegwick 2026-10-31 20:56:23 +01:00
  • 2058036650 NK-WP-0056: split T06 prerequisites into T14-T17 (founder decision 2026-10-31) tegwick 2026-10-31 20:54:55 +01:00
  • a020758448 NK-WP-0056-T10 done: unattended live journey passes at aal2 tegwick 2026-10-31 20:48:42 +01:00
  • d685df4d56 NK-WP-0056-T10: startup race fixed; image 71da4a51 pinned tegwick 2026-10-31 20:35:29 +01:00
  • e830238746 NK-WP-0056-T10: examples re-pinned at 15c9cdb tegwick 2026-10-31 20:33:28 +01:00
  • 15c9cdbef8 NK-WP-0056-T10: wait for OpenBao reachability before the first login tegwick 2026-10-31 20:33:17 +01:00
  • 110eb63058 NK-WP-0056-T10: journey-only image 550bb9d0 pinned in rapp tegwick 2026-10-31 19:59:35 +01:00
  • 9a81123ade NK-WP-0056-T10: examples re-pinned at abed436 tegwick 2026-10-31 19:57:16 +01:00
  • abed4360d4 NK-WP-0056-T10: journey-only executor mode; fail-closed proof on the T08 stack tegwick 2026-10-31 19:56:52 +01:00
  • ef6284c371 NK-WP-0056-T10: executor lanes set up and verified (founder-run receipts) tegwick 2026-10-31 19:47:29 +01:00
  • 12c9b2df43 NK-WP-0056-T10: set cas_required by metadata write (platform-admin has no patch) tegwick 2026-10-31 19:42:40 +01:00
  • 634b3a41df NK-WP-0056-T10: attended OpenBao setup and proof for the executor lanes tegwick 2026-10-31 19:15:46 +01:00
  • 37f4d4f306 NK-WP-0056-T10: image 716dccef pinned (CI tests passed); CCR-2026-0059 approved tegwick 2026-10-31 19:08:59 +01:00
  • 4815c58dce NK-WP-0056-T10: examples re-pinned at 1cdc18f; gaps fixed, what is left tegwick 2026-10-31 19:02:09 +01:00
  • 1cdc18f75f NK-WP-0056-T10: one OpenBao login per lane; renew before the 15m lease ends tegwick 2026-10-31 19:01:44 +01:00
  • 74599a583d NK-WP-0056-T10: prerequisites; CCR-2026-0059 drafted; two executor gaps recorded tegwick 2026-10-31 18:49:00 +01:00
  • b39fc6348f NK-WP-0056-T13: rapp-bounded-executor pushed to Forgejo (rebased onto stub) tegwick 2026-10-31 18:41:27 +01:00
  • 387f8b1c8b NK-WP-0056: sso ingress for the bounded executor; README and handoff follow-up tegwick 2026-10-31 18:27:30 +01:00
  • cd0ce905a2 NK-WP-0056-T13: name the rapp pin commit tegwick 2026-10-31 18:21:03 +01:00
  • 7a7748e869 NK-WP-0056-T13 done: bounded-executor image pinned in rapp tegwick 2026-10-31 18:19:27 +01:00
  • 4ebbe2ef14 NK-WP-0056-T13: founder server dry run passed tegwick 2026-10-31 18:15:36 +01:00
  • 1ab019e339 NK-WP-0056-T13 (part): rapp-bounded-executor reshaped to one Job per admission tegwick 2026-10-31 18:11:31 +01:00
  • ba9d266b7e NK-WP-0056-T13 (part): executor CLI, clients, Containerfile, image workflow tegwick 2026-10-31 16:51:07 +01:00
  • fe18096aa3 State Hub ids written back tegwick 2026-10-31 16:27:33 +01:00
  • db56d8468e NK-WP-0056-T12 done: pilot operations; synthetic rotation and revert pass tegwick 2026-10-31 16:24:17 +01:00
  • 9b7701a32a NK-WP-0056-T11: test count tegwick 2026-10-31 16:01:17 +01:00
  • d1cf754222 NK-WP-0056-T11 done: bounded executor core runner tegwick 2026-10-31 16:00:52 +01:00
  • 3b1abc4054 NK-WP-0056: State Hub ids for T11 and T12 tegwick 2026-10-31 15:44:07 +01:00
  • cdf0d9bf25 NK-WP-0056: founder decisions folded in; runtime split into T11 and T12 tegwick 2026-10-31 15:42:30 +01:00
  • c9ab01e23e NK-WP-0056-T02: note all misattributed hub replies tegwick 2026-10-31 14:35:59 +01:00
  • 9d1fc3f55b Link reset transition checkpoints to State Hub tasks tegwick 2026-10-31 14:34:44 +01:00
  • 522b5d08ed NK-WP-0056-T02 done: all seven owners answered; founder decisions collected tegwick 2026-10-31 14:34:00 +01:00
  • aeb7fd81f4 NK-WP-0056-T02: record access-engine, secrets-engine and railiance-platform answers; LLDAP self-rotation proven tegwick 2026-10-31 14:30:33 +01:00
  • c07e6ebe34 Prepare guarded reset-role transition and native recovery proof tegwick 2026-10-31 14:26:17 +01:00
  • 2387409d08 NK-WP-0056-T03 done: executor identity and authority ceiling, in source tegwick 2026-10-31 14:21:04 +01:00
  • 43a7890759 NK-WP-0056-T02: blocking reason is the pending owner answers tegwick 2026-10-31 14:07:52 +01:00
  • 8cb416e82a NK-WP-0056-T02: founder chose the executor runtime owner; owner requests sent tegwick 2026-10-31 14:06:31 +01:00
  • b5cb1520d8 Complete attended reset-role observation with verified receipt tegwick 2026-10-31 14:00:35 +01:00
  • 989d5d4f5d NK-WP-0056-T01 done: Bounded Execution Admission v0.1 (proposed) tegwick 2026-10-31 13:55:18 +01:00
  • 27b4ea6933 Prepare attended read-only classification for accepted reset subject tegwick 2026-10-31 13:54:51 +01:00
  • b8d3dacc41 Record native reset rehearsal task identifier tegwick 2026-10-31 13:42:37 +01:00
  • a192c9abfc Record native reset authority rehearsal and remaining admission scope tegwick 2026-10-31 13:40:07 +01:00
  • 661ab6a52e NK-WP-0056-T09 done: syn-journey live, synthetic journey passes at aal2 tegwick 2026-10-31 13:33:31 +01:00
  • 488f5f4ece Record projected reset followthrough task identifiers tegwick 2026-10-31 13:30:58 +01:00
  • 05fa8f67f6 Track post-split password reset authority and consumer return tegwick 2026-10-31 13:29:30 +01:00
  • 55fe8303f3 NK-WP-0056-T09: enroll with a privacyIDEA-generated key, write KV last tegwick 2026-10-31 13:23:47 +01:00
  • 79e533b548 NK-WP-0056-T09: lane looks up the privacyIDEA token by serial; name login failures tegwick 2026-10-31 13:01:42 +01:00
  • d654f8a6ec NK-WP-0056-T09: SecurityCase nk-synthetic-journey accepted by the founder tegwick 2026-10-31 12:51:09 +01:00
  • aedf43860e NK-WP-0056-T09: route the human gate (decision 91323969) tegwick 2026-10-31 12:44:24 +01:00
  • ddde021bd0 NK-WP-0056-T09: prepare synthetic journey identity for founder run tegwick 2026-10-31 12:42:36 +01:00
  • 22e50ef04b NK-WP-0056-T08 done: synthetic identity stack on pinned images; broken binds fail closed tegwick 2026-10-31 12:27:01 +01:00
  • 0409c7b375 NK-WP-0056-T05 done: journey runner green in identity-provider journey acceptance tegwick 2026-10-31 11:54:46 +01:00
  • 72ff31b497 NK-WP-0056: hub task ids for T08-T10 tegwick 2026-10-31 11:52:09 +01:00
  • 0b0c6c9628 NK-WP-0056-T05: synthetic MFA journey runner; split T05 into T05/T08/T09/T10 tegwick 2026-10-31 11:50:30 +01:00
  • ad7d1cdf49 NK-WP-0056-T04 done: svc-privacyidea written through from OpenBao; all four binds in platform custody tegwick 2026-10-31 11:19:21 +01:00
  • c28651e55b NK-WP-0056-T04: svc-privacyidea lane in OpenBao custody with attended write-through tegwick 2026-10-31 11:06:53 +01:00
  • 12834b6e8a NK-WP-0056-T04: svc-privacyidea design proposal (OpenBao custody, attended write-through) tegwick 2026-10-31 11:00:04 +01:00
  • a65673985c NK-WP-0056-T04: svc-keycape bind delivered from OpenBao; bindPW cleared from keycape-config tegwick 2026-10-31 10:52:05 +01:00
  • 6c7c37aa70 NK-WP-0056-T04: svc-keycape bind lane (source only, CCR-2026-0054) tegwick 2026-10-31 10:31:30 +01:00
  • 6aae759043 NK-WP-0056-T04: svc-keycape delivery design proposal (KeyCape env override, dedicated ESO Secret) tegwick 2026-10-31 10:21:30 +01:00
  • 76573deea2 NK-WP-0056-T04: record svc-authelia lane live and verified tegwick 2026-10-31 10:11:22 +01:00
  • 7f37e2521f NK-WP-0056-T04: svc-authelia bind delivered from OpenBao; setup and verify receipts tegwick 2026-10-31 10:11:07 +01:00
  • 034634ac5f NK-WP-0056-T04: svc-authelia bind lane (source only, CCR-2026-0053) tegwick 2026-10-31 09:20:53 +01:00
  • 436c5fe585 NK-WP-0054-T05: post-split restore drill passed as admin; SI-X1 retired tegwick 2026-10-31 08:31:17 +01:00
  • 87e57aa710 NK-WP-0056-T04: svc-provisioner bind delivered from OpenBao; setup and verify receipts tegwick 2026-10-30 23:19:10 +01:00
  • 985cfc37de NK-WP-0056-T04: bind ESO sets explicit target metadata so the last-applied annotation is not copied tegwick 2026-10-30 23:16:21 +01:00
  • 57369779e2 NK-WP-0056-T04: bind-lane requires a confirmed Kubernetes binding, as the CCR apply gate does tegwick 2026-10-30 23:05:26 +01:00
  • 162b65efd8 NK-WP-0056-T04: bind-lane accepts approvals recorded by credential-change.py approve tegwick 2026-10-30 23:00:48 +01:00
  • e0719ff663 NK-WP-0056-T04: bind-lane test reads the CCR as YAML tegwick 2026-10-30 23:00:31 +01:00
  • c6df34c4de NK-WP-0056-T04: svc-provisioner bind lane into OpenBao/ESO (source only, CCR-2026-0052) tegwick 2026-10-30 22:54:25 +01:00
  • 3a9d640efb NK-WP-0055-T08: kingpath off-site receipts uploaded and verified tegwick 2026-10-30 22:22:35 +01:00
  • 5a52dc8a23 NK-WP-0056-T04: custody client secret reconciled with live; re-sealed custody tegwick 2026-10-30 22:01:30 +01:00
  • b19f7f6493 NK-WP-0056-T04: reconcile tool reports a value-free error class tegwick 2026-10-30 21:58:01 +01:00
  • a4b6a8f753 NK-WP-0056-T04: reconcile tool names the failing phase (custody, cluster, live-pair) tegwick 2026-10-30 21:54:47 +01:00
  • 05d63e05bd NK-WP-0056-T04: value-free custody reconciliation for the KeyCape client secret tegwick 2026-10-30 21:51:58 +01:00
  • 14e7056469 NK-WP-0054-T05: evidence — resolver password restored from custody; OpenBao login works tegwick 2026-10-30 21:49:34 +01:00
  • 08087ec5ac NK-WP-0054-T05: privacyIDEA resolver still bound as admin after step 8; fixed live, runbook check added tegwick 2026-10-30 21:18:15 +01:00
  • 103c2c1505 NK-WP-0054-T05: re-seal custody after the bind split (ld-admin and svc-* binds) tegwick 2026-10-30 20:02:36 +01:00
  • 232bb50a0c chore(consistency): register NK-WP-0056 task identifiers tegwick 2026-10-30 19:59:32 +01:00
  • c1a9009707 NK-WP-0056: intervention notes for founder-gated tasks tegwick 2026-10-30 19:57:15 +01:00
  • be3971c0f2 NK-WP-0056: propose the bounded executor path (founder admits, executors run) tegwick 2026-10-30 19:55:39 +01:00
  • 098c2c7810 NK-WP-0054-T05: live LLDAP bind split passed (2026-10-30); runbook setup fixes tegwick 2026-10-30 19:54:33 +01:00
  • 81292e2231 NK-WP-0053 finished: G1 decided (Scaleway second-provider intake, e8935fa6) tegwick 2026-10-30 00:17:11 +01:00
  • f24af91211 NK-WP-0053-T02/T04: first admin-operated identity restore drill passed (2026-10-29) tegwick 2026-10-30 00:12:41 +01:00
  • f4a74ebc1c NK-WP-0055-T07: finding - identity backup refused 2026-10-20..29 on a full Storage Share account tegwick 2026-10-30 00:03:58 +01:00
  • dbf22cea91 List-first pruning of a full Storage Share CNPG dump folder (founder-run) tegwick 2026-10-29 23:43:00 +01:00
  • cb286e7b03 NK-WP-0054-T05: provisioner journeys green; preconditions 2 and 3 done tegwick 2026-10-29 23:00:20 +01:00
  • 4261a5a4f8 identity-provisioner: platform group boundary test without pytest tegwick 2026-10-29 22:48:54 +01:00
  • c1bedf1a6e NK-WP-0054-T05: pin identity-provisioner image with LLDAP_ADMIN_USERNAME support tegwick 2026-10-29 22:44:01 +01:00